IS-2258: Add behandler system api for isfrisktilarbeid

.nais/naiserator-dev.yaml

@@ -42,6 +42,7 @@ spec:
     inbound:
       rules:
         - application: syfomodiaperson
+        - application: isfrisktilarbeid
         - application: soknad-api
           namespace: aap
           cluster: dev-gcp

.nais/naiserator-prod.yaml

@@ -42,6 +42,7 @@ spec:
     inbound:
       rules:
         - application: syfomodiaperson
+        - application: isfrisktilarbeid
         - application: soknad-api
           namespace: aap
           cluster: prod-gcp

src/main/kotlin/no/nav/syfo/application/ApplicationEnvironment.kt

@@ -28,6 +28,10 @@ data class Environment(
         syfooppfolgingsplanserviceApplicationName,
         lpsOppfolgingsplanMottakApplicationName,
     ),
+    private val isfrisktilarbeidApplicationName: String = "isfrisktilarbeid",
+    val behandlerSystemAPIAuthorizedConsumerApplicationNameList: List<String> = listOf(
+        isfrisktilarbeidApplicationName,
+    ),
 
     val electorPath: String = getEnvVar("ELECTOR_PATH"),
     val serviceuserUsername: String = getEnvVar("SERVICEUSER_USERNAME"),

src/main/kotlin/no/nav/syfo/application/api/ApiModule.kt

@@ -12,6 +12,7 @@ import no.nav.syfo.dialogmelding.bestilling.DialogmeldingToBehandlerService
 import no.nav.syfo.behandler.api.person.registerPersonBehandlerApi
 import no.nav.syfo.behandler.api.person.registerPersonOppfolgingsplanApi
 import no.nav.syfo.behandler.api.registerBehandlerApi
+import no.nav.syfo.behandler.api.registerBehandlerSystemApi
 import no.nav.syfo.client.veiledertilgang.VeilederTilgangskontrollClient
 import no.nav.syfo.oppfolgingsplan.OppfolgingsplanService
 
@@ -74,6 +75,11 @@ fun Application.apiModule(
                 behandlerService = behandlerService,
                 veilederTilgangskontrollClient = veilederTilgangskontrollClient,
             )
+            registerBehandlerSystemApi(
+                behandlerService = behandlerService,
+                apiConsumerAccessService = systemAPIConsumerAccessService,
+                authorizedApplicationNameList = environment.behandlerSystemAPIAuthorizedConsumerApplicationNameList
+            )
         }
         authenticate(JwtIssuerType.IDPORTEN_TOKENX.name) {
             registerPersonBehandlerApi(

src/main/kotlin/no/nav/syfo/behandler/api/BehandlerSystemApi.kt

@@ -0,0 +1,41 @@
+package no.nav.syfo.behandler.api
+
+import io.ktor.http.*
+import io.ktor.server.application.*
+import io.ktor.server.response.*
+import io.ktor.server.routing.*
+import no.nav.syfo.application.api.APISystemConsumerAccessService
+import no.nav.syfo.behandler.BehandlerService
+import no.nav.syfo.behandler.domain.*
+import no.nav.syfo.util.*
+import java.util.*
+
+const val behandlerSystemApiPath = "/api/system/v1/behandler"
+
+fun Route.registerBehandlerSystemApi(
+    behandlerService: BehandlerService,
+    apiConsumerAccessService: APISystemConsumerAccessService,
+    authorizedApplicationNameList: List<String>,
+) {
+    route(behandlerSystemApiPath) {
+        get("/{$behandlerRefParam}") {
+            val token = getBearerHeader()
+                ?: throw IllegalArgumentException("No Authorization header supplied")
+            apiConsumerAccessService.validateSystemConsumerApplicationClientId(
+                authorizedApplicationNameList = authorizedApplicationNameList,
+                token = token,
+            )
+
+            val behandlerRef = UUID.fromString(this.call.parameters[behandlerRefParam])
+            val behandler = behandlerService.getBehandler(
+                behandlerRef = behandlerRef
+            )
+
+            if (behandler != null) {
+                call.respond(behandler.toBehandlerDTO(behandlerType = null))
+            } else {
+                call.respond(HttpStatusCode.NotFound)
+            }
+        }
+    }
+}

src/test/kotlin/no/nav/syfo/behandler/api/BehandlerSystemApiSpek.kt

@@ -0,0 +1,110 @@
+package no.nav.syfo.behandler.api
+
+import com.fasterxml.jackson.databind.ObjectMapper
+import com.fasterxml.jackson.module.kotlin.readValue
+import io.ktor.http.*
+import io.ktor.server.testing.*
+import no.nav.syfo.testhelper.*
+import no.nav.syfo.testhelper.UserConstants.ARBEIDSTAKER_FNR
+import no.nav.syfo.testhelper.UserConstants.PARTNERID
+import no.nav.syfo.testhelper.generator.generateBehandler
+import no.nav.syfo.util.bearerHeader
+import no.nav.syfo.util.configuredJacksonMapper
+import org.amshove.kluent.shouldBeEqualTo
+import org.spekframework.spek2.Spek
+import org.spekframework.spek2.style.specification.describe
+import java.util.UUID
+
+class BehandlerSystemApiSpek : Spek({
+    val objectMapper: ObjectMapper = configuredJacksonMapper()
+
+    with(TestApplicationEngine()) {
+        start()
+
+        val externalMockEnvironment = ExternalMockEnvironment.instance
+        val database = externalMockEnvironment.database
+        application.testApiModule(externalMockEnvironment = externalMockEnvironment)
+
+        afterEachTest {
+            database.dropData()
+        }
+
+        describe(BehandlerSystemApiSpek::class.java.simpleName) {
+
+            val validToken = generateJWTSystem(
+                audience = externalMockEnvironment.environment.aadAppClient,
+                azp = isfrisktilarbeidClientId,
+                issuer = externalMockEnvironment.wellKnownInternalAzureAD.issuer,
+            )
+
+            describe("Get behandler for behandlerRef") {
+                val behandlerRef = UUID.randomUUID()
+                val url = "$behandlerSystemApiPath/$behandlerRef"
+                val behandler = generateBehandler(
+                    behandlerRef = behandlerRef,
+                    partnerId = PARTNERID,
+                )
+                describe("Happy path") {
+                    it("should return behandler for behandlerRef") {
+                        database.createBehandlerForArbeidstaker(
+                            behandler = behandler,
+                            arbeidstakerPersonident = ARBEIDSTAKER_FNR,
+                        )
+                        with(
+                            handleRequest(HttpMethod.Get, url) {
+                                addHeader(HttpHeaders.Authorization, bearerHeader(validToken))
+                            }
+                        ) {
+                            val behandlerDTO =
+                                objectMapper.readValue<BehandlerDTO>(response.content!!)
+                            behandlerDTO.behandlerRef shouldBeEqualTo behandlerRef.toString()
+                            behandlerDTO.fornavn shouldBeEqualTo "Dana"
+                        }
+                    }
+                }
+                describe("Unhappy path") {
+                    it("should return status NotFound for non-matching behandlerRef") {
+                        with(
+                            handleRequest(HttpMethod.Get, url) {
+                                addHeader(HttpHeaders.Authorization, bearerHeader(validToken))
+                            }
+                        ) {
+                            response.status() shouldBeEqualTo HttpStatusCode.NotFound
+                        }
+                    }
+                    it("should return status Unauthorized if no token is supplied") {
+                        with(
+                            handleRequest(HttpMethod.Get, url) {}
+                        ) {
+                            response.status() shouldBeEqualTo HttpStatusCode.Unauthorized
+                        }
+                    }
+                    it("should return status BadRequest if invalid behandlerRef") {
+                        with(
+                            handleRequest(HttpMethod.Get, "$behandlerPath/123abc") {
+                                addHeader(HttpHeaders.Authorization, bearerHeader(validToken))
+                            }
+                        ) {
+                            response.status() shouldBeEqualTo HttpStatusCode.BadRequest
+                        }
+                    }
+                    it("should return status Forbidden if wrong consumer azp") {
+                        val invalidValidToken = generateJWTSystem(
+                            audience = externalMockEnvironment.environment.aadAppClient,
+                            azp = testSyfooppfolgingsplanserviceClientId,
+                            issuer = externalMockEnvironment.wellKnownInternalAzureAD.issuer,
+                        )
+
+                        with(
+                            handleRequest(HttpMethod.Get, url) {
+                                addHeader(HttpHeaders.Authorization, bearerHeader(invalidValidToken))
+                            }
+                        ) {
+                            response.status() shouldBeEqualTo HttpStatusCode.Forbidden
+                        }
+                    }
+                }
+            }
+        }
+    }
+})

src/test/kotlin/no/nav/syfo/testhelper/TestEnvironment.kt

@@ -4,7 +4,6 @@ import no.nav.syfo.application.*
 import no.nav.syfo.application.kafka.ApplicationEnvironmentKafka
 import no.nav.syfo.behandler.api.person.access.PreAuthorizedClient
 import no.nav.syfo.util.configuredJacksonMapper
-import java.net.ServerSocket
 
 fun testEnvironment() = Environment(
     aadAppClient = "isdialogmelding-client-id",
@@ -60,6 +59,7 @@ fun testEnvironment() = Environment(
 const val testAapSoknadApiClientId = "soknad-api-client-id"
 const val testAapOppslagApiClientId = "oppslag-client-id"
 const val testSyfooppfolgingsplanserviceClientId = "syfooppfolgingsplanservice-client-id"
+const val isfrisktilarbeidClientId = "isfrisktilarbeid-client-id"
 
 fun testAppState() = ApplicationState(
     alive = true,
@@ -71,8 +71,8 @@ val testAzureAppPreAuthorizedApps = listOf(
         name = "dev-fss:team-esyfo:syfooppfolgingsplanservice",
         clientId = testSyfooppfolgingsplanserviceClientId,
     ),
+    PreAuthorizedClient(
+        name = "dev-gcp:teamsykefravr:isfrisktilarbeid",
+        clientId = isfrisktilarbeidClientId,
+    )
 )
-
-fun getRandomPort() = ServerSocket(0).use {
-    it.localPort
-}