@ministryofjustice/hmpps-prison-permissions-lib 2.2.0 → 2.3.0

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 Please use this to capture reasoning behind changes:
 
+## 2.3.0
+
+Adding an extra option `readOnly` to the `PermissionsService` which defaults to `false`. When set to `true`, this
+will only grant read permissions. This allows a service to configure itself as read-only if required. This was initially
+required by the Prisoner Profile to display a read-only view of duplicate prisoner profiles.
+
+## 2.2.1
+
+Minor dependency update
+
 ## 2.2.0
 
 Introduced permissions for the Prisoner Moves domain. The first couple of permissions added are
@@ -9,20 +19,31 @@ Introduced permissions for the Prisoner Moves domain. The first couple of permis
 follow the base checks and just require additional roles.
 
 # 2.1.0
-Adds the sensitive edits role to the edit_contacts permission so users can edit Next of Kin and Emergency contacts in the prisoner profile without requiring Contacts Administrator or Authoriser roles.
+
+Adds the sensitive edits role to the edit_contacts permission so users can edit Next of Kin and Emergency contacts in
+the prisoner profile without requiring Contacts Administrator or Authoriser roles.
 
 # 2.0.1
-Fixes incorrect usage of `previousPrisonId` and `previousPrisonLeavingDate` when checking contacts read permissions. These are only used in the context of transfers, not releases. The correct ones now in use are `lastPrisonId` and `releaseDate`.
+
+Fixes incorrect usage of `previousPrisonId` and `previousPrisonLeavingDate` when checking contacts read permissions.
+These are only used in the context of transfers, not releases. The correct ones now in use are `lastPrisonId` and
+`releaseDate`.
 
 # 2.0.0
-Replaced contacts read permissions check with one that handles released prisoners differently. Checks for current prisoners are unaffected.
+
+Replaced contacts read permissions check with one that handles released prisoners differently. Checks for current
+prisoners are unaffected.
 
 To be permitted to read contacts for released prisoners:
-- the user's roles must include `InactiveBookings` and one or both of the following: `ContactsAdministrator, ContactsAuthoriser`
+
+- the user's roles must include `InactiveBookings` and one or both of the following:
+  `ContactsAdministrator, ContactsAuthoriser`
 - the prisoner must have been released within the last 3 years (`PermissionCheckStatus.EXCEEDS_TIME_RESTRICTION`)
 - the previous prison of the prisoner must match the user's caseload
 
-These changes were requested by the contacts team after noticing the 'External Contacts' widget was not showing on the prisoner profiles of released prisoners. This was due to a caseload mismatch, as the assigned caseload for released prisoners is 'OUT'.
+These changes were requested by the contacts team after noticing the 'External Contacts' widget was not showing on the
+prisoner profiles of released prisoners. This was due to a caseload mismatch, as the assigned caseload for released
+prisoners is 'OUT'.
 
 ## 1.1.2
 

package/README.md

@@ -79,6 +79,7 @@ The permissions service should be created just like any other of your services.
 * `logger`: Bunyan logger for logging permissions events. Defaults to using `console`.
 * `telemetryClient`: Optional but recommended. Instead of just logging permissions events, this provides richer metadata
   to Application Insights.
+* `readOnly`: Optional boolean (defaults to false) which, if set to true, will only grant read permissions.
 
 e.g.
 

package/dist/index.cjs

@@ -14,6 +14,7 @@ exports.PermissionCheckStatus = void 0;
     PermissionCheckStatus["EXCEEDS_TIME_RESTRICTION"] = "EXCEEDS_TIME_RESTRICTION";
     PermissionCheckStatus["ROLE_NOT_PRESENT"] = "ROLE_NOT_PRESENT";
     PermissionCheckStatus["NOT_PRISON_USER"] = "NOT_PRISON_USER";
+    PermissionCheckStatus["READ_ONLY"] = "READ_ONLY";
     PermissionCheckStatus["OK"] = "OK";
 })(exports.PermissionCheckStatus || (exports.PermissionCheckStatus = {}));
 
@@ -244,12 +245,15 @@ const baseCheckConditions = {
 const baseCheckStatus = (user, prisoner) => getPermissionStatus(user, prisoner, baseCheckConditions);
 
 const matchBaseCheckAnd = (additionalConditions) => (permission, context) => {
-    const { user, prisoner, baseCheckStatus } = context;
+    const { user, prisoner, baseCheckStatus, readOnly } = context;
     const baseCheckPassed = baseCheckStatus === exports.PermissionCheckStatus.OK;
-    const permissionStatus = getPermissionStatus(user, prisoner, {
-        ...baseCheckConditions,
-        ...additionalConditions,
-    });
+    const readOnlyCheckPassed = readOnly ? permission.endsWith(':read') : true;
+    const permissionStatus = readOnlyCheckPassed
+        ? getPermissionStatus(user, prisoner, {
+            ...baseCheckConditions,
+            ...additionalConditions,
+        })
+        : exports.PermissionCheckStatus.READ_ONLY;
     const permissionCheckPassed = baseCheckPassed && permissionStatus === exports.PermissionCheckStatus.OK;
     if (!permissionCheckPassed)
         logDeniedPermissionCheck(permission, context, permissionStatus);
@@ -321,8 +325,8 @@ function prisonerAdjudicationsCheck(context) {
 
 exports.PrisonerIncentivesPermission = void 0;
 (function (PrisonerIncentivesPermission) {
-    PrisonerIncentivesPermission["read_incentive_level"] = "prisoner:prisoner-incentives:read_incentive_level";
-    PrisonerIncentivesPermission["read_incentive_level_history"] = "prisoner:prisoner-incentives:read_incentive_level_history";
+    PrisonerIncentivesPermission["read_incentive_level"] = "prisoner:incentives:incentive-level:read";
+    PrisonerIncentivesPermission["read_incentive_level_history"] = "prisoner:incentives:incentive-level-history:read";
 })(exports.PrisonerIncentivesPermission || (exports.PrisonerIncentivesPermission = {}));
 
 const incentiveLevelHistoryReadCheck = matchBaseCheckAnd({
@@ -907,12 +911,14 @@ function probationCheck(context) {
 exports.PersonInterventionsPermission = void 0;
 (function (PersonInterventionsPermission) {
     PersonInterventionsPermission["read_csip"] = "prisoner:csip:read";
+    PersonInterventionsPermission["edit_csip"] = "prisoner:csip:edit";
 })(exports.PersonInterventionsPermission || (exports.PersonInterventionsPermission = {}));
 
 function personInterventionsCheck(context) {
     const check = checkWith(context);
     return {
         ...check(exports.PersonInterventionsPermission.read_csip, inUsersCaseLoad),
+        ...check(exports.PersonInterventionsPermission.edit_csip, inUsersCaseLoad),
     };
 }
 
@@ -950,12 +956,14 @@ function personPlanAndNeedsCheck(context) {
 class PermissionsService {
     prisonerSearchClient;
     permissionsLogger;
-    static create({ prisonerSearchConfig, authenticationClient, logger = console, telemetryClient, }) {
-        return new PermissionsService(new PrisonerSearchClient(logger, prisonerSearchConfig, authenticationClient), new PermissionsLogger(logger, telemetryClient));
+    readOnly;
+    static create({ prisonerSearchConfig, authenticationClient, logger = console, telemetryClient, readOnly = false, }) {
+        return new PermissionsService(new PrisonerSearchClient(logger, prisonerSearchConfig, authenticationClient), new PermissionsLogger(logger, telemetryClient), readOnly);
     }
-    constructor(prisonerSearchClient, permissionsLogger) {
+    constructor(prisonerSearchClient, permissionsLogger, readOnly) {
         this.prisonerSearchClient = prisonerSearchClient;
         this.permissionsLogger = permissionsLogger;
+        this.readOnly = readOnly;
     }
     getPrisonerPermissions({ user, prisoner, requestDependentOn, }) {
         const context = {
@@ -964,6 +972,7 @@ class PermissionsService {
             baseCheckStatus: baseCheckStatus(user, prisoner),
             requestDependentOn,
             permissionsLogger: this.permissionsLogger,
+            readOnly: this.readOnly,
         };
         return {
             [exports.PrisonerBasePermission.read]: baseCheck(exports.PrisonerBasePermission.read, context),
@@ -1202,6 +1211,7 @@ const probationDomainPermissionPaths = {
 // eslint-disable-next-line import/prefer-default-export
 const personInterventionsPermissionPaths = {
     [exports.PersonInterventionsPermission.read_csip]: `domainGroups.interventions.personInterventions.${exports.PersonInterventionsPermission.read_csip}`,
+    [exports.PersonInterventionsPermission.edit_csip]: `domainGroups.interventions.personInterventions.${exports.PersonInterventionsPermission.edit_csip}`,
 };
 
 // eslint-disable-next-line import/prefer-default-export