@ministryofjustice/hmpps-prison-permissions-lib 2.2.1 → 2.4.0

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 Please use this to capture reasoning behind changes:
 
+## 2.4.0
+
+The Connect DPS team have been supporting a request to make duplicate prisoner records more visible to users.
+The policy is that if a prisoner record is a duplicate of a record that a user has access to, then the user should
+have read-only access to the duplicate record if they wouldn't otherwise have had access. This allows users to see if
+there is any relevant information in the duplicate record that they may need to be aware of when working with the
+prisoner.
+
+This release introduces support for this policy in the permissions library. The client currently needs to supply
+a list of prisoner search results for the duplicate prisoner records by placing them in
+`req.middleware.duplicatePrisonerData`. Duplicate prison numbers are found by making a request to the
+`hmpps-person-record` API. This is optional, if the client does not provide this data then the
+library will continue to function as before but without any additional access to duplicate records.
+
+When a required permission is upgraded by a duplicate record, this is logged for audit purposes.
+
+## 2.3.0
+
+Adding an extra option `readOnly` to the `PermissionsService` which defaults to `false`. When set to `true`, this
+will only grant read permissions. This allows a service to configure itself as read-only if required. This was initially
+required by the Prisoner Profile to display a read-only view of duplicate prisoner profiles.
+
 ## 2.2.1
 
 Minor dependency update
@@ -13,20 +35,31 @@ Introduced permissions for the Prisoner Moves domain. The first couple of permis
 follow the base checks and just require additional roles.
 
 # 2.1.0
-Adds the sensitive edits role to the edit_contacts permission so users can edit Next of Kin and Emergency contacts in the prisoner profile without requiring Contacts Administrator or Authoriser roles.
+
+Adds the sensitive edits role to the edit_contacts permission so users can edit Next of Kin and Emergency contacts in
+the prisoner profile without requiring Contacts Administrator or Authoriser roles.
 
 # 2.0.1
-Fixes incorrect usage of `previousPrisonId` and `previousPrisonLeavingDate` when checking contacts read permissions. These are only used in the context of transfers, not releases. The correct ones now in use are `lastPrisonId` and `releaseDate`.
+
+Fixes incorrect usage of `previousPrisonId` and `previousPrisonLeavingDate` when checking contacts read permissions.
+These are only used in the context of transfers, not releases. The correct ones now in use are `lastPrisonId` and
+`releaseDate`.
 
 # 2.0.0
-Replaced contacts read permissions check with one that handles released prisoners differently. Checks for current prisoners are unaffected.
+
+Replaced contacts read permissions check with one that handles released prisoners differently. Checks for current
+prisoners are unaffected.
 
 To be permitted to read contacts for released prisoners:
-- the user's roles must include `InactiveBookings` and one or both of the following: `ContactsAdministrator, ContactsAuthoriser`
+
+- the user's roles must include `InactiveBookings` and one or both of the following:
+  `ContactsAdministrator, ContactsAuthoriser`
 - the prisoner must have been released within the last 3 years (`PermissionCheckStatus.EXCEEDS_TIME_RESTRICTION`)
 - the previous prison of the prisoner must match the user's caseload
 
-These changes were requested by the contacts team after noticing the 'External Contacts' widget was not showing on the prisoner profiles of released prisoners. This was due to a caseload mismatch, as the assigned caseload for released prisoners is 'OUT'.
+These changes were requested by the contacts team after noticing the 'External Contacts' widget was not showing on the
+prisoner profiles of released prisoners. This was due to a caseload mismatch, as the assigned caseload for released
+prisoners is 'OUT'.
 
 ## 1.1.2
 

package/README.md

@@ -79,6 +79,7 @@ The permissions service should be created just like any other of your services.
 * `logger`: Bunyan logger for logging permissions events. Defaults to using `console`.
 * `telemetryClient`: Optional but recommended. Instead of just logging permissions events, this provides richer metadata
   to Application Insights.
+* `readOnly`: Optional boolean (defaults to false) which, if set to true, will only grant read permissions.
 
 e.g.