Merge pull request #104 from anjumabbas5/API-7437

API-7437 - failing to get scopes for some sessions
hmrc · Dec 12, 2023 · 6de107b · 6de107b
2 parents c49397b + 0af92cc
commit 6de107b
Show file tree

Hide file tree

Showing 7 changed files with 183 additions and 51 deletions.
diff --git a/app/connectors/ThirdPartyDelegatedAuthorityConnector.scala b/app/connectors/ThirdPartyDelegatedAuthorityConnector.scala
@@ -30,8 +30,8 @@ import scala.util.control.NonFatal
 class ThirdPartyDelegatedAuthorityConnector @Inject() (appContext: AppContext, http: HttpGet) {
   val serviceUrl: String = appContext.thirdPartyDelegatedAuthorityUrl
 
-  def fetchScopes(authorizationTokens: String)(implicit hc: HeaderCarrier, ec: ExecutionContext): Future[Set[String]] = {
-    http.GET(s"$serviceUrl/delegated-authority", Nil, Seq("internal-auth-header" -> authorizationTokens))(readRaw, hc, ec) map { response =>
+  def fetchScopes(accessToken: String)(implicit hc: HeaderCarrier, ec: ExecutionContext): Future[Set[String]] = {
+    http.GET(s"$serviceUrl/delegated-authority", Nil, Seq("access-token" -> accessToken))(readRaw, hc, ec) map { response =>
       if (response.status == Status.NOT_FOUND) {
         Set[String]()
       } else {

diff --git a/app/controllers/UserInfoController.scala b/app/controllers/UserInfoController.scala
@@ -25,7 +25,7 @@ import play.api.libs.json.Json
 import play.api.mvc.{AnyContent, BodyParser, ControllerComponents}
 import services.UserInfoService
 import uk.gov.hmrc.api.controllers.HeaderValidator
-import uk.gov.hmrc.http.{BadRequestException, UpstreamErrorResponse => UER}
+import uk.gov.hmrc.http.{BadRequestException, UnauthorizedException, UpstreamErrorResponse => UER}
 import uk.gov.hmrc.http.UpstreamErrorResponse.{Upstream4xxResponse, Upstream5xxResponse}
 import uk.gov.hmrc.play.bootstrap.backend.controller.BackendBaseController
 
@@ -70,7 +70,8 @@ trait UserInfoController extends BackendBaseController with HeaderValidator {
       case Upstream4xxResponse(UER(_, 401, _, _))    => Unauthorized(Json.toJson(ErrorUnauthorized()))
       case Upstream4xxResponse(UER(msg4xx, _, _, _)) => BadGateway(Json.toJson(ErrorBadGateway(msg4xx)))
       case Upstream5xxResponse(UER(msg5xx, _, _, _)) => BadGateway(Json.toJson(ErrorBadGateway(msg5xx)))
-      case bex: BadRequestException => BadRequest(Json.toJson(ErrorBadRequest(bex.getMessage)))
+      case bex: BadRequestException   => BadRequest(Json.toJson(ErrorBadRequest(bex.getMessage)))
+      case uex: UnauthorizedException => Unauthorized(Json.toJson(ErrorUnauthorized(uex.getMessage)))
     }
   }
 }

diff --git a/app/services/UserInfoService.scala b/app/services/UserInfoService.scala
@@ -40,9 +40,12 @@ class LiveUserInfoService @Inject() (
 
   override def fetchUserInfo(version: Version)(implicit hc: HeaderCarrier): Future[UserInfo] = {
 
-    val scopes = hc.authorization match {
-      case Some(authorisationTokens) => thirdPartyDelegatedAuthorityConnector.fetchScopes(authorisationTokens.value)
-      case None                      => Future.failed(new UnauthorizedException("Authorization token is required"))
+    val accessTokenHeaderName = "X-Client-Authorization-Token"
+    val accessTokenHeader = hc.otherHeaders.find(x => x._1 == accessTokenHeaderName)
+
+    val scopes = accessTokenHeader match {
+      case Some(accessTokenHeader) => thirdPartyDelegatedAuthorityConnector.fetchScopes(accessTokenHeader._2)
+      case None                    => Future.failed(new UnauthorizedException(s"$accessTokenHeaderName header is missing"))
     }
 
     scopes.flatMap { scopes =>