Apply POA rules like Caseflow #1218
Assignees
Comments
pkarman
added a commit
that referenced
this issue
May 5, 2020
connects #1218 Add BGS service endpoints for PID and Person services. This will allow us to begin implementing POA rules based on the same endpoints that Caseflow uses. Add participant_id to the User model so we can look up POA matches more easily for the current_user. Start re-orienting the authorization model to check permissions at the boundaries for BGS calls.
pkarman
added a commit
that referenced
this issue
May 6, 2020
connects #1218 * use latest bgs gem * add support for user CSS record on demand * use BGS claimants service for POA by file number * adds `deceased` boolean flag to veteran info * BGS service tests
pkarman
added a commit
that referenced
this issue
May 8, 2020
connects #1218 * adds `UserAuthorizer` class to implement POA rules * adds `user_authorizer` feature toggle to enable new rules Previously the POA check was a simple error string match with yes/no. Now we check explicitly for POA record on the claimant and veteran, independently, and also whether the Veteran is deceased (in which case the claimant's POA has precedence).
This was referenced May 8, 2020
|
tested as of #1229 and working. |
This was referenced May 26, 2020
Merged
va-bot
pushed a commit
to department-of-veterans-affairs/caseflow
that referenced
this issue
Jun 12, 2020
connects #10431 ### Description In the process of developing [POA features for eFolder Express](department-of-veterans-affairs/caseflow-efolder#1218) we discovered some new BGS endpoints for determining POA. This PR is the first step at porting those back to Caseflow. The feature toggle `use_poa_claimants` can control whether the new or existing POA service endpoints are used.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
EE currently applies a simple POA check that relies on BGS error message to disqualify viewing of VBMS efolder documents.
VBMS itself uses the same BGS POA participant id API calls that Caseflow does, so switch over to those.
See context in https://dsva.slack.com/archives/C3EAF3Q15/p1588359644063900
VBMS POA rules:
Some POA rules in this older ticket too: #410 (comment)
Testing
:user_authorizerfor known POA user having trouble https://dsva.slack.com/archives/CHX8FMP28/p1588101644494200The text was updated successfully, but these errors were encountered: