Feature/891 cases confidentiality

src/open_inwoner/accounts/views/cases.py

@@ -1,5 +1,5 @@
 import dataclasses
-from typing import List
+from typing import List, Optional
 
 from django.contrib.auth.mixins import AccessMixin
 from django.core.cache import cache
@@ -35,7 +35,7 @@
     fetch_single_information_object,
 )
 from open_inwoner.openzaak.models import OpenZaakConfig
-from open_inwoner.openzaak.utils import filter_info_object_visibility
+from open_inwoner.openzaak.utils import filter_info_object_visibility, is_zaak_visible
 
 
 class CaseAccessMixin(AccessMixin):
@@ -59,14 +59,15 @@ def dispatch(self, request, *args, **kwargs):
         if not request.user.bsn:
             return self.handle_no_permission()
 
-        if "object_id" in kwargs:
-            case_uuid = kwargs["object_id"]
-            self.case = fetch_single_case(case_uuid)
+        self.case = self.get_case(kwargs)
+        if self.case:
+            # check if we have a role in this case
+            if not fetch_roles_for_case_and_bsn(self.case.url, request.user.bsn):
+                return self.handle_no_permission()
 
-            if self.case:
-                # check if we have a role in this case
-                if not fetch_roles_for_case_and_bsn(self.case.url, request.user.bsn):
-                    return self.handle_no_permission()
+            # check confidentiality level
+            if not is_zaak_visible(self.case):
+                return self.handle_no_permission()
 
         return super().dispatch(request, *args, **kwargs)
 
@@ -76,6 +77,13 @@ def handle_no_permission(self):
 
         return super().handle_no_permission()
 
+    def get_case(self, kwargs) -> Optional[Zaak]:
+        case_uuid = kwargs.get("object_id")
+        if not case_uuid:
+            return None
+
+        return fetch_single_case(case_uuid)
+
 
 class CaseListView(BaseBreadcrumbMixin, CaseAccessMixin, TemplateView):
     template_name = "pages/cases/list.html"

src/open_inwoner/openzaak/cases.py

@@ -9,23 +9,30 @@
 
 from .api_models import Zaak, ZaakInformatieObject
 from .clients import build_client
+from .models import OpenZaakConfig
 
 logger = logging.getLogger(__name__)
 
 
 def fetch_cases(user_bsn: str) -> List[Zaak]:
+    """
+    retrieve cases for particular user with allowed confidentiality level
+    """
     client = build_client("zaak")
 
     if client is None:
         return []
 
+    config = OpenZaakConfig.get_solo()
+
     try:
         response = get_paginated_results(
             client,
             "zaak",
             request_kwargs={
                 "params": {
-                    "rol__betrokkeneIdentificatie__natuurlijkPersoon__inpBsn": user_bsn
+                    "rol__betrokkeneIdentificatie__natuurlijkPersoon__inpBsn": user_bsn,
+                    "maximaleVertrouwelijkheidaanduiding": config.zaak_max_confidentiality,
                 },
             },
         )

src/open_inwoner/openzaak/migrations/0005_openzaakconfig_zaak_max_confidentiality.py

@@ -0,0 +1,33 @@
+# Generated by Django 3.2.15 on 2022-11-16 16:29
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("openzaak", "0004_openzaakconfig_document_max_confidentiality"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="openzaakconfig",
+            name="zaak_max_confidentiality",
+            field=models.CharField(
+                choices=[
+                    ("openbaar", "Openbaar"),
+                    ("beperkt_openbaar", "Beperkt openbaar"),
+                    ("intern", "Intern"),
+                    ("zaakvertrouwelijk", "Zaakvertrouwelijk"),
+                    ("vertrouwelijk", "Vertrouwelijk"),
+                    ("confidentieel", "Confidentieel"),
+                    ("geheim", "Geheim"),
+                    ("zeer_geheim", "Zeer geheim"),
+                ],
+                default="openbaar",
+                help_text="Select maximum confidentiality level of cases",
+                max_length=32,
+                verbose_name="Case confidentiality",
+            ),
+        ),
+    ]

src/open_inwoner/openzaak/models.py

@@ -19,6 +19,13 @@ class OpenZaakConfig(SingletonModel):
         related_name="+",
         null=True,
     )
+    zaak_max_confidentiality = models.CharField(
+        max_length=32,
+        choices=VertrouwelijkheidsAanduidingen.choices,
+        default=VertrouwelijkheidsAanduidingen.openbaar,
+        verbose_name=_("Case confidentiality"),
+        help_text=_("Select maximum confidentiality level of cases"),
+    )
     catalogi_service = models.OneToOneField(
         "zgw_consumers.Service",
         verbose_name=_("Catalogi API"),

src/open_inwoner/openzaak/tests/test_statuses.py → src/open_inwoner/openzaak/tests/test_case_detail.py

@@ -27,7 +27,7 @@
 
 
 @requests_mock.Mocker()
-class TestListStatusView(WebTest):
+class TestCaseDetailView(WebTest):
     def setUp(self):
         self.maxDiff = None
 
@@ -38,23 +38,28 @@ def setUpTestData(self):
         self.user = UserFactory(
             login_type=LoginTypeChoices.digid, bsn="900222086", email="[email protected]"
         )
-        self.config = OpenZaakConfig.get_solo()
+        # services
         self.zaak_service = ServiceFactory(api_root=ZAKEN_ROOT, api_type=APITypes.zrc)
-        self.config.zaak_service = self.zaak_service
         self.catalogi_service = ServiceFactory(
             api_root=CATALOGI_ROOT, api_type=APITypes.ztc
         )
-        self.config.catalogi_service = self.catalogi_service
         self.document_service = ServiceFactory(
             api_root=DOCUMENTEN_ROOT, api_type=APITypes.drc
         )
+        # openzaak config
+        self.config = OpenZaakConfig.get_solo()
+        self.config.zaak_service = self.zaak_service
+        self.config.catalogi_service = self.catalogi_service
         self.config.document_service = self.document_service
-
         self.config.document_max_confidentiality = (
             VertrouwelijkheidsAanduidingen.beperkt_openbaar
         )
-
+        self.config.zaak_max_confidentiality = (
+            VertrouwelijkheidsAanduidingen.beperkt_openbaar
+        )
         self.config.save()
+
+        # openzaak resources
         self.zaak = generate_oas_component(
             "zrc",
             "schemas/Zaak",
@@ -66,6 +71,18 @@ def setUpTestData(self):
             startdatum="2022-01-02",
             einddatum=None,
             status=f"{ZAKEN_ROOT}statussen/3da89990-c7fc-476a-ad13-c9023450083c",
+            vertrouwelijkheidaanduiding=VertrouwelijkheidsAanduidingen.openbaar,
+        )
+        self.zaak_invisible = generate_oas_component(
+            "zrc",
+            "schemas/Zaak",
+            uuid="213b0a04-fcbc-4fee-8d11-cf950a0a0bbb",
+            url=f"{ZAKEN_ROOT}zaken/213b0a04-fcbc-4fee-8d11-cf950a0a0bbb",
+            zaaktype=f"{CATALOGI_ROOT}zaaktypen/53340e34-7581-4b04-884f",
+            identificatie="ZAAK-2022-invisible",
+            omschrijving="Zaak invisible",
+            startdatum="2022-01-02",
+            vertrouwelijkheidaanduiding=VertrouwelijkheidsAanduidingen.geheim,
         )
         self.zaaktype = generate_oas_component(
             "ztc",
@@ -405,3 +422,21 @@ def test_no_data_is_retrieved_when_http_500(self, m):
 
         self.assertIsNone(response.context.get("case"))
         self.assertContains(response, _("There is no available data at the moment."))
+
+    def test_no_access_when_case_is_confidential(self, m):
+        mock_service_oas_get(m, ZAKEN_ROOT, "zrc")
+        mock_service_oas_get(m, CATALOGI_ROOT, "ztc")
+        m.get(self.zaak_invisible["url"], json=self.zaak_invisible)
+        m.get(
+            f"{ZAKEN_ROOT}rollen?zaak={self.zaak_invisible['url']}&betrokkeneIdentificatie__natuurlijkPersoon__inpBsn={self.user.bsn}",
+            json=paginated_response([self.role]),
+        )
+
+        response = self.app.get(
+            reverse(
+                "accounts:case_status",
+                kwargs={"object_id": self.zaak_invisible["uuid"]},
+            ),
+            user=self.user,
+        )
+        self.assertRedirects(response, reverse("root"))

src/open_inwoner/openzaak/tests/test_cases.py

@@ -5,6 +5,8 @@
 
 import requests_mock
 from django_webtest import WebTest
+from furl import furl
+from zgw_consumers.api_models.constants import VertrouwelijkheidsAanduidingen
 from zgw_consumers.constants import APITypes
 from zgw_consumers.test import generate_oas_component, mock_service_oas_get
 
@@ -32,13 +34,18 @@ def setUpTestData(self):
         self.user = UserFactory(
             login_type=LoginTypeChoices.digid, bsn="900222086", email="[email protected]"
         )
-        self.config = OpenZaakConfig.get_solo()
+        # services
         self.zaak_service = ServiceFactory(api_root=ZAKEN_ROOT, api_type=APITypes.zrc)
-        self.config.zaak_service = self.zaak_service
         self.catalogi_service = ServiceFactory(
             api_root=CATALOGI_ROOT, api_type=APITypes.ztc
         )
+        # operzaak config
+        self.config = OpenZaakConfig.get_solo()
+        self.config.zaak_service = self.zaak_service
         self.config.catalogi_service = self.catalogi_service
+        self.config.zaak_max_confidentiality = (
+            VertrouwelijkheidsAanduidingen.beperkt_openbaar
+        )
         self.config.save()
 
         self.zaak1 = generate_oas_component(
@@ -51,6 +58,7 @@ def setUpTestData(self):
             startdatum="2022-01-02",
             einddatum="2022-01-16",
             status=f"{ZAKEN_ROOT}statussen/3da89990-c7fc-476a-ad13-c9023450083c",
+            vertrouwelijkheidaanduiding=VertrouwelijkheidsAanduidingen.openbaar,
         )
         self.zaak2 = generate_oas_component(
             "zrc",
@@ -62,6 +70,7 @@ def setUpTestData(self):
             startdatum="2022-01-12",
             einddatum=None,
             status=f"{ZAKEN_ROOT}statussen/3da81560-c7fc-476a-ad13-beu760sle929",
+            vertrouwelijkheidaanduiding=VertrouwelijkheidsAanduidingen.openbaar,
         )
         self.zaak3 = generate_oas_component(
             "zrc",
@@ -73,6 +82,7 @@ def setUpTestData(self):
             startdatum="2021-07-26",
             einddatum=None,
             status=f"{ZAKEN_ROOT}statussen/98659876-bbb3-476a-ad13-n3nvcght758js",
+            vertrouwelijkheidaanduiding=VertrouwelijkheidsAanduidingen.openbaar,
         )
         self.zaaktype = generate_oas_component(
             "ztc",
@@ -148,7 +158,14 @@ def _setUpMocks(self, m):
         mock_service_oas_get(m, ZAKEN_ROOT, "zrc")
         mock_service_oas_get(m, CATALOGI_ROOT, "ztc")
         m.get(
-            f"{ZAKEN_ROOT}zaken?rol__betrokkeneIdentificatie__natuurlijkPersoon__inpBsn=900222086",
+            furl(f"{ZAKEN_ROOT}zaken")
+            .add(
+                {
+                    "rol__betrokkeneIdentificatie__natuurlijkPersoon__inpBsn": self.user.bsn,
+                    "maximaleVertrouwelijkheidaanduiding": VertrouwelijkheidsAanduidingen.beperkt_openbaar,
+                }
+            )
+            .url,
             json=paginated_response([self.zaak1, self.zaak2, self.zaak3]),
         )
         m.get(f"{CATALOGI_ROOT}zaaktypen", json=paginated_response([self.zaaktype]))
@@ -211,6 +228,24 @@ def test_sorted_cases_are_retrieved_when_user_logged_in_via_digid(self, m):
                 }
             ],
         )
+        # check zaken request query parameters
+        list_zaken_req = [
+            req
+            for req in m.request_history
+            if req.hostname == "zaken.nl" and req.path == "/api/v1/zaken"
+        ][0]
+        self.assertEqual(len(list_zaken_req.qs), 2)
+        self.assertEqual(
+            list_zaken_req.qs,
+            {
+                "rol__betrokkeneidentificatie__natuurlijkpersoon__inpbsn": [
+                    self.user.bsn
+                ],
+                "maximalevertrouwelijkheidaanduiding": [
+                    VertrouwelijkheidsAanduidingen.beperkt_openbaar
+                ],
+            },
+        )
 
     def test_status_type_is_manually_retrieved_if_not_in_status_types(self, m):
         self._setUpMocks(m)

src/open_inwoner/openzaak/tests/test_documents.py

@@ -46,6 +46,9 @@ def setUpTestData(self):
         self.config.document_max_confidentiality = (
             VertrouwelijkheidsAanduidingen.beperkt_openbaar
         )
+        self.config.zaak_max_confidentiality = (
+            VertrouwelijkheidsAanduidingen.beperkt_openbaar
+        )
         self.config.save()
 
         self.zaak = generate_oas_component(
@@ -59,6 +62,7 @@ def setUpTestData(self):
             startdatum="2022-01-02",
             einddatum=None,
             status=f"{ZAKEN_ROOT}statussen/3da89990-c7fc-476a-ad13-c9023450083c",
+            vertrouwelijkheidaanduiding=VertrouwelijkheidsAanduidingen.openbaar,
         )
         self.zaak_informatie_object = generate_oas_component(
             "zrc",

src/open_inwoner/openzaak/utils.py

@@ -1,6 +1,26 @@
 from zgw_consumers.api_models.constants import VertrouwelijkheidsAanduidingen
 
-from open_inwoner.openzaak.api_models import InformatieObject
+from open_inwoner.openzaak.api_models import InformatieObject, Zaak
+
+from .models import OpenZaakConfig
+
+
+def is_object_visible(obj, max_confidentiality_level: str) -> bool:
+    """
+    Compare obj.vertrouwelijkheidaanduiding and max_confidentiality_level
+    Can be used for any object which has vertrouwelijkheidaanduiding property
+    """
+    if not obj:
+        return False
+
+    levels = [c[0] for c in VertrouwelijkheidsAanduidingen.choices]
+    try:
+        max_index = levels.index(max_confidentiality_level)
+        doc_index = levels.index(obj.vertrouwelijkheidaanduiding)
+    except ValueError:
+        return False
+
+    return doc_index <= max_index
 
 
 def filter_info_object_visibility(
@@ -12,16 +32,13 @@ def filter_info_object_visibility(
     We check on its definitive status, and a maximum confidentiality level (compared the
     ordering from the VertrouwelijkheidsAanduidingen.choices)
     """
-    if not info_object:
-        return False
     if info_object.status != "definitief":
         return False
 
-    levels = [c[0] for c in VertrouwelijkheidsAanduidingen.choices]
-    try:
-        max_index = levels.index(max_confidentiality_level)
-        doc_index = levels.index(info_object.vertrouwelijkheidaanduiding)
-    except ValueError:
-        return False
+    return is_object_visible(info_object, max_confidentiality_level)
 
-    return doc_index <= max_index
+
+def is_zaak_visible(zaak: Zaak) -> bool:
+    """Check if zaak is visible for users"""
+    config = OpenZaakConfig.get_solo()
+    return is_object_visible(zaak, config.zaak_max_confidentiality)