Update GET patient/:id to also allow first responders

sfbrigade · Sep 16, 2024 · b9eaf98 · b9eaf98
1 parent 7f63adf
commit b9eaf98
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 10 deletions.
diff --git a/server/routes/api/v1/patients/get.js b/server/routes/api/v1/patients/get.js
@@ -70,7 +70,12 @@ export default async function (fastify, _opts) {
           },
         },
       },
-      onRequest: fastify.requireUser([Role.ADMIN, Role.STAFF, Role.VOLUNTEER]),
+      onRequest: fastify.requireUser([
+        Role.ADMIN,
+        Role.STAFF,
+        Role.VOLUNTEER,
+        Role.FIRST_RESPONDER,
+      ]),
     },
     async (request, reply) => {
       const { id } = request.params;

diff --git a/server/test/routes/api/v1/patients.test.js b/server/test/routes/api/v1/patients.test.js
@@ -19,22 +19,14 @@ describe('/api/v1/patients', () => {
   });
 
   describe('GET /:id', () => {
-    it('should return a 403 error if not an ADMIN, STAFF or VOLUNTEER user', async (t) => {
+    it('should return UNAUTHORIZED if the user is not logged in', async (t) => {
       const app = await build(t);
       await t.loadFixtures();
 
       let reply = await app
         .inject()
         .get('/api/v1/patients/27963f68-ebc1-408a-8bb5-8fbe54671064');
       assert.deepStrictEqual(reply.statusCode, StatusCodes.UNAUTHORIZED);
-
-      let headers = await t.authenticate('[email protected]', 'test');
-      reply = await app
-        .inject()
-        .get('/api/v1/patients/27963f68-ebc1-408a-8bb5-8fbe54671064')
-        .headers(headers);
-
-      assert.deepStrictEqual(reply.statusCode, StatusCodes.FORBIDDEN);
     });
 
     it('should allow ADMIN to retrieve a patient', async (t) => {