Carl 9782 block v1v2 access (#1311)

## 🎫 Ticket

https://jira.cms.gov/browse/BCDA-9782

## 🛠 Changes

Add a v1/v2 deny access configuration check to v1/v2 request middleware.

## ℹ️ Context

Part of making sure new clients that start with v3 are not making old
request.

<!-- If any of the following security implications apply, this PR must
not be merged without Stephen Walter's approval. Explain in this section
and add @SJWalter11 as a reviewer.
  - Adds a new software dependency or dependencies.
  - Modifies or invalidates one or more of our security controls.
  - Stores or transmits data that was not stored or transmitted before.
- Requires additional review of security implications for other reasons.
-->

## 🧪 Validation

Local linting and testing.

Author: carlpartridge

bcda/service/config.go

@@ -33,6 +33,7 @@ type Config struct {
 	V3EnabledACOs           []string    `conf:"v3_enabled_acos"` // Simple list of ACOs with v3 access
 	CutoffDuration          time.Duration
 	RateLimitConfig         RateLimitConfig `conf:"rate_limit_config"`
+	V1V2DenyRegexes         []string        `conf:"v1_v2_deny_regexes"`
 	// Use the squash tag to allow the RunoutConfigs to avoid requiring the parameters
 	// to be defined as a child of RunoutConfig.
 	// Ex: Without the ,squash, we would have to have RunoutConfig.RUNOUT_CUTOFF_DATE_DAYS

bcda/web/middleware/middleware.go

@@ -3,6 +3,7 @@ package middleware
 import (
 	"fmt"
 	"net/http"
+	"regexp"
 
 	"github.com/CMSgov/bcda-app/bcda/auth"
 	"github.com/CMSgov/bcda-app/bcda/responseutils"
@@ -34,14 +35,10 @@ func SecurityHeader(next http.Handler) http.Handler {
 func ACOEnabled(cfg *service.Config) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		fn := func(w http.ResponseWriter, r *http.Request) {
-			ctx := r.Context()
-			ad, ok := ctx.Value(auth.AuthDataContextKey).(auth.AuthData)
+			ad, ok := handleAuthData(r)
 			if !ok {
-				// We cannot get the correct FHIR response writer from here, so
-				// return a non-FHIR-compliant HTTP response
-				logger := log.GetCtxLogger(ctx)
-				logger.WithField("resp_status", http.StatusInternalServerError).Error("AuthData should be set before calling this handler")
 				http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+				return
 			}
 
 			rw, _ := getResponseWriterFromRequestPath(w, r)
@@ -50,8 +47,8 @@ func ACOEnabled(cfg *service.Config) func(next http.Handler) http.Handler {
 			}
 
 			if cfg.IsACODisabled(ad.CMSID) {
-				ctx, _ = log.WriteWarnWithFields(
-					ctx,
+				ctx, _ := log.WriteWarnWithFields(
+					r.Context(),
 					fmt.Sprintf("%s: Failed to complete request, CMSID %s is not enabled", responseutils.UnauthorizedErr, ad.CMSID),
 					logrus.Fields{"resp_status": http.StatusUnauthorized},
 				)
@@ -68,13 +65,8 @@ func ACOEnabled(cfg *service.Config) func(next http.Handler) http.Handler {
 func V3AccessControl(cfg *service.Config) func(next http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		fn := func(w http.ResponseWriter, r *http.Request) {
-			ctx := r.Context()
-			ad, ok := ctx.Value(auth.AuthDataContextKey).(auth.AuthData)
+			ad, ok := handleAuthData(r)
 			if !ok {
-				// We cannot get the correct FHIR response writer from here, so
-				// return a non-FHIR-compliant HTTP response
-				logger := log.GetCtxLogger(ctx)
-				logger.WithField("resp_status", http.StatusInternalServerError).Error("AuthData should be set before calling this handler")
 				http.Error(w, "Internal Server Error", http.StatusInternalServerError)
 				return
 			}
@@ -85,8 +77,8 @@ func V3AccessControl(cfg *service.Config) func(next http.Handler) http.Handler {
 			}
 
 			if !cfg.IsACOV3Enabled(ad.CMSID) {
-				ctx, _ = log.WriteWarnWithFields(
-					ctx,
+				ctx, _ := log.WriteWarnWithFields(
+					r.Context(),
 					fmt.Sprintf("%s: Failed to begin v3 request, CMSID %s does not have v3 access", responseutils.UnauthorizedErr, ad.CMSID),
 					logrus.Fields{"resp_status": http.StatusForbidden},
 				)
@@ -99,3 +91,60 @@ func V3AccessControl(cfg *service.Config) func(next http.Handler) http.Handler {
 		return http.HandlerFunc(fn)
 	}
 }
+
+func V1V2DenyControl(cfg *service.Config) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		fn := func(w http.ResponseWriter, r *http.Request) {
+			ad, ok := handleAuthData(r)
+			if !ok {
+				http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+				return
+			}
+
+			rw, _ := getResponseWriterFromRequestPath(w, r)
+			if rw == nil {
+				return
+			}
+
+			if isACOV1V2DeniedAccess(cfg, ad.CMSID) {
+				ctx, _ := log.WriteWarnWithFields(
+					r.Context(),
+					fmt.Sprintf("%s: Failed to begin v1/v2 request, CMSID %s does not have v1/v2 access", responseutils.UnauthorizedErr, ad.CMSID),
+					logrus.Fields{"resp_status": http.StatusForbidden},
+				)
+				rw.OpOutcome(ctx, w, http.StatusForbidden, responseutils.UnauthorizedErr, "v1 nor v2 access not enabled for this ACO")
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		}
+
+		return http.HandlerFunc(fn)
+	}
+}
+
+func handleAuthData(r *http.Request) (auth.AuthData, bool) {
+	ctx := r.Context()
+	ad, ok := ctx.Value(auth.AuthDataContextKey).(auth.AuthData)
+	if !ok {
+		// We cannot get the correct FHIR response writer from here, so
+		// return a non-FHIR-compliant HTTP response
+		logger := log.GetCtxLogger(ctx)
+		logger.WithField("resp_status", http.StatusInternalServerError).Error("AuthData should be set before calling this handler")
+
+		return ad, false
+	}
+
+	return ad, true
+}
+
+func isACOV1V2DeniedAccess(cfg *service.Config, ACOID string) bool {
+	for _, str := range cfg.V1V2DenyRegexes {
+		regex := regexp.MustCompile(str)
+		if regex.MatchString(ACOID) {
+			return true
+		}
+	}
+
+	return false
+}

bcda/web/middleware/middleware_test.go

@@ -239,6 +239,48 @@ func (s *MiddlewareTestSuite) TestV3AccessControl() {
 	}
 }
 
+func (s *MiddlewareTestSuite) TestV1V2DenyControl() {
+	tests := []struct {
+		name         string
+		acoID        string
+		regexes      []string
+		expectedCode int
+	}{
+		{"V1V2 deny empty", "A1234", []string{}, http.StatusOK},
+		{"V1V2 deny list nil", "A1234", nil, http.StatusOK},
+		{"V1V2 deny list mismatch", "A1234", []string{"D\\d{4}"}, http.StatusOK},
+		{"V1V2 deny list mismatch specific", "A1234", []string{"A1235", "A1236"}, http.StatusOK},
+		{"V1V2 deny list mismatch case sensitive", "a1234", []string{"A1234", "A5678"}, http.StatusOK},
+		{"V1V2 deny list match", "A1234", []string{"A\\d{4}"}, http.StatusForbidden},
+		{"V1V2 deny list match specific", "A1234", []string{"A1234"}, http.StatusForbidden},
+		{"V1V2 deny all", "A9999", []string{".*"}, http.StatusForbidden},
+		{"V1V2 deny many regexes", "A9999", []string{"A1234", "A9998", "A999\\d"}, http.StatusForbidden},
+	}
+
+	for _, tt := range tests {
+		cfg := &service.Config{
+			RunoutConfig:    service.RunoutConfig{CutoffDurationDays: 180, ClaimThruDate: "2020-12-31"},
+			V1V2DenyRegexes: tt.regexes,
+		}
+
+		rr := httptest.NewRecorder()
+
+		V1V2DenyControl(cfg)(http.HandlerFunc(
+			func(rw http.ResponseWriter, r *http.Request) {}),
+		).ServeHTTP(rr, testRequest(RequestParameters{}, tt.acoID))
+
+		assert.Equal(s.T(), tt.expectedCode, rr.Code)
+	}
+}
+
+func (s *MiddlewareTestSuite) TestV1V2DenyControl_PanicOnBadRegex() {
+	cfg := &service.Config{
+		RunoutConfig:    service.RunoutConfig{CutoffDurationDays: 180, ClaimThruDate: "2020-12-31"},
+		V1V2DenyRegexes: []string{"?!.*"}, // invalid regex (invalid target for quantifier)
+	}
+	assert.Panics(s.T(), func() { isACOV1V2DeniedAccess(cfg, "A1234") })
+}
+
 func testRequest(rp RequestParameters, cmsid string) *http.Request {
 	ctx := context.WithValue(context.Background(), auth.AuthDataContextKey, auth.AuthData{CMSID: cmsid, ACOID: cmsid})
 	ctx = SetRequestParamsCtx(ctx, rp)

bcda/web/router.go

@@ -45,10 +45,10 @@ func NewAPIRouter(db *sql.DB, pool *pgxv5Pool.Pool, provider auth.Provider) http
 
 	rlm := middleware.NewRateLimitMiddleware(cfg, db)
 	var requestValidators = []func(http.Handler) http.Handler{
-		middleware.ACOEnabled(cfg), middleware.ValidateRequestURL, middleware.ValidateRequestHeaders, rlm.CheckConcurrentJobs,
+		middleware.ACOEnabled(cfg), middleware.V1V2DenyControl(cfg), middleware.ValidateRequestURL, middleware.ValidateRequestHeaders, rlm.CheckConcurrentJobs,
 	}
 	nonExportRequestValidators := []func(http.Handler) http.Handler{
-		middleware.ACOEnabled(cfg), middleware.ValidateRequestURL, middleware.ValidateRequestHeaders,
+		middleware.ACOEnabled(cfg), middleware.V1V2DenyControl(cfg), middleware.ValidateRequestURL, middleware.ValidateRequestHeaders,
 	}
 
 	if conf.GetEnv("DEPLOYMENT_TARGET") != "prod" {

conf/configs/dev.yml

@@ -79,3 +79,4 @@ rate_limit_config:
   all: false
   acos: []
 v3_enabled_acos: []
+v1_v2_deny_regexes: []

conf/configs/prod.yml

@@ -79,4 +79,5 @@ rate_limit_config:
   all: true
   acos: []
 v3_enabled_acos:
-  - "TEST994"
+  - "TEST994"
+v1_v2_deny_regexes: ["IOTA\\d{3}"]

conf/configs/sandbox.yml

@@ -86,3 +86,4 @@ rate_limit_config:
   all: false
   acos: ["SBXBM0002"]
 v3_enabled_acos: []
+v1_v2_deny_regexes: []

conf/configs/test.yml

@@ -79,3 +79,4 @@ rate_limit_config:
   all: true
   acos: []
 v3_enabled_acos: []
+v1_v2_deny_regexes: []