001package ca.uhn.fhir.rest.server.interceptor.auth;
002
003/*-
004 * #%L
005 * HAPI FHIR - Server Framework
006 * %%
007 * Copyright (C) 2014 - 2019 University Health Network
008 * %%
009 * Licensed under the Apache License, Version 2.0 (the "License");
010 * you may not use this file except in compliance with the License.
011 * You may obtain a copy of the License at
012 *
013 *      http://www.apache.org/licenses/LICENSE-2.0
014 *
015 * Unless required by applicable law or agreed to in writing, software
016 * distributed under the License is distributed on an "AS IS" BASIS,
017 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
018 * See the License for the specific language governing permissions and
019 * limitations under the License.
020 * #L%
021 */
022
023import java.util.Collection;
024
025/**
026 * @see AuthorizationInterceptor#setFlags(Collection)
027 */
028public enum AuthorizationFlagsEnum {
029
030        /**
031         * If this flag is set, attempts to perform read operations
032         * (read/search/history) will be matched by the interceptor before
033         * the method handler is called.
034         * <p>
035         * For example, suppose a rule set is in place that only allows read
036         * access to compartment <code>Patient/123</code>. With this flag set,
037         * any attempts
038         * to perform a FHIR read/search/history operation will be permitted
039         * to proceed to the method handler, and responses will be blocked
040         * by the AuthorizationInterceptor if the response contains a resource
041         * that is not in the given compartment.
042         * </p>
043         * <p>
044         * Setting this flag is less secure, since the interceptor can potentially leak
045         * information about the existence of data, but it is useful in some
046         * scenarios.
047         * </p>
048         *
049         * @since This flag has existed since HAPI FHIR 3.5.0. Prior to this
050         * version, this flag was the default and there was no ability to
051         * proactively block compartment read access.
052         */
053        NO_NOT_PROACTIVELY_BLOCK_COMPARTMENT_READ_ACCESS,
054
055        ALLOW_PATCH_REQUEST_UNCHALLENGED;
056}