BFD-3666: removing SAMHSA sensitive information based on security tags in the response #2530
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
BFD-3666 SAMHSAConsentInterceptor
BFD-3666 SAMHSAConsentInterceptor functions
BFD-3666 SAMHSA 2.0 v1 and v2 ConsentInterceptor functions
…ext bean BFD-6666 getting the booleanValue of the future flag using springContext bean
BFD-6666 redacting sensitive data based on security tags
BFD-3666 fixing testes, removing total from the tests because the interceptor will remove it
MahiFentaye
changed the title
MahiFentaye
changed the title
BFD-3666 fixing testes, removing total from the tests because the interceptor will remove it
MahiFentaye
requested review from
mjburling,
dondevun,
aschey-forpeople and
malessi
as code owners
aschey-forpeople
requested changes
Feb 4, 2025
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V2SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
apps/bfd-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V2Server.java
Outdated
Show resolved
Hide resolved
MahiFentaye
force-pushed
the
BFD-3666
branch
2 times, most recently
from
507c852 to
5b9d4cf
Compare
aschey-forpeople
requested changes
Feb 5, 2025
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V2SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
MahiFentaye
force-pushed
the
BFD-3666
branch
2 times, most recently
from
3805918 to
c61cb67
Compare
apps/bfd-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/commons/StringUtils.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V2SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
dondevun
reviewed
Feb 6, 2025
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V2SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V2SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
...d-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V2SamhsaConsentInterceptor.java
Outdated
Show resolved
Hide resolved
…r/war/V2SamhsaConsentInterceptor.java Update StringUtils.java BFD-3666 simpler method Update apps/bfd-server/bfd-server-war/src/main/java/gov/cms/bfd/server/war/V1SamhsaConsentInterceptor.java Co-Authored-By: aschey-forpeople <[email protected]>
aschey-forpeople
approved these changes
Feb 6, 2025
dondevun
approved these changes
Feb 6, 2025
dondevun
pushed a commit
that referenced
this pull request
Feb 18, 2025
…s in the response (#2530) Co-authored-by: aschey-forpeople <[email protected]>
aschey-forpeople
added a commit
that referenced
this pull request
Mar 4, 2025
…s in the response (#2530) Co-authored-by: aschey-forpeople <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
JIRA Ticket:
BFD-3666
What Does This PR Do?
We’re using ConsentInterceptor to filter SAMHSA-related sensitive information based on security tags in the response. Both v1 and v2 SAMHSA consent interceptors scan every response and scrub resources that contain the 42CFRPart2 security tag. If these tags are detected, the interceptor will redact sensitive data from the response. Additionally, registering the ConsentInterceptor removes the total field from the response by default.
This feature is disabled by default and will be applied to responses once the SSM_PATH_SAMHSA_V2_ENABLED flag is enabled
What Should Reviewers Watch For?
If you're reviewing this PR, please check for these things in particular:
What Security Implications Does This PR Have?
Please indicate if this PR does any of the following:
Adds any new software dependencies
Modifies any security controls
Adds new transmission or storage of data
Any other changes that could possibly affect security?
I have considered the above security implications as it relates to this PR. (If one or more of the above apply, it cannot be merged without the ISSO or team security engineer's (
@sb-benohe) approval.)Validation
Have you fully verified and tested these changes? Is the acceptance criteria met? Please provide reproducible testing instructions, code snippets, or screenshots as applicable.
Tested Claim, ClaimResponse and Eob v1 and v2 endpoints with both excludeSAMHSA true and false