BB2-4961: Switch Account Link by JamesDemeryNava · Pull Request #1649 · CMSgov/bluebutton-web-server

JamesDemeryNava · 2026-07-09T12:59:08Z

JIRA Ticket:
BB2-4961

What Does This PR Do?

Ensures that a beneficiary on the v3 permissions screen can click the Switch account link, and be redirected back to the CSPs landing page, where they can then re-authorize and get an access token. This works via Postman and the testclient, though some extra code was needed for it to work for the testclient.

Some minor styling changes to the v3 permissions screen as well.

What Should Reviewers Watch For?

Is the dot_ext/views/authorization.py file becoming too large? Maybe not a problem for this PR, but it's almost 1,500 lines now
Any concerns on the change in testclient/views.py: setup_testclient_http_response? Needed to make a change there so that, even after a user makes it through the testclient, that the resource links actually work

If you're reviewing this PR, please check for these things in particular:

Validation

Styling changes:

Ensure that when you click into one of the accordions, that the sub-heading that appears (will end with 'if applicable:'), is now size 16 font
Ensure that if there is no support email on the application, that the Reviuew {{appName}}'s Privacy Policy and Terms and Conditions, appears in line with the question mark icon to the left

Switch account changes:

In Postman, go through a v3 auth flow. Log in as a user (BBUser00100), then click the switch account link at the top of the page
You will be redirected to the CSPs landing page, click Medicare.gov, and enter the credentials for BBUser00575
Click Share on the v3 permissions screen.
Run a v3 patient search call for your newly created token. If you used BBUser00575, the fhir_id_v3 should be a specific value that I can share with you (don't want to include in a PR)
In the testclient, go through a v3 auth flow. Log in as a user (BBUser00100), then click the switch account link at the top of the page
You will be redirected to the CSPs landing page, click Medicare.gov, and enter the credentials for BBUser00575
Click Share on the v3 permissions screen.
Click through every link on the testclient landing page to ensure they all work
Also go through testclient flows for v2/v3 without clicking switch account to ensure they still work. Do the same for Postman.

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

Adds any new software dependencies
Modifies any security controls
Adds new transmission or storage of data
Any other changes that could possibly affect security?

None of the above apply necesarily, but @sb-benohe, curious if you have any concerns about logging a user out and then maintaining the oauth_params so another user can login.

Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team
security engineer's approval.

Any Migrations?

Yes, there are migrations
- The migrations should be run PRIOR to the code being deployed
- The migrations should be run AFTER the code is deployed
- There is a more complicated migration plan (downtime,
  etc)
No migrations

… missing code_verifier

…ith switch account

bwang-icf · 2026-07-10T17:41:52Z

This can be followed up on in a future ticket, but I believe it would make sense to add this workflow to selenium tests.

JamesDemeryNava · 2026-07-10T20:22:03Z

adding a get_oauth_param helper to simplify param retrieval

Definitely, I will write up a ticket for that

bwang-icf

Great job!

annamontare-nava · 2026-07-13T22:31:13Z

Validation:

styling changes look good
switch account validation steps all worked

annamontare-nava · 2026-07-14T01:25:26Z

Did you hear back from @sb-benohe on the security question?

JamesDemeryNava · 2026-07-14T13:23:13Z

Did you hear back from @sb-benohe on the security question?

No

annamontare-nava

All the validation steps worked! I have some security questions that may be non-issues due to my own misunderstanding. I also think potentially we could add more tests to this.

annamontare-nava · 2026-07-14T14:19:06Z

+        ]
+        oauth_params = {}
+        for param in params:
+            oauth_params[param] = self.request.GET.get(param)


Would this work if the request method was POST?

annamontare-nava · 2026-07-14T14:58:21Z



+def get_oauth_param(request: HttpRequest, parameter: str, fallback_session_parameter: str = None) -> str | None:
+    """Resolve an OAuth parameter from GET, then session, then session['oauth_params'].


Should this handle POST too?

I looked at Splunk and I swore we were only getting GET requests on authorize endpoints, which is why I wrote it as so. Looking now, I do see some POST requests, so i'll add handling for that as a backup.

Co-authored-by: annamontare-nava <267455234+annamontare-nava@users.noreply.github.com>

JamesDemeryNava · 2026-07-14T17:17:54Z

All the validation steps worked! I have some security questions that may be non-issues due to my own misunderstanding. I also think potentially we could add more tests to this.

I'm going to write a ticket to add a Selenium test for this. What other tests do you think need to be added before this can be merged?

annamontare-nava · 2026-07-14T17:19:25Z

All the validation steps worked! I have some security questions that may be non-issues due to my own misunderstanding. I also think potentially we could add more tests to this.

I'm going to write a ticket to add a Selenium test for this. What other tests do you think need to be added before this can be merged?

I think a selenium test would cover it!

annamontare-nava · 2026-07-14T17:42:13Z

+            'code_challenge_method': CODE_CHALLENGE_METHOD_S256,
+            'code_challenge': request.session.get('oauth_params', {}).get('code_challenge'),
+            'scope': request.session.get('oauth_params', {}).get('scope'),
+            'code_verifier': request.session.get('code_verifier'),


The code_verifier shouldn't be sent on the authorization request, no?

Great catch. It doesn't come through on Postman auth requests (similar to our actual apps), but it does in testclient. So that is why it's included here, so the testclient switch account flow works. I'll leave a comment to explain that.

I think it should be set in the session, but not placed in the authorize url parameters later on.

Is there a change you are suggesting? I didn't add it to the authorize url parameters, just making it so it is retrievable after switch account is clicked for testclient.

It goes into the url parameters in line 1493 right?

JamesDemeryNava added 8 commits June 30, 2026 12:29

WIP on 4961

a177e8b

More work - postman working but not test client yet, seemingly due to…

56d508a

… missing code_verifier

Rebase and fix conflict

7ddfe0c

Continuing to try and make testclient work, postman auth flow works w…

0b95685

…ith switch account

Rebase and fix conflict

28c5fc3

Make switch account link work for testclient. Fix/add some tests

37d6f30

Remove unused code

5aae555

Cleanup tests, add a comment, add a style class

c75dba4

github-advanced-security AI found potential problems Jul 9, 2026

View reviewed changes

Comment thread apps/dot_ext/views/authorization.py Fixed

bwang-icf and others added 2 commits July 9, 2026 08:06

Merge branch 'master' into jamesdemery/bb2-4961-switch-account-link

d32f5df

Update color

c3a96cc

bwang-icf reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/dot_ext/views/authorization.py Outdated

bwang-icf reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/testclient/views.py Outdated

bwang-icf and others added 2 commits July 10, 2026 12:57

adding a get_oauth_param helper to simplify param retrieval

c118c3b

Merge branch 'master' into jamesdemery/bb2-4961-switch-account-link

c42fc29

bwang-icf and others added 2 commits July 10, 2026 15:46

cleaning up oauth_params retrieval

6a5b091

Merge branch 'master' into jamesdemery/bb2-4961-switch-account-link

517ee74

bwang-icf previously approved these changes Jul 13, 2026

View reviewed changes

jimmyfagan assigned annamontare-nava Jul 13, 2026

Merge branch 'master' into jamesdemery/bb2-4961-switch-account-link

fb67242

annamontare-nava reviewed Jul 14, 2026

View reviewed changes

Apply suggestion from @annamontare-nava

2bcf1ad

Co-authored-by: annamontare-nava <267455234+annamontare-nava@users.noreply.github.com>

JamesDemeryNava dismissed bwang-icf’s stale review via 2bcf1ad July 14, 2026 16:38

annamontare-nava reviewed Jul 14, 2026

View reviewed changes



		def get_oauth_param(request: HttpRequest, parameter: str, fallback_session_parameter: str = None) -> str \| None:
		"""Resolve an OAuth parameter from GET, then session, then session['oauth_params'].

Uh oh!

Conversation

JamesDemeryNava commented Jul 9, 2026

What Does This PR Do?

What Should Reviewers Watch For?

Validation

What Security Implications Does This PR Have?

Any Migrations?

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bwang-icf commented Jul 10, 2026

Uh oh!

JamesDemeryNava commented Jul 10, 2026

Uh oh!

bwang-icf left a comment

Choose a reason for hiding this comment

Uh oh!

annamontare-nava commented Jul 13, 2026

Uh oh!

annamontare-nava commented Jul 14, 2026

Uh oh!

JamesDemeryNava commented Jul 14, 2026

Uh oh!

annamontare-nava left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JamesDemeryNava commented Jul 14, 2026

Uh oh!

annamontare-nava commented Jul 14, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants