Security work that
holds up in audit.

import { authorize, audit, AccessDeniedError } from "@apollo/security"
import { z } from "zod"

// Every PHI read flows through here. The audit log is the evidence.

const PHIRequest = z.object({
  patientId: z.string(),
  purpose: z.enum([
    "treatment",
    "payment",
    "operations",
  ]),
  requestedFields: z.array(z.string()),
});
export async function readPatientRecord(
  request: z.infer<typeof PHIRequest>,
  user: User,
) {
  // 1. Authorize. Returns the minimum permitted field set.
  const decision = await authorize({
    subject: user,
    action: "read",
    resource: `patient:${request.patientId}`,
    purpose: request.purpose,
  });

  if (!decision.allowed) {
    audit.log({
      event: "phi.access.denied",
      user: user.id,
      patientId: request.patientId,
      reason: decision.reason,
    });
   throw new AccessDeniedError(decision.reason);
  }

  // 2. Read only the fields the policy permits.
  const allowedFields =intersect(request.requestedFields, decision.permittedFields);
  const record =await db.patient.read(request.patientId, allowedFields);

  // 3. Emit the evidence record.
  audit.log({
    event: "phi.access.granted",
    user: user.id,
    patientId: request.patientId,
    fields: allowedFields,
    purpose: request.purpose,
  });

  return record
}