[GPCAPIM-287] Orange box

[Vox-Ben]

Description

This PR permits CDG to call the Orange Box GP Connect demonstrator

Note that it includes a call script. To call the orange box.

1. Set $STUB_PROVIDER=false in your terminal
2. make deploy
3. cd gateway-api
4. python scripts/call_gateway.py 9690937278

To revert to using the stub, repeat the above but unset STUB_PROVIDER before doing make deploy.

Context

This demonstrates that we can build a request that is acceptable to the Orange Box demonstrator for GP Connect and return the response that we get.

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming
• Exceptions/Exclusions to coding standards (e.g. #noqa or #NOSONAR) are included within this Pull Request.

---

Sensitive Information Declaration

To ensure the utmost confidentiality and protect your and others privacy, we kindly ask you to NOT including PII (Personal Identifiable Information) / PID (Personal Identifiable Data) or any other sensitive data in this PR (Pull Request) and the codebase changes. We will remove any PR that do contain any sensitive information. We really appreciate your cooperation in this matter.

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[Copilot]

Pull request overview

This PR enables the gateway-api to construct and send GP Connect Access Record Structured requests that the Orange Box GP Connect demonstrator accepts, including updated stub data to “trigger” the Orange Box path and updated JWT claim structures/validation.

Changes:

• Added stub SDS/PDS data (ODS/ASID/endpoint + patient) to route a specific NHS number to the Orange Box demonstrator.
• Updated clinical JWT claim modeling (Device/Practitioner/Organization as dict payloads) and introduced a JWTValidator with unit tests.
• Updated the GP provider client request URL path/headers and expanded error diagnostics (behind CDG_DEBUG), plus corresponding test updates and a new call script.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
gateway-api/stubs/stubs/sds/stub.py	Adds dummy ODS/ASID/device + Orange Box endpoint seed data for SDS stub responses.
gateway-api/stubs/stubs/provider/stub.py	Adds strict header + JWT validation for stubbed provider access_record_structured handling.
gateway-api/stubs/stubs/pds/stub.py	Adds a test NHS number mapping to the new Orange Box trigger patient.
gateway-api/stubs/stubs/data/patients/patients.py	Registers the new Orange Box trigger patient fixture.
gateway-api/stubs/stubs/data/patients/orange_box_trigger_9690937278.json	Adds a Patient resource used to route to Orange Box via GP ODS.
gateway-api/src/gateway_api/test_controller.py	Updates controller JWT claim assertions to match new dict-based organization claim.
gateway-api/src/gateway_api/provider/test_client.py	Updates provider client tests for new endpoint path, headers, and stub signature.
gateway-api/src/gateway_api/provider/client.py	Changes provider endpoint path handling, content-type headers, and error reporting.
gateway-api/src/gateway_api/controller.py	Updates JWT generation to use dict claim objects (Device/Practitioner/Organization).
gateway-api/src/gateway_api/conftest.py	Adds a shared valid_jwt fixture for validator/client tests.
gateway-api/src/gateway_api/common/error.py	Introduces JWTValidationError for claim validation failures.
gateway-api/src/gateway_api/common/common.py	Adds get_http_text() helper for HTTP status phrase lookup.
gateway-api/src/gateway_api/clinical_jwt/validator.py	New JWTValidator implementing claim structure/timestamp validation.
gateway-api/src/gateway_api/clinical_jwt/test_validator.py	New unit tests for JWTValidator behavior.
gateway-api/src/gateway_api/clinical_jwt/test_practitioner.py	Updates Practitioner tests to use to_dict() output.
gateway-api/src/gateway_api/clinical_jwt/test_jwt.py	Updates JWT tests for dict-based claims and default algorithm behavior.
gateway-api/src/gateway_api/clinical_jwt/test_device.py	Updates Device tests to use to_dict() output.
gateway-api/src/gateway_api/clinical_jwt/practitioner.py	Refactors Practitioner to emit structured dict payloads (no JSON string building).
gateway-api/src/gateway_api/clinical_jwt/organization.py	Adds Organization claim model emitting dict payloads.
gateway-api/src/gateway_api/clinical_jwt/jwt.py	Changes JWT claim field types to dict payloads and sets default algorithm to none.
gateway-api/src/gateway_api/clinical_jwt/device.py	Refactors Device to emit structured dict payloads (no JSON string building).
gateway-api/src/gateway_api/clinical_jwt/init.py	Exposes Organization and JWTValidator from the clinical_jwt package.
gateway-api/scripts/call_gateway.py	Adds a CLI script for calling the gateway’s getstructuredrecord endpoint.
gateway-api/poetry.lock	Updates lockfile metadata (Poetry version and content hash).
Makefile	Passes stub/debug env vars into the docker container on make deploy.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
99.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Deployment Complete

• Preview URL: https://feature-gpcapim-287-orange-box.dev.endpoints.clinical-data-gateway.national.nhs.uk — Health endpoint
  • Smoke Test: ✅ Passed (HTTP 200)
• Proxy URL: https://internal-dev.api.service.nhs.uk/clinical-data-gateway-api-poc-pr-105
• ECS Cluster: ecs-cluster
• ECS Service: pr-feature-gpcapim-287-orange-box
• ALB Target: arn:aws:elasticloadbalancing:eu-west-2:900119715266:targetgroup/gpcapim-287-orange-box/0cc545b84d290619