Update to API access request feature (#1120)

* Update to API access request feature

- Do not auto approve when academic user requested API access
- Include justification in slack channel
- Show API Access Justification in User page
- Allow admin to change API access justification in User page

* update screenshot tests

Author: zhx828

screenshot-test/__baseline_snapshots__/Company User Details Page-snap.png

@@ -33,6 +33,7 @@
 import org.mskcc.cbio.oncokb.service.dto.UserDTO;
 import org.mskcc.cbio.oncokb.service.dto.UserMailsDTO;
 import org.mskcc.cbio.oncokb.service.dto.useradditionalinfo.AdditionalInfoDTO;
+import org.mskcc.cbio.oncokb.service.dto.useradditionalinfo.ApiAccessRequest;
 import org.mskcc.cbio.oncokb.service.mapper.UserMapper;
 import org.mskcc.cbio.oncokb.util.ObjectUtil;
 import org.mskcc.cbio.oncokb.util.StringUtil;
@@ -397,6 +398,20 @@ private List<LayoutBlock> buildWarningBlocks(UserDTO userDTO, Company company) {
             blocks.add(SectionBlock.builder().text(MarkdownTextObject.builder().text(text).build()).build());
         }
 
+        // Add API request info if exists
+        Optional<Boolean> apiAccessRequestedOptional = Optional.ofNullable(userDTO)
+            .map(UserDTO::getAdditionalInfo)
+            .map(AdditionalInfoDTO::getApiAccessRequest)
+            .map(ApiAccessRequest::isRequested);
+        if (apiAccessRequestedOptional.isPresent() && apiAccessRequestedOptional.get()) {
+            String apiRequestJustification = userDTO.getAdditionalInfo().getApiAccessRequest().getJustification();
+            if (apiRequestJustification.isEmpty()) {
+                apiRequestJustification = "[no justification provided]";
+            }
+            String text = ":information_source: *API Access Requested*: " + apiRequestJustification;
+            blocks.add(SectionBlock.builder().text(MarkdownTextObject.builder().text(text).build()).build());
+        }
+
         return blocks;
     }
 
@@ -405,10 +420,6 @@ private LayoutBlock buildCurrentLicense(UserDTO userDTO) {
         boolean isAcademicLicense = userDTO.getLicenseType().equals(LicenseType.ACADEMIC);
         sb.append("*" + userDTO.getLicenseType().getName() + "*" + (isAcademicLicense ? "" : " :clap:") +"\n");
 
-        boolean apiAccessRequested = userDTO.getAdditionalInfo() != null && userDTO.getAdditionalInfo().getApiAccessRequest() != null && userDTO.getAdditionalInfo().getApiAccessRequest().isRequested();
-        if (isAcademicLicense && apiAccessRequested) {
-            sb.append(":information_source: API Access\n");
-        }
         if (StringUtils.isNotEmpty(userDTO.getCompanyName())) {
             sb.append("*" + userDTO.getCompanyName() + "*");
         }

screenshot-test/__baseline_snapshots__/User Details Page-snap.png

@@ -810,7 +810,7 @@ public CompanyCandidate findCompanyCandidate(UserDTO userDTO) {
                     return new CompanyCandidate(Optional.of(company), true);
                 }
             } else if (companies.size() > 1) {
-                // If there are mutliple companies with the domain, then we find a company with a regular license.
+                // If there are multiple companies with the domain, then we find a company with a regular license.
                 Optional<Company> foundCompany = companies
                     .stream()
                     .filter(c -> {

src/main/java/org/mskcc/cbio/oncokb/service/SlackService.java

@@ -6,8 +6,8 @@
 import org.mskcc.cbio.oncokb.domain.Token;
 import org.mskcc.cbio.oncokb.domain.User;
 import org.mskcc.cbio.oncokb.domain.enumeration.LicenseStatus;
+import org.mskcc.cbio.oncokb.domain.enumeration.LicenseType;
 import org.mskcc.cbio.oncokb.repository.UserRepository;
-import org.mskcc.cbio.oncokb.security.AuthoritiesConstants;
 import org.mskcc.cbio.oncokb.security.SecurityUtils;
 import org.mskcc.cbio.oncokb.security.uuid.TokenProvider;
 import org.mskcc.cbio.oncokb.service.*;
@@ -197,13 +197,21 @@ private boolean activateUser(
             slackService.sendUserRegistrationToChannel(userDTO, userService.isUserOnTrial(userDTO), limitedCompany);
         } else {
             Company company = companyCandidate.getCompanyCandidate().get();
-            userService.updateUserWithCompanyLicense(userDTO, company, false, false);
-            // Don't send the automated approval message to slack if the company is on trial
-            // We only want a message when the user accepts the trial license agreement.
             if (company.getLicenseStatus().equals(LicenseStatus.REGULAR)) {
-                userService.approveUser(userDTO, false);
-                slackService.sendApprovedConfirmation(userDTO, company);
-                userIsActivated = true;
+                Optional<Boolean> apiRequestedOptional = Optional.ofNullable(userDTO.getAdditionalInfo())
+                    .map(AdditionalInfoDTO::getApiAccessRequest)
+                    .map(ApiAccessRequest::isRequested);
+                if (apiRequestedOptional.isPresent() && apiRequestedOptional.get() && LicenseType.ACADEMIC.equals(company.getLicenseType())) {
+                    // if user specifically asked for API access, we need to send the justification to user channel for approval
+                    slackService.sendUserRegistrationToChannel(userDTO, userService.isUserOnTrial(userDTO), company);
+                } else {
+                    // Don't send the automated approval message to slack if the company is on trial
+                    // We only want a message when the user accepts the trial license agreement.
+                    userService.updateUserWithCompanyLicense(userDTO, company, false, false);
+                    userService.approveUser(userDTO, false);
+                    slackService.sendApprovedConfirmation(userDTO, company);
+                    userIsActivated = true;
+                }
             }
         }
 

src/main/java/org/mskcc/cbio/oncokb/service/UserService.java

@@ -727,6 +727,7 @@ export enum ACCOUNT_TITLES {
   API_TOKEN = 'API Token',
   LICENSE_TYPE = 'License',
   ADDITIONAL_INFO_USE_CASE = 'Use Case',
+  ADDITIONAL_INFO_API_ACCESS_JUSTIFICATION = 'API Access Justification',
 }
 
 export enum API_CALL_STATUS {

src/main/java/org/mskcc/cbio/oncokb/web/rest/AccountResource.java

@@ -412,13 +412,30 @@ export default class UserPage extends React.Component<IUserPage> {
         ...this.user.additionalInfo,
         userCompany: updatedUserCompany,
       };
-      if (!values.authorities.includes(AUTHORITIES.API)) {
+
+      // If previously the user has API role, but in the latest, it's removed, then we will clean up the api access request
+      if (
+        this.user.authorities.includes(AUTHORITIES.API) &&
+        !values.authorities.includes(AUTHORITIES.API)
+      ) {
         updatedAdditionalInfo.apiAccessRequest = {
           requested: false,
           justification: '',
         };
       }
 
+      if (values.additionalInfoApiAccessJustification) {
+        if (updatedAdditionalInfo.apiAccessRequest) {
+          updatedAdditionalInfo.apiAccessRequest.justification =
+            values.additionalInfoApiAccessJustification;
+        } else {
+          updatedAdditionalInfo.apiAccessRequest = {
+            requested: true,
+            justification: values.additionalInfoApiAccessJustification,
+          };
+        }
+      }
+
       const updatedUser: UserDTO = {
         ...this.user,
         firstName: values.firstName,
@@ -917,6 +934,23 @@ export default class UserPage extends React.Component<IUserPage> {
                             type={'textarea'}
                             validate={LONG_TEXT_VAL}
                           />
+                          <AvField
+                            name="additionalInfoApiAccessJustification"
+                            label={
+                              <BoldAccountTitle
+                                title={
+                                  ACCOUNT_TITLES.ADDITIONAL_INFO_API_ACCESS_JUSTIFICATION
+                                }
+                              />
+                            }
+                            value={
+                              this.user.additionalInfo?.apiAccessRequest
+                                ?.justification
+                            }
+                            rows={3}
+                            type={'textarea'}
+                            validate={LONG_TEXT_VAL}
+                          />
                           <AvField
                             name="city"
                             label={