jimfuqian/BB2-3566 POC: A Web Client for 3rd party app

[JFU-NAVA-PBC]

JIRA Ticket:
BB2-3566

What Does This PR Do?

Create a light weight web client which can be used to let a BB2 Sandbox user i.e. who registered an account e.g.
user name: U001, email: u001@example.com with BlueButton API on Sandbox and have one or more apps created: A1, A2, A3,....

From BB2 Sandbox landing page: there is a link "MyApp" on right side of link "TestClient" see screen shot:

Click the "MyApp" link will bring up web UI page to experience the process of letting beneficiaries authorize through medicare.gov login and grant access to their claim data to the 3rd party app.

What Should Reviewers Watch For?

Try out scenarios in "Validation" section.

If you're reviewing this PR, please check for these things in particular:

Validation

Local:

1. Check out the PR to local
2. Spin up a BB2 server following readme
3. Create a user account and create apps under the user - optionally turn on DAG feature flag to use the new access grant screen, pick an app and copy its credentials (client_id, client_secret) into e.g. clipboard
4. Click "MyApp" on the top header menu bar

6. MyApp authorization start with page like below:
7.

8. paste client_id and client_secret into the fields as instructed, also add redirect URL to the app - as instructed by the on screen text.
9. Click "Authorize as a beneficiary", the familiar medicare.gov login flow starts, follow through the login and click "Connect" on data access grant page to grant access, the flow goes back to "MyApp" authorized page where you can access various data and meta data end points, like screen shot below:
10.

11. You can restart the process by clicking a in page "restart" link or click the "MyApp" link on top header menu
12. Click "TestClient" link on the top header menu will start the BB2 testclient as usual

Note, do not use TestApp creds to test the "MyApp" client on LLE, TestApp's client_secret is sensitive info.

What Security Implications Does This PR Have?

Please indicate if this PR does any of the following:

• Adds any new software dependencies
• Modifies any security controls
• Adds new transmission or storage of data
• Any other changes that could possibly affect security?

• Yes, one or more of the above security implications apply. This PR must not be merged without the ISSO or team
  security engineer's approval.

Any Migrations?

• Yes, there are migrations
  • The migrations should be run PRIOR to the code being deployed
  • The migrations should be run AFTER the code is deployed
  • There is a more complicated migration plan (downtime,
    etc)
• No migrations