Update: [AEA-4652] - signature validation on prescription creation

.github/scripts/fix_cdk_json.sh

@@ -76,6 +76,7 @@ fix_string_key defaultPTLPartyKey "${DEFAULT_PTL_PARTY_KEY}"
 fix_string_key sandboxModeEnabled "${SANDBOX_MODE_ENABLED}"
 fix_boolean_number_key enableMutualTls "${ENABLE_MUTUAL_TLS}"
 fix_string_key SHA1EnabledApplicationIds "${SHA1_ENABLED_APPLICATION_IDS}"
+fix_boolean_number_key enablePrescribingSignatureValidation "${ENABLE_PRESCRIBING_SIGNATURE_VALIDATION}"
 fix_boolean_number_key desiredFhirFacadeCount "${DESIRED_FHIR_FACADE_COUNT}"
 fix_boolean_number_key forwardCsocLogs "${FORWARD_CSOC_LOGS}"
 

.github/workflows/cdk_release_code.yml

@@ -72,6 +72,9 @@ on:
       SHA1_ENABLED_APPLICATION_IDS:
         type: string
         required: true
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION:
+        type: boolean
+        required: true
       SANDBOX_MODE_ENABLED:
         type: string
         required: true
@@ -234,6 +237,7 @@ jobs:
           SANDBOX_MODE_ENABLED: "${{ inputs.SANDBOX_MODE_ENABLED }}"
           ENABLE_MUTUAL_TLS: "${{ inputs.ENABLE_MUTUAL_TLS }}"
           SHA1_ENABLED_APPLICATION_IDS: "${{ inputs.SHA1_ENABLED_APPLICATION_IDS }}"
+          ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: "${{ inputs.ENABLE_PRESCRIBING_SIGNATURE_VALIDATION }}"
           DESIRED_FHIR_FACADE_COUNT: "${{ inputs.DESIRED_FHIR_FACADE_COUNT }}"
           DESIRED_CLAIMS_COUNT: "${{ inputs.DESIRED_CLAIMS_COUNT }}"
           DESIRED_PEAK_CLAIMS_COUNT: "${{ inputs.DESIRED_PEAK_CLAIMS_COUNT }}"
@@ -373,6 +377,7 @@ jobs:
       APIGEE_ENVIRONMENT: ${{ inputs.APIGEE_ENVIRONMENT }}
       VERSION_NUMBER: ${{ inputs.VERSION_NUMBER }}
       IS_PULL_REQUEST: ${{ inputs.IS_PULL_REQUEST }}
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: ${{ inputs.ENABLE_PRESCRIBING_SIGNATURE_VALIDATION }}
       pinned_image: ${{ inputs.pinned_image }}
     secrets:
       API_CLIENT_ID: ${{ secrets.API_CLIENT_ID }}

.github/workflows/ci.yml

@@ -95,6 +95,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,babc739d-6a30-4bb1-b4b2-919c6b63c7bc,1122eb42-c783-4748-84b7-47e20446306d
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1
@@ -143,6 +144,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,babc739d-6a30-4bb1-b4b2-919c6b63c7bc,1122eb42-c783-4748-84b7-47e20446306d
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
       SANDBOX_MODE_ENABLED: 1
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1
@@ -195,6 +197,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 4515047f-fdbf-486f-bafe-dfae62482526,d3984d64-c463-4bb1-adec-ba303a8a123b
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: true
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 2
       DESIRED_CLAIMS_COUNT: 2
@@ -243,6 +246,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 5ad18b73-df45-4d41-9a1e-764d5a2b8671,8082cea1-1016-4ebf-9d80-5057c8275074
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: true
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1

.github/workflows/pull_request.yml

@@ -134,6 +134,7 @@ jobs:
       IS_PULL_REQUEST: true
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,babc739d-6a30-4bb1-b4b2-919c6b63c7bc,1122eb42-c783-4748-84b7-47e20446306d
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1
@@ -178,6 +179,7 @@ jobs:
       IS_PULL_REQUEST: true
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,babc739d-6a30-4bb1-b4b2-919c6b63c7bc,1122eb42-c783-4748-84b7-47e20446306d
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
       SANDBOX_MODE_ENABLED: 1
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1

.github/workflows/release.yml

@@ -96,6 +96,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,babc739d-6a30-4bb1-b4b2-919c6b63c7bc,1122eb42-c783-4748-84b7-47e20446306d
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1
@@ -144,6 +145,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,babc739d-6a30-4bb1-b4b2-919c6b63c7bc,1122eb42-c783-4748-84b7-47e20446306d
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
       SANDBOX_MODE_ENABLED: 1
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1
@@ -196,6 +198,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 4515047f-fdbf-486f-bafe-dfae62482526,d3984d64-c463-4bb1-adec-ba303a8a123b
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: true
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 2
       DESIRED_CLAIMS_COUNT: 2
@@ -244,6 +247,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 5ad18b73-df45-4d41-9a1e-764d5a2b8671,8082cea1-1016-4ebf-9d80-5057c8275074
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: true
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1
@@ -290,6 +294,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 5a5e8a3d-8272-4d59-985e-5b2df5c08176,b09efcba-4fa0-4cb9-8ee0-d49b43a4cc1d
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: true
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1
@@ -338,6 +343,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: unused
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
       SANDBOX_MODE_ENABLED: 1
       DESIRED_FHIR_FACADE_COUNT: 1
       DESIRED_CLAIMS_COUNT: 1
@@ -381,6 +387,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: false
       SHA1_ENABLED_APPLICATION_IDS: dbc8b146-7cb1-4a72-a4b3-767a118bdc36,875e2505-6ad5-442a-9e6c-69a299561e33,da32c882-52d4-41f7-86c2-959b15673aca
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: false
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 2
       DESIRED_CLAIMS_COUNT: 2

.github/workflows/release_ref.yml

@@ -73,6 +73,7 @@ jobs:
       IS_PULL_REQUEST: false
       ENABLE_DEFAULT_ASID_PARTY_KEY: true
       SHA1_ENABLED_APPLICATION_IDS: 4515047f-fdbf-486f-bafe-dfae62482526,d3984d64-c463-4bb1-adec-ba303a8a123b
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: true
       SANDBOX_MODE_ENABLED: 0
       DESIRED_FHIR_FACADE_COUNT: 2
       DESIRED_CLAIMS_COUNT: 2

.github/workflows/run_pact_tests.yml

@@ -12,6 +12,9 @@ on:
       IS_PULL_REQUEST:
         type: boolean
         default: false
+      ENABLE_PRESCRIBING_SIGNATURE_VALIDATION:
+        type: boolean
+        default: false
       pinned_image:
         type: string
         required: true
@@ -87,6 +90,7 @@ jobs:
           SIGNING_PRIVATE_KEY: ${{ secrets.SIGNING_PRIVATE_KEY }}
           SIGNING_CERT: ${{ secrets.SIGNING_CERT }}
           API_DEPLOYMENT_METHOD: proxygen
+          ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: ${{ inputs.ENABLE_PRESCRIBING_SIGNATURE_VALIDATION }}
 
       - name: Verify pacts
         shell: bash

.github/workflows/run_regression_tests.yml

@@ -63,11 +63,11 @@ jobs:
         run: |
           if [[ "$TARGET_ENVIRONMENT" != "prod" && "$TARGET_ENVIRONMENT" != "ref" ]]; then
             # this should be the tag of the tests you want to run
-            REGRESSION_TEST_REPO_TAG=v3.9.9
+            REGRESSION_TEST_REPO_TAG=v3.12.0
 
             # this should be the tag of the regression test workflow you want to run
             # This will normally be the same as REGRESSION_TEST_REPO_TAG
-            REGRESSION_TEST_WORKFLOW_TAG=v3.9.9
+            REGRESSION_TEST_WORKFLOW_TAG=v3.12.0
 
             # If the workflow tag doesn't start with `v`, it's a PR and we need to use the path heads, instead of refs
             # e.g. refs/heads/aea-0000-test-pr/scripts/run_regression_tests.py

.trivyignore.yaml

@@ -158,7 +158,7 @@ vulnerabilities:
   - id: CVE-2026-2229
     statement: Transitive dependency vulnerability in undici of npm
     expired_at: 2026-06-01
-  - id: CVE-2026-33036 
+  - id: CVE-2026-33036
     statement: fast-xml-parser vulnerability accepted as risk
     expired_at: 2026-06-01
   - id: CVE-2026-33180

azure/templates/run_tests.yml

@@ -114,19 +114,24 @@ steps:
           if [[ "$APIGEE_ENVIRONMENT" == *"internal-dev"* ]]; then
             API_CLIENT_ID=$(INTERNAL_DEV_CLIENT_ID)
             API_CLIENT_SECRET=$(INTERNAL_DEV_CLIENT_SECRET)
+            ENABLE_PRESCRIBING_SIGNATURE_VALIDATION=false
           elif [[ "$APIGEE_ENVIRONMENT" == *"internal-qa"* ]]; then
             API_CLIENT_ID=$(INTERNAL_QA_CLIENT_ID)
             API_CLIENT_SECRET=$(INTERNAL_QA_CLIENT_SECRET)
+            ENABLE_PRESCRIBING_SIGNATURE_VALIDATION=true
           elif [[ "$APIGEE_ENVIRONMENT" == *"int"* ]]; then
             API_CLIENT_ID=$(INT_CLIENT_ID)
             API_CLIENT_SECRET=$(INT_CLIENT_SECRET)
+            ENABLE_PRESCRIBING_SIGNATURE_VALIDATION=true
           elif [[ "$APIGEE_ENVIRONMENT" == *"ref"* ]]; then
             API_CLIENT_ID=$(REF_CLIENT_ID)
             API_CLIENT_SECRET=$(REF_CLIENT_SECRET)
+            ENABLE_PRESCRIBING_SIGNATURE_VALIDATION=true
           fi
 
           export API_CLIENT_ID
           export API_CLIENT_SECRET
+          export ENABLE_PRESCRIBING_SIGNATURE_VALIDATION
 
           export APIGEE_ACCESS_TOKEN=dummy_token
           echo "##vso[task.setvariable variable=SIGNING_PRIVATE_KEY_PATH]$SIGNING_PRIVATE_KEY_PATH"
@@ -141,6 +146,7 @@ steps:
       echo "##vso[task.setvariable variable=API_MODE]$API_MODE"
       echo "##vso[task.setvariable variable=CREATE_PACT_MAKEFILE_TARGET]$CREATE_PACT_MAKEFILE_TARGET"
       echo "##vso[task.setvariable variable=API_DEPLOYMENT_METHOD]$API_DEPLOYMENT_METHOD"
+      echo "##vso[task.setvariable variable=ENABLE_PRESCRIBING_SIGNATURE_VALIDATION]${ENABLE_PRESCRIBING_SIGNATURE_VALIDATION:-false}"
     displayName: Set PACT variables and install node dependencies
     name: setPactVariables
     condition: and(succeeded(), eq(variables['run_smoke_tests'], 'true'))
@@ -166,6 +172,7 @@ steps:
       export API_MODE=$(API_MODE)
       export CREATE_PACT_MAKEFILE_TARGET=$(CREATE_PACT_MAKEFILE_TARGET)
       export API_DEPLOYMENT_METHOD=$(API_DEPLOYMENT_METHOD)
+      export ENABLE_PRESCRIBING_SIGNATURE_VALIDATION=$(ENABLE_PRESCRIBING_SIGNATURE_VALIDATION)
 
       echo "SERVICE_ARTIFACT_NAME: ${SERVICE_ARTIFACT_NAME}"
       echo "SERVICE_BASE_PATH: ${SERVICE_BASE_PATH}"
@@ -209,6 +216,7 @@ steps:
       export API_MODE=$(API_MODE)
       export CREATE_PACT_MAKEFILE_TARGET=$(CREATE_PACT_MAKEFILE_TARGET)
       export API_DEPLOYMENT_METHOD=$(API_DEPLOYMENT_METHOD)
+      export ENABLE_PRESCRIBING_SIGNATURE_VALIDATION=$(ENABLE_PRESCRIBING_SIGNATURE_VALIDATION)
 
       make ${CREATE_PACT_MAKEFILE_TARGET}
     displayName: Create PACT tests

cdk.json

@@ -92,6 +92,7 @@
     "enableMutualTls": false,
     "trustStoreVersion": "foo",
     "SHA1EnabledApplicationIds": "",
+    "enablePrescribingSignatureValidation": false,
     "sandboxModeEnabled": "0",
     "desiredFhirFacadeCount": 1,
     "desiredClaimsCount": 1,

packages/cdk/resources/ECSTasks.ts

@@ -45,6 +45,7 @@ export interface ECSTasksProps {
   readonly coordinatorLogGroup: ILogGroup
   readonly validatorLogGroup: ILogGroup
   readonly SHA1EnabledApplicationIds: string
+  readonly enablePrescribingSignatureValidation: boolean
   readonly sandboxModeEnabled: string
   readonly cpu: number
   readonly memory: number
@@ -141,7 +142,7 @@ export class ECSTasks extends Construct {
       ],
       environment: {
         VALIDATOR_HOST: `${props.containerNamePrefix}-validator`,
-        TARGET_SPINE_SERVER:  props.targetSpineServer,
+        TARGET_SPINE_SERVER: props.targetSpineServer,
         MTLS_SPINE_CLIENT: "true",
         PRESCRIBE_ENABLED: "true",
         DISPENSE_ENABLED: "true",
@@ -160,6 +161,7 @@ export class ECSTasks extends Construct {
         DEFAULT_PTL_ASID: props.defaultPTLAsid,
         DEFAULT_PTL_PARTY_KEY: props.defaultPTLPartyKey,
         SANDBOX: props.sandboxModeEnabled,
+        ENABLE_PRESCRIBING_SIGNATURE_VALIDATION: String(props.enablePrescribingSignatureValidation),
         POLLING_DELAY: props.pollingDelay.toString()
       },
       secrets: {

packages/cdk/stacks/PrescribeDispenseStack.ts

@@ -1,5 +1,6 @@
 import {
   App,
+  CfnOutput,
   Duration,
   Environment,
   Fn,
@@ -39,11 +40,11 @@ import {
 import {LogGroup} from "aws-cdk-lib/aws-logs"
 
 export interface PrescribeDispenseStackProps extends StackProps {
-    readonly env: Environment
-    readonly serviceName: string
-    readonly stackName: string
-    readonly version: string
-  }
+  readonly env: Environment
+  readonly serviceName: string
+  readonly stackName: string
+  readonly version: string
+}
 
 export class PrescribeDispenseStack extends Stack {
 
@@ -71,6 +72,8 @@ export class PrescribeDispenseStack extends Stack {
     const trustStoreVersion: string = this.node.tryGetContext("trustStoreVersion")
     const SHA1EnabledApplicationIds: string = this.node.tryGetContext("SHA1EnabledApplicationIds")
     const sandboxModeEnabled: string = this.node.tryGetContext("sandboxModeEnabled")
+    const enablePrescribingSignatureValidation: boolean = this.node
+      .tryGetContext("enablePrescribingSignatureValidation")
     const desiredFhirFacadeCount: number = this.node.tryGetContext("desiredFhirFacadeCount")
     const desiredClaimsCount: number = this.node.tryGetContext("desiredClaimsCount")
     const desiredPeakClaimsCount: number = this.node.tryGetContext("desiredPeakClaimsCount")
@@ -164,6 +167,7 @@ export class PrescribeDispenseStack extends Stack {
       coordinatorLogGroup: logGroups.coordinatorLogGroup,
       validatorLogGroup: logGroups.validatorLogGroup,
       SHA1EnabledApplicationIds: SHA1EnabledApplicationIds,
+      enablePrescribingSignatureValidation: enablePrescribingSignatureValidation,
       sandboxModeEnabled: sandboxModeEnabled,
       cpu: serviceCpu,
       memory: serviceMemory,
@@ -197,6 +201,7 @@ export class PrescribeDispenseStack extends Stack {
       coordinatorLogGroup: logGroups.claimsCoordinatorLogGroup,
       validatorLogGroup: logGroups.claimsValidatorLogGroup,
       SHA1EnabledApplicationIds: SHA1EnabledApplicationIds,
+      enablePrescribingSignatureValidation: enablePrescribingSignatureValidation,
       sandboxModeEnabled: sandboxModeEnabled,
       cpu: serviceCpu,
       memory: serviceMemory,
@@ -394,6 +399,12 @@ export class PrescribeDispenseStack extends Stack {
       Port.tcp(containerPort),
       "Allow traffic to Claims Service from FHIR Facade load balancer"
     )
+
+    new CfnOutput(this, "EnablePrescribingSignatureValidation", {
+      value: String(enablePrescribingSignatureValidation),
+      exportName: `${props.stackName}:enablePrescribingSignatureValidation`
+    })
+
     nagSuppressions(this)
   }
 }

packages/coordinator/ecs-proxies-deploy-prod.yml

@@ -36,6 +36,8 @@ docker_service:
         value: "egress.prod.api.platform.nhs.uk:700"
       - name: SHA1_ENABLED_APPLICATION_IDS
         value: "dbc8b146-7cb1-4a72-a4b3-767a118bdc36,875e2505-6ad5-442a-9e6c-69a299561e33,da32c882-52d4-41f7-86c2-959b15673aca"
+      - name: ENABLE_PRESCRIBING_SIGNATURE_VALIDATION
+        value: "false"
     secrets:
       - name: SPINE_URL
         valueFrom: "/{{ account }}/platform-common/egress/hosts/spine-prescriptions-prod"

packages/coordinator/ecs-proxies-deploy.yml

@@ -43,6 +43,8 @@ docker_service:
       # 5a5e8a3d-8272-4d59-985e-5b2df5c08176 = int-eps-fhir-facade-sha1
       # 4515047f-fdbf-486f-bafe-dfae62482526  = ref-eps-fhir-facade-sha1
         value: "486a14ea-a0df-4f76-abac-e7d10dab8ae2,aa237a18-24af-421d-a4a8-e82474572a49,5ad18b73-df45-4d41-9a1e-764d5a2b8671,5a5e8a3d-8272-4d59-985e-5b2df5c08176,4515047f-fdbf-486f-bafe-dfae62482526"
+      - name: ENABLE_PRESCRIBING_SIGNATURE_VALIDATION
+        value: "{{ 'false' if APIGEE_ENVIRONMENT in ('internal-dev', 'internal-dev-sandbox') else 'true' }}"
     secrets:
       - name: SPINE_URL
         valueFrom: "/{{ account }}/platform-common/egress/hosts/spine-prescriptions-{{ SPINE_ENV }}"

packages/coordinator/src/routes/process.ts

@@ -9,7 +9,7 @@ import {
   handleResponse
 } from "./util"
 import {createHash} from "./create-hash"
-import {fhir} from "@models"
+import {fhir, spine} from "@models"
 import * as bundleValidator from "../services/validation/bundle-validator"
 import {
   getAsid,
@@ -19,6 +19,9 @@ import {
 } from "../utils/headers"
 import {getStatusCode} from "../utils/status-code"
 import {HashingAlgorithm} from "../services/translation/common/hashingAlgorithm"
+import {isSignatureValidationEnabled} from "../utils/feature-flags"
+import {identifyMessageType} from "../services/translation/common"
+import {verifyAndFormatPrescriptionSignature} from "../services/verification/signature-verification"
 
 export default [
   /*
@@ -49,7 +52,28 @@ export default [
       }
 
       request.logger.info("Building Spine request")
-      const spineRequest = await translator.convertBundleToSpineRequest(bundle, request.headers, request.logger)
+
+      let spineRequest: spine.SpineRequest
+      if (identifyMessageType(bundle) === fhir.EventCodingCode.PRESCRIPTION) {
+        const result = await translator.convertPrescriptionBundleToSpineRequest(
+          bundle, request.headers, request.logger
+        )
+
+        if (isSignatureValidationEnabled()) {
+          const signatureIssues = await verifyAndFormatPrescriptionSignature(
+            result.parentPrescription, request.logger, "creation"
+          )
+          if (signatureIssues.length) {
+            const response = fhir.createOperationOutcome(signatureIssues, bundle.meta?.lastUpdated)
+            return responseToolkit.response(response).code(400).type(ContentTypes.FHIR)
+          }
+        }
+
+        spineRequest = result.spineRequest
+      } else {
+        spineRequest = await translator.convertBundleToSpineRequest(bundle, request.headers, request.logger)
+      }
+
       const spineResponse = await spineClient.send(spineRequest, getAsid(request.headers), request.logger)
       return await handleResponse(request, spineResponse, responseToolkit)
     })