carin_for_blue_button_test_kit 0.14.0 → 0.15.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea990f355ce17cde4cd012adc06141cb44bf6c3c70a8bc73de0faa9d3f3c2102
-  data.tar.gz: 58e4f6efca2020589024a8cbb11959ed159f58ff00690a3d85f57fd9fea6f7c3
+  metadata.gz: 1b3cdc3b7c526f79be3e7941386187f42a15828d4ef19792aba376268fde1b8a
+  data.tar.gz: 7542f67061a8ac32bee0353d336c553d13a7fb2e58ebdcf573ed8957d9afae0b
 SHA512:
-  metadata.gz: 22e6ea91cf9494db944a339344b23c80386bbe6ccfb2ef085264467a334c98eca1905acf8ab9d9b5c604b89379816ef8f867bfaf65b62f7ba5ffd838eada51f1
-  data.tar.gz: 23fd00d94577114d623bbeef68b15ff2e121de486b24082a66eace0cb915eee51b1d34215582cfa1aad39236aff17fab4af21959532199b266ff7d65351415fb
+  metadata.gz: f6270e60778abe840346f9793143327f9fef4be1d408c317467316ca400faba3538708d66ba1e3c22a36ec6bdb3e77b2608ff03e4dfe44f3a372e8da518c7d05
+  data.tar.gz: 4265870ed675a4d105b92ffe6a861cbcb65162c847ef81c3543f5e625d01e3816e56c2523e4ee1b957d164232dfc7b598ad5e2f270e563c79bc988d5582f3ce3

data/lib/carin_for_blue_button_test_kit/capability_statement/tests/instantiates_test.rb

@@ -6,6 +6,7 @@ module CarinForBlueButtonTestKit
           This test inspects the CapabilityStatement returned by the server to
           verify that the server instantiates http://hl7.org/fhir/us/carin-bb/CapabilityStatement/c4bb
         )
+      verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@17'
 
       uses_request :capability_statement
 

data/lib/carin_for_blue_button_test_kit/capability_statement/tests/json_support_test.rb

@@ -25,6 +25,7 @@ module CarinForBlueButtonTestKit
       * application/fhir+json
     )
     uses_request :capability_statement
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@98'
 
     run do
       assert_resource_type(:capability_statement)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/c4bb_client_test_suite.rb

@@ -1,7 +1,6 @@
-require 'inferno/dsl/oauth_credentials'
 require_relative 'endpoints/resource_api_endpoint'
 require_relative 'endpoints/token_endpoint'
-require_relative 'endpoints/authorize_endpoint'
+require_relative 'endpoints/authorization_endpoint'
 require_relative 'endpoints/next_page_endpoint'
 require_relative 'endpoints/resource_id_endpoint'
 
@@ -10,8 +9,14 @@ require_relative 'mock_server'
 require_relative 'tags'
 require_relative 'collection'
 require_relative 'client_validation_test'
+require_relative 'client_options'
 
+require_relative 'client_registration_group'
 require_relative 'initial_wait_test'
+require_relative 'client_auth_smart_alca_group'
+require_relative 'client_auth_smart_alcs_group'
+require_relative 'client_auth_smart_alp_group'
+require_relative 'client_auth_udap_group'
 
 require_relative 'claim_data_request_tests/patient_claims_data_request_test'
 require_relative 'claim_data_request_tests/coverage_claims_data_request_test'
@@ -78,16 +83,50 @@ module CarinForBlueButtonTestKit
       end
     end
 
-    suite_endpoint :post, TOKEN_PATH, MockAuthorization::TokenEndpoint
-    suite_endpoint :get, AUTH_PATH, MockAuthorization::AuthorizeEndpoint
-    suite_endpoint :post, AUTH_PATH, MockAuthorization::AuthorizeEndpoint
+    suite_option  :client_type,
+                  title: 'Client Security Type',
+                  list_options: [
+                    {
+                      label: 'SMART App Launch Public Client',
+                      value: CarinClientOptions::SMART_APP_LAUNCH_PUBLIC
+                    },
+                    {
+                      label: 'SMART App Launch Confidential Symmetric Client',
+                      value: CarinClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_SYMMETRIC
+                    },
+                    {
+                      label: 'SMART App Launch Confidential Asymmetric Client',
+                      value: CarinClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_ASYMMETRIC
+                    },
+                    {
+                      label: 'UDAP Authorization Code Client',
+                      value: CarinClientOptions::UDAP_AUTHORIZATION_CODE
+                    }
+                  ]
 
-    suite_endpoint :get, PATIENT_PATH, ResourceAPIEndpoint
+    route(:get, METADATA_PATH, get_metadata)
+    route(:get, UDAPSecurityTestKit::UDAP_DISCOVERY_PATH, lambda { |_env|
+      UDAPSecurityTestKit::MockUDAPServer.udap_server_metadata(id)
+    })
+    route(:get, SMARTAppLaunch::SMART_DISCOVERY_PATH, lambda { |_env|
+      SMARTAppLaunch::MockSMARTServer.smart_server_metadata(id)
+    })
+    route(:get, SMARTAppLaunch::OIDC_DISCOVERY_PATH, ->(_env) {SMARTAppLaunch::MockSMARTServer.openid_connect_metadata(id) }) 
+    route(
+      :get,
+      SMARTAppLaunch::OIDC_JWKS_PATH,
+      ->(_env) { [200, { 'Content-Type' => 'application/json' }, [SMARTAppLaunch::OIDCJWKS.jwks_json]] }
+    )
+
+    suite_endpoint :post, UDAPSecurityTestKit::REGISTRATION_PATH,
+                    UDAPSecurityTestKit::MockUDAPServer::RegistrationEndpoint
+    suite_endpoint :post, UDAPSecurityTestKit::TOKEN_PATH, MockUdapSmartServer::TokenEndpoint
+    suite_endpoint :get,  UDAPSecurityTestKit::AUTHORIZATION_PATH, MockUdapSmartServer::AuthorizationEndpoint
+    suite_endpoint :post, UDAPSecurityTestKit::AUTHORIZATION_PATH, MockUdapSmartServer::AuthorizationEndpoint
 
+    suite_endpoint :get, PATIENT_PATH, ResourceAPIEndpoint
     suite_endpoint :get, RESOURCE_API_PATH, ResourceAPIEndpoint
-
     suite_endpoint :get, RESOURCE_ID_PATH, ResourceIDEndpoint
-
     suite_endpoint :get, BASE_FHIR_PATH, NextPageEndpoint
 
     resume_test_route :get, RESUME_CLAIMS_DATA_PATH do |request|
@@ -102,139 +141,164 @@ module CarinForBlueButtonTestKit
       C4BBV200ClientSuite.extract_token_from_query_params(request)
     end
 
-    route(:get, METADATA_PATH, get_metadata)
-    route(:get, SMART_CONFIG_PATH, carin_smart_config)
-    route(:get, JKWS_PATH, MockAuthorization.method(:jwks))
-
-    group do
-      run_as_group
-      title 'Wait for Claims Data and Search Requests'
-      description %(
-        This test will wait for the client system under test to submit requests for resources for each of the
-        [CARIN for Blue Button profiles](https://hl7.org/fhir/us/carin-bb/STU2/artifacts.html#structures-resource-profiles),
-        and for requests including all of the required search parameters for each resource type specified in the
-        [C4BB CapabilityStatement](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html) and the
-        [US Core Client CapabilityStatement](https://hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html).
-      )
-      id :c4bb_claims_data_wait_test_group
-
-      test from: :c4bb_v200_initial_wait_test
-    end
+    group from: :c4bb_v200_client_registration
 
     group do
-      title 'C4BB Patient Profile claims data and search request tests'
+      title 'Verify CARIN for Blue Button Data Access'
       description %(
-        These tests look through all the requests sent in from the client system to ensure a request was made that
-        returned a Patient resource implementing the CARIN for Blue Button [Patient profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Patient.html).
-        It will also verify that the client made a request using each required search parameter for the Patient resource
-        specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#patient)
-        and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#patient)
-        Capability Statements.
+        During these tests, the client under tests will access data from Inferno's simulated
+        CARIN for Blue Button server and then Inferno will check that the entire scope of
+        the API defined by the IG has been used.
       )
-      id :c4bb_patient_profile_test_group
-
-      test from: :patient_claims_data_request_test
-      test from: :patient_required_searches
-    end
-
-    group do
-      title 'C4BB Coverage Profile claims data and search request tests'
-      description %(
-        These tests look through all the requests sent in from the client system to ensure a request was made that
-        returned a Coverage resource implementing the CARIN for Blue Button [Coverage profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Coverage.html).
-        It will also verify that the client made a request using each required search parameter for the Coverage
-        resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#coverage)
-        and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
-        Capability Statements.
-      )
-      id :c4bb_coverage_profile_test_group
+      id :c4bb_data_access
+      run_as_group
 
-      test from: :coverage_claims_data_request_test
-      test from: :coverage_required_searches
-    end
+      group do
+        title 'Wait for Claims Data and Search Requests'
+        description %(
+          This test will wait for the client system under test to submit requests for resources for each of the
+          [CARIN for Blue Button profiles](https://hl7.org/fhir/us/carin-bb/STU2/artifacts.html#structures-resource-profiles),
+          and for requests including all of the required search parameters for each resource type specified in the
+          [C4BB CapabilityStatement](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html) and the
+          [US Core Client CapabilityStatement](https://hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html).
+        )
+        id :c4bb_claims_data_wait_test_group
+
+        test from: :c4bb_v200_initial_wait_test
+      end
 
-    group do
-      title 'C4BB Organization Profile claims data and search request tests'
-      description %(
-        These tests look through all the requests sent in from the client system to ensure a request was made that
-        returned a Organization resource implementing the CARIN for Blue Button [Organization profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Organization.html).
-        It will also verify that the client made a request using each required search parameter for the Organization
-        resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#organization)
-        and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#organization)
-        Capability Statements.
-      )
-      id :c4bb_organization_profile_test_group
-      optional
+      group do
+        title 'C4BB Patient Profile claims data and search request tests'
+        description %(
+          These tests look through all the requests sent in from the client system to ensure a request was made that
+          returned a Patient resource implementing the CARIN for Blue Button [Patient profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Patient.html).
+          It will also verify that the client made a request using each required search parameter for the Patient resource
+          specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#patient)
+          and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#patient)
+          Capability Statements.
+        )
+        id :c4bb_patient_profile_test_group
+
+        test from: :patient_claims_data_request_test
+        test from: :patient_required_searches
+      end
 
-      test from: :organization_claims_data_request_test
-      test from: :organization_required_searches
-    end
+      group do
+        title 'C4BB Coverage Profile claims data and search request tests'
+        description %(
+          These tests look through all the requests sent in from the client system to ensure a request was made that
+          returned a Coverage resource implementing the CARIN for Blue Button [Coverage profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Coverage.html).
+          It will also verify that the client made a request using each required search parameter for the Coverage
+          resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#coverage)
+          and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
+          Capability Statements.
+        )
+        id :c4bb_coverage_profile_test_group
+
+        test from: :coverage_claims_data_request_test
+        test from: :coverage_required_searches
+      end
 
-    group do
-      title 'C4BB Practitioner Profile claims data and search request tests'
-      description %(
-        These tests look through all the requests sent in from the client system to ensure a request was made that
-        returned a Practitioner resource implementing the CARIN for Blue Button [Practitioner profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Practitioner.html).
-        It will also verify that the client made a request using each required search parameter for the Practitioner
-        resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#practitioner)
-        and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#practitioner)
-        Capability Statements.
-      )
-      id :c4bb_practitioner_profile_test_group
-      optional
+      group do
+        title 'C4BB Organization Profile claims data and search request tests'
+        description %(
+          These tests look through all the requests sent in from the client system to ensure a request was made that
+          returned a Organization resource implementing the CARIN for Blue Button [Organization profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Organization.html).
+          It will also verify that the client made a request using each required search parameter for the Organization
+          resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#organization)
+          and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#organization)
+          Capability Statements.
+        )
+        id :c4bb_organization_profile_test_group
+        optional
+
+        test from: :organization_claims_data_request_test
+        test from: :organization_required_searches
+      end
 
-      test from: :practitioner_claims_data_request_test
-      test from: :practitioner_required_searches
-    end
+      group do
+        title 'C4BB Practitioner Profile claims data and search request tests'
+        description %(
+          These tests look through all the requests sent in from the client system to ensure a request was made that
+          returned a Practitioner resource implementing the CARIN for Blue Button [Practitioner profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Practitioner.html).
+          It will also verify that the client made a request using each required search parameter for the Practitioner
+          resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#practitioner)
+          and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#practitioner)
+          Capability Statements.
+        )
+        id :c4bb_practitioner_profile_test_group
+        optional
+
+        test from: :practitioner_claims_data_request_test
+        test from: :practitioner_required_searches
+      end
 
-    group do
-      title 'C4BB RelatedPerson Profile claims data and search request tests'
-      description %(
-        These tests look through all the requests sent in from the client system to ensure a request was made that
-        returned a RelatedPerson resource implementing the CARIN for Blue Button [RelatedPerson profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-RelatedPerson.html).
-        It will also verify that the client made a request using each required search parameter for the RelatedPerson
-        resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#relatedperson)
-        and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
-        Capability Statements.
-      )
-      id :c4bb_relatedperson_profile_test_group
-      optional
+      group do
+        title 'C4BB RelatedPerson Profile claims data and search request tests'
+        description %(
+          These tests look through all the requests sent in from the client system to ensure a request was made that
+          returned a RelatedPerson resource implementing the CARIN for Blue Button [RelatedPerson profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-RelatedPerson.html).
+          It will also verify that the client made a request using each required search parameter for the RelatedPerson
+          resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#relatedperson)
+          and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
+          Capability Statements.
+        )
+        id :c4bb_relatedperson_profile_test_group
+        optional
+
+        test from: :relatedperson_claims_data_request_test
+        test from: :relatedperson_required_searches
+      end
 
-      test from: :relatedperson_claims_data_request_test
-      test from: :relatedperson_required_searches
-    end
+      group do
+        title 'C4BB ExplanationOfBenefit Profiles claims data and search request tests'
+        description %(
+          These tests look through all the requests sent in from the client system to ensure a request was made that
+          returned ExplanationOfBenefit resources implementing each of the
+          CARIN for Blue Button [ExplanationOfBenefit profiles](https://hl7.org/fhir/us/carin-bb/STU2/artifacts.html#structures-resource-profiles).
+          It will also verify that the client made a request using each required search parameter for the
+          ExplanationOfBenefit resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#explanationofbenefit)
+          and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
+          Capability Statements.
+        )
+        id :c4bb_explanationofbenefit_profiles_test_group
+
+        test from: :eob_inpatient_claims_data_request_test
+        test from: :eob_outpatient_claims_data_request_test
+        test from: :eob_oral_claims_data_request_test
+        test from: :eob_pharmacy_claims_data_request_test
+        test from: :eob_professional_claims_data_request_test
+        test from: :eob_required_searches
+      end
 
-    group do
-      title 'C4BB ExplanationOfBenefit Profiles claims data and search request tests'
-      description %(
-        These tests look through all the requests sent in from the client system to ensure a request was made that
-        returned ExplanationOfBenefit resources implementing each of the
-        CARIN for Blue Button [ExplanationOfBenefit profiles](https://hl7.org/fhir/us/carin-bb/STU2/artifacts.html#structures-resource-profiles).
-        It will also verify that the client made a request using each required search parameter for the
-        ExplanationOfBenefit resource specified in the [CARIN IG for Blue Button](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html#explanationofbenefit)
-        and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
-        Capability Statements.
-      )
-      id :c4bb_explanationofbenefit_profiles_test_group
-
-      test from: :eob_inpatient_claims_data_request_test
-      test from: :eob_outpatient_claims_data_request_test
-      test from: :eob_oral_claims_data_request_test
-      test from: :eob_pharmacy_claims_data_request_test
-      test from: :eob_professional_claims_data_request_test
-      test from: :eob_required_searches
-    end
+      group do
+        run_as_group
+        title 'CARIN For Blue Button Client Attestation'
+        description %(
+          Attest that the client system under test was able to sucessfully process all of the requested resources for
+          each of the CARIN for Blue Button profiles.
+        )
+        id :c4bb_client_attestation_test_group
 
-    group do
-      run_as_group
-      title 'CARIN For Blue Button Client Attestation'
-      description %(
-        Attest that the client system under test was able to sucessfully process all of the requested resources for
-        each of the CARIN for Blue Button profiles.
-      )
-      id :c4bb_client_attestation_test_group
+        test from: :client_claims_data_attestation
+      end
 
-      test from: :client_claims_data_attestation
+      group from: :c4bb_v200_client_auth_smart_alca,
+            required_suite_options: {
+              client_type: CarinClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_ASYMMETRIC
+            }
+      group from: :c4bb_v200_client_auth_smart_alcs,
+            required_suite_options: {
+              client_type: CarinClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_SYMMETRIC
+            }
+      group from: :c4bb_v200_client_auth_smart_alp,
+            required_suite_options: {
+              client_type: CarinClientOptions::SMART_APP_LAUNCH_PUBLIC
+            }
+      group from: :c4bb_v200_client_auth_udap,
+            required_suite_options: {
+              client_type: CarinClientOptions::UDAP_AUTHORIZATION_CODE
+            }
     end
   end
 end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/client_auth_smart_alca_group.rb

@@ -0,0 +1,30 @@
+require 'smart_app_launch_test_kit'
+
+module CarinForBlueButtonTestKit
+  class C4BBV200ClientAuthSMARTConfidentialAsymmetricGroup < Inferno::TestGroup
+    id :c4bb_v200_client_auth_smart_alca
+    title 'Review Authentication Interactions'
+    description %(
+      During these tests, Inferno will verify that the client interacted with Inferno's
+      simulated SMART authorization server in a conformant manner when requesting access tokens
+      and that the client under test was able to use provided access tokens to make CARIN
+      requests.
+
+      Before running these tests, perform the Data Access group so that the client
+      will request an access token and use it on a data access request.
+    )
+    run_as_group
+
+    # smart auth verification
+    test from: :smart_client_authorization_request_verification,
+         id: :c4bb_v200_client_authorization_smart_alca_verification,
+         config: { options: { endpoint_suite_id: :c4bb_v200_client } }
+    test from: :smart_client_token_request_alca_verification,
+         id: :c4bb_v200_client_token_smart_alca_verification,
+         config: { options: { endpoint_suite_id: :c4bb_v200_client } }
+    test from: :smart_client_token_use_verification,
+          config: {
+            options: { access_request_tags: [RESOURCE_ID_TAG, RESOURCE_API_TAG] }
+          }
+  end
+end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/client_auth_smart_alcs_group.rb

@@ -0,0 +1,30 @@
+require 'smart_app_launch_test_kit'
+
+module CarinForBlueButtonTestKit
+  class C4BBV200ClientAuthSMARTConfidentialSymmetricGroup < Inferno::TestGroup
+    id :c4bb_v200_client_auth_smart_alcs
+    title 'Review Authentication Interactions'
+    description %(
+      During these tests, Inferno will verify that the client interacted with Inferno's
+      simulated SMART authorization server in a conformant manner when requesting access tokens
+      and that the client under test was able to use provided access tokens to make CARIN
+      requests.
+
+      Before running these tests, perform the Data Access group so that the client
+      will request an access token and use it on a data access request.
+    )
+    run_as_group
+
+    # smart auth verification
+    test from: :smart_client_authorization_request_verification,
+         id: :c4bb_v200_client_authorization_smart_alcs_verification,
+         config: { options: { endpoint_suite_id: :c4bb_v200_client } }
+    test from: :smart_client_token_request_alcs_verification,
+         id: :c4bb_v200_client_token_smart_alcs_verification,
+         config: { options: { endpoint_suite_id: :c4bb_v200_client } }
+    test from: :smart_client_token_use_verification,
+          config: {
+            options: { access_request_tags: [RESOURCE_ID_TAG, RESOURCE_API_TAG] }
+          }
+  end
+end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/client_auth_smart_alp_group.rb

@@ -0,0 +1,30 @@
+require 'smart_app_launch_test_kit'
+
+module CarinForBlueButtonTestKit
+  class C4BBV200ClientAuthSMARTPublicGroup < Inferno::TestGroup
+    id :c4bb_v200_client_auth_smart_alp
+    title 'Review Authentication Interactions'
+    description %(
+      During these tests, Inferno will verify that the client interacted with Inferno's
+      simulated SMART authorization server in a conformant manner when requesting access tokens
+      and that the client under test was able to use provided access tokens to make CARIN
+      requests.
+
+      Before running these tests, perform the Data Access group so that the client
+      will request an access token and use it on a data access request.
+    )
+    run_as_group
+
+    # smart auth verification
+    test from: :smart_client_authorization_request_verification,
+         id: :c4bb_v200_client_authorization_smart_alp_verification,
+         config: { options: { endpoint_suite_id: :c4bb_v200_client } }
+    test from: :smart_client_token_request_alp_verification,
+         id: :c4bb_v200_client_token_smart_alp_verification,
+         config: { options: { endpoint_suite_id: :c4bb_v200_client } }
+    test from: :smart_client_token_use_verification,
+          config: {
+            options: { access_request_tags: [RESOURCE_ID_TAG, RESOURCE_API_TAG] }
+          }
+  end
+end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/client_auth_udap_group.rb

@@ -0,0 +1,29 @@
+require 'udap_security_test_kit'
+
+module CarinForBlueButtonTestKit
+  class C4BBV200ClientAuthUDAPGroup < Inferno::TestGroup
+    id :c4bb_v200_client_auth_udap
+    title 'Review UDAP Authentication Interactions'
+    description %(
+      During these tests, Inferno will verify that the client interacted with Inferno's
+      simulated UDAP authorization server in a conformant manner when requesting access tokens
+      and that the client under test was able to use provided access tokens to make CARIN
+      requests.
+
+      Before running these tests, perform the Data Access group so that the client
+      will request an access token and use it on a data access request.
+    )
+    run_as_group
+
+    test from: :udap_client_authorization_request_verification,
+         id: :c4bb_v200_client_authorization_udap_verification,
+         config: { options: { endpoint_suite_id: :c4bb_v200_client } }
+    test from: :udap_client_token_request_ac_verification,
+         id: :c4bb_v200_client_token_udap_verification,
+         config: { options: { endpoint_suite_id: :c4bb_v200_client } }
+    test from: :udap_client_token_use_verification,
+          config: {
+            options: { access_request_tags: [RESOURCE_ID_TAG, RESOURCE_API_TAG] }
+          }
+  end
+end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/client_options.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require 'smart_app_launch_test_kit'
+require 'udap_security_test_kit'
+require_relative 'tags'
+
+module CarinForBlueButtonTestKit
+  module CarinClientOptions
+    SMART_APP_LAUNCH_PUBLIC = SMARTAppLaunch::SMARTClientOptions::SMART_APP_LAUNCH_PUBLIC
+    SMART_APP_LAUNCH_CONFIDENTIAL_SYMMETRIC =
+      SMARTAppLaunch::SMARTClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_SYMMETRIC
+    SMART_APP_LAUNCH_CONFIDENTIAL_ASYMMETRIC =
+      SMARTAppLaunch::SMARTClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_ASYMMETRIC
+    UDAP_AUTHORIZATION_CODE = 
+      UDAPSecurityTestKit::UDAPClientOptions::UDAP_AUTHORIZATION_CODE
+
+    def selected_security_ig(suite_options)
+      if suite_options[:client_type].include?(UDAPSecurityTestKit::UDAP_TAG)
+        UDAPSecurityTestKit::UDAP_TAG
+      else 
+        SMARTAppLaunch::SMART_TAG
+      end
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/client_registration/configuration_display_smart_test.rb

@@ -0,0 +1,36 @@
+require_relative '../urls'
+
+module CarinForBlueButtonTestKit
+  class C4BBV200ClientRegistrationConfigurationSMARTDisplay < Inferno::Test
+    include URLs
+
+    id :c4bb_v200_client_reg_config_smart_display
+    title 'Confirm client configuration'
+    description %(
+      This test provides all the information needed for testers to configure
+      the client under test to communicate with Inferno's simulated CARIN server
+      including SMART endpoints to obtain access tokens using the SMART App Launch flow.
+    )
+
+    input :client_id
+
+    run do
+      wait(
+        identifier: client_id,
+        message: %(
+          **Inferno Simulated Server Details**:
+
+          FHIR Base URL: `#{fhir_base_url}`
+
+          Authentication Details:
+          - SMART Client Id: `#{client_id}`
+          - Authorization endpoint: `#{authorization_url}`
+          - Token endpoint: `#{token_url}`
+
+          [Click here](#{resume_pass_url}?token=#{client_id}) once you have configured
+          the client to connect to Inferno at the above endpoints.
+        )
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/client_registration/configuration_display_udap_test.rb

@@ -0,0 +1,36 @@
+require_relative '../urls'
+
+module CarinForBlueButtonTestKit
+  class C4BBV200ClientRegistrationConfigurationUDAPDisplay < Inferno::Test
+    include URLs
+
+    id :c4bb_v200_client_reg_config_udap_display
+    title 'Confirm client configuration'
+    description %(
+      This test provides all the information needed for testers to configure
+      the client under test to communicate with Inferno's simulated CARIN server
+      including UDAP endpoints to obtain access tokens using the authorization_code flow.
+    )
+
+    input :client_id
+
+    run do
+      wait(
+        identifier: client_id,
+        message: %(
+          **Inferno Simulated Server Details**:
+
+          FHIR Base URL: `#{fhir_base_url}`
+
+          Authentication Details:
+          - UDAP Client Id: `#{client_id}`
+          - Authorization endpoint: `#{authorization_url}`
+          - Token endpoint: `#{token_url}`
+
+          [Click here](#{resume_pass_url}?token=#{client_id}) once you have configured
+          the client to connect to Inferno at the above endpoints.
+        )
+      )
+    end
+  end
+end