carin_for_blue_button_test_kit 0.15.0 → 0.15.1

data/lib/carin_for_blue_button_test_kit/custom_groups/v2.0.0/c4bb_smart_launch_group.rb

@@ -51,6 +51,7 @@ module CarinForBlueButtonTestKit
 
       group from: :smart_discovery do
         run_as_group
+        verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@58'
 
         test from: :c4bb_v200_smart_capabilities do
           config(
@@ -95,6 +96,14 @@ module CarinForBlueButtonTestKit
 
           * [Standalone Launch Sequence](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#standalone-launch-sequence)
         )
+        verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@1', 'hl7.fhir.us.carin-bb_2.0.0@60',
+                              'hl7.fhir.us.carin-bb_2.0.0@68', 'hl7.fhir.us.carin-bb_2.0.0@69',
+                              'hl7.fhir.us.carin-bb_2.0.0@70', 'hl7.fhir.us.carin-bb_2.0.0@71',
+                              'hl7.fhir.us.carin-bb_2.0.0@72', 'hl7.fhir.us.carin-bb_2.0.0@73',
+                              'hl7.fhir.us.carin-bb_2.0.0@74', 'hl7.fhir.us.carin-bb_2.0.0@75',
+                              'hl7.fhir.us.carin-bb_2.0.0@76', 'hl7.fhir.us.carin-bb_2.0.0@77',
+                              'hl7.fhir.us.carin-bb_2.0.0@78', 'hl7.fhir.us.carin-bb_2.0.0@79',
+                              'hl7.fhir.us.carin-bb_2.0.0@80', 'hl7.fhir.us.carin-bb_2.0.0@81'
 
         test from: :c4bb_v200_smart_scopes do
           config(

data/lib/carin_for_blue_button_test_kit/docs/carin_for_blue_button_v2.0.0_client_suite_description.md

@@ -38,49 +38,144 @@ During execution, Inferno will wait for the client under test to issue requests
 
 ### Quick Start
 
-The following input must be provided by the tester to execute
-any tests in this suite:
-1. *Client ID*: A Client ID that the client under test will use to connect to the test suite via SMART.
-   This client ID will be sent back to the client as the `Bearer` token that the client under test will send in the 
-   `Authorization` header of HTTP requests made against Inferno. Inferno uses the
-   value to identify incoming requests that belong to the testing session.
-
-The CARIN for Blue Button Patient that the client needs to request data for can be requested and searched for
-with the following information:
+Inferno's simulated payer endpoints require authentication using the OAuth flows
+conforming either to the
+- SMART [App Launch flow](https://hl7.org/fhir/smart-app-launch/STU2.2/app-launch.html), or
+- UDAP [Consumer-Facing flow](https://hl7.org/fhir/us/udap-security/STU1/consumer.html).
+
+When creating a test session, select the Client Security Type corresponding to an
+authentication approach supported by the client. Then, start by running the "Client Registration"
+group which will guide you through the registration process, including what inputs to provide. See the
+*Auth Configuration Details* section below for details. If the client is not able to use the SMART or
+UDAP protocols to obtain an access token, see the *Demonstration* section below for how to use the SMART
+or UDAP server tests to obtain an access token that the client can use.
+
+Once registration is complete, run the "Verify CARIN for Blue Button Data Access" group and Inferno will 
+wait for CARIN for Blue Button resource and search requests from the client, return the requested CARIN
+resources to the client, and verify the interaction. The CARIN for Blue Button Patient that the client
+needs to request data for can be requested and searched for with the following information:
  - **Resource ID**: 888
  - **Name**: Johnny Smith
  - **Member Identifier**: 1234-234-1243-12345678901 (system: http://inferno.healthit.gov/reference-server/r4/uniquememberidentifier)
  - **Date of Birth**: 1986-01-01
  - **Gender**: male
 
-Once the testing starts, Inferno will wait for CARIN for Blue Button resource and search requests from the client,
-return the requested CARIN resources to the client, and verify the interaction.
-
-### Sample Execution - Postman
+### Demonstration using Postman
 
 To try out these tests without a CARIN for Blue Button client implementation, you may
 run them using [this Postman collection](https://github.com/inferno-framework/carin-for-blue-button-test-kit/blob/main/config/C4BB%20Client%20Search%20Tests.postman_collection.json). This Postman collection includes all of the required CARIN for Blue Button profile resource requests and required search
 requests needed to pass all of the tests. Note that some requests within the collection (those suffixed with "(unsupported)") are expected to return a 400 status and OperationOutcome indicating failure due to current limitations on search parameter support.
 
 To run the client tests against the Postman collection:
-1. Start an Inferno session of the CARIN for Blue Button Client test suite.
-3. Click the "Run All Tests" button in the upper right and type in "SAMPLE_CLIENT_ID" for the `Client ID` input in the dialog that appears.
-4. Click the "Submit" button. The simulated server will then be waiting for an interaction.
-4. Open Postman and import the `C4BB Client Search Tests` Postman collection.
-5. Send each of the requests listed under the `C4BB Client Search Tests` Postman collection and ensure a
+1. Start an Inferno session of the CARIN for Blue Button Client test suite and choose one of the SMART options for the
+   Client Security Type.
+1. Register and obtain and access token:
+   1. In another tab, start an Inferno session for the SMART App Launch STU2.2 test suite. Select the "Demo: Run Against the SMART
+      Client Suite" preset corresponding to the authentication type you chose for the CARIN Client session in step 1.
+   1. Select the "Standalone Launch" group and click the "RUN TESTS" button, but don't run the tests yet.
+   1. Back in the CARIN test session, select the "CARIN IG for Blue Button® v2.0.0 Client Test Suite" group, click the
+      "RUN ALL TESTS" button, fill in the following inputs using the values from the SMART App Tests:
+      - **Client Id**: from the SMART tests **Client ID** input
+      - **SMART App Launch Redirect URI(s)**: from the SMART app "OAuth Redirect URI" value at the top of the input box.
+      - **FHIR User Relative Reference**: `Patient/888`
+   1. Click "SUBMIT" in the CARIN tests and when the first wait dialog appears, confirm that the client has been set up.
+   1. When the second wait dialog appears asking for CARIN requests, return to the SMART tests. Update the
+      **FHIR Endpoint** input to use the FHIR endpoint displayed in the wait dialog of the CARIN tests, taking
+      everything up to and including `/fhir`. Click "SUBMIT" and then click the link to authorize when instructed.
+      The tests should complete.
+   1. Find the `standalone_access_token` output in test **1.2.06** "Token exchange response body contains required information
+      encoded in JSON", and copy the value, which will be a ~100 character string of letters and numbers (e.g.,
+      eyJjbGllbnRfaWQiOiJzbWFydF9jbGllbnRfdGVzdF9kZW1vIiwiZXhwaXJhdGlvbiI6MTc0MzUxNDk4Mywibm9uY2UiOiJlZDI5MWIwNmZhMTE4OTc4In0).
+1. Open Postman and import the `C4BB Client Search Tests` Postman collection if not already done.
+1. Open the "Variables" tab of the collection, paste the access value obtained in the previous step into the "Current value"
+   column for the "access_token" variable and save the collection.
+1. Send each of the requests listed under the `C4BB Client Search Tests` Postman collection and ensure a
    200 response is received along with any requested CARIN for Blue Button resources.
-6. Once you have finished making requests, click the "Click here" link in the wait dialog to evaluate the requests.
-7. An attestation dialog will appear asking the client to attest that it was able to process each of the 
+1. Once you have finished making requests, click the "Click here" link in the wait dialog of the CARIN client tests to
+   evaluate the requests.
+1. An attestation dialog will appear asking the client to attest that it was able to process each of the 
    the resources it received. Click the first "Click here" link in the wait dialog to pass the test.
+1. The tests will complete and should all pass, with the possible exception of registration errors if executing on a
+   non-TLS hosted server.
+
+#### Optional Demo Modification: Tester-provided Client Id
 
-NOTE: Inferno uses the `Bearer` token sent in the `Authorization` HTTP header 
+NOTE: Inferno uses **Client Id** input and the generated bearer tokens sent in the `Authorization` HTTP header 
 to associate requests with sessions. If multiple concurrent sessions are configured
 to use the same token, they may interfere with each other. To prevent concurrent executors
-of these sample executions from disrupting your session it
-is recommended, but not required, to:
-1. When starting the tests, provide a random client id in the `Client ID` input.
-2. A wait dialog will appear for the first test to wait for incoming requests. This window provides the bearer token Inferno expects to receive in the Authorization header of incoming requests.
-3. Update the Authorization tab of the C4BB Client Search Tests collection in Postman to this provided bearer token.
+of these sample executions from disrupting your session it is recommended, but not required, to:
+1. When running the Client Registration test group, leave the **Client Id** input blank or provide your own unique or
+   random value.
+2. When the wait dialog appears for confirmation of client registration, note the indicated `Client Id` value and copy it
+   into the **Client ID** input of the SMART tests.
+
+#### Optional Demo Modification: UDAP Authentication
+
+To run the demonstration using UDAP authentication to obtain an access token, replace step 2. "Register and obtain and access token"
+with the following:
+
+1. In another tab, start an Inferno session for the UDAP Security Server test suite. Select the "Demo: Run Against the UDAP Security
+   Client Suite" preset
+1. Select the "UDAP Authorization Code Flow" group and click the "RUN TESTS" button, but don't run the tests yet.
+1. Back in the CARIN test session, select the "CARIN IG for Blue Button® v2.0.0 Client Test Suite" group,
+   click the "RUN ALL TESTS" button, and fill in the following inputs using the values from the UDAP Tests:
+   - **UDAP Client URI**: from the UDAP **Authorization Code JWT Issuer (iss) Claim** input
+1. Run the CARIN registration tests and once the wait dialog appears, copy the "FHIR server" value and put it in the
+   **FHIR Server Base URL** input of the UDAP tests.
+1. Click "SUBMIT" on the UDAP tests and then click the link to authorize when instructed. The tests should complete.
+1. Find the `udap_auth_code_flow_access_token` output in test **1.3.04** "Token exchange response body contains required information
+   encoded in JSON", and copy the value, which will be a ~100 character string of letters and numbers (e.g.,
+   eyJjbGllbnRfaWQiOiJzbWFydF9jbGllbnRfdGVzdF9kZW1vIiwiZXhwaXJhdGlvbiI6MTc0MzUxNDk4Mywibm9uY2UiOiJlZDI5MWIwNmZhMTE4OTc4In0).
+1. Return to the CARIN tests and confirm that UDAP registration has been completed and then that the client has been configured
+   to connect to Inferno. A third wait dialog will be displayed asking for CARIN data requests.
+
+The tests will pass with the possible exception of some UDAP registration details.
+
+## Input Details
+
+### Auth Configuration Details
+
+When running these tests there are 4 options for authentication, which also allows 
+Inferno to identify which session the requests are for. The choice is made when the
+session is created with the selected Client Security Type option, which determines
+what details the tester needs to provide during the Client Registration tests:
+
+- **SMART App Launch Client**: the system under test will manually register
+  with Inferno and request access tokens to use when accessing FHIR endpoints
+  as per the SMART App Luanch specification, which includes providing one or more
+  redirect URI(s) in the **SMART App Launch Redirect URI(s)** input, and optionally,
+  launch URL(s) in the **SMART App Launch URL(s)** input. Additionally, testers may provide
+  a **Client Id** if they want their client assigned a specific one. Depending on the
+  specific SMART flavor chosen, additional inputs for authentication may be needed:
+  - **SMART App Launch Public Client**: no additional authentication inputs
+  - **SMART App Launch Confidential Symmetric Client**: provide a secret using the
+    **SMART Confidential Symmetric Client Secret** input.
+  - **SMART App Launch Confidential Asymmetric Client**: provide a URL that resolves
+    to a JWKS or a raw JWKS in JSON format using the **SMART JSON Web Key Set (JWKS)** input.
+- **UDAP Authorization Code Client**: the system under test will dynamically register
+  with Inferno and request access tokens used to access FHIR endpoints
+  as per the UDAP specification. It requires the **UDAP Client URI** input
+  to be populated with the URI that the client will use when dynamically
+  registering with Inferno. This will be used to generate a client id (each
+  unique UDAP Client URI will always get the same client id). All other details
+  that Inferno needs will be provided as a part of the dynamic registration.
+
+### Inputs Controlling Token Responses
+
+Inferno's SMART simulation does not include the details needed to populate
+the token response [context data](https://hl7.org/fhir/smart-app-launch/STU2.2/scopes-and-launch-context.html)
+when requested by apps using scopes during the *SMART App Launch* flow. If the tested app
+needs and will request these details, the tester must provide them for Inferno
+to respond with using the following inputs:
+- **Launch Context**: Testers can provide a JSON
+  array for Inferno to use as the base for building a token response on. This can include
+  keys like `"patient"` when the `launch/patient` scope will be requested. Note that when keys that Inferno
+  also populates (e.g. `access_token` or `id_token`) are included, the Inferno value will be returned.
+- **FHIR User Relative Reference**: Testers
+  can provide a FHIR relative reference (`<resource type>/<id>`) for the FHIR user record
+  to return with the `id_token` when the `openid` and `fhirUser` scopes are requested.
+  If populated, ensure that the referenced resource is available in Inferno's simulated
+  FHIR server so that it can be accessed.
 
 ## Current Limitations
 
@@ -90,7 +185,18 @@ that the test kit covers and does not cover in the [Requirements Coverage](https
 CSV document.
 
 Specific current limitations to highlight include:
-   - Inferno's simulated CARIN server does not support all required search parameters on the ExplanationOfBenefit resource, including service-date, service-start-date, billable-period-start, type, and _include=ExplanationOfBenefit:insurer. Inferno recognizes searches made using those parameters and will give the client credit for having performed them, but will always return an OperationOutcome indicating failure. 
-   - Testers must manually configure their client system to connect to a specific target patient and ingest specific curated sample CARIN data. Future versions of the tests may allow more flexibility in the patient identity and the associated data.
-   - Testers must attest to their system's ability to process and retain all received information. Currently, this is implemented as a single test. Future versions of the tests may split this test out into different attestations per profile or other more fine-grained organization.
-   - This test kit contains basic SMART App Launch capabilities that may not be complete. In particular, refresh tokens are not currently supported and scopes are not precise. To provide feedback and input on the design of this feature and help us prioritize improvements, submit a ticket [here](https://github.com/inferno-framework/carin-for-blue-button-test-kit/issues).
+   - Inferno's simulated CARIN server does not support all required search parameters on the ExplanationOfBenefit resource,
+     including service-date, service-start-date, billable-period-start, type, and _include=ExplanationOfBenefit:insurer.
+     Inferno recognizes searches made using those parameters and will give the client credit for having performed them, but
+     will always return an OperationOutcome indicating failure. 
+   - Testers must manually configure their client system to connect to a specific target patient and ingest specific curated sample
+     CARIN data. Future versions of the tests may allow more flexibility in the patient identity and the associated data.
+   - Testers must attest to their system's ability to process and retain all received information. Currently, this is implemented
+     as a single test. Future versions of the tests may split this test out into different attestations per profile or other
+     more fine-grained organization.
+   - This test kit contains basic SMART App Launch and UDAP OAuth capabilities that may not be complete. In particular, Inferno will
+     echo back the scopes requested by the client and will not check that they are sufficient to grant access to the data requests
+     that it makes. To provide feedback and input on the design of this feature and help us prioritize improvements, submit a
+     ticket [here](https://github.com/inferno-framework/carin-for-blue-button-test-kit/issues).
+   - In order to access CARIN data on Inferno's simulated FHIR server, an access token must be obtained from Inferno and sent
+     within the HTTP `Authorization` header as a bearer token.

data/lib/carin_for_blue_button_test_kit/generated/v1.1.0/coverage/metadata.yml

@@ -40,14 +40,16 @@
 :must_supports:
   :extensions: []
   :slices:
-  - :name: Coverage.class:group
+  - :slice_id: Coverage.class:group
+    :slice_name: group
     :path: class
     :discriminator:
       :type: patternCodeableConcept
       :path: type
       :code: group
       :system: http://terminology.hl7.org/CodeSystem/coverage-class
-  - :name: Coverage.class:plan
+  - :slice_id: Coverage.class:plan
+    :slice_name: plan
     :path: class
     :discriminator:
       :type: patternCodeableConcept
@@ -63,14 +65,20 @@
   - :path: beneficiary
     :types:
     - Reference
+    :target_profiles:
+    - http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Patient
   - :path: relationship
   - :path: period
   - :path: payor
     :types:
     - Reference
+    :target_profiles:
+    - http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Organization
   - :path: class
-  - :path: class.value
-  - :path: class.name
+  - :path: class:group.value
+  - :path: class:group.name
+  - :path: class:plan.value
+  - :path: class:plan.name
 :mandatory_elements:
 - Coverage.meta
 - Coverage.meta.lastUpdated

data/lib/carin_for_blue_button_test_kit/generated/v1.1.0/coverage/must_support_test.rb

@@ -17,10 +17,12 @@ module CarinForBlueButtonTestKit
 
                 * Coverage.beneficiary
         * Coverage.class
-        * Coverage.class.name
-        * Coverage.class.value
         * Coverage.class:group
+        * Coverage.class:group.name
+        * Coverage.class:group.value
         * Coverage.class:plan
+        * Coverage.class:plan.name
+        * Coverage.class:plan.value
         * Coverage.identifier
         * Coverage.meta
         * Coverage.meta.lastUpdated

data/lib/carin_for_blue_button_test_kit/generated/v1.1.0/eob/metadata.yml

@@ -239,10 +239,14 @@
   - :path: patient
     :types:
     - Reference
+    :target_profiles:
+    - http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Patient
   - :path: billablePeriod
   - :path: insurer
     :types:
     - Reference
+    :target_profiles:
+    - http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Organization
   - :path: provider
     :types:
     - Reference
@@ -266,6 +270,8 @@
   - :path: insurance.coverage
     :types:
     - Reference
+    :target_profiles:
+    - http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Coverage
   - :path: item
   - :path: item.sequence
   - :path: item.noteNumber

data/lib/carin_for_blue_button_test_kit/generated/v1.1.0/eob/patient_search_test.rb

@@ -32,8 +32,12 @@ requirement of CARIN IG for Blue Button® v1.1.0.
       input :patient_ids,
         title: 'Patient IDs',
         type: 'text',
-        description: 'Comma separated list of patient IDs that in sum
-                          contain all MUST SUPPORT elements'
+        description: %q(
+          
+Comma separated list of patient IDs that in sum
+contain all MUST SUPPORT elements
+
+        )
       
       def self.properties
         @properties ||= SearchTestProperties.new(