carin_for_blue_button_test_kit 0.13.3 → 0.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ddcfc1b502d40c9e506ac6219457d4f810ac18ce1cc520e448c4b96f609ed2d
-  data.tar.gz: 9cb13ece58d5934e9b62482594c5c2d1ef55c49ec3cad5f034db45f64c9b5156
+  metadata.gz: ea990f355ce17cde4cd012adc06141cb44bf6c3c70a8bc73de0faa9d3f3c2102
+  data.tar.gz: 58e4f6efca2020589024a8cbb11959ed159f58ff00690a3d85f57fd9fea6f7c3
 SHA512:
-  metadata.gz: a171f8af69738d3c1d85fb0ad4186ef50257f3e6fe43c01f3d4fc118bfab940e6638d480842a4160e1881334eb11435e67e6fa12524acfc2ac45fd7b7ca7f478
-  data.tar.gz: 1cb33dfb109fac99d85d2096f08d99a03dba45f43e2e62386ab62a4c5d5601222d29089e175becf7eb9ab6fddab9cfa94dfd05d69f45e4036a57cade90661099
+  metadata.gz: 22e6ea91cf9494db944a339344b23c80386bbe6ccfb2ef085264467a334c98eca1905acf8ab9d9b5c604b89379816ef8f867bfaf65b62f7ba5ffd838eada51f1
+  data.tar.gz: 23fd00d94577114d623bbeef68b15ff2e121de486b24082a66eace0cb915eee51b1d34215582cfa1aad39236aff17fab4af21959532199b266ff7d65351415fb

data/config/presets/carin_cpcds_client_ri.json

@@ -0,0 +1,12 @@
+{
+  "title": "CARIN CPCDS Reference Implementation Client",
+  "id": "carin_cpcds_client_ri_preset",
+  "test_suite_id": "c4bb_v200_client",
+  "inputs": [
+    {
+      "name": "client_id",
+      "type": "text",
+      "value": "SAMPLE_CLIENT_ID"
+    }
+  ]
+}

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/c4bb_client_test_suite.rb

@@ -1,6 +1,7 @@
 require 'inferno/dsl/oauth_credentials'
 require_relative 'endpoints/resource_api_endpoint'
 require_relative 'endpoints/token_endpoint'
+require_relative 'endpoints/authorize_endpoint'
 require_relative 'endpoints/next_page_endpoint'
 require_relative 'endpoints/resource_id_endpoint'
 
@@ -77,7 +78,9 @@ module CarinForBlueButtonTestKit
       end
     end
 
-    suite_endpoint :post, TOKEN_PATH, TokenEndpoint
+    suite_endpoint :post, TOKEN_PATH, MockAuthorization::TokenEndpoint
+    suite_endpoint :get, AUTH_PATH, MockAuthorization::AuthorizeEndpoint
+    suite_endpoint :post, AUTH_PATH, MockAuthorization::AuthorizeEndpoint
 
     suite_endpoint :get, PATIENT_PATH, ResourceAPIEndpoint
 
@@ -87,11 +90,11 @@ module CarinForBlueButtonTestKit
 
     suite_endpoint :get, BASE_FHIR_PATH, NextPageEndpoint
 
-    resume_test_route :get, RESUME_PASS_PATH do |request|
-      C4BBV200ClientSuite.extract_token_from_query_params(request)
+    resume_test_route :get, RESUME_CLAIMS_DATA_PATH do |request|
+      C4BBV200ClientSuite.extract_test_run_identifier_from_query_params(request)
     end
 
-    resume_test_route :get, RESUME_CLAIMS_DATA_PATH do |request|
+    resume_test_route :get, RESUME_PASS_PATH do |request|
       C4BBV200ClientSuite.extract_token_from_query_params(request)
     end
 
@@ -100,6 +103,8 @@ module CarinForBlueButtonTestKit
     end
 
     route(:get, METADATA_PATH, get_metadata)
+    route(:get, SMART_CONFIG_PATH, carin_smart_config)
+    route(:get, JKWS_PATH, MockAuthorization.method(:jwks))
 
     group do
       run_as_group
@@ -111,6 +116,7 @@ module CarinForBlueButtonTestKit
         [C4BB CapabilityStatement](https://hl7.org/fhir/us/carin-bb/STU2/CapabilityStatement-c4bb.html) and the
         [US Core Client CapabilityStatement](https://hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html).
       )
+      id :c4bb_claims_data_wait_test_group
 
       test from: :c4bb_v200_initial_wait_test
     end
@@ -125,6 +131,7 @@ module CarinForBlueButtonTestKit
         and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#patient)
         Capability Statements.
       )
+      id :c4bb_patient_profile_test_group
 
       test from: :patient_claims_data_request_test
       test from: :patient_required_searches
@@ -140,6 +147,7 @@ module CarinForBlueButtonTestKit
         and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
         Capability Statements.
       )
+      id :c4bb_coverage_profile_test_group
 
       test from: :coverage_claims_data_request_test
       test from: :coverage_required_searches
@@ -155,6 +163,7 @@ module CarinForBlueButtonTestKit
         and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#organization)
         Capability Statements.
       )
+      id :c4bb_organization_profile_test_group
       optional
 
       test from: :organization_claims_data_request_test
@@ -171,6 +180,7 @@ module CarinForBlueButtonTestKit
         and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html#practitioner)
         Capability Statements.
       )
+      id :c4bb_practitioner_profile_test_group
       optional
 
       test from: :practitioner_claims_data_request_test
@@ -187,6 +197,7 @@ module CarinForBlueButtonTestKit
         and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
         Capability Statements.
       )
+      id :c4bb_relatedperson_profile_test_group
       optional
 
       test from: :relatedperson_claims_data_request_test
@@ -204,6 +215,7 @@ module CarinForBlueButtonTestKit
         and the [US Core Client](https://www.hl7.org/fhir/us/core/STU3.1.1/CapabilityStatement-us-core-client.html)
         Capability Statements.
       )
+      id :c4bb_explanationofbenefit_profiles_test_group
 
       test from: :eob_inpatient_claims_data_request_test
       test from: :eob_outpatient_claims_data_request_test
@@ -220,6 +232,7 @@ module CarinForBlueButtonTestKit
         Attest that the client system under test was able to sucessfully process all of the requested resources for
         each of the CARIN for Blue Button profiles.
       )
+      id :c4bb_client_attestation_test_group
 
       test from: :client_claims_data_attestation
     end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/coverage_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is a Coverage resource
       that conforms to the CARIN for Blue Button [Coverage profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Coverage.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:Coverage)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/eob_inpatient_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is an ExplanationOfBenefit resource
       that conforms to the CARIN for Blue Button [Outpatient Institutional ExplanationOfBenefit profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-ExplanationOfBenefit-Outpatient-Institutional.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:ExplanationOfBenefit_Inpatient_Institutional)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/eob_oral_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is an ExplanationOfBenefit resource
       that conforms to the CARIN for Blue Button [Oral ExplanationOfBenefit profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-ExplanationOfBenefit-Oral.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:ExplanationOfBenefit_Oral)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/eob_outpatient_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is an ExplanationOfBenefit resource
       that conforms to the CARIN for Blue Button [Outpatient Institutional ExplanationOfBenefit profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-ExplanationOfBenefit-Outpatient-Institutional.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:ExplanationOfBenefit_Outpatient_Institutional)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/eob_pharmacy_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is an ExplanationOfBenefit resource
       that conforms to the CARIN for Blue Button [Pharmacy ExplanationOfBenefit profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-ExplanationOfBenefit-Pharmacy.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:ExplanationOfBenefit_Pharmacy)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/eob_professional_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is an ExplanationOfBenefit resource
       that conforms to the CARIN for Blue Button [Professional NonClinician ExplanationOfBenefit profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-ExplanationOfBenefit-Professional-NonClinician.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:ExplanationOfBenefit_Professional_NonClinician)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/organization_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is an Organization resource
       that conforms to the CARIN for Blue Button [Organization profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Organization.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:Organization)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/patient_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is a Patient resource
       that conforms to the CARIN for Blue Button [Patient profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Patient.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:Patient)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/practitioner_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is a Practitioner resource
       that conforms to the CARIN for Blue Button [Practitioner profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-Practitioner.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:Practitioner)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/claim_data_request_tests/relatedperson_claims_data_request_test.rb

@@ -12,7 +12,6 @@ module CarinForBlueButtonTestKit
       This test verifies that an instance returned by requests made by the client is a RelatedPerson resource
       that conforms to the CARIN for Blue Button [RelatedPerson profile](https://hl7.org/fhir/us/carin-bb/STU2/StructureDefinition-C4BB-RelatedPerson.html).
     )
-    input :access_token
 
     run do
       resources = previous_resource_requests(:RelatedPerson)

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/endpoints/authorize_endpoint.rb

@@ -0,0 +1,32 @@
+module CarinForBlueButtonTestKit
+  module MockAuthorization
+    class AuthorizeEndpoint < Inferno::DSL::SuiteEndpoint
+      def test_run_identifier
+        request.params[:client_id]
+      end
+
+      def tags
+        [AUTHORIZE_TAG]
+      end
+
+      def make_response
+        if request.params[:redirect_uri].present?
+          redirect_uri = "#{request.params[:redirect_uri]}?" \
+                         "code=#{SecureRandom.hex}&" \
+                         "state=#{request.params[:state]}"
+          response.status = 302
+          response.headers['Location'] = redirect_uri
+        else
+          response.status = 400
+          response.format = 'application/fhir+json'
+          response.body = FHIR::OperationOutcome.new(
+            issue: FHIR::OperationOutcome::Issue.new(severity: 'fatal', code: 'required',
+                                                     details: FHIR::CodeableConcept.new(
+                                                       text: 'No redirect_uri provided'
+                                                     ))
+          ).to_json
+        end
+      end
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/endpoints/next_page_endpoint.rb

@@ -1,12 +1,14 @@
 require_relative '../tags'
 require_relative '../mock_server'
+require_relative '../mock_authorization'
 
 module CarinForBlueButtonTestKit
   class NextPageEndpoint < Inferno::DSL::SuiteEndpoint
     include CarinForBlueButtonTestKit::MockServer
+    include CarinForBlueButtonTestKit::MockAuthorization
 
     def test_run_identifier
-      extract_bearer_token(request)
+      extract_client_id_from_bearer_token(request)
     end
 
     def make_response

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/endpoints/resource_api_endpoint.rb

@@ -1,14 +1,16 @@
 require_relative '../tags'
 require_relative '../mock_server'
+require_relative '../mock_authorization'
 require_relative '../client_validation_test'
 
 module CarinForBlueButtonTestKit
   class ResourceAPIEndpoint < Inferno::DSL::SuiteEndpoint
     include CarinForBlueButtonTestKit::MockServer
+    include CarinForBlueButtonTestKit::MockAuthorization
     include CarinForBlueButtonTestKit::ClientValidationTest
 
     def test_run_identifier
-      extract_bearer_token(request)
+      extract_client_id_from_bearer_token(request)
     end
 
     def make_response

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/endpoints/resource_id_endpoint.rb

@@ -1,12 +1,14 @@
 require_relative '../tags'
 require_relative '../mock_server'
+require_relative '../mock_authorization'
 
 module CarinForBlueButtonTestKit
   class ResourceIDEndpoint < Inferno::DSL::SuiteEndpoint
     include CarinForBlueButtonTestKit::MockServer
+    include CarinForBlueButtonTestKit::MockAuthorization
 
     def test_run_identifier
-      extract_bearer_token(request)
+      extract_client_id_from_bearer_token(request)
     end
 
     def make_response

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/endpoints/token_endpoint.rb

@@ -1,24 +1,80 @@
 require_relative '../tags'
+require_relative '../urls'
 require_relative '../mock_server'
+require_relative '../mock_authorization'
 
 module CarinForBlueButtonTestKit
-  class TokenEndpoint < Inferno::DSL::SuiteEndpoint
-    include CarinForBlueButtonTestKit::MockServer
+  module MockAuthorization
+    CARIN_PATIENT_ID = '888'.freeze # Must exist on the FHIR_REFERENCE_SERVER (env var)
 
-    def test_run_identifier
-      extract_client_id(request)
-    end
+    class TokenEndpoint < Inferno::DSL::SuiteEndpoint
+      include CarinForBlueButtonTestKit::MockServer
 
-    def make_response
-      token_response(request)
-    end
+      def test_run_identifier
+        extract_client_id
+      end
 
-    def tags
-      [AUTH_TAG]
-    end
+      def tags
+        [TOKEN_TAG]
+      end
+
+      def make_response
+        client_id = extract_client_id
+        access_token = JWT.encode({ inferno_client_id: client_id }, nil, 'none')
+        granted_scopes = SUPPORTED_SCOPES & requested_scopes
+
+        response_hash = { access_token:, scope: granted_scopes.join(' '), token_type: 'bearer',
+                          expires_in: 3600 }
+
+        response_hash.merge!(patient: CARIN_PATIENT_ID)
+
+        response.body = response_hash.to_json
+        response.headers['Cache-Control'] = 'no-store'
+        response.headers['Pragma'] = 'no-cache'
+        response.status = 200
+      end
+
+      private
+
+      def extract_client_id
+        # Public client            || confidential client asymmetric          || confidential client symmetric
+        request.params[:client_id] || extract_client_id_from_client_assertion || extract_client_id_from_basic_auth
+      end
+
+      def extract_client_id_from_client_assertion
+        encoded_jwt = request.params[:client_assertion]
+        return unless encoded_jwt.present?
+
+        jwt_payload =
+          begin
+            JWT.decode(encoded_jwt, nil, false)&.first # skip signature verification
+          rescue StandardError
+            nil
+          end
+
+        jwt_payload['iss'] || jwt_payload['sub'] if jwt_payload.present?
+      end
+
+      def extract_client_id_from_basic_auth
+        encoded_credentials = request.headers['authorization']&.delete_prefix('Basic ')
+        return unless encoded_credentials.present?
+
+        decoded_credentials = Base64.decode64(encoded_credentials)
+        decoded_credentials&.split(':')&.first
+      end
+
+      def requested_scopes
+        auth_request = requests_repo.tagged_requests(result.test_session_id, [AUTHORIZE_TAG]).last
+        return [] unless auth_request
 
-    def update_result
-      results_repo.update(result.id, result: 'pass') unless test.config.options[:accepts_multiple_requests]
+        auth_params = if auth_request.verb.downcase == 'get'
+                        auth_request.query_parameters
+                      else
+                        URI.decode_www_form(auth_request.request_body)&.to_h
+                      end
+        scope_str = auth_params&.dig('scope')
+        scope_str ? URI.decode_www_form_component(scope_str).split : []
+      end
     end
   end
 end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/initial_wait_test.rb

@@ -8,14 +8,44 @@ module CarinForBlueButtonTestKit
     description %(
       This test will receive claims data requests and search requests until the user confirms they are done.
     )
-    input :access_token
+    input :client_id,
+          title: 'Client ID',
+          description: %(
+            Enter the client ID you will use to connect to this CARIN server via a SMART launch.
+          )
+
     config options: { accepts_multiple_requests: true }
 
+    def example_client_jwt_payload_part
+      Base64.strict_encode64({ inferno_client_id: client_id }.to_json).delete('=')
+    end
+
     run do
       wait(
-        identifier: access_token,
+        identifier: client_id,
         message: %(
-          Access Token: #{access_token} \n
+          ### SMART App Launch
+
+          You may connect to the Inferno CARIN client test server via
+          [SMART App Launch](https://hl7.org/fhir/smart-app-launch/STU2/app-launch.html).
+          Perform the following steps:
+            1. Perform a [Standalone Launch](https://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#step-2-launch-standalone)
+            2. Retrieve .well-known/smart-configuration: `#{smart_configuration_url}`
+            3. Obtain authorization code: `#{authorization_url}`
+            4. Obtain access token: `#{token_url}`
+            5. Access FHIR API
+
+          ### Request Identification
+
+          In order to identify requests for this session, Inferno will look for
+          an `Authorization` header with value:
+
+          ```
+          Bearer eyJhbGciOiJub25lIn0.#{example_client_jwt_payload_part}.
+          ```
+
+          ### FHIR API
+
           Submit CARIN requests via the following method:
           * Single Resource API: `#{submit_url}?:search_params`, with `:endpoint` replaced with the endpoint you want
           to reach and `:search_params` replaced with the search parameters for the request.
@@ -67,7 +97,8 @@ module CarinForBlueButtonTestKit
                 * ExplanationOfBenefit:payee
                 * ExplanationOfBenefit:*
 
-          [Click here](#{resume_claims_data_url}?token=#{access_token}) when done.
+
+          [Click here](#{resume_claims_data_url}?test_run_identifier=#{client_id}) when done.
         ),
         timeout: 900
       )

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/metadata/{mock_capability_statement.json → mock_capability_statement.json.erb}

@@ -23,6 +23,34 @@
     {
       "mode": "server",
       "documentation": "The C4BB  Server **SHALL**:\n\n1. Support all profiles defined in this Implementation Guide..\n2.  Implement the RESTful behavior according to the FHIR specification.\n3. Return the following response classes:\n   - (Status 400): invalid parameter\n   - (Status 401/4xx): unauthorized request\n   - (Status 403): insufficient scope\n   - (Status 404): unknown resource\n   - (Status 410): deleted resource.\n4. Support json source formats for all CARIN-BB interactions.\n5. Identify the CARIN-BB  profiles supported as part of the FHIR `meta.profile` attribute for each instance.\n6. Support the searchParameters on each profile  individually and in combination.\n\nThe C4BB  Server **SHOULD**:\n\n1. Support xml source formats for all C4BB interactions.\n",
+      "security": {
+        "extension": [
+            {
+                "url": "http://fhir-registry.smarthealthit.org/StructureDefinition/oauth-uris",
+                "extension": [
+                    {
+                        "url": "token",
+                        "valueUri": "<%= Inferno::Application['base_url']  %>/custom/c4bb_v200_client/mock_auth/token"
+                    },
+                    {
+                        "url": "authorize",
+                        "valueUri": "<%= Inferno::Application['base_url']  %>/custom/c4bb_v200_client/mock_auth/authorization"
+                    }
+                ]
+            }
+        ],
+        "service": [
+            {
+                "coding": [
+                    {
+                        "system": "http://terminology.hl7.org/CodeSystem/restful-security-service",
+                        "code": "SMART-on-FHIR"
+                    }
+                ],
+                "text": "OAuth2 using SMART-on-FHIR profile (see http://docs.smarthealthit.org)"
+            }
+        ]
+      },
       "resource": [
         {
           "extension": [

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/mock_authorization.rb

@@ -0,0 +1,35 @@
+module CarinForBlueButtonTestKit
+  module MockAuthorization
+    RSA_PRIVATE_KEY = OpenSSL::PKey::RSA.generate(2048)
+    RSA_PUBLIC_KEY = RSA_PRIVATE_KEY.public_key
+
+    module_function
+
+    def extract_client_id_from_bearer_token(request)
+      token = request.headers['authorization']&.delete_prefix('Bearer ')
+      jwt =
+        begin
+          JWT.decode(token, nil, false)
+        rescue StandardError
+          nil
+        end
+      jwt&.first&.dig('inferno_client_id')
+    end
+
+    def jwks(_env)
+      response_body = {
+        keys: [
+          {
+            kty: 'RSA',
+            alg: 'RS256',
+            n: Base64.urlsafe_encode64(RSA_PUBLIC_KEY.n.to_s(2), padding: false),
+            e: Base64.urlsafe_encode64(RSA_PUBLIC_KEY.e.to_s(2), padding: false),
+            use: 'sig'
+          }
+        ]
+      }.to_json
+
+      [200, { 'Content-Type' => 'application/json' }, [response_body]]
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/mock_server.rb

@@ -2,7 +2,6 @@ require_relative 'user_input_response'
 require_relative 'urls'
 require_relative 'collection'
 require_relative 'client_validation_test'
-# require_relative 'metadata/mock_capability_statement'
 
 module CarinForBlueButtonTestKit
   # Serve responses to CARIN requests
@@ -13,6 +12,8 @@ module CarinForBlueButtonTestKit
   module MockServer
     include URLs
 
+    SUPPORTED_SCOPES = ['launch', 'patient/*.rs', 'user/*.rs', 'offline_access'].freeze
+
     def server_proxy
       @server_proxy ||= Faraday.new(
         url: ENV.fetch('FHIR_REFERENCE_SERVER'),
@@ -25,12 +26,6 @@ module CarinForBlueButtonTestKit
       end
     end
 
-    def token_response(request, _test = nil, _test_result = nil)
-      # Placeholder for a more complete mock token endpoint
-      response.body = { access_token: SecureRandom.hex, token_type: 'bearer', expires_in: 300 }.to_json
-      response.status = 200
-    end
-
     def error_response_resource(request)
       server_response = server_proxy.get('Patient', { _id: 888 })
       response_resource = FHIR.from_contents(server_response.body)
@@ -97,9 +92,43 @@ module CarinForBlueButtonTestKit
     end
 
     def get_metadata
+      erb_template = ERB.new(
+        File.read(
+          File.join(__dir__,
+                    'metadata/mock_capability_statement.json.erb')
+        )
+      )
+      capability_statement = JSON.parse(erb_template.result).to_json
+
       proc {
         [200, { 'Content-Type' => 'application/fhir+json;charset=utf-8' },
-         [File.read('lib/carin_for_blue_button_test_kit/client/v2.0.0/metadata/mock_capability_statement.json')]]
+         [capability_statement]]
+      }
+    end
+
+    def carin_smart_config
+      response_body =
+        {
+          authorization_endpoint: authorization_url,
+          token_endpoint: token_url,
+          token_endpoint_auth_methods_supported: ['private_key_jwt'],
+          token_endpoint_auth_signing_alg_values_supported: ['RS256'],
+          grant_types_supported: ['authorization_code'],
+          scopes_supported: SUPPORTED_SCOPES,
+          response_types_supported: ['code'],
+          code_challenge_methods_supported: ['S256'],
+          capabilities: [
+            'launch-ehr',
+            'permission-patient',
+            'permission-user',
+            'client-public',
+            'client-confidential-symmetric',
+            'client-confidential-asymmetric'
+          ]
+        }.to_json
+
+      proc {
+        [200, { 'Content-Type' => 'application/json' }, [response_body]]
       }
     end
 
@@ -137,6 +166,10 @@ module CarinForBlueButtonTestKit
       request.query_parameters['token']
     end
 
+    def extract_test_run_identifier_from_query_params(request)
+      request.query_parameters['test_run_identifier']
+    end
+
     # Pull resource type from url
     # e.g. http://example.org/fhir/Patient?_id=123 -> Patient
     # @private
@@ -156,7 +189,8 @@ module CarinForBlueButtonTestKit
 
     def mock_operation_outcome_resource
       FHIR.from_contents(File.read(
-                           'lib/carin_for_blue_button_test_kit/client/v2.0.0/metadata/mock_operation_outcome_resource.json'
+                           File.join(__dir__,
+                                     'metadata/mock_operation_outcome_resource.json')
                          ))
     end
 

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/required_searches_tests/coverage_required_searches.rb

@@ -17,7 +17,6 @@ module CarinForBlueButtonTestKit
         * _id
         * patient
     )
-    input :access_token
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@14'
 

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/required_searches_tests/eob_required_searches.rb

@@ -31,7 +31,6 @@ module CarinForBlueButtonTestKit
           * ExplanationOfBenefit:payee
           * ExplanationOfBenefit:*
     )
-    input :access_token
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@14'
 

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/required_searches_tests/organization_required_searches.rb

@@ -18,7 +18,6 @@ module CarinForBlueButtonTestKit
         * name
         * address
     )
-    input :access_token
 
     verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@14'