davinci_crd_test_kit 0.11.1 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 970eb61c1075868a3d84497e1765c2b67c02a8bf61e0005fe0700c4df15984cb
-  data.tar.gz: 799e551ca2d70bf6ca6ffb539ebd8832ec638c04cdfcc5b3206e58df42d7a86f
+  metadata.gz: e7aa24c2a8102e8bed59aa0048f99c0ef46a75b0f6d1019c089929a73ee72415
+  data.tar.gz: ccd3b902a0daff447d42331458c5951f383ce59515d00504f6abb02e63c00342
 SHA512:
-  metadata.gz: 854c86c38eacd5cca3c40253da23625f9597b317a09ab406e341930a1571018364bca1bc6b61237862b5019491ffb9ac231de11f7bfe17021819a7d68a21f9ef
-  data.tar.gz: 7f8d00e32b5b10a3fd89f15e1e3eff2369c7fd52e58caf065d47778e19eb509244f36ca385bd1435032f0b96d94e285a9ea754b94b6cce582619c25be5e07d81
+  metadata.gz: faa55e1274867c584dec2c5e3c6522b13590c41342eb1e55691e5f5f78ce1208b2d4df7674b0ef1e7ba23ab6bc22ce1226f283ca9c0cc1583d61e668ef80a56d
+  data.tar.gz: 1b0d2526904aaf5138cf12d131e7fd769ca05652fb542d0139e9f93abce996edd929336c8f786639cea54bbda75b3c8ae67783ea5bf494a0e182ddde4eab092c

data/config/presets/inferno_crd_server_suite.json.erb

@@ -4,11 +4,16 @@
   "test_suite_id": "crd_client",
   "inputs": [
     {
-      "name": "iss",
+      "name": "cds_jwt_iss",
       "title": "URI of the issuer of the JWT used to authorize CDS Hooks calls",
       "type": "text",
       "value": "<%= Inferno::Application['base_url'] %>/custom/crd_server"
     },
+    {
+      "name": "cds_jwk_set",
+      "type": "textarea",
+      "value": "<%= Inferno::Application['base_url'] %>/custom/crd_server/jwks.json"
+    },
     {
       "name": "url",
       "description": "URL of the FHIR endpoint used by SMART applications",
@@ -17,34 +22,16 @@
       "value": "<%= ENV.fetch('INFERNO_REFERENCE_SERVER_URI', 'https://inferno-qa.healthit.gov') %>/reference-server/r4"
     },
     {
-      "name": "ehr_smart_credentials",
+      "name": "smart_auth_info",
       "optional": true,
       "title": "OAuth Credentials",
-      "type": "oauth_credentials",
+      "type": "auth_info",
       "value": {
+        "auth_type": "public",
         "access_token": "SAMPLE_TOKEN",
-        "refresh_token": "",
-        "expires_in": "",
-        "client_id": "",
-        "client_secret": "",
-        "token_url": ""
+        "client_id": "SAMPLE_PUBLIC_CLIENT_ID"
       }
     },
-    {
-      "name": "ehr_client_id",
-      "description": "Client ID provided during registration of Inferno as an EHR launch application",
-      "title": "EHR Launch Client ID",
-      "type": "text",
-      "value": "SAMPLE_PUBLIC_CLIENT_ID"
-    },
-    {
-      "name": "ehr_requested_scopes",
-      "default": "launch openid fhirUser offline_access user/*.rs",
-      "description": "OAuth 2.0 scope provided by system to enable all required functionality",
-      "title": "EHR Launch Scope",
-      "type": "textarea",
-      "value": "launch openid fhirUser offline_access user/*.rs"
-    },
     {
       "name": "patient_ids",
       "description": "Comma separated list of Patient IDs that in sum contain all MUST SUPPORT elements",

data/config/presets/ri_crd_request_generator.json.erb

@@ -4,7 +4,7 @@
   "test_suite_id": "crd_client",
   "inputs": [
     {
-      "name": "iss",
+      "name": "cds_jwt_iss",
       "title": "URI of the issuer of the JWT used to authorize CDS Hooks calls",
       "type": "text",
       "value": "<%= ENV.fetch('RI_CRD_REQUEST_GENERATOR_URI', 'https://crd-test.davinci.hl7.org') %>/test-ehr/r4"

data/lib/davinci_crd_test_kit/client_fhir_api_group.rb

@@ -41,6 +41,27 @@ module DaVinciCRDTestKit
         server with Inferno so that Inferno may access resources on the FHIR server in order to perform the FHIR RESTful
         Capabilities tests.
       )
+      verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@64', 'hl7.fhir.us.davinci-crd_2.0.1@65',
+                            'hl7.fhir.us.davinci-crd_2.0.1@66', 'hl7.fhir.us.davinci-crd_2.0.1@89',
+                            'hl7.fhir.us.davinci-crd_2.0.1@92'
+
+      config(
+        inputs: {
+          smart_auth_info: {
+            name: :smart_auth_info,
+            title: 'EHR Launch Credentials',
+            options: {
+              mode: 'auth',
+              components: [
+                Inferno::DSL::AuthInfo.default_auth_type_component_without_backend_services
+              ]
+            }
+          }
+        },
+        outputs: {
+          smart_auth_info: { name: :smart_auth_info }
+        }
+      )
 
       group from: :smart_discovery do
         required_suite_options CRDOptions::SMART_1_REQUIREMENT
@@ -107,11 +128,7 @@ module DaVinciCRDTestKit
         optional
         config(
           inputs: {
-            id_token: { name: :ehr_id_token },
-            client_id: { name: :ehr_client_id },
-            requested_scopes: { name: :ehr_requested_scopes },
-            access_token: { name: :ehr_access_token },
-            smart_credentials: { name: :ehr_smart_credentials }
+            id_token: { name: :ehr_id_token }
           }
         )
       end
@@ -121,9 +138,6 @@ module DaVinciCRDTestKit
         optional
         config(
           inputs: {
-            refresh_token: { name: :ehr_refresh_token },
-            client_id: { name: :ehr_client_id },
-            client_secret: { name: :ehr_client_secret },
             received_scopes: { name: :ehr_received_scopes }
           }
         )
@@ -157,15 +171,18 @@ module DaVinciCRDTestKit
           * [Task](https://hl7.org/fhir/us/davinci-crd/STU2/CapabilityStatement-crd-client.html#Task1-16)
           * [VisionPrescription](https://hl7.org/fhir/us/davinci-crd/STU2/CapabilityStatement-crd-client.html#VisionPrescription1-17)
       )
+      verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@43'
+
       input :url
-      input :ehr_smart_credentials,
-            type: :oauth_credentials,
+      input :smart_auth_info,
+            type: :auth_info,
             title: 'OAuth Credentials',
+            options: { mode: 'access' },
             optional: true
 
       fhir_client do
         url :url
-        oauth_credentials :ehr_smart_credentials
+        auth_info :smart_auth_info
       end
 
       group do
@@ -206,6 +223,7 @@ module DaVinciCRDTestKit
           Resource Conformance: SHOULD
         )
         optional
+        verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@150'
 
         test from: :crd_client_fhir_api_update_test,
              optional: true,
@@ -227,8 +245,8 @@ module DaVinciCRDTestKit
           validate any returned resources against the [CRD Coverage profile](https://hl7.org/fhir/us/davinci-crd/STU2/StructureDefinition-profile-coverage.html)
 
           Required Coverage resource FHIR interactions:
-            * SHALL suport search by [`patient`](http://hl7.org/fhir/R4/coverage.html#search)
-            * SHALL suport search by [`status`](http://hl7.org/fhir/R4/coverage.html#search)
+            * SHALL support search by [`patient`](http://hl7.org/fhir/R4/coverage.html#search)
+            * SHALL support search by [`status`](http://hl7.org/fhir/R4/coverage.html#search)
 
           Resource Conformance: SHALL
         )
@@ -305,6 +323,7 @@ module DaVinciCRDTestKit
           Resource Conformance: SHOULD
         )
         optional
+        verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@150'
 
         test from: :crd_client_fhir_api_update_test,
              optional: true,
@@ -582,6 +601,7 @@ module DaVinciCRDTestKit
           Resource Conformance: SHOULD
         )
         optional
+        verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@150'
 
         test from: :crd_client_fhir_api_update_test,
              optional: true,
@@ -608,6 +628,7 @@ module DaVinciCRDTestKit
           Resource Conformance: SHOULD
         )
         optional
+        verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@150'
 
         test from: :crd_client_fhir_api_update_test,
              optional: true,
@@ -666,6 +687,7 @@ module DaVinciCRDTestKit
           Resource Conformance: SHOULD
         )
         optional
+        verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@150'
 
         test from: :crd_client_fhir_api_update_test,
              optional: true,
@@ -744,6 +766,7 @@ module DaVinciCRDTestKit
           Resource Conformance: SHOULD
         )
         optional
+        verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@150'
 
         test from: :crd_client_fhir_api_update_test,
              optional: true,

data/lib/davinci_crd_test_kit/client_hooks_group.rb

@@ -41,11 +41,18 @@ module DaVinciCRDTestKit
         the patient provided in the service request.
     DESCRIPTION
     id :crd_client_hooks
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@149'
 
-    input :iss,
-          title: 'JWT Issuer',
-          description: 'The `iss` claim of the JWT in the Authorization header ' \
-                       'will be used to associate incoming requests with this test session'
+    input :cds_jwt_iss,
+          title: 'CRD JWT Issuer',
+          description: %(
+            Value of the `iss` claim that must be sent on the Bearer token in the `Authorization`
+            header of all requests. Run or re-run the **Client Registration** group to set or
+            change this value.
+          ),
+          locked: true
+
+    input_order :cds_jwt_iss, :cds_jwk_set
 
     group from: :crd_client_appointment_book,
           optional: true

data/lib/davinci_crd_test_kit/client_registration_group.rb

@@ -0,0 +1,26 @@
+require_relative 'client_tests/client_registration_verification_test'
+
+module DaVinciCRDTestKit
+  class PASClientRegistrationGroup < Inferno::TestGroup
+    id :crd_client_registration
+    title 'Client Registration'
+    description %(
+        Register the CRD client under test with Inferno's simulated CRD Server by
+        providing required information for Inferno to use in identifying and verify
+        hook requests.
+
+        Testers will be required to provide:
+        1. The `iss` URI that uniquely identifies this CRD client to Inferno.
+        2. The CRD client's JSON Web Key (JWK) Set in the form of either a URL
+           that resolves to a valid JWK Set or the literal JWK Set in JSON form.
+
+        Inferno will verify these values and use them for the remainder of the tests.
+        These tests must be run before any other tests as they represent the registration
+        of the client under test with the Inferno service. If the client needs to make a
+        change to its registered values during execution, this test will need to be re-run.
+      )
+    run_as_group
+
+    test from: :crd_client_registration_verification
+  end
+end

data/lib/davinci_crd_test_kit/client_tests/appointment_book_receive_request_test.rb

@@ -14,8 +14,18 @@ module DaVinciCRDTestKit
         level of detail provided is insufficient to determine coverage.
       )
     config options: { accepts_multiple_requests: true }
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@164', 'hl7.fhir.us.davinci-crd_2.0.1@171',
+                          'hl7.fhir.us.davinci-crd_2.0.1@183', 'hl7.fhir.us.davinci-crd_2.0.1@243',
+                          'hl7.fhir.us.davinci-crd_2.0.1@244', 'hl7.fhir.us.davinci-crd_2.0.1@245'
 
-    input :iss
+    input :cds_jwt_iss,
+          title: 'CRD JWT Issuer',
+          description: %(
+            Value of the `iss` claim that must be sent on the Bearer token in the `Authorization`
+            header of all requests. Run or re-run the **Client Registration** group to set or
+            change this value.
+          ),
+          locked: true
     input :appointment_book_selected_response_types,
           title: 'Response types to return from appointment-book hook requests',
           description: %(
@@ -64,7 +74,7 @@ module DaVinciCRDTestKit
 
     run do
       wait(
-        identifier: "appointment-book #{iss}",
+        identifier: "appointment-book #{cds_jwt_iss}",
         message: %(
           **Appointment Book CDS Service Test**:
 
@@ -74,7 +84,8 @@ module DaVinciCRDTestKit
 
           Inferno will process the requests and return CDS cards if successful.
 
-          [Click here](#{resume_pass_url}?token=appointment-book%20#{iss}) when you have finished submitting requests.
+          [Click here](#{resume_pass_url}?token=appointment-book%20#{cds_jwt_iss}) when you have finished
+          submitting requests.
         )
       )
     end

data/lib/davinci_crd_test_kit/client_tests/client_appointment_book_group.rb

@@ -25,9 +25,12 @@ module DaVinciCRDTestKit
 
       This version of the CRD implementation guide refers to version 1.0 of the hook.
     DESCRIPTION
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@172'
 
     run_as_group
 
+    input_order :cds_jwt_iss, :cds_jwk_set
+
     config(
       inputs: {
         auth_token_headers_json: { name: :appointment_book_auth_token_headers_json },
@@ -63,7 +66,9 @@ module DaVinciCRDTestKit
     test from: :crd_token_payload
     test from: :crd_hook_request_required_fields
     test from: :crd_hook_request_optional_fields
-    test from: :crd_hook_request_valid_context
+    test from: :crd_hook_request_valid_context do
+      verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@71', 'hl7.fhir.us.davinci-crd_2.0.1@286'
+    end
     test from: :crd_hook_request_valid_prefetch
     test from: :crd_card_display_attest_test
   end

data/lib/davinci_crd_test_kit/client_tests/client_encounter_discharge_group.rb

@@ -29,6 +29,8 @@ module DaVinciCRDTestKit
 
     run_as_group
 
+    input_order :cds_jwt_iss, :cds_jwk_set
+
     config(
       inputs: {
         auth_token_headers_json: { name: :encounter_discharge_auth_token_headers_json },

data/lib/davinci_crd_test_kit/client_tests/client_encounter_start_group.rb

@@ -25,9 +25,12 @@ module DaVinciCRDTestKit
 
       This version of the CRD implementation guide refers to version 1.0 of the hook.
     DESCRIPTION
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@187'
 
     run_as_group
 
+    input_order :cds_jwt_iss, :cds_jwk_set
+
     config(
       inputs: {
         auth_token_headers_json: { name: :encounter_start_auth_token_headers_json },

data/lib/davinci_crd_test_kit/client_tests/client_fhir_api_create_test.rb

@@ -6,6 +6,7 @@ module DaVinciCRDTestKit
         Verify that the CRD client supports the create interaction for the given resource. The capabilities required
         by each resource can be found here: https://hl7.org/fhir/us/davinci-crd/CapabilityStatement-crd-client.html#resourcesSummary1
       )
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@74'
 
     input :create_resources,
           type: 'textarea',

data/lib/davinci_crd_test_kit/client_tests/client_fhir_api_search_test.rb

@@ -24,7 +24,7 @@ module DaVinciCRDTestKit
       ['organization_include', 'practitioner_include', 'location_include']
     end
 
-    def reference_search_paramaters
+    def reference_search_parameters
       ['organization', 'practitioner', 'patient']
     end
 
@@ -209,7 +209,7 @@ module DaVinciCRDTestKit
           if search_type == '_id'
             bundle = perform_fhir_search({ _id: search_id }, [resource_type, 'id_search'])
             id_search_result_check(bundle, search_id)
-          elsif reference_search_paramaters.include?(search_type)
+          elsif reference_search_parameters.include?(search_type)
             search_params = {}
             search_params[search_type] = search_id
             bundle = perform_fhir_search(search_params, [resource_type, "#{search_type}_search"])

data/lib/davinci_crd_test_kit/client_tests/client_fhir_api_update_test.rb

@@ -6,6 +6,7 @@ module DaVinciCRDTestKit
         Verify that the CRD client supports the update interaction for the given resource. The capabilities required by
         each resource can be found here: https://hl7.org/fhir/us/davinci-crd/CapabilityStatement-crd-client.html#resourcesSummary1
       )
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@74'
 
     input :update_resources,
           type: 'textarea',

data/lib/davinci_crd_test_kit/client_tests/client_fhir_api_validation_test.rb

@@ -4,7 +4,7 @@ module DaVinciCRDTestKit
     title 'FHIR Resource Validation'
     description %(
         Verify that the given resources returned from the previous client API interactions are valid resources. Each
-        resource is validated against its corresponding [CRD resorce profile](https://hl7.org/fhir/us/davinci-crd/STU2/artifacts.html).
+        resource is validated against its corresponding [CRD resource profile](https://hl7.org/fhir/us/davinci-crd/STU2/artifacts.html).
       )
 
     def resource_type

data/lib/davinci_crd_test_kit/client_tests/client_order_dispatch_group.rb

@@ -28,6 +28,8 @@ module DaVinciCRDTestKit
 
     run_as_group
 
+    input_order :cds_jwt_iss, :cds_jwk_set
+
     config(
       inputs: {
         auth_token_headers_json: { name: :order_dispatch_auth_token_headers_json },
@@ -63,7 +65,14 @@ module DaVinciCRDTestKit
     test from: :crd_token_payload
     test from: :crd_hook_request_required_fields
     test from: :crd_hook_request_optional_fields
-    test from: :crd_hook_request_valid_context
+    test from: :crd_hook_request_valid_context do
+      verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@284', 'hl7.fhir.us.davinci-crd_2.0.1@285',
+                            'hl7.fhir.us.davinci-crd_2.0.1@286', 'hl7.fhir.us.davinci-crd_2.0.1@287',
+                            'hl7.fhir.us.davinci-crd_2.0.1@288', 'hl7.fhir.us.davinci-crd_2.0.1@289',
+                            'hl7.fhir.us.davinci-crd_2.0.1@290', 'hl7.fhir.us.davinci-crd_2.0.1@291',
+                            'hl7.fhir.us.davinci-crd_2.0.1@292', 'hl7.fhir.us.davinci-crd_2.0.1@293',
+                            'hl7.fhir.us.davinci-crd_2.0.1@294', 'hl7.fhir.us.davinci-crd_2.0.1@295'
+    end
     test from: :crd_hook_request_valid_prefetch
     test from: :crd_card_display_attest_test
   end

data/lib/davinci_crd_test_kit/client_tests/client_order_select_group.rb

@@ -30,6 +30,8 @@ module DaVinciCRDTestKit
 
     run_as_group
 
+    input_order :cds_jwt_iss, :cds_jwk_set
+
     config(
       inputs: {
         auth_token_headers_json: { name: :order_select_auth_token_headers_json },
@@ -65,7 +67,15 @@ module DaVinciCRDTestKit
     test from: :crd_token_payload
     test from: :crd_hook_request_required_fields
     test from: :crd_hook_request_optional_fields
-    test from: :crd_hook_request_valid_context
+    test from: :crd_hook_request_valid_context do
+      verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@71', 'hl7.fhir.us.davinci-crd_2.0.1@284',
+                            'hl7.fhir.us.davinci-crd_2.0.1@285', 'hl7.fhir.us.davinci-crd_2.0.1@286',
+                            'hl7.fhir.us.davinci-crd_2.0.1@287', 'hl7.fhir.us.davinci-crd_2.0.1@288',
+                            'hl7.fhir.us.davinci-crd_2.0.1@289', 'hl7.fhir.us.davinci-crd_2.0.1@290',
+                            'hl7.fhir.us.davinci-crd_2.0.1@291', 'hl7.fhir.us.davinci-crd_2.0.1@292',
+                            'hl7.fhir.us.davinci-crd_2.0.1@293', 'hl7.fhir.us.davinci-crd_2.0.1@294',
+                            'hl7.fhir.us.davinci-crd_2.0.1@295'
+    end
     test from: :crd_hook_request_valid_prefetch
     test from: :crd_card_display_attest_test
   end

data/lib/davinci_crd_test_kit/client_tests/client_order_sign_group.rb

@@ -29,6 +29,8 @@ module DaVinciCRDTestKit
 
     run_as_group
 
+    input_order :cds_jwt_iss, :cds_jwk_set
+
     config(
       inputs: {
         auth_token_headers_json: { name: :order_sign_auth_token_headers_json },
@@ -64,7 +66,15 @@ module DaVinciCRDTestKit
     test from: :crd_token_payload
     test from: :crd_hook_request_required_fields
     test from: :crd_hook_request_optional_fields
-    test from: :crd_hook_request_valid_context
+    test from: :crd_hook_request_valid_context do
+      verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@71', 'hl7.fhir.us.davinci-crd_2.0.1@284',
+                            'hl7.fhir.us.davinci-crd_2.0.1@285', 'hl7.fhir.us.davinci-crd_2.0.1@286',
+                            'hl7.fhir.us.davinci-crd_2.0.1@287', 'hl7.fhir.us.davinci-crd_2.0.1@288',
+                            'hl7.fhir.us.davinci-crd_2.0.1@289', 'hl7.fhir.us.davinci-crd_2.0.1@290',
+                            'hl7.fhir.us.davinci-crd_2.0.1@291', 'hl7.fhir.us.davinci-crd_2.0.1@292',
+                            'hl7.fhir.us.davinci-crd_2.0.1@293', 'hl7.fhir.us.davinci-crd_2.0.1@294',
+                            'hl7.fhir.us.davinci-crd_2.0.1@295'
+    end
     test from: :crd_hook_request_valid_prefetch
     test from: :crd_card_display_attest_test
   end

data/lib/davinci_crd_test_kit/client_tests/client_registration_verification_test.rb

@@ -0,0 +1,88 @@
+require 'jwt'
+
+module DaVinciCRDTestKit
+  class CRDClientRegistrationVerification < Inferno::Test
+    include URLs
+
+    id :crd_client_registration_verification
+    title 'Verify CRD Client Registration'
+    description %(
+        During this test, Inferno will verify that the CRD Client registration details
+        provided are conformant.
+      )
+    input :cds_jwt_iss,
+          title: 'CRD JWT Issuer',
+          description: %(
+            The `iss` claim of the JWT in the Authorization header sent by the CRD client under test on
+            all CRD requests. This value will be used to associate incoming requests with this test
+            session and any requests that use a different `iss` value will not be recognized.
+          ),
+          type: 'text'
+    input :cds_jwk_set,
+          title: 'CRD JSON Web Key Set (JWKS)',
+          type: 'textarea',
+          description: %(
+            The CRD client's JWK Set containing it's public key. May be either
+            a publicly accessible url containing the JWKS, or the raw JWKS.
+            This input is required for these tests to pass.
+          ),
+          optional: true
+
+    run do
+      assert cds_jwk_set.present?, 'Provide a jwk set in the **CRD JSON Web Key Set (JWKS)** input.'
+
+      jwks_warnings = []
+      parsed_jwk_set = jwk_set(cds_jwk_set, jwks_warnings)
+      jwks_warnings.each { |warning| add_message('warning', warning) }
+
+      assert parsed_jwk_set.length.positive?, 'JWKS content does not include any valid keys.'
+
+      assert messages.none? { |msg| msg[:type] == 'error' }, 'Invalid key set provided. See messages for details'
+    end
+
+    def jwk_set(jku, warning_messages = []) # rubocop:disable Metrics/CyclomaticComplexity
+      jwk_set = JWT::JWK::Set.new
+
+      if jku.blank?
+        warning_messages << 'No key set input.'
+        return jwk_set
+      end
+
+      jwk_body = # try as raw jwk set
+        begin
+          JSON.parse(jku)
+        rescue JSON::ParserError
+          nil
+        end
+
+      if jwk_body.blank?
+        retrieved = Faraday.get(jku) # try as url pointing to a jwk set
+        jwk_body =
+          begin
+            JSON.parse(retrieved.body)
+          rescue JSON::ParserError
+            warning_messages << "Failed to fetch valid json from jwks uri #{jku}."
+            nil
+          end
+      else
+        warning_messages << 'Providing the JWK Set directly is strongly discouraged.'
+      end
+
+      return jwk_set if jwk_body.blank?
+
+      jwk_body['keys']&.each_with_index do |key_hash, index|
+        parsed_key =
+          begin
+            JWT::JWK.new(key_hash)
+          rescue JWT::JWKError => e
+            id = key_hash['kid'] | index
+            warning_messages << "Key #{id} invalid: #{e}"
+            nil
+          end
+        jwk_set << parsed_key unless parsed_key.blank?
+      end
+
+      jwk_set
+    end
+  end
+end

data/lib/davinci_crd_test_kit/client_tests/encounter_discharge_receive_request_test.rb

@@ -10,10 +10,19 @@ module DaVinciCRDTestKit
         This test waits for multiple incoming [encounter-discharge](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#encounter-discharge)
         hook requests and responds to the client with the response types selected as an input.
       )
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@197', 'hl7.fhir.us.davinci-crd_2.0.1@243',
+                          'hl7.fhir.us.davinci-crd_2.0.1@244', 'hl7.fhir.us.davinci-crd_2.0.1@245'
 
     config options: { accepts_multiple_requests: true }
 
-    input :iss
+    input :cds_jwt_iss,
+          title: 'CRD JWT Issuer',
+          description: %(
+            Value of the `iss` claim that must be sent on the Bearer token in the `Authorization`
+            header of all requests. Run or re-run the **Client Registration** group to set or
+            change this value.
+          ),
+          locked: true
     input :encounter_discharge_selected_response_types,
           title: 'Response types to return from encounter-discharge hook requests',
           description: %(
@@ -62,7 +71,7 @@ module DaVinciCRDTestKit
 
     run do
       wait(
-        identifier: "encounter-discharge #{iss}",
+        identifier: "encounter-discharge #{cds_jwt_iss}",
         message: %(
           **Encounter Discharge CDS Service Test**:
 
@@ -72,7 +81,7 @@ module DaVinciCRDTestKit
 
           Inferno will process the requests and return CDS cards if successful.
 
-          [Click here](#{resume_pass_url}?token=encounter-discharge%20#{iss}) when you have finished submitting
+          [Click here](#{resume_pass_url}?token=encounter-discharge%20#{cds_jwt_iss}) when you have finished submitting
           requests.
         )
       )

data/lib/davinci_crd_test_kit/client_tests/encounter_start_receive_request_test.rb

@@ -10,10 +10,19 @@ module DaVinciCRDTestKit
       This test waits for multiple incoming [encounter-start](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#encounter-start)
       hook requests and responds to the client with the response types selected as an input.
       )
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@186', 'hl7.fhir.us.davinci-crd_2.0.1@243',
+                          'hl7.fhir.us.davinci-crd_2.0.1@244', 'hl7.fhir.us.davinci-crd_2.0.1@245'
 
     config options: { accepts_multiple_requests: true }
 
-    input :iss
+    input :cds_jwt_iss,
+          title: 'CRD JWT Issuer',
+          description: %(
+            Value of the `iss` claim that must be sent on the Bearer token in the `Authorization`
+            header of all requests. Run or re-run the **Client Registration** group to set or
+            change this value.
+          ),
+          locked: true
     input :encounter_start_selected_response_types,
           title: 'Response types to return from encounter-start hook requests',
           description: %(
@@ -62,7 +71,7 @@ module DaVinciCRDTestKit
 
     run do
       wait(
-        identifier: "encounter-start #{iss}",
+        identifier: "encounter-start #{cds_jwt_iss}",
         message: %(
           **Encounter Start CDS Service Test**:
 
@@ -72,7 +81,8 @@ module DaVinciCRDTestKit
 
           Inferno will process the requests and return CDS cards if successful.
 
-          [Click here](#{resume_pass_url}?token=enounter-start%20#{iss}) when you have finished submitting requests.
+          [Click here](#{resume_pass_url}?token=enounter-start%20#{cds_jwt_iss}) when you have finished submitting
+          requests.
         )
       )
     end

data/lib/davinci_crd_test_kit/client_tests/hook_request_optional_fields_test.rb

@@ -15,7 +15,7 @@ module DaVinciCRDTestKit
         * `fhirAuthorization` - *object*
         * `prefetch` - *object*
 
-      This test checks for the precense of these fields and if they are of the correct type. This test is optional and
+      This test checks for the presence of these fields and if they are of the correct type. This test is optional and
       will not fail if the hook request does not contain an optional field, it only produces an informational message.
       If the client provides its FHIR server URL in the `fhirServer` field, and it's authorization token in the
       `fhirAuthorization` field object, they will be produced as an output from this test to be used in

data/lib/davinci_crd_test_kit/client_tests/hook_request_valid_context_test.rb

@@ -34,6 +34,7 @@ module DaVinciCRDTestKit
       The client must provide its FHIR server URL and access token in the hook request in order to run
       this test.
     )
+    verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@254'
 
     input :contexts, :client_fhir_server
     input :client_access_token,