davinci_crd_test_kit 0.13.0 → 0.14.0

data/lib/davinci_crd_test_kit/client/v2.0.1/auth/token_payload_test.rb

@@ -0,0 +1,85 @@
+require_relative '../../client_hook_request_validation'
+
+module DaVinciCRDTestKit
+  module V201
+    class TokenPayloadTest < Inferno::Test
+      include ClientHookRequestValidation
+      include ClientURLs
+
+      id :crd_v201_token_payload
+      title 'Authorization token payload has required claims and a valid signature'
+      description %(
+        Verify that the JWT payload contains the payload fields required by the
+        [CDS hooks spec](https://cds-hooks.hl7.org/2.0#trusting-cds-clients).
+        The `iss`, `aud`, `exp`, `iat`, and `jti` claims are required.
+        Additionally:
+
+        - `iss` must match the `issuer` from the **CRD JWT Issuer** input
+        - `aud` must match the URL of the CDS Service endpoint being invoked
+        - `exp` must represent a time in the future
+        - `jti` must be a non-blank string that uniquely identifies this authentication JWT
+      )
+
+      verifies_requirements 'cds-hooks_2.0@180', 'cds-hooks_2.0@181', 'cds-hooks_2.0@187', 'cds-hooks_2.0@189',
+                            'cds-hooks_2.0@190', 'cds-hooks_2.0@191', 'cds-hooks_2.0@192', 'cds-hooks_2.0@196',
+                            'cds-hooks_2.0@203'
+
+      REQUIRED_CLAIMS = ['iss', 'aud', 'exp', 'iat', 'jti'].freeze
+
+      def required_claims
+        REQUIRED_CLAIMS.dup
+      end
+
+      def hook_url
+        inferno_base_url + config.options[:hook_path]
+      end
+
+      input :auth_tokens,
+            :auth_tokens_jwk_json,
+            :cds_jwt_iss
+
+      run do
+        auth_tokens_list = JSON.parse(auth_tokens)
+        auth_tokens_jwk = JSON.parse(auth_tokens_jwk_json)
+        skip_if auth_tokens_list.empty?, 'No Authorization tokens produced from the previous tests.'
+        skip_if auth_tokens_jwk.empty?, 'No Authorization token JWK produced from the previous test.'
+
+        auth_tokens_jwk.each_with_index do |auth_token_jwk, index|
+          @request_number = index + 1
+
+          begin
+            jwk = JSON.parse(auth_token_jwk).deep_symbolize_keys
+
+            payload, =
+              JWT.decode(
+                auth_tokens_list[index],
+                JWT::JWK.import(jwk).public_key,
+                true,
+                algorithms: [jwk[:alg]],
+                exp_leeway: 60,
+                iss: cds_jwt_iss,
+                aud: hook_url,
+                verify_not_before: false,
+                verify_iat: false,
+                verify_jti: true,
+                verify_iss: true,
+                verify_aud: true
+              )
+          rescue StandardError => e
+            add_message('error', "#{request_number}Token validation error: #{e.message}")
+            next
+          end
+
+          missing_claims = required_claims - payload.keys
+          missing_claims_string = missing_claims.map { |claim| "`#{claim}`" }.join(', ')
+
+          unless missing_claims.empty?
+            add_message('error', "#{request_number}JWT payload missing required claims: #{missing_claims_string}")
+            next
+          end
+        end
+        no_error_validation('Token payload is missing required claims or does not have a valid signature.')
+      end
+    end
+  end
+end

data/lib/davinci_crd_test_kit/{routes/cds-services.json → client/v2.0.1/cds-services-v201.json}

@@ -4,7 +4,7 @@
     {
       "hook": "appointment-book",
       "title": "Appointment Booking CDS Service",
-      "description": "An example of a CDS Service that is invoked when user of a CRD Client books a future appointment for a patient",
+      "description": "An example of a CDS Service that is invoked when user of a CRD client books a future appointment for a patient",
       "id": "appointment-book-service",
       "prefetch": {
         "user": "{{context.userId}}",

data/lib/davinci_crd_test_kit/client/v2.0.1/client_appointment_book_group.rb

@@ -0,0 +1,108 @@
+require_relative 'invocation/appointment_book_receive_request_test'
+require_relative 'auth/decode_auth_token_test'
+require_relative 'auth/retrieve_jwks_test'
+require_relative 'auth/token_header_test'
+require_relative 'auth/token_payload_test'
+require_relative 'verify_request/hook_request_optional_fields_test'
+require_relative 'verify_request/hook_request_required_fields_test'
+require_relative 'verify_request/hook_request_valid_context_test'
+require_relative 'verify_request/hook_request_valid_prefetch_test'
+require_relative 'verify_request/hook_request_fetched_data_test'
+require_relative 'verify_request/hook_request_prefetch_equals_queried_test'
+require_relative 'verify_response/inferno_response_validation'
+require_relative 'verify_response/client_display_cards_attest'
+
+module DaVinciCRDTestKit
+  module V201
+    class ClientAppointmentBookGroup < Inferno::TestGroup
+      title 'appointment-book'
+      id :crd_v201_client_appointment_book
+      description <<~DESCRIPTION
+        The appointment-book hook is invoked when the user is scheduling one or more future encounters/visits for the
+        patient. These tests are based on the following criteria:
+          * [CRD IG requirements for this hook](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#appointment-book),
+          which include the profiles that are expected to be used for the resources resolved to by `context` FHIR ID
+          fields
+          * Specific [appointment-book `context` requirements](https://cds-hooks.hl7.org/hooks/appointment-book/2023SepSTU1Ballot/appointment-book/)
+          defined in the CDS Hooks specification
+
+        This version of the CRD implementation guide refers to version 1.0 of the hook.
+      DESCRIPTION
+      verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@172'
+
+      run_as_group
+
+      input_order :cds_jwt_iss, :cds_jwk_set
+
+      config(
+        inputs: {
+          auth_token_headers_json: { name: :appointment_book_auth_token_headers_json },
+          auth_tokens: { name: :appointment_book_auth_tokens },
+          auth_tokens_jwk_json: { name: :appointment_book_auth_tokens_jwk_json },
+          client_access_token: { name: :appointment_book_client_access_token },
+          override_access_token: { name: :appointment_book_override_access_token,
+                                   title: 'appointment-book Prefetch Validation Override Bearer Token' },
+          client_fhir_server: { name: :appointment_book_client_fhir_server },
+          crd_jwks_keys_json: { name: :appointment_book_crd_jwks_keys_json },
+          custom_response_template: { name: :appointment_book_custom_response_template },
+          selected_response_types: { name: :appointment_book_selected_response_types }
+        },
+        outputs: {
+          auth_token_headers_json: { name: :appointment_book_auth_token_headers_json },
+          auth_token_payloads_json: { name: :appointment_book_auth_token_payloads_json },
+          auth_tokens: { name: :appointment_book_auth_tokens },
+          auth_tokens_jwk_json: { name: :appointment_book_auth_tokens_jwk_json },
+          client_access_token: { name: :appointment_book_client_access_token },
+          client_fhir_server: { name: :appointment_book_client_fhir_server },
+          crd_jwks_json: { name: :appointment_book_crd_jwks_json },
+          crd_jwks_keys_json: { name: :appointment_book_crd_jwks_keys_json }
+        },
+        options: {
+          hook_name: 'appointment-book',
+          hook_path: APPOINTMENT_BOOK_PATH
+        }
+      )
+
+      group do
+        title 'Make Hook Requests'
+        test from: :crd_v201_appointment_book_request
+      end
+
+      group do
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
+      end
+
+      group do
+        title 'Verify Requests'
+        test from: :crd_v201_hook_request_required_fields
+        test from: :crd_v201_hook_request_optional_fields
+        test from: :crd_v201_hook_request_valid_context do
+          verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@71',
+                                'hl7.fhir.us.davinci-crd_2.0.1@177', 'hl7.fhir.us.davinci-crd_2.0.1@178',
+                                'hl7.fhir.us.davinci-crd_2.0.1@179', 'hl7.fhir.us.davinci-crd_2.0.1@180',
+                                'hl7.fhir.us.davinci-crd_2.0.1@286',
+                                'cds-hooks-library_1.0.1@17', 'cds-hooks-library_1.0.1@18',
+                                'cds-hooks-library_1.0.1@19', 'cds-hooks-library_1.0.1@21',
+                                'cds-hooks-library_1.0.1@22', 'cds-hooks-library_1.0.1@23',
+                                'cds-hooks-library_1.0.1@25', 'cds-hooks-library_1.0.1@26',
+                                'cds-hooks-library_1.0.1@27', 'cds-hooks-library_1.0.1@29',
+                                'cds-hooks-library_1.0.1@30', 'cds-hooks-library_1.0.1@31'
+        end
+        test from: :crd_v201_hook_request_valid_prefetch
+        test from: :crd_v201_hook_request_fetched_data
+        test from: :crd_v201_hook_request_prefetch_equals_queried
+      end
+
+      group do
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
+      end
+    end
+  end
+end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_card_must_support_group.rb

@@ -0,0 +1,31 @@
+require_relative 'must_support/client_card_must_support_coverage_information'
+require_relative 'must_support/client_card_must_support_external_reference'
+require_relative 'must_support/client_card_must_support_instructions'
+
+module DaVinciCRDTestKit
+  module V201
+    class ClientCardMustSupportGroup < Inferno::TestGroup
+      title 'Card Must Support'
+      id :crd_v201_client_card_must_support
+      description <<~DESCRIPTION
+        CRD clients are required to support the following card types
+        - [External Reference](https://hl7.org/fhir/us/davinci-crd/STU2/cards.html#external-reference)
+        - [Instructions](https://hl7.org/fhir/us/davinci-crd/STU2/cards.html#instructions)
+        - [Coverage Information](https://hl7.org/fhir/us/davinci-crd/STU2/cards.html#coverage-information)
+
+        This group checks that instances of each of these card types were observed across all hook calls
+        made by the client as a part of this test session. In the case of the Coverage Information card type,
+        all must support elements defined in the [coverage-information extension](https://hl7.org/fhir/us/davinci-crd/STU2/StructureDefinition-ext-coverage-information.html)
+        must be demonstrated.
+
+        These tests must be run after the tests in the "Hooks" group are run.
+      DESCRIPTION
+
+      run_as_group
+
+      test from: :crd_v201_client_card_must_support_coverage_information
+      test from: :crd_v201_client_card_must_support_external_reference
+      test from: :crd_v201_client_card_must_support_instructions
+    end
+  end
+end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_encounter_discharge_group.rb

@@ -0,0 +1,105 @@
+require_relative 'invocation/encounter_discharge_receive_request_test'
+require_relative 'auth/decode_auth_token_test'
+require_relative 'auth/retrieve_jwks_test'
+require_relative 'auth/token_header_test'
+require_relative 'auth/token_payload_test'
+require_relative 'verify_request/hook_request_optional_fields_test'
+require_relative 'verify_request/hook_request_required_fields_test'
+require_relative 'verify_request/hook_request_valid_context_test'
+require_relative 'verify_request/hook_request_valid_prefetch_test'
+require_relative 'verify_request/hook_request_fetched_data_test'
+require_relative 'verify_request/hook_request_prefetch_equals_queried_test'
+require_relative 'verify_response/inferno_response_validation'
+require_relative 'verify_response/client_display_cards_attest'
+
+module DaVinciCRDTestKit
+  module V201
+    class ClientEncounterDischargeGroup < Inferno::TestGroup
+      title 'encounter-discharge'
+      id :crd_v201_client_encounter_discharge
+      description <<~DESCRIPTION
+        The encounter-discharge hook is invoked when the user is performing the discharge process for an encounter where
+        the notion of 'discharge' is relevant - typically an inpatient encounter. These tests are based on the
+        following criteria:
+          * [CRD IG requirements for this hook](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#encounter-discharge),
+          which includes the profiles that are expected to be used for the resources resolved to by `context`
+          FHIR ID fields
+          * Specific [encounter-discharge `context` requirements](https://cds-hooks.hl7.org/hooks/encounter-discharge/2023SepSTU1Ballot/encounter-discharge/)
+          defined in the CDS Hooks specification
+
+        This version of the CRD implementation guide refers to version 1.0 of the hook.
+      DESCRIPTION
+
+      run_as_group
+
+      input_order :cds_jwt_iss, :cds_jwk_set
+
+      config(
+        inputs: {
+          auth_token_headers_json: { name: :encounter_discharge_auth_token_headers_json },
+          auth_tokens: { name: :encounter_discharge_auth_tokens },
+          auth_tokens_jwk_json: { name: :encounter_discharge_auth_tokens_jwk_json },
+          client_access_token: { name: :encounter_discharge_client_access_token },
+          override_access_token: { name: :encounter_discharge_override_access_token,
+                                   title: 'encounter-discharge Prefetch Validation Override Bearer Token' },
+          client_fhir_server: { name: :encounter_discharge_client_fhir_server },
+          crd_jwks_keys_json: { name: :encounter_discharge_crd_jwks_keys_json },
+          custom_response_template: { name: :encounter_discharge_custom_response_template },
+          selected_response_types: { name: :encounter_discharge_selected_response_types }
+        },
+        outputs: {
+          auth_token_headers_json: { name: :encounter_discharge_auth_token_headers_json },
+          auth_token_payloads_json: { name: :encounter_discharge_auth_token_payloads_json },
+          auth_tokens: { name: :encounter_discharge_auth_tokens },
+          auth_tokens_jwk_json: { name: :encounter_discharge_auth_tokens_jwk_json },
+          client_access_token: { name: :encounter_discharge_client_access_token },
+          client_fhir_server: { name: :encounter_discharge_client_fhir_server },
+          crd_jwks_json: { name: :encounter_discharge_crd_jwks_json },
+          crd_jwks_keys_json: { name: :encounter_discharge_crd_jwks_keys_json }
+        },
+        options: {
+          hook_name: 'encounter-discharge',
+          hook_path: ENCOUNTER_DISCHARGE_PATH
+        }
+      )
+
+      group do
+        title 'Make Hook Requests'
+        test from: :crd_v201_encounter_discharge_request
+      end
+
+      group do
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
+      end
+
+      group do
+        title 'Verify Requests'
+        test from: :crd_v201_hook_request_required_fields
+        test from: :crd_v201_hook_request_optional_fields
+        test from: :crd_v201_hook_request_valid_context do
+          verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@201', 'hl7.fhir.us.davinci-crd_2.0.1@202',
+                                'hl7.fhir.us.davinci-crd_2.0.1@203',
+                                'cds-hooks-library_1.0.1@45', 'cds-hooks-library_1.0.1@46',
+                                'cds-hooks-library_1.0.1@47', 'cds-hooks-library_1.0.1@49',
+                                'cds-hooks-library_1.0.1@50', 'cds-hooks-library_1.0.1@51',
+                                'cds-hooks-library_1.0.1@53', 'cds-hooks-library_1.0.1@54',
+                                'cds-hooks-library_1.0.1@55'
+        end
+        test from: :crd_v201_hook_request_valid_prefetch
+        test from: :crd_v201_hook_request_fetched_data
+        test from: :crd_v201_hook_request_prefetch_equals_queried
+      end
+
+      group do
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
+      end
+    end
+  end
+end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_encounter_start_group.rb

@@ -0,0 +1,105 @@
+require_relative 'invocation/encounter_start_receive_request_test'
+require_relative 'auth/decode_auth_token_test'
+require_relative 'auth/retrieve_jwks_test'
+require_relative 'auth/token_header_test'
+require_relative 'auth/token_payload_test'
+require_relative 'verify_request/hook_request_optional_fields_test'
+require_relative 'verify_request/hook_request_required_fields_test'
+require_relative 'verify_request/hook_request_valid_context_test'
+require_relative 'verify_request/hook_request_valid_prefetch_test'
+require_relative 'verify_request/hook_request_fetched_data_test'
+require_relative 'verify_request/hook_request_prefetch_equals_queried_test'
+require_relative 'verify_response/inferno_response_validation'
+require_relative 'verify_response/client_display_cards_attest'
+
+module DaVinciCRDTestKit
+  module V201
+    class ClientEncounterStartGroup < Inferno::TestGroup
+      title 'encounter-start'
+      id :crd_v201_client_encounter_start
+      description <<~DESCRIPTION
+        The encounter-start hook is invoked when the user is initiating a new encounter. These tests are based on the
+        following criteria:
+          * [CRD IG requirements for this hook](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#encounter-start),
+          which include the profiles that are expected to be used for the resources resolved to by `context` FHIR ID
+          fields
+          * Specific [encounter-start `context` requirements](https://cds-hooks.hl7.org/hooks/encounter-start/2023SepSTU1Ballot/encounter-start/)
+          defined in the CDS Hooks specification
+
+        This version of the CRD implementation guide refers to version 1.0 of the hook.
+      DESCRIPTION
+      verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@187'
+
+      run_as_group
+
+      input_order :cds_jwt_iss, :cds_jwk_set
+
+      config(
+        inputs: {
+          auth_token_headers_json: { name: :encounter_start_auth_token_headers_json },
+          auth_tokens: { name: :encounter_start_auth_tokens },
+          auth_tokens_jwk_json: { name: :encounter_start_auth_tokens_jwk_json },
+          client_access_token: { name: :encounter_start_client_access_token },
+          override_access_token: { name: :encounter_start_override_access_token,
+                                   title: 'encounter-start Prefetch Validation Override Bearer Token' },
+          client_fhir_server: { name: :encounter_start_client_fhir_server },
+          crd_jwks_keys_json: { name: :encounter_start_crd_jwks_keys_json },
+          custom_response_template: { name: :encounter_start_custom_response_template },
+          selected_response_types: { name: :encounter_start_selected_response_types }
+        },
+        outputs: {
+          auth_token_headers_json: { name: :encounter_start_auth_token_headers_json },
+          auth_token_payloads_json: { name: :encounter_start_auth_token_payloads_json },
+          auth_tokens: { name: :encounter_start_auth_tokens },
+          auth_tokens_jwk_json: { name: :encounter_start_auth_tokens_jwk_json },
+          client_access_token: { name: :encounter_start_client_access_token },
+          client_fhir_server: { name: :encounter_start_client_fhir_server },
+          crd_jwks_json: { name: :encounter_start_crd_jwks_json },
+          crd_jwks_keys_json: { name: :encounter_start_crd_jwks_keys_json }
+        },
+        options: {
+          hook_name: 'encounter-start',
+          hook_path: ENCOUNTER_START_PATH
+        }
+      )
+
+      group do
+        title 'Make Hook Requests'
+        test from: :crd_v201_encounter_start_request
+      end
+
+      group do
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
+      end
+
+      group do
+        title 'Verify Requests'
+        test from: :crd_v201_hook_request_required_fields
+        test from: :crd_v201_hook_request_optional_fields
+        test from: :crd_v201_hook_request_valid_context do
+          verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@192', 'hl7.fhir.us.davinci-crd_2.0.1@193',
+                                'hl7.fhir.us.davinci-crd_2.0.1@194',
+                                'cds-hooks-library_1.0.1@33', 'cds-hooks-library_1.0.1@34',
+                                'cds-hooks-library_1.0.1@35', 'cds-hooks-library_1.0.1@37',
+                                'cds-hooks-library_1.0.1@38', 'cds-hooks-library_1.0.1@39',
+                                'cds-hooks-library_1.0.1@41', 'cds-hooks-library_1.0.1@42',
+                                'cds-hooks-library_1.0.1@43'
+        end
+        test from: :crd_v201_hook_request_valid_prefetch
+        test from: :crd_v201_hook_request_fetched_data
+        test from: :crd_v201_hook_request_prefetch_equals_queried
+      end
+
+      group do
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
+      end
+    end
+  end
+end