davinci_crd_test_kit 0.13.0 → 0.14.0

data/lib/davinci_crd_test_kit/client/v2.2.1/auth/decode_auth_token_test.rb

@@ -0,0 +1,69 @@
+require_relative '../../multi_request_message_helper'
+require_relative '../../tagged_request_load_helper'
+
+module DaVinciCRDTestKit
+  module V221
+    class DecodeAuthTokenTest < Inferno::Test
+      include DaVinciCRDTestKit::MultiRequestMessageHelper
+      include DaVinciCRDTestKit::TaggedRequestLoadHelper
+
+      id :crd_v221_decode_auth_token
+      title 'Bearer tokens can be decoded'
+      description %(
+        During this test, Inferno will verify that for each request the Bearer token is a properly constructed JWT.
+        As per the [CDS hooks specification](https://cds-hooks.hl7.org/2026Jan/en/#trusting-cds-clients),
+        each time a CDS client transmits a request to a CDS Service which requires authentication, the request MUST
+        include an Authorization header presenting the JWT as a "Bearer" token.
+      )
+
+      verifies_requirements 'cds-hooks_3.0.0-ballot@178'
+
+      output :auth_tokens, :auth_token_payloads_json, :auth_token_headers_json
+
+      run do
+        load_hook_requests
+        skip_if requests.empty?, "No #{hook_name} requests were made in a previous test as expected."
+        auth_tokens = []
+        auth_token_payloads_json = []
+        auth_token_headers_json = []
+
+        requests.each_with_index do |request, index|
+          authorization_header = request.request_header('Authorization')&.value
+
+          unless authorization_header&.start_with?('Bearer ')
+            add_request_message('error', 'Authorization token must be a JWT presented as a `Bearer` token', index)
+            auth_tokens << nil
+            auth_token_payloads_json << nil
+            auth_token_headers_json << nil
+            next
+          end
+
+          auth_token = authorization_header.delete_prefix('Bearer ')
+          auth_tokens << auth_token
+
+          begin
+            payload, header =
+              JWT.decode(
+                auth_token,
+                nil,
+                false
+              )
+
+            auth_token_payloads_json << payload.to_json
+            auth_token_headers_json << header.to_json
+          rescue StandardError => e
+            add_request_message('error', "Token is not a properly constructed JWT: #{e.message}", index)
+            auth_token_payloads_json << nil
+            auth_token_headers_json << nil
+          end
+        end
+        output auth_tokens: auth_tokens.to_json,
+               auth_token_payloads_json: auth_token_payloads_json.to_json,
+               auth_token_headers_json: auth_token_headers_json.to_json
+
+        assert_no_error_messages("#{requests_with_errors_prefix}Decoding Authorization header Bearer tokens failed. " \
+                                 'See Messages for details.')
+      end
+    end
+  end
+end

data/lib/davinci_crd_test_kit/client/v2.2.1/auth/retrieve_jwks_test.rb

@@ -0,0 +1,120 @@
+require_relative '../../multi_request_message_helper'
+
+module DaVinciCRDTestKit
+  module V221
+    class RetrieveJWKSTest < Inferno::Test
+      include DaVinciCRDTestKit::MultiRequestMessageHelper
+
+      id :crd_v221_retrieve_jwks
+      title 'JWKSs can be retrieved'
+      description %(
+        During this test, Inferno will verify that for each request the JWKS can be retrieved from the JWKS uri if
+        it is present in the `jku` field within the JWT token header. Additionally, keys will be extracted and
+        outputted for use in subsequent tests. If the client does not provide a uri in the `jku` field,
+        Inferno will extract keys from the raw JWKS JSON provided out of band as a part of the "Registration" group.
+      )
+
+      verifies_requirements 'cds-hooks_3.0.0-ballot@183', 'cds-hooks_3.0.0-ballot@185', 'cds-hooks_3.0.0-ballot@197',
+                            'cds-hooks_3.0.0-ballot@199'
+
+      input :auth_token_headers_json
+      input :cds_jwk_set,
+            title: 'CRD JSON Web Key Set (JWKS)',
+            type: 'textarea',
+            description: %(
+            The client's registered JWK Set containing it's public key. Used
+            only when a request was received with a JWT without the `jku` header.
+            Inferno assumes this input, provided during the "Registration"
+            group, contains the raw JSON representation of a JWKS (if a URI was provided
+            it would be populated in the `jku` header). Run or re-run the "Registration"
+            group to set or change this value.
+          ),
+            locked: true,
+            optional: true
+      output :crd_jwks_keys_json
+
+      run do
+        auth_token_headers = JSON.parse(auth_token_headers_json) # NOTE: pre-verified json
+        skip_if auth_token_headers.compact.empty?, 'No Authorization tokens produced from the previous test.'
+        skip_if cds_jwk_set.blank? && cds_jwk_set_input_needed?(auth_token_headers),
+                "JWK Set must be inputted if the client's JWK Set is not available"
+
+        crd_jwks_keys_json = []
+        auth_token_headers.each_with_index do |token_header, index|
+          unless token_header.present?
+            crd_jwks_keys_json << nil
+            next
+          end
+
+          jku = JSON.parse(token_header)['jku'] # NOTE: pre-verified json
+          jwks =
+            if jku.present?
+              get(jku)
+
+              if response[:status] == 200
+                parse_json_request_entity(response[:body], 'Fetched jku url response', index)
+              else
+                add_request_message('error',
+                                    "Unexpected response status: expected 200, but received #{response[:status]}",
+                                    index)
+                nil
+              end
+            else
+              parse_json_request_entity(cds_jwk_set, 'JWK Set input', index)
+            end
+          if jwks.blank?
+            crd_jwks_keys_json << nil
+            next
+          end
+
+          keys = jwks['keys']
+          unless keys.is_a?(Array)
+            add_request_message('error', 'JWKS `keys` field must be an array', index)
+            crd_jwks_keys_json << nil
+            next
+          end
+
+          if keys.blank?
+            add_request_message('error', 'The JWK set returned contains no public keys', index)
+            crd_jwks_keys_json << nil
+            next
+          end
+
+          keys.each do |jwk|
+            JWT::JWK.import(jwk.deep_symbolize_keys)
+          rescue StandardError
+            add_request_message('error', "Invalid JWK: #{jwk.to_json}", index)
+          end
+
+          kid_presence = keys.all? { |key| key['kid'].present? }
+          if kid_presence.blank?
+            add_request_message('error',
+                                '`kid` field must be present in each key if JWKS contains multiple keys',
+                                index)
+            crd_jwks_keys_json << nil
+            next
+          end
+
+          kid_uniqueness = keys.map { |key| key['kid'] }.uniq.length == keys.length
+          if kid_uniqueness.blank?
+            add_request_message('error', "`kid` must be unique within the client's JWK Set.", index)
+            crd_jwks_keys_json << nil
+            next
+          end
+
+          crd_jwks_keys_json << keys.to_json
+        end
+
+        output crd_jwks_keys_json: crd_jwks_keys_json.to_json
+
+        assert_no_error_messages("#{requests_with_errors_prefix}Retrieving JWKS failed. See Messages for details.")
+      end
+
+      def cds_jwk_set_input_needed?(auth_token_headers)
+        auth_token_headers.any? do |token_header|
+          token_header.present? && JSON.parse(token_header)['jku'].blank?
+        end
+      end
+    end
+  end
+end

data/lib/davinci_crd_test_kit/client/v2.2.1/auth/token_header_test.rb

@@ -0,0 +1,92 @@
+require_relative '../../multi_request_message_helper'
+
+module DaVinciCRDTestKit
+  module V221
+    class TokenHeaderTest < Inferno::Test
+      include DaVinciCRDTestKit::MultiRequestMessageHelper
+
+      id :crd_v221_token_header
+      title 'Authorization token headers contain required information'
+      description %(
+        During this test, Inferno will verify that for each request the JWT header is conformant to the
+        requirements in the [CDS hooks specification](https://cds-hooks.hl7.org/2026Jan/en/#trusting-cds-clients),
+        including the following:
+        - The `alg`, `kid`, and `typ` fields are required.
+        - The `typ` field must be "JWT".
+        - The key used to sign the token must be present in the JWKS.
+      )
+
+      verifies_requirements 'cds-hooks_3.0.0-ballot@182', 'cds-hooks_3.0.0-ballot@184', 'cds-hooks_3.0.0-ballot@202'
+
+      input :auth_token_headers_json, :crd_jwks_keys_json
+      output :auth_tokens_jwk_json
+
+      run do
+        auth_token_headers = JSON.parse(auth_token_headers_json)
+        crd_jwks_keys = JSON.parse(crd_jwks_keys_json)
+        skip_if auth_token_headers.compact.empty?, 'No Authorization tokens produced from the previous tests.'
+        skip_if crd_jwks_keys.compact.empty?, 'No JWKS keys produced from the previous test.'
+
+        auth_tokens_jwk_json = []
+        auth_token_headers.each_with_index do |token_header, index|
+          unless token_header.present?
+            auth_tokens_jwk_json << nil
+            next
+          end
+
+          header = JSON.parse(token_header) # NOTE: pre-verified json
+          algorithm = header['alg']
+
+          if algorithm.blank?
+            add_request_message('error', 'Token header must have the `alg` field', index)
+            auth_tokens_jwk_json << nil
+            next
+          end
+
+          if algorithm == 'none'
+            add_request_message('error', 'Token header `alg` field cannot be set to none', index)
+            auth_tokens_jwk_json << nil
+            next
+          end
+
+          if header['typ'].blank?
+            add_request_message('error', 'Token header must have the `typ` field', index)
+          elsif header['typ'] != 'JWT'
+            add_request_message('error',
+                                "Token header `typ` field must be set to 'JWT', instead was #{header['typ']}",
+                                index)
+          end
+
+          if header['kid'].blank?
+            add_request_message('error', 'Token header must have the `kid` field', index)
+            auth_tokens_jwk_json << nil
+            next
+          end
+
+          kid = header['kid']
+          if crd_jwks_keys[index].nil?
+            add_request_message('error', 'No JWKS keys available for this request', index)
+            auth_tokens_jwk_json << nil
+            next
+          end
+
+          keys = JSON.parse(crd_jwks_keys[index]) # NOTE: pre-verified json
+
+          jwk = keys.find { |key| key['kid'] == kid }
+          if jwk.blank?
+            add_request_message('error', "JWKS did not contain a public key with an id of `#{kid}`", index)
+            auth_tokens_jwk_json << nil
+            next
+          end
+
+          auth_tokens_jwk_json << jwk.to_json
+        end
+
+        output auth_tokens_jwk_json: auth_tokens_jwk_json.to_json
+
+        assert_no_error_messages("#{requests_with_errors_prefix}Token header missing required information. " \
+                                 'See Messages for details.')
+      end
+    end
+  end
+end

data/lib/davinci_crd_test_kit/client/v2.2.1/auth/token_payload_test.rb

@@ -0,0 +1,93 @@
+require_relative '../../multi_request_message_helper'
+require_relative '../../tagged_request_load_helper'
+
+module DaVinciCRDTestKit
+  module V221
+    class TokenPayloadTest < Inferno::Test
+      include DaVinciCRDTestKit::MultiRequestMessageHelper
+      include DaVinciCRDTestKit::TaggedRequestLoadHelper
+      include ClientURLs
+
+      id :crd_v221_token_payload
+      title 'Authorization token payloads have required claims and valid signatures'
+      description %(
+        During this test, Inferno will verify that for each request the JWT payload is conformant to the
+        requirements in the [CDS hooks specification](https://cds-hooks.hl7.org/2026Jan/en/#trusting-cds-clients),
+        including the following:
+        - The `iss`, `aud`, `exp`, `iat`, and `jti` claims are required.
+        - `iss` must match the `issuer` from the **CRD JWT Issuer** input.
+        - `aud` must match the URL of the CDS Service endpoint being invoked.
+        - `exp` must represent a time in the future.
+        - `jti` must be a non-blank string that uniquely identifies this authentication JWT.
+      )
+
+      verifies_requirements 'cds-hooks_3.0.0-ballot@180', 'cds-hooks_3.0.0-ballot@181', 'cds-hooks_3.0.0-ballot@187',
+                            'cds-hooks_3.0.0-ballot@189', 'cds-hooks_3.0.0-ballot@190', 'cds-hooks_3.0.0-ballot@191',
+                            'cds-hooks_3.0.0-ballot@192', 'cds-hooks_3.0.0-ballot@196', 'cds-hooks_3.0.0-ballot@203'
+
+      REQUIRED_CLAIMS = ['iss', 'aud', 'exp', 'iat', 'jti'].freeze
+
+      def required_claims
+        REQUIRED_CLAIMS.dup
+      end
+
+      # Replace the scheme+host of request.url with the configured external host
+      # so that aud validation works correctly when Inferno is behind a reverse proxy.
+      def public_hook_url(request)
+        hook_suffix = URI.parse(request.url).path.delete_prefix(URI.parse(inferno_base_url).path)
+        inferno_base_url + hook_suffix
+      end
+
+      input :auth_tokens,
+            :auth_tokens_jwk_json,
+            :cds_jwt_iss
+
+      run do
+        auth_tokens_list = JSON.parse(auth_tokens)
+        auth_tokens_jwk = JSON.parse(auth_tokens_jwk_json)
+        requests = load_hook_requests
+        skip_if auth_tokens_list.compact.empty?, 'No Authorization tokens produced from the previous tests.'
+        skip_if auth_tokens_jwk.compact.empty?, 'No Authorization token JWK produced from the previous test.'
+
+        auth_tokens_jwk.each_with_index do |auth_token_jwk, index|
+          next unless auth_token_jwk.present?
+
+          request = requests[index]
+
+          begin
+            jwk = JSON.parse(auth_token_jwk).deep_symbolize_keys # NOTE: pre-verified json
+
+            payload, =
+              JWT.decode(
+                auth_tokens_list[index],
+                JWT::JWK.import(jwk).public_key,
+                true,
+                algorithms: [jwk[:alg]],
+                exp_leeway: 60,
+                iss: cds_jwt_iss,
+                aud: public_hook_url(request),
+                verify_not_before: false,
+                verify_iat: false,
+                verify_jti: true,
+                verify_iss: true,
+                verify_aud: true
+              )
+          rescue StandardError => e
+            add_request_message('error', "Token validation error: #{e.message}", index)
+            next
+          end
+
+          missing_claims = required_claims - payload.keys
+          missing_claims_string = missing_claims.map { |claim| "`#{claim}`" }.join(', ')
+
+          unless missing_claims.empty?
+            add_request_message('error', "JWT payload missing required claims: #{missing_claims_string}", index)
+            next
+          end
+        end
+        assert_no_error_messages("#{requests_with_errors_prefix}Token payload is missing required claims or " \
+                                 'does not have a valid signature. See Messages for details.')
+      end
+    end
+  end
+end

data/lib/davinci_crd_test_kit/client/v2.2.1/cds-services-prefetch-subset-v221.json

@@ -0,0 +1,198 @@
+
+{
+  "services": [
+    {
+      "hook": "appointment-book",
+      "title": "Appointment Booking CDS Service",
+      "description": "A simulated CDS Service requesting a subset of the standard prefetches that is invoked when user of a CRD client books a future appointment for a patient",
+      "id": "appointment-book-subset",
+      "prefetch" : {
+        "pat": "Patient/{{context.patientId}}",
+        "enc": "Encounter/{{context.encounterId}}",
+        "cov": "Coverage?patient={{context.patientId}}&status=active",
+        "devReqs" : "DeviceRequest?_id={{context.appointments.entry.resource.basedOn.extension('http://hl7.org/fhir/StructureDefinition/alternate-reference').value.resolve().ofType(DeviceRequest).id}}",
+        "servReqs" : "ServiceRequest?_id={{context.appointments.entry.resource.basedOn.resolve().ofType(ServiceRequest).id}}",
+        "medReqs" : "MedicationRequest?_id={{context.appointments.entry.resource.basedOn.extension('http://hl7.org/fhir/StructureDefinition/alternate-reference').value.resolve().ofType(MedicationRequest).id}}",
+        "devs": "Device?_id={{%devReqs.entry.resource.code.resolve().id}}",
+        "meds": "Medication?_id={{%medReqs.entry.resource.medication.resolve().id}}",
+        "roles" : "PractitionerRole?_id={{%devReqs.entry.resource.performer.resolve().ofType(PractitionerRole).id|%medReqs.entry.resource.performer.resolve().ofType(PractitionerRole).id|%servReqs.entry.resource.performer.resolve().ofType(PractitionerRole).id}}",
+        "pracs" : "Practitioner?_id={{%roles.entry.resource.practitioner.resolve().id|%devReqs.entry.resource.performer.resolve().ofType(Practitioner).id|%medReqs.entry.resource.performer.resolve().ofType(Practitioner).id|%servReqs.entry.resource.performer.resolve().ofType(Practitioner).id}}",
+        "locs" : "Location?_id={{%roles.entry.resource.location.resolve().id|%enc.location.location.resolve().id|%servReqs.entry.resource.locationReference.resolve().ofType(Location).id}}"
+      },
+      "extension" : {
+        "davinci-crd.version" : [
+          "2.2",
+          "2.0"
+        ],
+        "davinci-crd.configuration-options" : [
+          {
+            "code" : "coverage-info",
+            "type" : "boolean",
+            "name" : "Coverage Information",
+            "description" : "Information related to the patient's coverage, including whether a service is covered, requires prior authorization, is approved without seeking prior authorization, and/or requires additional documentation or data collection",
+            "default" : true
+          }
+        ]
+      }
+    },
+    {
+      "hook": "encounter-start",
+      "title": "Encounter Start CDS Service",
+      "description": "A simulated CDS Service requesting a subset of the standard prefetches that is invoked when the user is initiating a new encounter.",
+      "id": "encounter-start-subset",
+      "prefetch" : {
+        "pat": "Patient/{{context.patientId}}",
+        "enc": "Encounter/{{context.encounterId}}",
+        "cov": "Coverage?patient={{context.patientId}}&status=active",
+        "roles" : "PractitionerRole?_id={{%enc.participant.individual.resolve().ofType(PractitionerRole).id}}",
+        "pracs" : "Practitioner?_id={{%roles.entry.resource.practitioner.resolve().id|%enc.participant.individual.resolve().ofType(Practitioner).id}}",
+        "orgs" : "Organization?_id={{%roles.entry.resource.organization.resolve().id}}",
+        "locs" : "Location?_id={{%roles.entry.resource.location.resolve().id}}"
+      },
+      "extension" : {
+        "davinci-crd.version" : [
+          "2.2",
+          "2.0"
+        ],
+        "davinci-crd.configuration-options" : [
+          {
+            "code" : "coverage-info",
+            "type" : "boolean",
+            "name" : "Coverage Information",
+            "description" : "Information related to the patient's coverage, including whether a service is covered, requires prior authorization, is approved without seeking prior authorization, and/or requires additional documentation or data collection",
+            "default" : true
+          }
+        ]
+      }
+    },
+    {
+      "hook": "encounter-discharge",
+      "title": "Encounter Disharge CDS Service Example",
+      "description": "A simulated CDS Service requesting a subset of the standard prefetches that is invoked when the user is performing the discharge process for an encounter - typically an inpatient encounter.",
+      "id": "encounter-discharge-subset",
+      "prefetch" : {
+        "pat": "Patient/{{context.patientId}}",
+        "enc": "Encounter/{{context.encounterId}}",
+        "cov": "Coverage?patient={{context.patientId}}&status=active",
+        "roles" : "PractitionerRole?_id={{%enc.participant.individual.resolve().ofType(PractitionerRole).id}}",
+        "pracs" : "Practitioner?_id={{%roles.entry.resource.practitioner.resolve().id|%enc.participant.individual.resolve().ofType(Practitioner).id}}",
+        "orgs" : "Organization?_id={{%roles.entry.resource.organization.resolve().id}}",
+        "locs" : "Location?_id={{%roles.entry.resource.location.resolve().id}}"
+      },
+      "extension" : {
+        "davinci-crd.version" : [
+          "2.2",
+          "2.0"
+        ],
+        "davinci-crd.configuration-options" : [
+          {
+            "code" : "coverage-info",
+            "type" : "boolean",
+            "name" : "Coverage Information",
+            "description" : "Information related to the patient's coverage, including whether a service is covered, requires prior authorization, is approved without seeking prior authorization, and/or requires additional documentation or data collection",
+            "default" : true
+          }
+        ]
+      }
+    },
+    {
+      "hook": "order-dispatch",
+      "title": "Order Dispatch CDS Service Example",
+      "description": "A simulated CDS Service requesting a subset of the standard prefetches that fires when a practitioner is selecting a candidate performer for a pre-existing order that was not tied to a specific performer",
+      "id": "order-dispatch-subset",
+      "prefetch": {
+        "pat": "Patient/{{context.patientId}}",
+        "enc": "Encounter/{{context.encounterId}}",
+        "cov": "Coverage?patient={{context.patientId}}&status=active",
+	      "comReqs": "CommunicationRequest?_id={{context.dispatchedOrders.resolve().ofType(CommunicationRequest).id}}",
+	      "devReqs": "DeviceRequest?_id={{context.dispatchedOrders.resolve().ofType(DeviceRequest).id}}",
+        "medReqs": "MedicationRequest?_id={{context.dispatchedOrders.resolve().ofType(MedicationRequest).id}}",
+        "nutOrds": "NutritionOrder?_id={{context.dispatchedOrders.resolve().ofType(NutritionOrder).id}}",
+        "servReqs": "ServiceRequest?_id={{context.dispatchedOrders.resolve().ofType(ServiceRequest).id}}",
+	      "visRxs": "VisionPrescription?_id={{context.dispatchedOrders.resolve().ofType(VisionPrescription).id}}",
+        "devs": "Device?_id={{%devReqs.entry.resource.code.resolve().id}}",
+        "meds": "Medication?_id={{%medReqs.entry.resource.medication.resolve().id}}",
+        "roles": "PractitionerRole?_id={{%comReqs.entry.resource.sender.resolve().ofType(PractitionerRole).id|%comReqs.entry.resource.recipient.resolve().ofType(PractitionerRole).id|%devReqs.entry.resource.performer.resolve().ofType(PractitionerRole).id|%medReqs.entry.resource.performer.resolve().ofType(PractitionerRole).id|%servReqs.entry.resource.performer.resolve().ofType(PractitionerRole).id}}",
+        "pracs": "Practitioner?_id={{%roles.entry.resource.practitioner.resolve().id|%comReqs.entry.resource.sender.resolve().ofType(Practitioner).id|%comReqs.entry.resource.recipient.resolve().ofType(Practitioner).id|%devReqs.entry.resource.performer.resolve().ofType(Practitioner).id|%medReqs.entry.resource.performer.resolve().ofType(Practitioner).id|%servReqs.entry.resource.performer.resolve().ofType(Practitioner).id}}",
+        "locs": "Location?_id={{%roles.entry.resource.location.resolve().id|%enc.location.location.resolve().id|%servReqs.entry.resource.locationReference.resolve().id}}"
+      },
+      "extension" : {
+        "davinci-crd.version" : [
+          "2.2",
+          "2.0"
+        ],
+        "davinci-crd.configuration-options" : [
+          {
+            "code" : "coverage-info",
+            "type" : "boolean",
+            "name" : "Coverage Information",
+            "description" : "Information related to the patient's coverage, including whether a service is covered, requires prior authorization, is approved without seeking prior authorization, and/or requires additional documentation or data collection",
+            "default" : true
+          }
+        ]
+      }
+    },
+    {
+      "hook": "order-select",
+      "title": "Order Select CDS Service",
+      "description": "A simulated CDS Service requesting a subset of the standard prefetches that fires when a clinician selects one or more orders to place for a patient",
+      "id": "order-select-subset",
+      "prefetch": {
+        "pat": "Patient/{{context.patientId}}",
+        "enc": "Encounter/{{context.encounterId}}",
+        "cov": "Coverage?patient={{context.patientId}}&status=active",        
+        "devs": "Device?_id={{context.draftOrders.entry.resource.ofType(DeviceRequest).code.resolve().id}}",
+        "meds": "Medication?_id={{context.draftOrders.entry.resource.ofType(MedicationRequest).medication.resolve().id}}",
+        "roles": "PractitionerRole?_id={{context.draftOrders.entry.resource.sender.resolve().ofType(PractitionerRole).id|context.draftOrders.entry.resource.recipient.resolve().ofType(PractitionerRole).id|context.draftOrders.entry.resource.performer.resolve().ofType(PractitionerRole).id}}",
+        "pracs": "Practitioner?_id={{%roles.entry.resource.practitioner.resolve().id|context.draftOrders.entry.resource.sender.resolve().ofType(Practitioner).id|context.draftOrders.entry.resource.recipient.resolve().ofType(Practitioner).id|context.draftOrders.entry.resource.performer.resolve().ofType(Practitioner).id}}",
+        "locs": "Location?_id={{%roles.entry.resource.location.resolve().id|%enc.location.location.resolve().id|context.draftOrders.entry.resource.locationReference.resolve().id}}"
+      },
+      "extension" : {
+        "davinci-crd.version" : [
+          "2.2",
+          "2.0"
+        ],
+        "davinci-crd.configuration-options" : [
+          {
+            "code" : "coverage-info",
+            "type" : "boolean",
+            "name" : "Coverage Information",
+            "description" : "Information related to the patient's coverage, including whether a service is covered, requires prior authorization, is approved without seeking prior authorization, and/or requires additional documentation or data collection",
+            "default" : true
+          }
+        ]
+      }
+    },
+    {
+      "hook": "order-sign",
+      "title": "Order Sign CDS Service",
+      "description": "A simulated CDS Service requesting a subset of the standard prefetches that fires when a clinician is ready to sign one or more orders for a patient",
+      "id": "order-sign-subset",
+      "prefetch": {
+        "pat": "Patient/{{context.patientId}}",
+        "enc": "Encounter/{{context.encounterId}}",
+        "cov": "Coverage?patient={{context.patientId}}&status=active",        
+        "devs": "Device?_id={{context.draftOrders.entry.resource.ofType(DeviceRequest).code.resolve().id}}",
+        "meds": "Medication?_id={{context.draftOrders.entry.resource.ofType(MedicationRequest).medication.resolve().id}}",
+        "roles": "PractitionerRole?_id={{context.draftOrders.entry.resource.sender.resolve().ofType(PractitionerRole).id|context.draftOrders.entry.resource.recipient.resolve().ofType(PractitionerRole).id|context.draftOrders.entry.resource.performer.resolve().ofType(PractitionerRole).id}}",
+        "pracs": "Practitioner?_id={{%roles.entry.resource.practitioner.resolve().id|context.draftOrders.entry.resource.sender.resolve().ofType(Practitioner).id|context.draftOrders.entry.resource.recipient.resolve().ofType(Practitioner).id|context.draftOrders.entry.resource.performer.resolve().ofType(Practitioner).id}}",
+        "locs": "Location?_id={{%roles.entry.resource.location.resolve().id|%enc.location.location.resolve().id|context.draftOrders.entry.resource.locationReference.resolve().id}}"
+      },
+      "extension" : {
+        "davinci-crd.version" : [
+          "2.2",
+          "2.0"
+        ],
+        "davinci-crd.configuration-options" : [
+          {
+            "code" : "coverage-info",
+            "type" : "boolean",
+            "name" : "Coverage Information",
+            "description" : "Information related to the patient's coverage, including whether a service is covered, requires prior authorization, is approved without seeking prior authorization, and/or requires additional documentation or data collection",
+            "default" : true
+          }
+        ]
+      }
+    }
+  ]
+}