davinci_crd_test_kit 0.14.1 → 0.14.2

data/lib/davinci_crd_test_kit/client/v2.0.1/auth/token_payload_test.rb

@@ -49,34 +49,47 @@ module DaVinciCRDTestKit
 
           begin
             jwk = JSON.parse(auth_token_jwk).deep_symbolize_keys
-
-            payload, =
-              JWT.decode(
-                auth_tokens_list[index],
-                JWT::JWK.import(jwk).public_key,
-                true,
-                algorithms: [jwk[:alg]],
-                exp_leeway: 60,
-                iss: cds_jwt_iss,
-                aud: hook_url,
-                verify_not_before: false,
-                verify_iat: false,
-                verify_jti: true,
-                verify_iss: true,
-                verify_aud: true
-              )
+            unverified_payload, jwt_header = JWT.decode(auth_tokens_list[index], nil, false)
           rescue StandardError => e
             add_message('error', "#{request_number}Token validation error: #{e.message}")
             next
           end
 
-          missing_claims = required_claims - payload.keys
-          missing_claims_string = missing_claims.map { |claim| "`#{claim}`" }.join(', ')
+          alg = jwk[:alg] || jwt_header['alg']
 
-          unless missing_claims.empty?
-            add_message('error', "#{request_number}JWT payload missing required claims: #{missing_claims_string}")
-            next
+          # Continue checking the rest of the token even when one check fails, so the tester sees every
+          # issue at once rather than fixing them one error at a time.
+          # CDS Hooks prohibits the `none` algorithm and symmetric (HMAC) algorithms for the authentication JWT.
+          if alg.to_s.match?(/\A(none|hs\d+)\z/i)
+            add_message('error',
+                        "#{request_number}Token signature algorithm #{alg.inspect} is not permitted; CDS Hooks " \
+                        'prohibits the `none` algorithm and symmetric (HMAC) algorithms.')
           end
+
+          begin
+            JWT.decode(
+              auth_tokens_list[index],
+              JWT::JWK.import(jwk).public_key,
+              true,
+              algorithms: [alg],
+              exp_leeway: 60,
+              iss: cds_jwt_iss,
+              aud: hook_url,
+              verify_not_before: false,
+              verify_iat: false,
+              verify_jti: true,
+              verify_iss: true,
+              verify_aud: true
+            )
+          rescue StandardError => e
+            add_message('error', "#{request_number}Token validation error: #{e.message}")
+          end
+
+          missing_claims = required_claims - unverified_payload.keys
+          next if missing_claims.empty?
+
+          missing_claims_string = missing_claims.map { |claim| "`#{claim}`" }.join(', ')
+          add_message('error', "#{request_number}JWT payload missing required claims: #{missing_claims_string}")
         end
         no_error_validation('Token payload is missing required claims or does not have a valid signature.')
       end

data/lib/davinci_crd_test_kit/client/v2.0.1/cds-services-v201.json

@@ -25,48 +25,48 @@
       }
     },
     {
-      "hook": "encounter-discharge",
-      "title": "Encounter Disharge CDS Service Example",
-      "description": "An example of a CDS Service that is invoked when the user is performing the discharge process for an encounter - typically an inpatient encounter.",
-      "id": "encounter-discharge-service",
+      "hook": "order-select",
+      "title": "Order Select CDS Service",
+      "description": "An example of a CDS Service that fires when a clinician selects one or more orders to place for a patient",
+      "id": "order-select-service",
       "prefetch": {
         "user": "{{context.userId}}",
         "patient": "Patient/{{context.patientId}}",
-        "encounter": "Encounter/{{context.encounterId}}",
         "coverage": "Coverage?patient={{context.patientId}}&status=active"
       }
     },
     {
-      "hook": "order-dispatch",
-      "title": "Order Dispatch CDS Service Example",
-      "description": "An example of a CDS Service that fires when a practitioner is selecting a candidate performer for a pre-existing order that was not tied to a specific performer",
-      "id": "order-dispatch-service",
+      "hook": "order-sign",
+      "title": "Order Sign CDS Service",
+      "description": "An example of a CDS Service that fires when a clinician is ready to sign one or more orders for a patient",
+      "id": "order-sign-service",
       "prefetch": {
+        "user": "{{context.userId}}",
         "patient": "Patient/{{context.patientId}}",
-        "performer": "{{context.performer}}",
-        "order": "{{context.order}}",
         "coverage": "Coverage?patient={{context.patientId}}&status=active"
       }
     },
     {
-      "hook": "order-select",
-      "title": "Order Select CDS Service",
-      "description": "An example of a CDS Service that fires when a clinician selects one or more orders to place for a patient",
-      "id": "order-select-service",
+      "hook": "order-dispatch",
+      "title": "Order Dispatch CDS Service Example",
+      "description": "An example of a CDS Service that fires when a practitioner is selecting a candidate performer for a pre-existing order that was not tied to a specific performer",
+      "id": "order-dispatch-service",
       "prefetch": {
-        "user": "{{context.userId}}",
         "patient": "Patient/{{context.patientId}}",
+        "performer": "{{context.performer}}",
+        "order": "{{context.order}}",
         "coverage": "Coverage?patient={{context.patientId}}&status=active"
       }
     },
     {
-      "hook": "order-sign",
-      "title": "Order Sign CDS Service",
-      "description": "An example of a CDS Service that fires when a clinician is ready to sign one or more orders for a patient",
-      "id": "order-sign-service",
+      "hook": "encounter-discharge",
+      "title": "Encounter Disharge CDS Service Example",
+      "description": "An example of a CDS Service that is invoked when the user is performing the discharge process for an encounter - typically an inpatient encounter.",
+      "id": "encounter-discharge-service",
       "prefetch": {
         "user": "{{context.userId}}",
         "patient": "Patient/{{context.patientId}}",
+        "encounter": "Encounter/{{context.encounterId}}",
         "coverage": "Coverage?patient={{context.patientId}}&status=active"
       }
     }

data/lib/davinci_crd_test_kit/client/v2.0.1/client_appointment_book_group.rb

@@ -59,7 +59,9 @@ module DaVinciCRDTestKit
         },
         options: {
           hook_name: 'appointment-book',
-          hook_path: APPOINTMENT_BOOK_PATH
+          hook_path: APPOINTMENT_BOOK_PATH,
+          crd_interaction_group: 'hooks-appointment-book',
+          include_in_cross_hook_analysis: true
         }
       )
 
@@ -69,11 +71,10 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Authorization'
-        test from: :crd_v201_decode_auth_token
-        test from: :crd_v201_retrieve_jwks
-        test from: :crd_v201_token_header
-        test from: :crd_v201_token_payload
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
       end
 
       group do
@@ -98,10 +99,11 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Response Handling'
-
-        test from: :crd_v201_inferno_response_validation
-        test from: :crd_v201_card_display_attest_test
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
       end
     end
   end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_encounter_discharge_group.rb

@@ -59,7 +59,9 @@ module DaVinciCRDTestKit
         },
         options: {
           hook_name: 'encounter-discharge',
-          hook_path: ENCOUNTER_DISCHARGE_PATH
+          hook_path: ENCOUNTER_DISCHARGE_PATH,
+          crd_interaction_group: 'hooks-encounter-discharge',
+          include_in_cross_hook_analysis: true
         }
       )
 
@@ -69,11 +71,10 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Authorization'
-        test from: :crd_v201_decode_auth_token
-        test from: :crd_v201_retrieve_jwks
-        test from: :crd_v201_token_header
-        test from: :crd_v201_token_payload
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
       end
 
       group do
@@ -95,10 +96,11 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Response Handling'
-
-        test from: :crd_v201_inferno_response_validation
-        test from: :crd_v201_card_display_attest_test
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
       end
     end
   end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_encounter_start_group.rb

@@ -59,7 +59,9 @@ module DaVinciCRDTestKit
         },
         options: {
           hook_name: 'encounter-start',
-          hook_path: ENCOUNTER_START_PATH
+          hook_path: ENCOUNTER_START_PATH,
+          crd_interaction_group: 'hooks-encounter-start',
+          include_in_cross_hook_analysis: true
         }
       )
 
@@ -69,11 +71,10 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Authorization'
-        test from: :crd_v201_decode_auth_token
-        test from: :crd_v201_retrieve_jwks
-        test from: :crd_v201_token_header
-        test from: :crd_v201_token_payload
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
       end
 
       group do
@@ -95,10 +96,11 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Response Handling'
-
-        test from: :crd_v201_inferno_response_validation
-        test from: :crd_v201_card_display_attest_test
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
       end
     end
   end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_hooks_group.rb

@@ -14,10 +14,10 @@ module DaVinciCRDTestKit
         [six hooks contained in the implementation guide](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html):
         * [appointment-book](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#appointment-book)
         * [encounter-start](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#encounter-start)
-        * [encounter-discharge](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#encounter-discharge)
         * [order-select](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#order-select)
-        * [order-dispatch](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#order-dispatch)
         * [order-sign](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#order-sign)
+        * [order-dispatch](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#order-dispatch)
+        * [encounter-discharge](https://hl7.org/fhir/us/davinci-crd/STU2/hooks.html#encounter-discharge)
 
         Each hook group contains a test which waits for incoming hook requests from the CRD client, and tests which
         verify the incoming hook requests conform to the specific hook requirements specified the
@@ -58,16 +58,16 @@ module DaVinciCRDTestKit
       group from: :crd_v201_client_encounter_start,
             optional: true
 
-      group from: :crd_v201_client_encounter_discharge,
+      group from: :crd_v201_client_order_select,
             optional: true
 
-      group from: :crd_v201_client_order_select,
+      group from: :crd_v201_client_order_sign,
             optional: true
 
       group from: :crd_v201_client_order_dispatch,
             optional: true
 
-      group from: :crd_v201_client_order_sign,
+      group from: :crd_v201_client_encounter_discharge,
             optional: true
     end
   end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_order_dispatch_group.rb

@@ -58,7 +58,9 @@ module DaVinciCRDTestKit
         },
         options: {
           hook_name: 'order-dispatch',
-          hook_path: ORDER_DISPATCH_PATH
+          hook_path: ORDER_DISPATCH_PATH,
+          crd_interaction_group: 'hooks-order-dispatch',
+          include_in_cross_hook_analysis: true
         }
       )
 
@@ -68,11 +70,10 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Authorization'
-        test from: :crd_v201_decode_auth_token
-        test from: :crd_v201_retrieve_jwks
-        test from: :crd_v201_token_header
-        test from: :crd_v201_token_payload
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
       end
 
       group do
@@ -101,10 +102,11 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Response Handling'
-
-        test from: :crd_v201_inferno_response_validation
-        test from: :crd_v201_card_display_attest_test
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
       end
     end
   end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_order_select_group.rb

@@ -60,7 +60,9 @@ module DaVinciCRDTestKit
         },
         options: {
           hook_name: 'order-select',
-          hook_path: ORDER_SELECT_PATH
+          hook_path: ORDER_SELECT_PATH,
+          crd_interaction_group: 'hooks-order-select',
+          include_in_cross_hook_analysis: true
         }
       )
 
@@ -70,11 +72,10 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Authorization'
-        test from: :crd_v201_decode_auth_token
-        test from: :crd_v201_retrieve_jwks
-        test from: :crd_v201_token_header
-        test from: :crd_v201_token_payload
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
       end
 
       group do
@@ -106,10 +107,11 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Response Handling'
-
-        test from: :crd_v201_inferno_response_validation
-        test from: :crd_v201_card_display_attest_test
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
       end
     end
   end

data/lib/davinci_crd_test_kit/client/v2.0.1/client_order_sign_group.rb

@@ -59,7 +59,9 @@ module DaVinciCRDTestKit
         },
         options: {
           hook_name: 'order-sign',
-          hook_path: ORDER_SIGN_PATH
+          hook_path: ORDER_SIGN_PATH,
+          crd_interaction_group: 'hooks-order-sign',
+          include_in_cross_hook_analysis: true
         }
       )
 
@@ -69,11 +71,10 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Authorization'
-        test from: :crd_v201_decode_auth_token
-        test from: :crd_v201_retrieve_jwks
-        test from: :crd_v201_token_header
-        test from: :crd_v201_token_payload
+        title 'Verify Response Handling'
+
+        test from: :crd_v201_inferno_response_validation
+        test from: :crd_v201_card_display_attest_test
       end
 
       group do
@@ -103,10 +104,11 @@ module DaVinciCRDTestKit
       end
 
       group do
-        title 'Verify Response Handling'
-
-        test from: :crd_v201_inferno_response_validation
-        test from: :crd_v201_card_display_attest_test
+        title 'Verify Authorization'
+        test from: :crd_v201_decode_auth_token
+        test from: :crd_v201_retrieve_jwks
+        test from: :crd_v201_token_header
+        test from: :crd_v201_token_payload
       end
     end
   end

data/lib/davinci_crd_test_kit/client/v2.0.1/must_support/client_card_must_support_coverage_information.rb

@@ -1,9 +1,11 @@
 require_relative '../../../cross_suite/cards_identification'
+require_relative '../../tagged_request_load_helper'
 
 module DaVinciCRDTestKit
   module V201
     class ClientCardMustSupportCoverageInformationTest < Inferno::Test
       include CardsIdentification
+      include TaggedRequestLoadHelper
 
       title 'Coverage Information Action Support'
       id :crd_v201_client_card_must_support_coverage_information
@@ -19,47 +21,12 @@ module DaVinciCRDTestKit
         and support for them is demonstrated.
       DESCRIPTION
 
-      ALL_HOOKS = [
-        APPOINTMENT_BOOK_TAG,
-        ENCOUNTER_START_TAG,
-        ENCOUNTER_DISCHARGE_TAG,
-        ORDER_DISPATCH_TAG,
-        ORDER_SELECT_TAG,
-        ORDER_SIGN_TAG
-      ].freeze
-
       def metadata
         @metadata ||= YAML.load_file(
           File.join(__dir__, '..', '..', '..', 'cross_suite', 'coverage-information_stu201_metadata.yml')
         )
       end
 
-      def configured_hook_name
-        config.options[:hook_name]
-      end
-
-      def crd_test_group
-        config.options[:crd_test_group]
-      end
-
-      def tags_to_load(hook_name)
-        crd_test_group.present? ? [hook_name, crd_test_group] : [hook_name]
-      end
-
-      def requests_to_analyze
-        if configured_hook_name.present?
-          load_requests_for_tags(tags_to_load(configured_hook_name))
-        else
-          ALL_HOOKS.each_with_object([]) do |hook_name, request_list|
-            request_list.concat(load_requests_for_tags(tags_to_load(hook_name)))
-          end
-        end
-      end
-
-      def load_requests_for_tags(tags_to_load)
-        load_tagged_requests(*tags_to_load)
-      end
-
       class MustSupportMetadataHolder
         attr_accessor :metadata
 
@@ -77,7 +44,7 @@ module DaVinciCRDTestKit
       end
 
       run do
-        loaded_requests = requests_to_analyze
+        loaded_requests = load_requests_for_cross_hook_analysis
 
         sorted_cards = sorted_cards_from_requests(loaded_requests)
 

data/lib/davinci_crd_test_kit/client/v2.0.1/must_support/client_card_must_support_external_reference.rb

@@ -1,9 +1,11 @@
 require_relative '../../../cross_suite/cards_identification'
+require_relative '../../tagged_request_load_helper'
 
 module DaVinciCRDTestKit
   module V201
     class ClientCardMustSupportExternalReferenceTest < Inferno::Test
       include CardsIdentification
+      include TaggedRequestLoadHelper
 
       title 'External Reference Card Support'
       id :crd_v201_client_card_must_support_external_reference
@@ -15,43 +17,8 @@ module DaVinciCRDTestKit
         and/or the hook requests made by the client during the Hooks tests such that an External Reference card is returned and support for it is demonstrated.
       DESCRIPTION
 
-      ALL_HOOKS = [
-        APPOINTMENT_BOOK_TAG,
-        ENCOUNTER_START_TAG,
-        ENCOUNTER_DISCHARGE_TAG,
-        ORDER_DISPATCH_TAG,
-        ORDER_SELECT_TAG,
-        ORDER_SIGN_TAG
-      ].freeze
-
-      def configured_hook_name
-        config.options[:hook_name]
-      end
-
-      def crd_test_group
-        config.options[:crd_test_group]
-      end
-
-      def tags_to_load(hook_name)
-        crd_test_group.present? ? [hook_name, crd_test_group] : [hook_name]
-      end
-
-      def requests_to_analyze
-        if configured_hook_name.present?
-          load_requests_for_tags(tags_to_load(configured_hook_name))
-        else
-          ALL_HOOKS.each_with_object([]) do |hook_name, request_list|
-            request_list.concat(load_requests_for_tags(tags_to_load(hook_name)))
-          end
-        end
-      end
-
-      def load_requests_for_tags(tags_to_load)
-        load_tagged_requests(*tags_to_load)
-      end
-
       run do
-        loaded_requests = requests_to_analyze
+        loaded_requests = load_requests_for_cross_hook_analysis
         sorted_cards = sorted_cards_from_requests(loaded_requests)
 
         assert sorted_cards['cards'][EXTERNAL_REFERENCE_RESPONSE_TYPE].present?,

data/lib/davinci_crd_test_kit/client/v2.0.1/must_support/client_card_must_support_instructions.rb

@@ -1,9 +1,11 @@
 require_relative '../../../cross_suite/cards_identification'
+require_relative '../../tagged_request_load_helper'
 
 module DaVinciCRDTestKit
   module V201
     class ClientCardMustSupportInstructionsTest < Inferno::Test
       include CardsIdentification
+      include TaggedRequestLoadHelper
 
       title 'Instructions Card Support'
       id :crd_v201_client_card_must_support_instructions
@@ -15,43 +17,8 @@ module DaVinciCRDTestKit
         and/or the hook requests made by the client during the Hooks tests such that an Instructions card is returned and support for it is demonstrated.
       DESCRIPTION
 
-      ALL_HOOKS = [
-        APPOINTMENT_BOOK_TAG,
-        ENCOUNTER_START_TAG,
-        ENCOUNTER_DISCHARGE_TAG,
-        ORDER_DISPATCH_TAG,
-        ORDER_SELECT_TAG,
-        ORDER_SIGN_TAG
-      ].freeze
-
-      def configured_hook_name
-        config.options[:hook_name]
-      end
-
-      def crd_test_group
-        config.options[:crd_test_group]
-      end
-
-      def tags_to_load(hook_name)
-        crd_test_group.present? ? [hook_name, crd_test_group] : [hook_name]
-      end
-
-      def requests_to_analyze
-        if configured_hook_name.present?
-          load_requests_for_tags(tags_to_load(configured_hook_name))
-        else
-          ALL_HOOKS.each_with_object([]) do |hook_name, request_list|
-            request_list.concat(load_requests_for_tags(tags_to_load(hook_name)))
-          end
-        end
-      end
-
-      def load_requests_for_tags(tags_to_load)
-        load_tagged_requests(*tags_to_load)
-      end
-
       run do
-        loaded_requests = requests_to_analyze
+        loaded_requests = load_requests_for_cross_hook_analysis
         sorted_cards = sorted_cards_from_requests(loaded_requests)
 
         assert sorted_cards['cards'][INSTRUCTIONS_RESPONSE_TYPE].present?,

data/lib/davinci_crd_test_kit/client/v2.0.1/verify_request/hook_request_fetched_data_test.rb

@@ -1,8 +1,11 @@
 require_relative '../../../cross_suite/tags'
+require_relative '../../tagged_request_load_helper'
 
 module DaVinciCRDTestKit
   module V201
     class HookRequestFetchedDataTest < Inferno::Test
+      include TaggedRequestLoadHelper
+
       id :crd_v201_hook_request_fetched_data
       title 'Minimum resource dataset was accessible during the hook invocation'
       description %(
@@ -33,24 +36,12 @@ module DaVinciCRDTestKit
       )
       verifies_requirements 'hl7.fhir.us.davinci-crd_2.0.1@43', 'hl7.fhir.us.davinci-crd_2.0.1@323'
 
-      def hook_name
-        config.options[:hook_name]
-      end
-
-      def crd_test_group
-        config.options[:crd_test_group]
-      end
-
-      def tags_to_load
-        crd_test_group.present? ? [hook_name, crd_test_group] : [hook_name]
-      end
-
       def no_error_validation(message)
         assert messages.none? { |msg| msg[:type] == 'error' }, message
       end
 
       run do
-        hook_requests = load_tagged_requests(*tags_to_load)
+        hook_requests = load_interaction_group_requests
 
         hook_requests.each do |hook_request|
           request_body = JSON.parse(hook_request.request_body)