davinci_dtr_test_kit 0.13.0 → 0.14.1

data/lib/davinci_dtr_test_kit/dtr_light_ehr_suite.rb

@@ -1,6 +1,17 @@
+require 'us_core_test_kit'
 require 'tls_test_kit'
 require_relative 'version'
 require_relative 'dtr_options'
+require_relative 'profiles/questionnaire_response_group'
+require_relative 'profiles/coverage_group'
+require_relative 'profiles/communication_request_group'
+require_relative 'profiles/device_request_group'
+require_relative 'profiles/encounter_group'
+require_relative 'profiles/medication_request_group'
+require_relative 'profiles/nutrition_order_group'
+require_relative 'profiles/service_request_group'
+require_relative 'profiles/task_group'
+require_relative 'profiles/vision_prescription_group'
 require 'smart_app_launch/smart_stu1_suite'
 require 'smart_app_launch/smart_stu2_suite'
 
@@ -32,8 +43,17 @@ module DaVinciDTRTestKit
     ]
 
     input :url,
-          title: 'FHIR Endpoint',
-          description: 'URL of the DTR FHIR server'
+          title: 'FHIR Server Base Url',
+          description: 'URL of the target DTR Light EHR'
+
+    # Hl7 Validator Wrapper:
+    fhir_resource_validator do
+      igs('hl7.fhir.us.davinci-dtr#2.0.1', 'hl7.fhir.us.davinci-pas#2.0.1', 'hl7.fhir.us.davinci-crd#2.0.1')
+
+      exclude_message do |message|
+        message.message.match?(/\A\S+: \S+: URL value '.*' does not resolve/)
+      end
+    end
 
     group do
       title 'Authorization'
@@ -71,5 +91,50 @@ module DaVinciDTRTestKit
             required_suite_options: DTROptions::SMART_2_REQUIREMENT,
             run_as_group: true
     end
+
+    group do
+      title 'FHIR API'
+      description %(This test group tests systems for their conformance to
+      the US Core v3.1.1 Capability Statement as defined by the DaVinci Documentation
+      Templates and Rules (DTR) v2.0.1 Implementation Guide Light DTR EHR
+      Capability Statement.
+
+      )
+
+      group from: :'us_core_v311-us_core_v311_fhir_api',
+            run_as_group: true
+    end
+
+    group do
+      title 'DTR Light EHR Profiles'
+      description %(This test group tests system for their conformance to
+      the RESTful capabilities by specified Resources/Profiles as defined by
+      the DaVinci Documentation Templates and Rules (DTR) v2.0,1 Implementation
+      Guide Light DTR EHR Capability Statement.
+
+      )
+
+      input :credentials,
+            title: 'OAuth Credentials',
+            type: :oauth_credentials,
+            optional: true
+
+      # All FHIR requests in this suite will use this FHIR client
+      fhir_client do
+        url :url
+        oauth_credentials :credentials
+      end
+
+      group from: :questionnaire_response_group
+      group from: :coverage_group
+      group from: :communication_request_group
+      group from: :device_request_group
+      group from: :encounter_group
+      group from: :medication_request_group
+      group from: :nutrition_order_group
+      group from: :service_request_group
+      group from: :task_group
+      group from: :vision_prescription_group
+    end
   end
 end

data/lib/davinci_dtr_test_kit/dtr_payer_server_suite.rb

@@ -1,17 +1,15 @@
-require_relative 'ext/inferno_core/runnable'
-require_relative 'ext/inferno_core/record_response_route'
-require_relative 'ext/inferno_core/request'
 require_relative 'payer_server_groups/payer_server_static_group'
 require_relative 'payer_server_groups/payer_server_adaptive_group'
 require_relative 'tags'
-require_relative 'mock_payer'
-require_relative 'mock_auth_server'
+require_relative 'endpoints/cors'
+require_relative 'endpoints/mock_authorization/simple_token_endpoint'
+require_relative 'endpoints/mock_payer/questionnaire_package_proxy_endpoint'
+require_relative 'endpoints/mock_payer/next_question_proxy_endpoint'
 require_relative 'version'
 
 module DaVinciDTRTestKit
   class DTRPayerServerSuite < Inferno::TestSuite
-    extend MockAuthServer
-    extend MockPayer
+    extend CORS
 
     id :dtr_payer_server
     title 'Da Vinci DTR Payer Server Test Suite'
@@ -106,22 +104,13 @@ module DaVinciDTRTestKit
 
     allow_cors QUESTIONNAIRE_PACKAGE_PATH, NEXT_PATH
 
-    record_response_route :post, PAYER_TOKEN_PATH, 'dtr_payer_auth', method(:payer_token_response) do |request|
-      DTRPayerServerSuite.extract_client_id_from_form_params(request)
-    end
-
-    record_response_route :post, QUESTIONNAIRE_PACKAGE_PATH, QUESTIONNAIRE_TAG,
-                          method(:payer_questionnaire_response), resumes: method(:test_resumes?) do |request|
-      DTRPayerServerSuite.extract_bearer_token(request)
-    end
+    suite_endpoint :post, PAYER_TOKEN_PATH, MockAuthorization::SimpleTokenEndpoint
 
-    record_response_route :post, NEXT_PATH, NEXT_TAG,
-                          method(:questionnaire_next_response), resumes: method(:test_resumes?) do |request|
-      DTRPayerServerSuite.extract_bearer_token(request)
-    end
+    suite_endpoint :post, QUESTIONNAIRE_PACKAGE_PATH, MockPayer::QuestionnairePackageProxyEndpoint
+    suite_endpoint :post, NEXT_PATH, MockPayer::NextQuestionProxyEndpoint
 
     resume_test_route :get, RESUME_PASS_PATH do |request|
-      DTRPayerServerSuite.extract_token_from_query_params(request)
+      request.query_parameters['token']
     end
 
     group from: :payer_server_static_package

data/lib/davinci_dtr_test_kit/dtr_questionnaire_response_validation.rb

@@ -20,10 +20,10 @@ module DaVinciDTRTestKit
       assert_resource_type(:questionnaire_response, resource: questionnaire_response)
     end
 
-    def verify_basic_conformance(questionnaire_response_json)
+    def verify_basic_conformance(questionnaire_response_json, profile_url = nil)
+      profile_url ||= 'http://hl7.org/fhir/us/davinci-dtr/StructureDefinition/dtr-questionnaireresponse|2.0.1'
       check_is_questionnaire_response(questionnaire_response_json)
-      assert_valid_resource(resource: FHIR.from_contents(questionnaire_response_json),
-                            profile_url: 'http://hl7.org/fhir/us/davinci-dtr/StructureDefinition/dtr-questionnaireresponse|2.0.1')
+      assert_valid_resource(resource: FHIR.from_contents(questionnaire_response_json), profile_url:)
     end
 
     # This only checks answers in the questionnaire response, meaning it does not catch missing answers
@@ -55,17 +55,25 @@ module DaVinciDTRTestKit
       end
     end
 
-    # This checks presence of all answers if link_ids is nil
-    def check_answer_presence(items, link_ids: nil)
-      items.each do |item|
-        check_answer_presence(item.item, link_ids:)
-
-        if !item.answer&.first&.value.present? && (link_ids.nil? || link_ids.include?(item.linkId))
-          add_message('error', "No answer for item #{item.linkId}")
+    # Ensures that all required questions have been answered.
+    # If required_link_ids not provided, all questions are treated as optional.
+    def check_answer_presence(response_items, required_link_ids = [])
+      required_link_ids.each do |link_id|
+        item = find_item_by_link_id(response_items, link_id)
+        unless item&.answer&.any? { |answer| answer.value.present? }
+          add_message('error', "No answer for item #{link_id}")
         end
       end
     end
 
+    def extract_required_link_ids(questionnaire_items)
+      questionnaire_items.each_with_object([]) do |item, required_link_ids|
+        required_link_ids << item.linkId if item.required
+
+        required_link_ids.concat(extract_required_link_ids(item.item)) if item.item.present?
+      end
+    end
+
     # Requirements:
     #  - Prior to exposing the draft QuestionnaireResponse to the user for completion and/or review, the DTR client
     #    SHALL execute all CQL necessary to resolve the initialExpression, candidateExpression and

data/lib/davinci_dtr_test_kit/dtr_smart_app_suite.rb

@@ -1,19 +1,21 @@
-require_relative 'ext/inferno_core/runnable'
-require_relative 'ext/inferno_core/record_response_route'
-require_relative 'ext/inferno_core/request'
 require_relative 'auth_groups/oauth2_authentication_group'
 require_relative 'client_groups/resp_assist_device/dtr_smart_app_questionnaire_workflow_group'
 require_relative 'client_groups/dinner_static/dtr_smart_app_questionnaire_workflow_group'
 require_relative 'client_groups/dinner_adaptive/dtr_smart_app_questionnaire_workflow_group'
-require_relative 'mock_payer'
-require_relative 'mock_ehr'
+require_relative 'endpoints/cors'
+require_relative 'endpoints/mock_authorization'
+require_relative 'endpoints/mock_authorization/authorize_endpoint'
+require_relative 'endpoints/mock_authorization/token_endpoint'
+require_relative 'endpoints/mock_payer/questionnaire_package_endpoint'
+require_relative 'endpoints/mock_payer/next_question_endpoint'
+require_relative 'endpoints/mock_ehr'
+require_relative 'endpoints/mock_ehr/questionnaire_response_endpoint'
+require_relative 'endpoints/mock_ehr/fhir_get_endpoint'
 require_relative 'version'
 
 module DaVinciDTRTestKit
   class DTRSmartAppSuite < Inferno::TestSuite
-    extend MockAuthServer
-    extend MockEHR
-    extend MockPayer
+    extend CORS
 
     id :dtr_smart_app
     title 'Da Vinci DTR SMART App Test Suite'
@@ -50,61 +52,32 @@ module DaVinciDTRTestKit
     end
 
     allow_cors QUESTIONNAIRE_PACKAGE_PATH, QUESTIONNAIRE_RESPONSE_PATH, FHIR_RESOURCE_PATH, FHIR_SEARCH_PATH,
-               EHR_AUTHORIZE_PATH, EHR_TOKEN_PATH, JKWS_PATH, OPENID_CONFIG_PATH
-
-    route(:get, '/fhir/metadata', method(:metadata_handler))
-
-    route(:get, SMART_CONFIG_PATH, method(:ehr_smart_config))
-    route(:get, OPENID_CONFIG_PATH, method(:ehr_openid_config))
-
-    route(:get, JKWS_PATH, method(:auth_server_jwks))
-
-    record_response_route :get, EHR_AUTHORIZE_PATH, EHR_AUTHORIZE_TAG, method(:ehr_authorize),
-                          resumes: ->(_) { false } do |request|
-      DTRSmartAppSuite.extract_client_id_from_query_params(request)
-    end
-
-    record_response_route :post, EHR_AUTHORIZE_PATH, EHR_AUTHORIZE_TAG, method(:ehr_authorize),
-                          resumes: ->(_) { false } do |request|
-      DTRSmartAppSuite.extract_client_id_from_form_params(request)
-    end
-
-    record_response_route :post, EHR_TOKEN_PATH, 'dtr_smart_app_ehr_token', method(:ehr_token_response),
-                          resumes: ->(_) { false } do |request|
-      DTRSmartAppSuite.extract_client_id_from_token_request(request)
-    end
-
-    record_response_route :post, PAYER_TOKEN_PATH, 'dtr_smart_app_payer_token',
-                          method(:payer_token_response) do |request|
-      DTRSmartAppSuite.extract_client_id_from_client_assertion(request)
-    end
-
-    record_response_route :post, QUESTIONNAIRE_PACKAGE_PATH, QUESTIONNAIRE_PACKAGE_TAG,
-                          method(:questionnaire_package_response), resumes: ->(_) { false } do |request|
-      DTRSmartAppSuite.extract_client_id_from_bearer_token(request)
-    end
-
-    record_response_route :post, QUESTIONNAIRE_RESPONSE_PATH, 'dtr_smart_app_questionnaire_response',
-                          method(:questionnaire_response_response) do |request|
-      DTRSmartAppSuite.extract_client_id_from_bearer_token(request)
-    end
-
-    record_response_route :get, FHIR_RESOURCE_PATH, SMART_APP_EHR_REQUEST_TAG, method(:get_fhir_resource),
-                          resumes: ->(_) { false } do |request|
-      DTRSmartAppSuite.extract_client_id_from_bearer_token(request)
-    end
-
-    record_response_route :get, FHIR_SEARCH_PATH, SMART_APP_EHR_REQUEST_TAG, method(:get_fhir_resource),
-                          resumes: ->(_) { false } do |request|
-      DTRSmartAppSuite.extract_client_id_from_bearer_token(request)
-    end
+               EHR_AUTHORIZE_PATH, EHR_TOKEN_PATH, JKWS_PATH, OPENID_CONFIG_PATH, NEXT_PATH
+
+    # Authorization server
+    route(:get, SMART_CONFIG_PATH, MockAuthorization.method(:ehr_smart_config))
+    route(:get, OPENID_CONFIG_PATH, MockAuthorization.method(:ehr_openid_config))
+    route(:get, JKWS_PATH, MockAuthorization.method(:jwks))
+    suite_endpoint :get, EHR_AUTHORIZE_PATH, MockAuthorization::AuthorizeEndpoint
+    suite_endpoint :post, EHR_AUTHORIZE_PATH, MockAuthorization::AuthorizeEndpoint
+    suite_endpoint :post, EHR_TOKEN_PATH, MockAuthorization::TokenEndpoint
+
+    # Payer
+    suite_endpoint :post, QUESTIONNAIRE_PACKAGE_PATH, MockPayer::QuestionnairePackageEndpoint
+    suite_endpoint :post, NEXT_PATH, MockPayer::NextQuestionEndpoint
+
+    # EHR
+    route(:get, '/fhir/metadata', MockEHR.method(:metadata))
+    suite_endpoint :post, QUESTIONNAIRE_RESPONSE_PATH, MockEHR::QuestionnaireResponseEndpoint
+    suite_endpoint :get, FHIR_RESOURCE_PATH, MockEHR::FHIRGetEndpoint
+    suite_endpoint :get, FHIR_SEARCH_PATH, MockEHR::FHIRGetEndpoint
 
     resume_test_route :get, RESUME_PASS_PATH do |request|
-      DTRSmartAppSuite.extract_client_id_from_query_params(request)
+      request.query_parameters['client_id'] || request.query_parameters['token']
     end
 
     resume_test_route :get, RESUME_FAIL_PATH, result: 'fail' do |request|
-      DTRSmartAppSuite.extract_client_id_from_query_params(request)
+      request.query_parameters['client_id'] || request.query_parameters['token']
     end
 
     # TODO: Update based on SMART Launch changes. Do we even want to have this group now?
@@ -118,7 +91,7 @@ module DaVinciDTRTestKit
       )
 
       group from: :dtr_smart_app_static_dinner_questionnaire_workflow
-      # group from: :dtr_smart_app_adaptive_dinner_questionnaire_workflow - TODO
+      group from: :dtr_smart_app_adaptive_dinner_questionnaire_workflow
     end
     group do
       id :dtr_smart_app_questionnaire_functionality

data/lib/davinci_dtr_test_kit/endpoints/cors.rb

@@ -0,0 +1,20 @@
+module DaVinciDTRTestKit
+  module CORS
+    PRE_FLIGHT_HANDLER = proc do
+      [
+        200,
+        {
+          'Access-Control-Allow-Origin' => '*',
+          'Access-Control-Allow-Headers' => 'Content-Type, Authorization'
+        },
+        ['']
+      ]
+    end
+
+    def allow_cors(*paths)
+      paths.each do |path|
+        route(:options, path, PRE_FLIGHT_HANDLER)
+      end
+    end
+  end
+end

data/lib/davinci_dtr_test_kit/endpoints/mock_authorization/authorize_endpoint.rb

@@ -0,0 +1,32 @@
+module DaVinciDTRTestKit
+  module MockAuthorization
+    class AuthorizeEndpoint < Inferno::DSL::SuiteEndpoint
+      def test_run_identifier
+        request.params[:client_id]
+      end
+
+      def tags
+        [EHR_AUTHORIZE_TAG]
+      end
+
+      def make_response
+        if request.params[:redirect_uri].present?
+          redirect_uri = "#{request.params[:redirect_uri]}?" \
+                         "code=#{SecureRandom.hex}&" \
+                         "state=#{request.params[:state]}"
+          response.status = 302
+          response.headers['Location'] = redirect_uri
+        else
+          response.status = 400
+          response.format = 'application/fhir+json'
+          response.body = FHIR::OperationOutcome.new(
+            issue: FHIR::OperationOutcome::Issue.new(severity: 'fatal', code: 'required',
+                                                     details: FHIR::CodeableConcept.new(
+                                                       text: 'No redirect_uri provided'
+                                                     ))
+          ).to_json
+        end
+      end
+    end
+  end
+end

data/lib/davinci_dtr_test_kit/endpoints/mock_authorization/simple_token_endpoint.rb

@@ -0,0 +1,19 @@
+module DaVinciDTRTestKit
+  module MockAuthorization
+    class SimpleTokenEndpoint < Inferno::DSL::SuiteEndpoint
+      def test_run_identifier
+        request.params[:client_id]
+      end
+
+      # Placeholder for a more complete mock token endpoint
+      def make_response
+        response.body = { access_token: SecureRandom.hex, token_type: 'bearer', expires_in: 3600 }.to_json
+        response.status = 200
+      end
+
+      def update_result
+        results_repo.update_result(result.id, 'pass')
+      end
+    end
+  end
+end

data/lib/davinci_dtr_test_kit/endpoints/mock_authorization/token_endpoint.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require_relative '../../urls'
+require_relative '../mock_authorization'
+
+module DaVinciDTRTestKit
+  module MockAuthorization
+    AUTHORIZED_PRACTITIONER_ID = 'pra1234' # Must exist on the FHIR_REFERENCE_SERVER (env var)
+
+    class TokenEndpoint < Inferno::DSL::SuiteEndpoint
+      def test_run_identifier
+        extract_client_id
+      end
+
+      def make_response
+        client_id = extract_client_id
+        access_token = JWT.encode({ inferno_client_id: client_id }, nil, 'none')
+        granted_scopes = SUPPORTED_SCOPES & requested_scopes
+
+        response_hash = { access_token:, scope: granted_scopes.join(' '), token_type: 'bearer', expires_in: 3600 }
+
+        if granted_scopes.include?('openid')
+          response_hash.merge!(id_token: create_id_token(client_id, fhir_user: granted_scopes.include?('fhirUser')))
+        end
+
+        fhir_context_input = find_test_input("#{input_group_prefix}_smart_fhir_context")
+        begin
+          fhir_context = JSON.parse(fhir_context_input)
+        rescue StandardError
+          fhir_context = nil
+        end
+        response_hash.merge!(fhirContext: fhir_context) if fhir_context
+
+        smart_patient_input = find_test_input("#{input_group_prefix}_smart_patient_id")
+        response_hash.merge!(patient: smart_patient_input) if smart_patient_input
+
+        response.body = response_hash.to_json
+        response.headers['Cache-Control'] = 'no-store'
+        response.headers['Pragma'] = 'no-cache'
+        response.headers['Access-Control-Allow-Origin'] = '*'
+        response.status = 200
+      end
+
+      private
+
+      def extract_client_id
+        # Public client            || confidential client asymmetric          || confidential client symmetric
+        request.params[:client_id] || extract_client_id_from_client_assertion || extract_client_id_from_basic_auth
+      end
+
+      def extract_client_id_from_client_assertion
+        encoded_jwt = request.params[:client_assertion]
+        return unless encoded_jwt.present?
+
+        jwt_payload =
+          begin
+            JWT.decode(encoded_jwt, nil, false)&.first # skip signature verification
+          rescue StandardError
+            nil
+          end
+
+        jwt_payload['iss'] || jwt_payload['sub'] if jwt_payload.present?
+      end
+
+      def input_group_prefix
+        if test.id.include?('static')
+          'static'
+        elsif test.id.include?('adaptive')
+          'adaptive'
+        else
+          'resp'
+        end
+      end
+
+      def find_test_input(input_name)
+        JSON.parse(result.input_json)&.find { |input| input['name'] == input_name }&.dig('value')
+      end
+
+      def extract_client_id_from_basic_auth
+        encoded_credentials = request.headers['authorization']&.delete_prefix('Basic ')
+        return unless encoded_credentials.present?
+
+        decoded_credentials = Base64.decode64(encoded_credentials)
+        decoded_credentials&.split(':')&.first
+      end
+
+      def requested_scopes
+        auth_request = requests_repo.tagged_requests(result.test_session_id, [EHR_AUTHORIZE_TAG]).last
+        return [] unless auth_request
+
+        auth_params = if auth_request.verb.downcase == 'get'
+                        auth_request.query_parameters
+                      else
+                        URI.decode_www_form(auth_request.request_body)&.to_h
+                      end
+        scope_str = auth_params&.dig('scope')
+        scope_str ? URI.decode_www_form_component(scope_str).split : []
+      end
+
+      def create_id_token(client_id, fhir_user: false)
+        # No point in mocking an identity provider, just always use known Practitioner as the authorized user
+        suite_fhir_base_url = request.url.split(EHR_TOKEN_PATH).first + FHIR_BASE_PATH
+        id_token_hash = {
+          iss: suite_fhir_base_url,
+          sub: AUTHORIZED_PRACTITIONER_ID,
+          aud: client_id,
+          exp: Time.now.to_i + (24 * 60 * 60), # 24 hrs
+          iat: Time.now.to_i
+        }
+        id_token_hash.merge!(fhirUser: "#{suite_fhir_base_url}/Practitioner/#{AUTHORIZED_PRACTITIONER_ID}") if fhir_user
+
+        JWT.encode(id_token_hash, RSA_PRIVATE_KEY, 'RS256')
+      end
+    end
+  end
+end

data/lib/davinci_dtr_test_kit/endpoints/mock_authorization.rb

@@ -0,0 +1,83 @@
+module DaVinciDTRTestKit
+  module MockAuthorization
+    RSA_PRIVATE_KEY = OpenSSL::PKey::RSA.generate(2048)
+    RSA_PUBLIC_KEY = RSA_PRIVATE_KEY.public_key
+    SUPPORTED_SCOPES = ['launch', 'patient/*.rs', 'user/*.rs', 'offline_access', 'openid', 'fhirUser'].freeze
+
+    module_function
+
+    def extract_client_id_from_bearer_token(request)
+      token = request.headers['authorization']&.delete_prefix('Bearer ')
+      jwt =
+        begin
+          JWT.decode(token, nil, false)
+        rescue StandardError
+          nil
+        end
+      jwt&.first&.dig('inferno_client_id')
+    end
+
+    def jwks(_env)
+      response_body = {
+        keys: [
+          {
+            kty: 'RSA',
+            alg: 'RS256',
+            n: Base64.urlsafe_encode64(RSA_PUBLIC_KEY.n.to_s(2), padding: false),
+            e: Base64.urlsafe_encode64(RSA_PUBLIC_KEY.e.to_s(2), padding: false),
+            use: 'sig'
+          }
+        ]
+      }.to_json
+
+      [200, { 'Content-Type' => 'application/json', 'Access-Control-Allow-Origin' => '*' }, [response_body]]
+    end
+
+    def ehr_smart_config(env)
+      base_url = env_base_url(env, SMART_CONFIG_PATH)
+      response_body =
+        {
+          authorization_endpoint: base_url + EHR_AUTHORIZE_PATH,
+          token_endpoint: base_url + EHR_TOKEN_PATH,
+          token_endpoint_auth_methods_supported: ['private_key_jwt'],
+          token_endpoint_auth_signing_alg_values_supported: ['RS256'],
+          grant_types_supported: ['authorization_code'],
+          scopes_supported: SUPPORTED_SCOPES,
+          response_types_supported: ['code'],
+          code_challenge_methods_supported: ['S256'],
+          capabilities: [
+            'launch-ehr',
+            'permission-patient',
+            'permission-user',
+            'client-public',
+            'client-confidential-symmetric',
+            'client-confidential-asymmetric'
+          ]
+        }.to_json
+
+      [200, { 'Content-Type' => 'application/json', 'Access-Control-Allow-Origin' => '*' }, [response_body]]
+    end
+
+    def ehr_openid_config(env)
+      base_url = env_base_url(env, OPENID_CONFIG_PATH)
+      response_body = {
+        issuer: base_url + FHIR_BASE_PATH,
+        authorization_endpoint: base_url + EHR_AUTHORIZE_PATH,
+        token_endpoint: base_url + EHR_TOKEN_PATH,
+        jwks_uri: base_url + JKWS_PATH,
+        response_types_supported: ['id_token'],
+        subject_types_supported: ['public'],
+        id_token_signing_alg_values_supported: ['RS256']
+      }.to_json
+      [200, { 'Content-Type' => 'application/json', 'Access-Control-Allow-Origin' => '*' }, [response_body]]
+    end
+
+    def env_base_url(env, endpoint_path)
+      protocol = env['rack.url_scheme']
+      host = env['HTTP_HOST']
+      path = env['REQUEST_PATH'] || env['PATH_INFO']
+      path.gsub!(%r{#{endpoint_path}(/)?}, '')
+      "#{protocol}://#{host + path}"
+    end
+  end
+end

data/lib/davinci_dtr_test_kit/endpoints/mock_ehr/fhir_get_endpoint.rb

@@ -0,0 +1,95 @@
+require_relative '../mock_authorization'
+require_relative '../mock_ehr'
+
+module DaVinciDTRTestKit
+  module MockEHR
+    class FHIRGetEndpoint < Inferno::DSL::SuiteEndpoint
+      include MockEHR
+
+      def test_run_identifier
+        MockAuthorization.extract_client_id_from_bearer_token(request)
+      end
+
+      def make_response
+        fhir_class, id = fhir_class_and_id_from_url(request.url)
+        response.format = 'application/fhir+json'
+        response.headers['Access-Control-Allow-Origin'] = '*'
+
+        if fhir_class.nil?
+          response.status = 400
+          response.body = FHIR::OperationOutcome.new(
+            issue: FHIR::OperationOutcome::Issue.new(severity: 'warning', code: 'not-supported',
+                                                     details: FHIR::CodeableConcept.new(
+                                                       text: 'No recognized resource type in URL'
+                                                     ))
+          ).to_json
+          return
+        end
+
+        # Respond with user-inputted resource if there is one that matches the request
+        ehr_bundle = ehr_input_bundle(test, result)
+        if id.present? && ehr_bundle.present?
+          matching_resource = find_resource_in_bundle(ehr_bundle, fhir_class, id)
+          if matching_resource.present?
+            response.status = 200
+            response.body = matching_resource.to_json
+            return
+          end
+        end
+
+        # Proxy resource request to the reference server
+        proxy_response = if id.present?
+                           resource_server_client.read(fhir_class, id)
+                         else
+                           resource_server_client.search(fhir_class,
+                                                         search: { parameters: request.env['rack.request.query_hash'] })
+                         end
+        response.status = proxy_response.code
+        response.body = proxy_response.body
+      end
+
+      def ehr_input_bundle(test, test_result)
+        input_name = "#{input_group_prefix(test)}_ehr_bundle"
+        ehr_bundle_input = JSON.parse(test_result.input_json).find { |input| input['name'] == input_name }
+        ehr_bundle_input_value = ehr_bundle_input_value = ehr_bundle_input['value'] if ehr_bundle_input.present?
+        ehr_bundle = FHIR.from_contents(ehr_bundle_input_value) if ehr_bundle_input_value.present?
+        ehr_bundle if ehr_bundle.is_a?(FHIR::Bundle)
+      rescue StandardError
+        nil
+      end
+
+      def input_group_prefix(test)
+        if test.id.include?('static')
+          'static'
+        elsif test.id.include?('adaptive')
+          'adaptive'
+        else
+          'resp'
+        end
+      end
+
+      def find_resource_in_bundle(bundle, fhir_class, id)
+        bundle.entry&.find do |entry|
+          entry.resource.is_a?(fhir_class) && entry.resource&.id == id
+        end&.resource
+      end
+
+      # Pull resource type class and ID from url
+      # e.g. http://example.org/fhir/Patient/123 -> [FHIR::Patient, '123']
+      # @private
+      def fhir_class_and_id_from_url(url)
+        path = url.split('?').first.split('/fhir/').second
+        path.sub!(%r{/$}, '')
+        resource_type, id = path.split('/')
+
+        begin
+          fhir_class = FHIR.const_get(resource_type)
+        rescue NameError
+          fhir_class = nil
+        end
+
+        [fhir_class, id]
+      end
+    end
+  end
+end