davinci_dtr_test_kit 0.16.0 → 0.16.1

data/lib/davinci_dtr_test_kit/dtr_full_ehr_suite.rb

@@ -1,12 +1,19 @@
+require 'udap_security_test_kit'
+require 'smart_app_launch_test_kit'
 require_relative 'client_groups/custom_static/dtr_full_ehr_custom_static_workflow_group'
 require_relative 'client_groups/dinner_static/dtr_full_ehr_static_dinner_workflow_group'
-require_relative 'client_groups/dinner_adaptive/dtr_full_ehr_adaptive_dinner_workflow_group'
-require_relative 'auth_groups/oauth2_authentication_group'
+require_relative 'client_groups/adaptive_questionnaire/dinner_order/dtr_full_ehr_adaptive_dinner_workflow_group'
+require_relative 'client_groups/adaptive_questionnaire/custom/dtr_full_ehr_custom_adaptive_workflow_group'
+require_relative 'client_groups/payer_registration/dtr_client_registration_group'
+require_relative 'client_groups/must_support/dtr_full_ehr_questionnaire_must_support_group'
+require_relative 'client_groups/auth/dtr_client_payer_auth_smart_group'
+require_relative 'client_groups/auth/dtr_client_payer_auth_udap_group'
 require_relative 'endpoints/cors'
-require_relative 'endpoints/mock_authorization/simple_token_endpoint'
+require_relative 'endpoints/mock_udap_smart_server/token_endpoint'
 require_relative 'endpoints/mock_payer/full_ehr_questionnaire_package_endpoint'
 require_relative 'endpoints/mock_payer/full_ehr_next_question_endpoint'
 require_relative 'version'
+require_relative 'dtr_client_options'
 
 module DaVinciDTRTestKit
   class DTRFullEHRSuite < Inferno::TestSuite
@@ -35,9 +42,22 @@ module DaVinciDTRTestKit
       }
     ]
 
+    suite_option :client_type,
+                 title: 'Client Security Type',
+                 list_options: [
+                   {
+                     label: 'SMART Backend Services',
+                     value: DTRClientOptions::SMART_BACKEND_SERVICES_CONFIDENTIAL_ASYMMETRIC
+                   },
+                   {
+                     label: 'UDAP B2B Client Credentials',
+                     value: DTRClientOptions::UDAP_CLIENT_CREDENTIALS
+                   }
+                 ]
+
     # Hl7 Validator Wrapper:
     fhir_resource_validator do
-      igs 'hl7.fhir.us.davinci-dtr#2.0.1'
+      igs 'igs/davinci_dtr_2.0.1.tgz'
 
       exclude_message do |message|
         message.message.match?(/\A\S+: \S+: URL value '.*' does not resolve/)
@@ -46,7 +66,16 @@ module DaVinciDTRTestKit
 
     allow_cors QUESTIONNAIRE_PACKAGE_PATH, NEXT_PATH
 
-    suite_endpoint :post, PAYER_TOKEN_PATH, MockAuthorization::SimpleTokenEndpoint
+    route(:get, UDAPSecurityTestKit::UDAP_DISCOVERY_PATH, lambda { |_env|
+      UDAPSecurityTestKit::MockUDAPServer.udap_server_metadata(id)
+    })
+    route(:get, SMARTAppLaunch::SMART_DISCOVERY_PATH, lambda { |_env|
+      SMARTAppLaunch::MockSMARTServer.smart_server_metadata(id)
+    })
+
+    suite_endpoint :post, UDAPSecurityTestKit::REGISTRATION_PATH,
+                   UDAPSecurityTestKit::MockUDAPServer::RegistrationEndpoint
+    suite_endpoint :post, UDAPSecurityTestKit::TOKEN_PATH, MockUdapSmartServer::TokenEndpoint
 
     suite_endpoint :post, QUESTIONNAIRE_PACKAGE_PATH, MockPayer::FullEHRQuestionnairePackageEndpoint
     suite_endpoint :post, NEXT_PATH, MockPayer::FullEHRNextQuestionEndpoint
@@ -59,13 +88,13 @@ module DaVinciDTRTestKit
       request.query_parameters['token']
     end
 
-    group from: :oauth2_authentication
+    group from: :dtr_client_payer_registration
     group do
       id :dtr_full_ehr_basic_workflows
       title 'Basic Workflows'
 
       group from: :dtr_full_ehr_custom_static_workflow
-      group from: :dtr_full_ehr_adaptive_dinner_workflow
+      group from: :dtr_full_ehr_custom_adaptive_workflow
     end
     group do
       id :dtr_full_ehr_questionnaire_functionality
@@ -75,6 +104,17 @@ module DaVinciDTRTestKit
         covering additional pre-population features of questionnaires.
       )
       group from: :dtr_full_ehr_static_dinner_workflow
+      group from: :dtr_full_ehr_adaptive_dinner_workflow
     end
+    group from: :dtr_full_ehr_questionnaire_ms
+
+    group from: :dtr_client_payer_auth_smart,
+          required_suite_options: {
+            client_type: DTRClientOptions::SMART_BACKEND_SERVICES_CONFIDENTIAL_ASYMMETRIC
+          }
+    group from: :dtr_client_payer_auth_udap,
+          required_suite_options: {
+            client_type: DTRClientOptions::UDAP_CLIENT_CREDENTIALS
+          }
   end
 end

data/lib/davinci_dtr_test_kit/dtr_questionnaire_response_validation.rb

@@ -29,14 +29,7 @@ module DaVinciDTRTestKit
                 "Couldn't find Questionnaire #{qr.questionnaire} in the provided custom questionnaire package
                 to validate the QuestionnaireResponse."
 
-        missing_origin_sources = ['auto', 'manual', 'override'] - extract_origin_sources(qr.item)
-        unless missing_origin_sources.empty?
-          add_message(
-            'error',
-            'All origin sources (auto, manual, override) must be present in the QuestionnaireResponse. ' \
-            "Missing #{missing_origin_sources.to_sentence}"
-          )
-        end
+        check_missing_origin_sources(qr)
       end
 
       check_origin_sources(questionnaire.item, qr.item, expected_overrides:)
@@ -46,6 +39,18 @@ module DaVinciDTRTestKit
       assert(messages.none? { |m| m[:type] == 'error' }, 'QuestionnaireResponse is not correct, see error message(s)')
     end
 
+    def check_missing_origin_sources(questionnaire_response, index = nil)
+      missing_origin_sources = ['auto', 'manual', 'override'] - extract_origin_sources(questionnaire_response.item)
+      return if missing_origin_sources.empty?
+
+      prefix = index ? "Request #{index}: " : ''
+      add_message(
+        'error',
+        "#{prefix}All origin sources (auto, manual, override) must be present in the QuestionnaireResponse. " \
+        "Missing #{missing_origin_sources.to_sentence}"
+      )
+    end
+
     def check_is_questionnaire_response(questionnaire_response_json)
       assert_valid_json(questionnaire_response_json)
       questionnaire_response = begin
@@ -65,9 +70,10 @@ module DaVinciDTRTestKit
     end
 
     # This only checks answers in the questionnaire response, meaning it does not catch missing answers
-    def check_origin_sources(questionnaire_items, response_items, expected_overrides: [])
+    def check_origin_sources(questionnaire_items, response_items, expected_overrides: [], index: nil)
+      prefix = index ? "Request #{index}: " : ''
       response_items&.each do |response_item|
-        check_origin_sources(questionnaire_items, response_item.item, expected_overrides:)
+        check_origin_sources(questionnaire_items, response_item.item, expected_overrides:, index:)
         next unless response_item.answer&.any?
 
         link_id = response_item.linkId
@@ -76,20 +82,25 @@ module DaVinciDTRTestKit
         is_cql_expression = item_is_cql_expression?(questionnaire_item)
 
         if origin_source.nil?
-          add_message('error', "Required `origin.source` extension not present on answer to item `#{link_id}`")
+          add_message('error', "#{prefix}Required `origin.source` extension not present on answer to item `#{link_id}`")
         else
-          check_origin_source(origin_source, link_id, is_cql_expression, override: expected_overrides.include?(link_id))
+          check_origin_source(
+            origin_source, link_id, is_cql_expression,
+            override: expected_overrides.include?(link_id),
+            index:
+          )
         end
       end
     end
 
-    def check_origin_source(origin_source, link_id, is_cql_expression, override: false)
+    def check_origin_source(origin_source, link_id, is_cql_expression, override: false, index: nil) # rubocop:disable  Metrics/CyclomaticComplexity
+      prefix = index ? "Request #{index}: " : ''
       if override
-        origin_source_error(link_id, ['override'], origin_source) unless origin_source == 'override'
+        origin_source_error(link_id, ['override'], origin_source, prefix) unless origin_source == 'override'
       elsif is_cql_expression && !['auto', 'override'].include?(origin_source)
-        origin_source_error(link_id, 'auto or override', origin_source)
+        origin_source_error(link_id, 'auto or override', origin_source, prefix)
       elsif !is_cql_expression && origin_source != 'manual'
-        origin_source_error(link_id, 'manual', origin_source)
+        origin_source_error(link_id, 'manual', origin_source, prefix)
       end
     end
 
@@ -104,11 +115,13 @@ module DaVinciDTRTestKit
 
     # Ensures that all required questions have been answered.
     # If required_link_ids not provided, all questions are treated as optional.
-    def check_answer_presence(response_items, required_link_ids = [])
+    def check_answer_presence(response_items, required_link_ids = [], index = nil)
+      prefix = index ? "Request #{index}: " : ''
+
       required_link_ids.each do |link_id|
         item = find_item_by_link_id(response_items, link_id)
         unless item&.answer&.any? { |answer| answer.value.present? }
-          add_message('error', "No answer for item #{link_id}")
+          add_message('error', "#{prefix}No answer for item #{link_id}")
         end
       end
     end
@@ -176,7 +189,6 @@ module DaVinciDTRTestKit
                                                questionnaire_cql_expression_link_ids,
                                                expected_prepopulated = {},
                                                expected_overrides = {})
-
       questionnaire_cql_expression_link_ids.each do |target_link_id|
         target_item = find_item_by_link_id(template_questionnaire_response.item, target_link_id)
         raise "Template QuestionnaireResponse missing item with link id `#{target_link_id}`" unless target_item.present?
@@ -235,8 +247,8 @@ module DaVinciDTRTestKit
       end
     end
 
-    def origin_source_error(link_id, expected, actual)
-      add_message('error', %(`origin.source` extension on item `#{link_id}` contains unexpected value.
+    def origin_source_error(link_id, expected, actual, msg_prefix = nil)
+      add_message('error', %(#{msg_prefix}`origin.source` extension on item `#{link_id}` contains unexpected value.
                              Expected: #{expected}. Found: #{actual}))
     end
 

data/lib/davinci_dtr_test_kit/dtr_smart_app_suite.rb

@@ -1,8 +1,10 @@
 require_relative 'auth_groups/oauth2_authentication_group'
 require_relative 'client_groups/respiratory/dtr_smart_app_respiratory_workflow_group'
 require_relative 'client_groups/dinner_static/dtr_smart_app_static_dinner_workflow_group'
-require_relative 'client_groups/dinner_adaptive/dtr_smart_app_adaptive_dinner_workflow_group'
+require_relative 'client_groups/adaptive_questionnaire/dinner_order/dtr_smart_app_adaptive_dinner_workflow_group'
 require_relative 'client_groups/custom_static/dtr_smart_app_custom_static_workflow_group'
+require_relative 'client_groups/adaptive_questionnaire/custom/dtr_smart_app_custom_adaptive_workflow_group'
+require_relative 'client_groups/must_support/dtr_smart_app_questionnaire_must_support_group'
 require_relative 'endpoints/cors'
 require_relative 'endpoints/mock_authorization'
 require_relative 'endpoints/mock_authorization/authorize_endpoint'
@@ -43,7 +45,7 @@ module DaVinciDTRTestKit
 
     # Hl7 Validator Wrapper:
     fhir_resource_validator do
-      igs 'hl7.fhir.us.davinci-dtr#2.0.1'
+      igs 'igs/davinci_dtr_2.0.1.tgz'
 
       exclude_message do |message|
         message.message.match?(/\A\S+: \S+: URL value '.*' does not resolve/)
@@ -90,10 +92,9 @@ module DaVinciDTRTestKit
       )
 
       group from: :dtr_smart_app_custom_static_workflow
-      group from: :dtr_smart_app_adaptive_dinner_workflow
+      group from: :dtr_smart_app_custom_adaptive_workflow
     end
     group do
-      id :dtr_smart_app_questionnaire_functionality
       title 'Questionnaire Functionality Coverage'
       description %(
         Tests in this group validate that the client can complete additional DTR workflows
@@ -101,6 +102,8 @@ module DaVinciDTRTestKit
       )
       group from: :dtr_smart_app_resp_workflow
       group from: :dtr_smart_app_static_dinner_workflow
+      group from: :dtr_smart_app_adaptive_dinner_workflow
     end
+    group from: :dtr_smart_app_questionnaire_ms
   end
 end

data/lib/davinci_dtr_test_kit/endpoints/mock_ehr.rb

@@ -21,7 +21,7 @@ module DaVinciDTRTestKit
         # Overwrite the OAuth URIs returned by the reference server to point to the suite endpoints instead
         oauth_uris_url = 'http://fhir-registry.smarthealthit.org/StructureDefinition/oauth-uris'
         base_url = MockAuthorization.env_base_url(env, METADATA_PATH)
-        sec_ext = cs.rest.first&.security&.extension&.delete_if { |e| e.url == oauth_uris_url }
+        sec_ext = cs.rest.first&.security&.extension&.delete_if { |e| e.url == oauth_uris_url } # rubocop:disable Style/SafeNavigationChainLength
         sec_ext&.push(
           FHIR::Extension.new(
             url: oauth_uris_url,

data/lib/davinci_dtr_test_kit/endpoints/mock_payer/full_ehr_next_question_endpoint.rb

@@ -4,7 +4,26 @@ module DaVinciDTRTestKit
   module MockPayer
     class FullEHRNextQuestionEndpoint < NextQuestionEndpoint
       def test_run_identifier
-        request.headers['authorization']&.delete_prefix('Bearer ')
+        return request.params[:session_path] if request.params[:session_path].present?
+
+        UDAPSecurityTestKit::MockUDAPServer.issued_token_to_client_id(
+          request.headers['authorization']&.delete_prefix('Bearer ')
+        )
+      end
+
+      def make_response
+        return if response.status == 401 # set in update_result (expired token handling there)
+
+        super
+      end
+
+      def update_result
+        if UDAPSecurityTestKit::MockUDAPServer.request_has_expired_token?(request)
+          UDAPSecurityTestKit::MockUDAPServer.update_response_for_expired_token(response, 'Bearer token')
+          return
+        end
+
+        super
       end
     end
   end

data/lib/davinci_dtr_test_kit/endpoints/mock_payer/full_ehr_questionnaire_package_endpoint.rb

@@ -1,10 +1,30 @@
+require 'udap_security_test_kit'
 require_relative 'questionnaire_package_endpoint'
 
 module DaVinciDTRTestKit
   module MockPayer
     class FullEHRQuestionnairePackageEndpoint < QuestionnairePackageEndpoint
       def test_run_identifier
-        request.headers['authorization']&.delete_prefix('Bearer ')
+        return request.params[:session_path] if request.params[:session_path].present?
+
+        UDAPSecurityTestKit::MockUDAPServer.issued_token_to_client_id(
+          request.headers['authorization']&.delete_prefix('Bearer ')
+        )
+      end
+
+      def make_response
+        return if response.status == 401 # set in update_result (expired token handling there)
+
+        super
+      end
+
+      def update_result
+        if UDAPSecurityTestKit::MockUDAPServer.request_has_expired_token?(request)
+          UDAPSecurityTestKit::MockUDAPServer.update_response_for_expired_token(response, 'Bearer token')
+          return
+        end
+
+        super
       end
     end
   end

data/lib/davinci_dtr_test_kit/endpoints/mock_payer/next_question_endpoint.rb

@@ -22,6 +22,29 @@ module DaVinciDTRTestKit
         response.body = build_questionnaire_next_response.to_json
       end
 
+      def custom_next_question_requests
+        requests_repo.tagged_requests(test_run.test_session_id, ["custom_#{DaVinciDTRTestKit::CLIENT_NEXT_TAG}"])
+      end
+
+      def custom_questionnaires
+        return @custom_questionnaires unless @custom_questionnaires.nil?
+
+        questionnaires = JSON.parse(result.input_json)
+          .find { |input| input['name'].include?('custom_next_question_questionnaires') }
+          &.dig('value')
+        return unless questionnaires
+
+        @custom_questionnaires = [JSON.parse(questionnaires)].flatten.compact
+      end
+
+      def next_custom_questionnaire
+        custom_questionnaires[custom_next_question_requests.length]
+      end
+
+      def complete_questionnaire?
+        custom_questionnaires && next_custom_questionnaire.blank?
+      end
+
       def update_result
         results_repo.update_result(result.id, 'pass') unless test.config.options[:accepts_multiple_requests]
       end
@@ -41,9 +64,9 @@ module DaVinciDTRTestKit
 
         questionnaire_response_param = FHIR::Parameters::Parameter.new(name: 'return', resource: questionnaire_response)
 
-        if questionnaire_last_dinner_order_question_present?(questionnaire_response)
+        if complete_questionnaire? || questionnaire_last_dinner_order_question_present?(questionnaire_response)
           # change the questionnaire response status to completed and return the parameters
-          return handle_last_dinner_order(questionnaire_response)
+          return complete_questionnaire(questionnaire_response)
         end
 
         next_questionnaire = determine_next_questionnaire(questionnaire_response, test.id)
@@ -103,15 +126,17 @@ module DaVinciDTRTestKit
       end
 
       def determine_next_questionnaire(questionnaire_response, test_id)
+        if custom_questionnaires
+          FHIR.from_contents(next_custom_questionnaire.to_json)
         # Retrieve the selected option from the response and determine the next set of questions
-        if questionnaire_dinner_order_selection_present?(questionnaire_response)
+        elsif questionnaire_dinner_order_selection_present?(questionnaire_response)
           dinner_question_from_selection(questionnaire_response, test_id)
         else
           Fixtures.next_question_for_test(test_id)
         end
       end
 
-      def handle_last_dinner_order(questionnaire_response)
+      def complete_questionnaire(questionnaire_response)
         update_questionnaire_response(questionnaire_response)
         questionnaire_response
       end

data/lib/davinci_dtr_test_kit/endpoints/mock_payer/questionnaire_package_endpoint.rb

@@ -12,7 +12,7 @@ module DaVinciDTRTestKit
       end
 
       def tags
-        [QUESTIONNAIRE_PACKAGE_TAG]
+        [test.config.options[:questionnaire_package_tag].presence || QUESTIONNAIRE_PACKAGE_TAG]
       end
 
       def make_response

data/lib/davinci_dtr_test_kit/endpoints/mock_udap_smart_server/token_endpoint.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require 'udap_security_test_kit'
+require 'smart_app_launch_test_kit'
+require_relative '../../urls'
+require_relative '../../tags'
+
+module DaVinciDTRTestKit
+  module MockUdapSmartServer
+    class TokenEndpoint < Inferno::DSL::SuiteEndpoint
+      include SMARTAppLaunch::MockSMARTServer::SMARTTokenResponseCreation
+      include UDAPSecurityTestKit::MockUDAPServer::UDAPTokenResponseCreation
+
+      def test_run_identifier
+        UDAPSecurityTestKit::MockUDAPServer.client_id_from_client_assertion(request.params[:client_assertion])
+      end
+
+      def make_response
+        if request.params[:udap].present?
+          make_udap_client_credential_token_response
+        else
+          make_smart_client_credential_token_response
+        end
+      end
+
+      def update_result
+        nil # never update for now
+      end
+
+      def tags
+        type_tag = request.params[:udap].present? ? UDAPSecurityTestKit::UDAP_TAG : SMARTAppLaunch::SMART_TAG
+        [UDAPSecurityTestKit::TOKEN_TAG, UDAPSecurityTestKit::CLIENT_CREDENTIALS_TAG, type_tag]
+      end
+    end
+  end
+end

data/lib/davinci_dtr_test_kit/requirements/davinci-dtr-test-kit_out_of_scope_requirements.csv

@@ -1,11 +1,12 @@
 Req Set,ID,Reason,Details
 hl7.fhir.us.davinci-dtr_2.0.1,10,Not Tested,"QuestionnaireResponse.source is not must support or required, so these systems are not required to support it."
 hl7.fhir.us.davinci-dtr_2.0.1,129,Not Tested,Cdex workflows out of initial scope
-hl7.fhir.us.davinci-dtr_2.0.1,231,Not Tested,check as a part of PAS initially
-hl7.fhir.us.davinci-dtr_2.0.1,232,Not Tested,check as a part of PAS initially
-hl7.fhir.us.davinci-dtr_2.0.1,233,Not Tested,check as a part of PAS initially
-hl7.fhir.us.davinci-dtr_2.0.1,234,Not Tested,check as a part of PAS initially
-hl7.fhir.us.davinci-dtr_2.0.1,236,Not Tested,check as a part of PAS initially
+hl7.fhir.us.davinci-dtr_2.0.1,231,Not Tested,Not compatible with the PAS approach to prior authorization submission
+hl7.fhir.us.davinci-dtr_2.0.1,232,Not Tested,Not compatible with the PAS approach to prior authorization submission
+hl7.fhir.us.davinci-dtr_2.0.1,233,Not Tested,Not compatible with the PAS approach to prior authorization submission
+hl7.fhir.us.davinci-dtr_2.0.1,234,Not Tested,Not compatible with the PAS approach to prior authorization submission
+hl7.fhir.us.davinci-dtr_2.0.1,235,Not Tested,Not compatible with the PAS approach to prior authorization submission
+hl7.fhir.us.davinci-dtr_2.0.1,236,Not Tested,Not compatible with the PAS approach to prior authorization submission
 hl7.fhir.us.davinci-dtr_2.0.1,237,Not Tested,"automatic or manual allowed, no clear impact on downstream functionality"
 hl7.fhir.us.davinci-dtr_2.0.1,238,Not Tested,"automatic or manual allowed, no clear impact on downstream functionality"
 hl7.fhir.us.davinci-dtr_2.0.1,328,Not Tested,metrics are optional at this time

data/lib/davinci_dtr_test_kit/requirements/davinci-dtr-test-kit_requirements.csv

@@ -10,8 +10,8 @@ hl7.fhir.us.davinci-dtr_2.0.1,9,https://hl7.org/fhir/us/davinci-dtr/STU2/specifi
 hl7.fhir.us.davinci-dtr_2.0.1,10,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[A]pps and EHRs acting as form fillers **SHALL** be able to display: … QuestionnaireResponse.source.resolve().name,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,11,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[A]pps and EHRs acting as form fillers **SHALL** be able to display: … QuestionnaireResponse.item.text,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,12,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[A]pps and EHRs acting as form fillers **SHALL** be able to display: … QuestionnaireResponse.item.value - all data types,SHALL,"Full EHR, SMART Client",,false
-hl7.fhir.us.davinci-dtr_2.0.1,13,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[A]pps and EHRs acting as form fillers **SHALL** be able to display: … The same [item.text] for all nested items,SHALL,"Full EHR, SMART Client",,false
-hl7.fhir.us.davinci-dtr_2.0.1,14,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[A]pps and EHRs acting as form fillers **SHALL** be able to display: … The same [all data types of item.value] for all nested items,SHALL,"Full EHR, SMART Client",,false
+hl7.fhir.us.davinci-dtr_2.0.1,13,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[A]pps and EHRs acting as form fillers **SHALL** be able to display: … The same [QuestionnaireResponse.item.text] for all nested items,SHALL,"Full EHR, SMART Client",,false
+hl7.fhir.us.davinci-dtr_2.0.1,14,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[A]pps and EHRs acting as form fillers **SHALL** be able to display: … The same [all data types of QuestionnaireResponse.item.value] for all nested items,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,15,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[Form filling systems] **SHALL** also handle all mustSupport elements within the Questionnaire profile,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,16,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,"[Form filling systems] **SHALL** …  provide visual cues where those elements impact expected user action (e.g., required answers, need for signatures, etc.)",SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,17,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#must-support,[Form filling] systems **SHOULD** be able to display Q[uestionnaire]R[esponse].item.itemMedia,SHOULD,"Full EHR, SMART Client",,false
@@ -69,8 +69,8 @@ hl7.fhir.us.davinci-dtr_2.0.1,64,https://hl7.org/fhir/us/davinci-dtr/STU2/specif
 hl7.fhir.us.davinci-dtr_2.0.1,65,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,Elements flagged as mustSupport [in the [Standard Questionnaire profile](https://hl7.org/fhir/us/davinci-dtr/STU2/StructureDefinition-dtr-std-questionnaire.html)] **SHALL** be supported by DTR Apps and Full EHRs.,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,66,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,Elements flagged as mustSupport [in the [[Adaptive Questionnaire profile](https://hl7.org/fhir/us/davinci-dtr/STU2/StructureDefinition-dtr-questionnaire-adapt.html)] **SHALL** be supported by DTR Apps and Full EHRs.,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,67,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,[Questionnaire client] systems **SHOULD** also support all non mustSupport data extensions included in the differential of the DTR Questionnaire profiles as per SDC documentation for those elements and extensions,SHOULD,"Full EHR, SMART Client",,false
-hl7.fhir.us.davinci-dtr_2.0.1,68,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,"[Questionnaire client] systems … **SHALL** gracefully handle the presence of these [Qestionnaire mustSupport] elements if not supported (i.e., non-support for an element **SHALL NOT** interfere with a user’s ability to complete a QuestionnaireResponse.)",SHALL,"Full EHR, SMART Client",,true
-hl7.fhir.us.davinci-dtr_2.0.1,69,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,"payers **SHALL NOT** rely on support for any of these [Questionnaire MustSupport] elements in the design of their Questionnaire. i.e., a DTR client that ignores such elements cannot impact the successful collection of information acceptability of the information gathered.",SHALL NOT,Payer Service,,false
+hl7.fhir.us.davinci-dtr_2.0.1,68,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,"[Questionnaire client] systems … **SHALL** gracefully handle the presence of these elements [representing Qestionnaire data extensions that are not must support]  if not supported (i.e., non-support for an element **SHALL NOT** interfere with a user’s ability to complete a QuestionnaireResponse.)",SHALL,"Full EHR, SMART Client",,true
+hl7.fhir.us.davinci-dtr_2.0.1,69,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,"payers **SHALL NOT** rely on support for any of these [Questionnaire non-MustSupport data extension] elements in the design of their Questionnaire. i.e., a DTR client that ignores such elements cannot impact the successful collection of information acceptability of the information gathered.",SHALL NOT,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,70,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,The questionnaire designer should consider the possibility that access to some data **MAY** be restricted or prohibited,SHOULD,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,71,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-design,"The questionnaire designer should consider the possibility that ... access restrictions **MAY** happen silently (e.g., indistinguishable absent data).",SHOULD,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,72,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#provider-attestation,Payers **SHOULD** design questionnaires to support attestation rather than discrete data where this is sufficient for the business requirements.,SHOULD,Payer Service,,false
@@ -96,7 +96,7 @@ hl7.fhir.us.davinci-dtr_2.0.1,91,https://hl7.org/fhir/us/davinci-dtr/STU2/specif
 hl7.fhir.us.davinci-dtr_2.0.1,92,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#cql-constraints,The CQL **SHALL** be version [CQL 1.5](http://cql.hl7.org/N1/).,SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,93,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#cql-constraints,CQL**SHALL** have a context of “Patient”.,SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,94,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#cql-constraints,"Within the Questionnaire, CQL **SHALL** follow SDC rules for determining context. Specifically, CQL definitions and variables defined on ancestor elements or preceding expression extensions within the same Questionnaire item are in scope for referencing in descendant/following expressions.",SHALL,Payer Service,,false
-hl7.fhir.us.davinci-dtr_2.0.1,95,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#cql-constraints,"Within Libraries, ... raw CQL ... (in JSON syntax – i.e., application/elm+json) **SHALL** be provided as [a] separate content repetition ... within the library.",SHALL,Payer Service,,false
+hl7.fhir.us.davinci-dtr_2.0.1,95,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#cql-constraints,"Within Libraries, ... raw CQL …  **SHALL** be provided as [a] separate content repetition ... within the library.",SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,96,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#cql-constraints,"Within Libraries, ... compiled ELM (in JSON syntax – i.e., application/elm+json) **SHALL** be provided as  [a] separate content repetition ... within the library.",SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,97,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#cql-constraints,"Within Expression elements, the base expression CQL **SHALL** be accompanied by a [US Public Health Alternative Expression Extension](http://hl7.org/fhir/us/ecr/StructureDefinition/us-ph-alternative-expression-extension) containing the compiled JSON ELM for the expression.",SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,98,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#cql-constraints,"If the Questionnaire depends on multiple Libraries (has multiple cqf-library elements), then any valueExpression referring to defined variables **SHALL** specify the library name as well as the statement name as follows: “LibraryName”.statementName.",SHALL,Payer Service,,true
@@ -215,7 +215,6 @@ hl7.fhir.us.davinci-dtr_2.0.1,207,https://hl7.org/fhir/us/davinci-dtr/STU2/speci
 hl7.fhir.us.davinci-dtr_2.0.1,208,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaire-rendering,CQL and FHIR Questionnaires **SHALL** be required even when DTR is implemented within a DTR Native App as opposed to a DTR SMART App.,SHALL,Full EHR,,false
 hl7.fhir.us.davinci-dtr_2.0.1,209,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#separating-user-provided-information-from-cql-retrieved-information,"When a user fills in a value or changes an answer in a QuestionnaireResponse, the DTR client **SHALL** populate the InformationOrigin extension, setting the ‘author’ property to the current user",SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,210,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#separating-user-provided-information-from-cql-retrieved-information,"When a user fills in a value or changes an answer in a QuestionnaireResponse, the DTR client **SHALL** populate the InformationOrigin extension, …  setting ‘source’ to ‘override’ if the source was already ‘override’ or ‘auto’, or ‘manual’ otherwise.",SHALL,"Full EHR, SMART Client",,false
-hl7.fhir.us.davinci-dtr_2.0.1,211,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#separating-user-provided-information-from-cql-retrieved-information,DTR clients **SHALL** either provide a PractitionerRole in the SMART App launch of DTR or support transmitting the role by means of the [Active Role](https://hl7.org/fhir/us/davinci-dtr/STU2/StructureDefinition-activeRole.html) extension within the Practitioner resource.,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,212,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaireresponse-validation,The DTR client **SHALL** validate the QuestionnaireResponse on an ongoing basis as the user is reviewing and entering data.,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,213,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaireresponse-validation,The client **SHALL** visually flag any elements that require adjustment to meet validation rules.,SHALL,"Full EHR, SMART Client",,false
 hl7.fhir.us.davinci-dtr_2.0.1,214,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#questionnaireresponse-validation,"For Standard Questionnaires, when the QuestionnaireResponse is valid, the DTR client **SHALL** indicate that to the user and allow them to mark the QuestionnaireResponse as complete",SHALL,"Full EHR, SMART Client",,false
@@ -244,7 +243,7 @@ hl7.fhir.us.davinci-dtr_2.0.1,236,https://hl7.org/fhir/us/davinci-dtr/STU2/speci
 hl7.fhir.us.davinci-dtr_2.0.1,237,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#passing-dtr-questionnaire-responses-to-downstream-processes,"the process by which attachments to prior auth requests, claims or orders are assembled ... could be done automatically",MAY,"Full EHR, SMART Client",,true
 hl7.fhir.us.davinci-dtr_2.0.1,238,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#passing-dtr-questionnaire-responses-to-downstream-processes,"the process by which attachments to prior auth requests, claims or orders are assembled ... could be done ... with human review.",MAY,"Full EHR, SMART Client",,true
 hl7.fhir.us.davinci-dtr_2.0.1,239,https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-dtr-payer-service.html#behavior,[Payer services] **SHALL** support the [`$questionnaire-package`](http://hl7.org/fhir/us/davinci-dtr/OperationDefinition/questionnaire-package) operation.,SHALL,Payer Service,,false
-hl7.fhir.us.davinci-dtr_2.0.1,240,https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-dtr-payer-service.html#behavior,[Payer services] **SHALL** support the [`$expand`]http://hl7.org/fhir/OperationDefinition/ValueSet-expand) operation.,SHALL,Payer Service,,false
+hl7.fhir.us.davinci-dtr_2.0.1,240,https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-dtr-payer-service.html#behavior,[Payer services] **SHALL** support the [`$expand`](http://hl7.org/fhir/OperationDefinition/ValueSet-expand) operation.,SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,241,https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-dtr-payer-service.html#behavior,[Payer services] **SHOULD** support the [`$next-question`](http://hl7.org/fhir/uv/sdc/OperationDefinition/Questionnaire-next-question) operation.,SHOULD,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,242,https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-dtr-smart-client.html#behavior,[SMART Clients] **SHALL** support the [`$questionnaire-package`](http://hl7.org/fhir/us/davinci-dtr/OperationDefinition/questionnaire-package) operation.,SHALL,SMART Client,,false
 hl7.fhir.us.davinci-dtr_2.0.1,243,https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-dtr-smart-client.html#behavior,[SMART Clients] **SHALL** support the [`$expand`]http://hl7.org/fhir/OperationDefinition/ValueSet-expand) operation.,SHALL,SMART Client,,false
@@ -320,7 +319,7 @@ hl7.fhir.us.davinci-dtr_2.0.1,307,https://hl7.org/fhir/us/davinci-dtr/STU2/Opera
 hl7.fhir.us.davinci-dtr_2.0.1,308,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,[Each questionnaire] Bundle [returned by the questionnaire package operation] **SHALL** include the Questionnaire as the first entry,SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,309,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,[Each questionnaire] Bundle [returned by the questionnaire package operation] **SHALL** include … all external Libraries referenced by the Questionnaire using the cqf-library extension,SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,310,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,[Each questionnaire] Bundle [returned by the questionnaire package operation] **SHALL** include … the recursive retrieval of all ‘related-artifact’ references of type ‘depends-on’ [within included Libraries].,SHALL,Payer Service,,false
-hl7.fhir.us.davinci-dtr_2.0.1,311,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,[Each questionnaire] Bundle [returned by the questionnaire package operation] **SHALL** all external ValueSet instances referenced by the Questionnaire.,SHALL,Payer Service,,false
+hl7.fhir.us.davinci-dtr_2.0.1,311,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,[Each questionnaire] Bundle [returned by the questionnaire package operation] **SHALL** include all external ValueSet instances referenced by the Questionnaire.,SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,312,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,All value sets [returned by the questionnaire package operation] **SHALL** be expanded as of the current date and using expansion parameters (such as SNOMED release) as deemed appropriate by the payer.,SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,313,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,"All references to Questionnaires, Libraries, and ValueSets within the Bundle [returned by the questionnaire package operation] **SHALL** be version specific",SHALL,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,314,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,"Note that the same Libraries and/or ValueSets may appear in more than one Questionnaire Bundle [returned by the questionnaire package operation], possibly with a different version.",MAY,Payer Service,,false
@@ -336,7 +335,7 @@ hl7.fhir.us.davinci-dtr_2.0.1,323,https://hl7.org/fhir/us/davinci-dtr/STU2/Opera
 hl7.fhir.us.davinci-dtr_2.0.1,324,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,The same QuestionnaireResponse [returned from the package questionnaire operation] might be associated with multiple Request resources or may need to be filled out separately for different Requests.,MAY,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,325,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,The payer **MAY** opt to pre-populate some answers in the provided QuestionnaireResponses [returned from the questionnaire package operation] based on information the payer has in its own records or has from context from CRD or from other prior auth or claims submissions.,MAY,Payer Service,,false
 hl7.fhir.us.davinci-dtr_2.0.1,326,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,"Payers must be cautious about prepopulating Questionnaires  [returned from the questionnaire package operation] with sensitive information, because there are rare situations where a malicious application could attempt to access information that was not authorized by the EHR.",SHOULD,Payer Service,,false
-hl7.fhir.us.davinci-dtr_2.0.1,327,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,"When resuming a work in progress questionnaire response the DTR client **SHALL** invoke the [qquestionnaire package] operation with the timestamp to see if the questionnaire package has changed since it was last retrieved, presuming that the QuestionnaireResponse.meta.lastUpdated element corresponds to the last package retrieval time.",SHALL,"Full EHR, SMART Client",,true
+hl7.fhir.us.davinci-dtr_2.0.1,327,https://hl7.org/fhir/us/davinci-dtr/STU2/OperationDefinition-questionnaire-package.html,"When resuming a work in progress questionnaire response the DTR client **SHALL** invoke the [questionnaire package] operation with the timestamp to see if the questionnaire package has changed since it was last retrieved, presuming that the QuestionnaireResponse.meta.lastUpdated element corresponds to the last package retrieval time.",SHALL,"Full EHR, SMART Client",,true
 hl7.fhir.us.davinci-dtr_2.0.1,328,https://hl7.org/fhir/us/davinci-dtr/STU2/metrics.html,each implementation should [capture the defined metrics],SHOULD,"Full EHR, Light EHR, SMART Client, Payer Service",,false
 hl7.fhir.us.davinci-dtr_2.0.1,329,https://hl7.org/fhir/us/davinci-dtr/STU2/StructureDefinition-DTRMetricData.html,[DTR Metric Data] **SHOULD**  be collected and maintained for each DTR system action.,SHOULD,"Full EHR, Light EHR, SMART Client, Payer Service",,false
 hl7.fhir.us.davinci-dtr_2.0.1,330,https://hl7.org/fhir/us/davinci-dtr/STU2/StructureDefinition-dtr-std-questionnaire.html,"Elements that are not mustSupport [in the DTR Standard Questionnaire Profile] are presented here as elements that may be of interest to certain payers, but can only be used if the payer is aware that the invoking EHR or SMART App can support them.",SHOULD,Payer Service,,false
@@ -372,3 +371,5 @@ hl7.fhir.us.davinci-dtr_2.0.1,355,https://hl7.org/fhir/us/davinci-dtr/STU2/speci
 hl7.fhir.us.davinci-dtr_2.0.1,356,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#general-considerations,This implementation guide adopts by reference ... HRex Conformance Requirements [([*Conformance Expectations*](https://hl7.org/fhir/us/davinci-hrex/STU1/conformance.html))] which describe ... rules around mustSupport [element processing for consumers that apply to Light EHRs when creating or updating instances of Da Vinci-defined profiles explicitly listed in the [Light DTR EHR Capability Statement](https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-light-dtr-ehr.html).],SHALL,Light EHR,,false
 hl7.fhir.us.davinci-dtr_2.0.1,357,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#general-considerations,This implementation guide adopts by reference ... HRex Conformance Requirements [([*Conformance Expectations*](https://hl7.org/fhir/us/davinci-hrex/STU1/conformance.html))] which describe ... rules around mustSupport [element population for data sources that apply to SMART Clients when creating or updating instances of Da Vinci-defined profiles explicitly listed in the [DTR SMART Client Capability Statement](https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-dtr-smart-client.html).],SHALL,SMART Client,,false
 hl7.fhir.us.davinci-dtr_2.0.1,358,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#general-considerations,This implementation guide adopts by reference ... HRex Conformance Requirements [([*Conformance Expectations*](https://hl7.org/fhir/us/davinci-hrex/STU1/conformance.html))] which describe ... rules around mustSupport [element processing for consumers that apply to SMART Clients when reading or searching for instances of Da Vinci-defined profiles explicitly listed in the [DTR SMART Client Capability Statement](https://hl7.org/fhir/us/davinci-dtr/STU2/CapabilityStatement-dtr-smart-client.html).],SHALL,SMART Client,,false
+hl7.fhir.us.davinci-dtr_2.0.1,359,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#separating-user-provided-information-from-cql-retrieved-information,DTR [SMART] clients **SHALL** [request user details using the `fhirUser` scope],SHALL,SMART Client,,false
+hl7.fhir.us.davinci-dtr_2.0.1,360,https://hl7.org/fhir/us/davinci-dtr/STU2/specification.html#separating-user-provided-information-from-cql-retrieved-information,"[When responding to a token request from a client requesting the `fhirUser` scope, Light EHRs **SHALL**] either provide a PractitionerRole in the SMART App launch of DTR or support transmitting the role by means of the [Active Role](https://hl7.org/fhir/us/davinci-dtr/STU2/StructureDefinition-activeRole.html) extension within the Practitioner resource.",SHALL,Light EHR,,false