davinci_pas_test_kit 0.15.1 → 0.16.0

data/lib/davinci_pas_test_kit/client/generated/v2.2.1/practitioner_role/client_submit_response_must_support_practitioner_role_test.rb

@@ -7,11 +7,11 @@ module DaVinciPASTestKit
       title 'All must support elements for profile PAS PractitionerRole are observed on $submit responses'
       description %(
         
-        PAS client systems are required to be able to receive all
-        must support elements on instances of all profiles included in 
+        PAS clients are required to be able to receive all
+        must support elements on instances of all profiles included in `$submit`
         responses, including instances of the PAS PractitionerRole Profile.
         This test checks all identified instances of the PAS PractitionerRole
-        Profile on responses sent to the client to ensure that the following
+        Profile on responses sent to the PAS client to ensure that the following
         must support elements are observed:
 
         * PractitionerRole.code
@@ -24,6 +24,7 @@ module DaVinciPASTestKit
         * PractitionerRole.telecom.system
         * PractitionerRole.telecom.value
       )
+      verifies_requirements 'hl7.fhir.us.davinci-pas_2.2.1@hrex-conf-2'
 
       config(
         options: {

data/lib/davinci_pas_test_kit/client/generated/v2.2.1/requestor/client_inquire_response_must_support_requestor_test.rb

@@ -7,11 +7,11 @@ module DaVinciPASTestKit
       title 'All must support elements for profile PAS Requestor Organization are observed on $inquire responses'
       description %(
         
-        PAS client systems are required to be able to receive all
-        must support elements on instances of all profiles included in 
+        PAS clients are required to be able to receive all
+        must support elements on instances of all profiles included in `$inquire`
         responses, including instances of the PAS Requestor Organization Profile.
         This test checks all identified instances of the PAS Requestor Organization
-        Profile on responses sent to the client to ensure that the following
+        Profile on responses sent to the PAS client to ensure that the following
         must support elements are observed:
 
         * Organization.active
@@ -34,6 +34,7 @@ module DaVinciPASTestKit
         * Organization.telecom.value
         * Organization.type
       )
+      verifies_requirements 'hl7.fhir.us.davinci-pas_2.2.1@hrex-conf-2'
 
       config(
         options: {

data/lib/davinci_pas_test_kit/client/generated/v2.2.1/requestor/client_submit_response_must_support_requestor_test.rb

@@ -7,11 +7,11 @@ module DaVinciPASTestKit
       title 'All must support elements for profile PAS Requestor Organization are observed on $submit responses'
       description %(
         
-        PAS client systems are required to be able to receive all
-        must support elements on instances of all profiles included in 
+        PAS clients are required to be able to receive all
+        must support elements on instances of all profiles included in `$submit`
         responses, including instances of the PAS Requestor Organization Profile.
         This test checks all identified instances of the PAS Requestor Organization
-        Profile on responses sent to the client to ensure that the following
+        Profile on responses sent to the PAS client to ensure that the following
         must support elements are observed:
 
         * Organization.active
@@ -34,6 +34,7 @@ module DaVinciPASTestKit
         * Organization.telecom.value
         * Organization.type
       )
+      verifies_requirements 'hl7.fhir.us.davinci-pas_2.2.1@hrex-conf-2'
 
       config(
         options: {

data/lib/davinci_pas_test_kit/client/jobs/send_pas_subscription_notification.rb

@@ -20,8 +20,18 @@ module DaVinciPASTestKit
 
       sidekiq_options retry: false
 
+      # How long an Inferno test that starts this job waits for it to send the notification. The job polls for
+      # the test to start waiting for up to this long, since there is no point sending once the wait has timed out.
+      TEST_WAIT_TIMEOUT_SECONDS = 300
+      TEST_WAITING_POLL_INTERVAL_SECONDS = 0.5
+
+      # test_run_id and result_id may be nil when the job is started by an Inferno test, which does not know
+      # them until it is waiting. They are then looked up from the test session once the test waits.
+      # When resume_test_after_notification is true, the job ends the wait with the resume_token after
+      # sending the notification (or fails it if the job errors).
+      # Sidekiq job arguments are positional, so the boolean cannot be a keyword argument
       def perform(test_run_id, test_session_id, result_id, notification_bearer_token, notification_json, resume_token,
-                  notification_suite_id, ig_version = 'v2.0.1')
+                  notification_suite_id, ig_version = 'v2.0.1', resume_test_after_notification = false) # rubocop:disable Style/OptionalBooleanParameter
         @test_run_id = test_run_id
         @test_session_id = test_session_id
         @result_id = result_id
@@ -30,8 +40,17 @@ module DaVinciPASTestKit
         @resume_token = resume_token
         @notification_suite_id = notification_suite_id
         @ig_version = ig_version
+        @resume_test_after_notification = resume_test_after_notification
 
         await_subscription_creation # NOTE: currently must exist - see PASClientPendedSubmitTest
+        if @result_id.nil? && !test_starts_waiting?
+          # the test can't be resumed because it isn't waiting, so just explain why no notification was sent
+          Inferno::Application['logger'].error(
+            "Subscription notification not sent: no test started waiting on '#{@resume_token}' " \
+            "within #{TEST_WAIT_TIMEOUT_SECONDS} seconds."
+          )
+          return
+        end
         sleep 1
         return unless test_still_waiting?
 
@@ -39,6 +58,12 @@ module DaVinciPASTestKit
         return unless test_still_waiting?
 
         send_event_notification
+        resume_test(RESUME_PASS_PATH) if @resume_test_after_notification
+      rescue StandardError => e
+        raise unless @resume_test_after_notification
+
+        Inferno::Application['logger'].error("Sending the subscription notification failed: #{e.message}")
+        resume_test(RESUME_FAIL_PATH)
       end
 
       def requests_repo
@@ -94,8 +119,44 @@ module DaVinciPASTestKit
         @subscription_full_url ||= "#{fhir_subscription_url}/#{subscription.id}"
       end
 
+      def test_runs_repo
+        @test_runs_repo ||= Inferno::Repositories::TestRuns.new
+      end
+
+      # @resume_token is the same identifier the test's own wait() call registers (and that
+      # resume_test later ends the wait with), so this is an exact match on the waiting test
+      # run - not a guess at "the most recent run for this session", which could pick up an
+      # unrelated run if the tester has more than one for the same session.
+      def test_run_id
+        @test_run_id ||= test_runs_repo.find_latest_waiting_by_identifier(@resume_token)&.id
+      end
+
+      def waiting_result
+        results_repo.find_waiting_result(test_run_id:)
+      end
+
+      def result_id
+        @result_id ||= waiting_result&.id
+      end
+
       def test_still_waiting?
-        results_repo.find_waiting_result(test_run_id: @test_run_id)
+        waiting_result.present?
+      end
+
+      # Inferno tests start the job before they begin waiting, so poll until the test is waiting, giving up
+      # once the test's own wait would have timed out.
+      # @return [Boolean] whether the test is waiting
+      def test_starts_waiting?
+        (TEST_WAIT_TIMEOUT_SECONDS / TEST_WAITING_POLL_INTERVAL_SECONDS).to_i.times do
+          return true if test_still_waiting?
+
+          sleep TEST_WAITING_POLL_INTERVAL_SECONDS
+        end
+        test_still_waiting?
+      end
+
+      def resume_test(path)
+        test_suite_connection.get(path.delete_prefix('/'), { token: @resume_token })
       end
 
       def await_subscription_creation
@@ -130,7 +191,7 @@ module DaVinciPASTestKit
           request_body: response.env.request_body,
           response_body: response.env.response_body,
           test_session_id: @test_session_id,
-          result_id: @result_id,
+          result_id:,
           request_headers: inferno_request_headers,
           response_headers: inferno_response_headers,
           tags:

data/lib/davinci_pas_test_kit/client/pas_client_subscription_pas_conformance_test.rb

@@ -9,14 +9,15 @@ module DaVinciPASTestKit
     id :pas_client_subscription_pas_conformance_test
     title 'Subscription creation request has the correct structure and content'
     description %(
-      This test verifies that the Subscription created by the client under test
+      This test verifies that the Subscription created by the PAS client
       is conformant to PAS requirements on the Subscription, including
       - The use of the [PAS-defined Subscription
         Topic](https://hl7.org/fhir/us/davinci-pas/STU2/SubscriptionTopic-PASSubscriptionTopic.html), and
-      - Inclusion of filter criteria for the client's organization.
+      - Inclusion of filter criteria for the PAS client's organization.
     )
 
-    verifies_requirements 'hl7.fhir.us.davinci-pas_2.2.1@spec-62'
+    verifies_requirements 'hl7.fhir.us.davinci-pas_2.2.1@spec-62', 'hl7.fhir.uv.subscriptions_1.1.0@64',
+                          'hl7.fhir.uv.subscriptions_1.1.0@96', 'hl7.fhir.uv.subscriptions_1.1.0@116'
 
     def ig_version
       config.options[:ig_version]

data/lib/davinci_pas_test_kit/client/registration/abstract_configuration_other_display_test.rb

@@ -3,9 +3,11 @@ module DaVinciPASTestKit
     id :pas_client_reg_config_other_display
     title 'PAS client registers Inferno as a PAS server'
     description %(
-      This test provides all the information needed for testers to configure
-      the client under test to communicate with Inferno's simulated PAS server
-      using dedicated endpoints.
+      During this test, Inferno will wait while the tester configures the PAS client
+      to communicate with Inferno's simulated PAS server using dedicated
+      endpoints. The "User Action Required" dialog that appears during the test
+      will provide all the information needed for testers to configure the PAS client,
+      including the FHIR base URL.
     )
     attestation
 
@@ -37,7 +39,7 @@ module DaVinciPASTestKit
           FHIR Base URL: `#{session_fhir_base_url(wait_identifier)}`
 
           [Click here](#{confirmation_url}) once you have configured
-          the client to connect to Inferno at the above endpoints.
+          the PAS client to send PAS requests to Inferno at the above endpoint.
         )
       )
     end

data/lib/davinci_pas_test_kit/client/registration/abstract_configuration_smart_display_test.rb

@@ -3,9 +3,12 @@ module DaVinciPASTestKit
     id :pas_client_reg_config_smart_display
     title 'PAS client registers Inferno as a PAS server'
     description %(
-      This test provides all the information needed for testers to configure
-      the client under test to communicate with Inferno's simulated PAS server
-      including SMART endpoints to obtain access tokens.
+      During this test, Inferno will wait while the tester configures the PAS client
+      to communicate with Inferno's simulated PAS server using
+      endpoints authenticated using SMART Backend Services. The "User Action Required"
+      dialog that appears during the test will provide all the information needed
+      for testers to configure the PAS client, including the FHIR base URL, the
+      token endpoint, and the PAS client's assigned client id.
     )
     attestation
 
@@ -29,7 +32,8 @@ module DaVinciPASTestKit
           - Token endpoint: `#{token_url}`
 
           [Click here](#{confirmation_url}) once you have configured
-          the client to connect to Inferno at the above endpoints.
+          the PAS client to authenticate with Inferno and send PAS requests
+          to Inferno at the above endpoint.
         )
       )
     end

data/lib/davinci_pas_test_kit/client/registration/abstract_configuration_udap_display_test.rb

@@ -3,9 +3,13 @@ module DaVinciPASTestKit
     id :pas_client_reg_config_udap_display
     title 'PAS client registers Inferno as a PAS server'
     description %(
-      This test provides all the information needed for testers to configure
-      the client under test to communicate with Inferno's simulated PAS server
-      including UDAP endpoints to obtain access tokens.
+      During this test, Inferno will wait while the tester configures the PAS client
+      to communicate with Inferno's simulated PAS server using
+      endpoints authenticated using the UDAP Client Credentials flow.
+      The "User Action Required" dialog that appears during the test will provide
+      all the information needed for testers to configure the PAS client,
+      including the FHIR base URL, the token endpoint, and the
+      assigned client id.
     )
     attestation
 
@@ -29,7 +33,8 @@ module DaVinciPASTestKit
           - Token endpoint: `#{token_url}`
 
           [Click here](#{confirmation_url}) once you have configured
-          the client to connect to Inferno at the above endpoints.
+          the PAS client to authenticate with Inferno and send PAS requests
+          to Inferno at the above endpoint.
         )
       )
     end

data/lib/davinci_pas_test_kit/client/registration/abstract_other_auth_attest_test.rb

@@ -3,8 +3,8 @@ module DaVinciPASTestKit
     id :pas_client_reg_other_auth_attest
     title 'PAS client supports a non-standard approach for authenticating with the PAS server'
     description %(
-      Since a standard auth approach was not chosen for this session, this test provides testers with an
-      opportunity to attest to their client's ability to authenticate itself to a server
+      Since a standard auth approach was not chosen for this session, this test asks testers
+      to attest to the PAS client's ability to authenticate itself to a server
       using a method that this Inferno test suite does not support, such as mutual authentication
       TLS.
     )
@@ -14,7 +14,8 @@ module DaVinciPASTestKit
     output :attest_false_url
 
     run do
-      identifier = test_session_id
+      # only the tester continues this wait, so use a fresh random identifier - see SessionIdentification
+      identifier = SecureRandom.uuid
       attest_true_url = "#{resume_pass_url}?token=#{identifier}"
       output(attest_true_url:)
       attest_false_url = "#{resume_fail_url}?token=#{identifier}"
@@ -25,7 +26,7 @@ module DaVinciPASTestKit
         message: %(
           **Other Authentication Attestation**:
 
-          I attest that the client system can authenticate itself with a PAS server using
+          I attest that the PAS client can authenticate itself with a PAS server using
           a mechanism other than the SMART Backend Services or UDAP B2B client credentials
           flows.
 

data/lib/davinci_pas_test_kit/client/request_count_gating.rb

@@ -0,0 +1,14 @@
+module DaVinciPASTestKit
+  # Shared predicates for the no_requests_ok/multiple_requests_ok config options, used to gate
+  # on how many tagged requests were found by AbstractResponseAttest's run block and by
+  # ClientBundleValidationHelper#check_request_count.
+  module RequestCountGating
+    def no_requests_ok?
+      config.options[:no_requests_ok]
+    end
+
+    def multiple_requests_ok?
+      config.options[:multiple_requests_ok]
+    end
+  end
+end

data/lib/davinci_pas_test_kit/client/response_generator.rb

@@ -4,6 +4,11 @@ module DaVinciPASTestKit
   module ResponseGenerator
     include ParametersHelper
 
+    # Extensions on elements of the request Claim that Inferno copies into the ClaimResponse it generates
+    # are kept only if they are published by HL7 (e.g., the PAS identifier extensions), since Inferno,
+    # acting as the payer, doesn't send custom extensions - see NO_CUSTOM_EXTENSIONS_VALIDATOR.
+    HL7_EXTENSION_URL_PREFIX = 'http://hl7.org/fhir/'.freeze
+
     def mock_id_only_notification_bundle(submit_response, subscription_reference, subscription_topic,
                                          ig_version = 'v2.0.1')
       notification_timestamp = Time.now.utc
@@ -240,14 +245,14 @@ module DaVinciPASTestKit
                                       else
                                         "http://hl7.org/fhir/us/davinci-pas/StructureDefinition/profile-claiminquiryresponse|#{ig_version.delete('v')}"
                                       end),
-        identifier: claim.identifier,
-        type: claim.type,
+        identifier: copy_without_custom_extensions(claim.identifier),
+        type: copy_without_custom_extensions(claim.type),
         status: claim.status,
         use: claim.use,
-        patient: absolute_reference(claim.patient, request_bundle.entry, root_url),
+        patient: copy_without_custom_extensions(absolute_reference(claim.patient, request_bundle.entry, root_url)),
         created: timestamp.iso8601,
-        insurer: absolute_reference(claim.insurer, request_bundle.entry, root_url),
-        requestor: absolute_reference(claim.provider, request_bundle.entry, root_url),
+        insurer: copy_without_custom_extensions(absolute_reference(claim.insurer, request_bundle.entry, root_url)),
+        requestor: copy_without_custom_extensions(absolute_reference(claim.provider, request_bundle.entry, root_url)),
         request: claim_full_url.present? ? FHIR::Reference.new(reference: claim_full_url) : nil,
         # v2.2.1 removed 'queued' from ClaimResponseOutcome ValueSet; pended status is
         # conveyed via item.extension:reviewActionCode instead.
@@ -303,13 +308,41 @@ module DaVinciPASTestKit
       claim_response
     end
 
+    # @param element [FHIR::Model, Array<FHIR::Model>, nil] an element of the request Claim.
+    # @return a copy of the element without extensions (at any depth) that aren't published by HL7.
+    def copy_without_custom_extensions(element)
+      return element.map { |child| copy_without_custom_extensions(child) } if element.is_a?(Array)
+      return element if element.nil?
+
+      element.class.new(without_custom_extensions(element.to_hash))
+    end
+
+    # Kept extensions are left whole, since complex extensions' sub-extensions use relative urls.
+    def without_custom_extensions(value)
+      case value
+      when Hash
+        value.each_with_object({}) do |(key, child), result|
+          if %w[extension modifierExtension].include?(key)
+            kept = child.select { |extension| extension['url'].to_s.start_with?(HL7_EXTENSION_URL_PREFIX) }
+            result[key] = kept if kept.present?
+          else
+            result[key] = without_custom_extensions(child)
+          end
+        end
+      when Array
+        value.map { |child| without_custom_extensions(child) }
+      else
+        value
+      end
+    end
+
     # Pairs each modified item (already marked A6 above) with a ClaimResponse.addItem, referenced by
     # the same itemSequence, conveying what the payer authorized (marked A1, 'Certified in total').
     def add_modified_items(claim_response, claim)
       claim_response.addItem = claim.item.map do |item|
         FHIR::ClaimResponse::AddItem.new(
           itemSequence: [item.sequence],
-          productOrService: item.productOrService,
+          productOrService: copy_without_custom_extensions(item.productOrService),
           adjudication: [
             FHIR::ClaimResponse::Item::Adjudication.new(
               extension: [
@@ -466,6 +499,8 @@ module DaVinciPASTestKit
         if attr.to_s == 'request' && resource.respond_to?(:resourceType) && resource.resourceType == 'ClaimResponse'
           next
         end
+        # JSON keys without a matching attribute, e.g., the `_gender` holding a primitive's extensions
+        next unless resource.respond_to?(attr.to_sym)
 
         value = resource.send(attr.to_sym)
         if value.is_a?(FHIR::Reference) && value.reference.present?
@@ -502,10 +537,16 @@ module DaVinciPASTestKit
       url.sub(%r{/[^/]*/[^/]*(/)?\z}, '')
     end
 
-    def claim_response_full_url_from_submit_response_bundle(submit_response_bundle)
-      submit_response_bundle = submit_response_bundle.parameter[0] if submit_response_bundle.is_a?(FHIR::Parameters)
+    # Finds the Bundle.entry for the ClaimResponse in a $submit response, which may be wrapped in a
+    # FHIR::Parameters resource (v2.2.1). Returns nil if there is no response bundle or no such entry.
+    def claim_response_entry_from_response_bundle(response_bundle)
+      response_bundle = response_bundle.parameter[0]&.resource if response_bundle.is_a?(FHIR::Parameters)
 
-      claim_response_entry = submit_response_bundle&.entry&.find { |e| e&.resource&.resourceType == 'ClaimResponse' }
+      response_bundle&.entry&.find { |e| e&.resource&.resourceType == 'ClaimResponse' }
+    end
+
+    def claim_response_full_url_from_submit_response_bundle(submit_response_bundle)
+      claim_response_entry = claim_response_entry_from_response_bundle(submit_response_bundle)
 
       if claim_response_entry.present?
         return claim_response_entry.fullUrl unless claim_response_entry.fullUrl.blank?

data/lib/davinci_pas_test_kit/client/session_identification.rb

@@ -1,7 +1,14 @@
 require 'udap_security_test_kit'
+require_relative 'pas_client_options'
 
 module DaVinciPASTestKit
   module SessionIdentification
+    # Wait identifiers:
+    # - A wait during which the client sends requests to Inferno (including waits that also offer a
+    #   "click here when done" link) must use session_wait_identifier, since Inferno's endpoints find
+    #   the waiting test from the client id or session URL path on the request.
+    # - A wait that only the tester (e.g., an attestation) or an Inferno job continues must use a fresh
+    #   SecureRandom.uuid, so that a stale link from an earlier wait in the session can't resume it.
     def session_wait_identifier(client_id, session_url_path)
       # look at test config and determine the wait identifier to use
       # at somepoint this would be an inferno type, for now, just two options
@@ -31,14 +38,26 @@ module DaVinciPASTestKit
       end
     end
 
-    # interpret the bearer token structure to determine the wait identifer
-    # - if structured like a token returned by the simulated Auth server, return the client URI
-    # - otherwise, use the raw token (provided token)
-    def bearer_token_to_wait_identifier(token)
-      client_id = UDAPSecurityTestKit::MockUDAPServer.issued_token_to_client_id(token)
-      return client_id if client_id.present?
+    def auth_description_for_wait(client_id)
+      case suite_options[:client_type]
+      when PASClientOptions::OTHER_AUTH
+        'No authentication with Inferno is required. Requests will be associated ' \
+        'with this session based on the endpoint alone.'
+      when PASClientOptions::SMART_BACKEND_SERVICES_CONFIDENTIAL_ASYMMETRIC
+        authenticated_auth_description_for_wait(client_id, 'SMART Backend Services')
+      when PASClientOptions::UDAP_CLIENT_CREDENTIALS
+        authenticated_auth_description_for_wait(client_id, 'UDAP B2B Client Credentials')
+      end
+    end
 
-      token
+    def authenticated_auth_description_for_wait(client_id, type)
+      "Requests must be authenticated by first obtaining a #{type} " \
+        'access token using' \
+        "\n\n- Token endpoint: `#{token_url}`" \
+        "\n- Client Id: `#{client_id}`\n\n" \
+        'Only requests that include an obtained access token as a bearer token ' \
+        'in the Authorization header of the HTTP request will be recognized as ' \
+        'associated with this session and return successful responses.'
     end
   end
 end

data/lib/davinci_pas_test_kit/client/subscription_notification_trigger.rb

@@ -0,0 +1,80 @@
+require_relative 'response_generator'
+require_relative 'jobs/send_pas_subscription_notification'
+
+module DaVinciPASTestKit
+  # Starts the job that sends a Subscription notification to the client after a pended $submit response.
+  # The notification is the tester-provided one (updated to be current) when there is one, or a mocked
+  # notification based on the response and the client's Subscription otherwise.
+  #
+  # The module does not know how to reach the tester's inputs or the requests made earlier in the session,
+  # because that differs between the classes that use it (suite endpoints and Inferno tests). Including
+  # classes provide them through the helper methods below, which raise NotImplementedError here.
+  #
+  # Helper methods the including class must provide:
+  # - notification_test_run_id, notification_test_session_id, notification_result_id: identify the test run,
+  #   session and the waiting result that the job checks on and records the notification request on. The test
+  #   run and result ids may be nil when the including class cannot know them yet (an Inferno test that has
+  #   not started waiting), in which case the job looks them up.
+  # - notification_bearer_token: the access token to send with the notification, from the tester's inputs
+  # - tester_notification_bundle: the tester-provided notification Bundle JSON, or nil
+  # - client_subscription_json: the Subscription the client created, as parsed JSON (so that primitive
+  #   extensions are kept), from the earlier successful Subscription create request. nil if there is none.
+  # - test_run_identifier: the token that identifies the waiting test to resume
+  # - suite_id and ig_version: the suite that the job should send the notification for, and its IG version
+  # - fhir_subscription_url: the base URL of the Subscription endpoint (provided by ClientURLs)
+  module SubscriptionNotificationTrigger
+    include ResponseGenerator
+
+    HELPERS = %i[notification_test_run_id notification_test_session_id notification_result_id
+                 notification_bearer_token tester_notification_bundle client_subscription_json].freeze
+    HELPERS.each do |helper|
+      define_method(helper) do
+        raise NotImplementedError, "#{self.class} must implement ##{helper} to use SubscriptionNotificationTrigger"
+      end
+    end
+
+    # With resume_test true, the job ends the wait identified by test_run_identifier once it has sent the
+    # notification, for use by an Inferno test that waits for the notification to be sent.
+    def start_notification_job(response_bundle_json, decision, generated_claim_response_uuid, resume_test: false)
+      notification_contents = notification_json(response_bundle_json, decision, generated_claim_response_uuid)
+
+      Inferno::Jobs.perform(Jobs::SendPASSubscriptionNotification, notification_test_run_id,
+                            notification_test_session_id, notification_result_id, notification_bearer_token,
+                            notification_contents, test_run_identifier, suite_id, ig_version, resume_test)
+    end
+
+    private
+
+    def notification_json(response_bundle_json, decision, generated_claim_response_uuid)
+      user_inputted_notification_json = tester_notification_bundle
+
+      if user_inputted_notification_json.present?
+        update_tester_provided_notification(user_inputted_notification_json, generated_claim_response_uuid)
+      else
+        generate_notification(response_bundle_json, decision)
+      end
+    end
+
+    def generate_notification(response_bundle_json, decision)
+      subscription = client_subscription_json
+      subscription_reference = "#{fhir_subscription_url}/#{subscription['id']}"
+      subscription_topic = subscription['criteria']
+
+      if find_subscription_content_type(subscription) == 'full-resource'
+        mock_full_resource_notification_bundle(response_bundle_json, subscription_reference, subscription_topic,
+                                               decision, ig_version)
+      else # assume id-only since empty not allowed - if asked for empty, other failures will occur
+        mock_id_only_notification_bundle(response_bundle_json, subscription_reference, subscription_topic,
+                                         ig_version)
+      end
+    end
+
+    def find_subscription_content_type(subscription)
+      content_ext = subscription.dig('channel', '_payload', 'extension')
+        &.find do |ext|
+          ext['url'] == 'http://hl7.org/fhir/uv/subscriptions-backport/StructureDefinition/backport-payload-content'
+        end
+      content_ext&.dig('valueCode')
+    end
+  end
+end

data/lib/davinci_pas_test_kit/client/subscription_setup_requirement.rb

@@ -0,0 +1,59 @@
+module DaVinciPASTestKit
+  # Shared guard for client tests that need the client's Subscription Setup to have completed
+  # before they can proceed - either because they need the created Subscription itself (e.g. to
+  # generate a notification against it, or to update or delete it) or just need to know one exists
+  # before continuing with the pended scenario.
+  module SubscriptionSetupRequirement
+    PENDED_SCENARIO_SKIP_MESSAGE = %(
+      This test cannot proceed because no Subscription exists to receive notifications
+      for pended claims. Run the _Subscription Setup_ tests to provide a Subscription
+      for use in delivering notifications before re-running the pended scenario tests.
+    ).freeze
+
+    PENDED_SCENARIO_MODIFIED_SUBSCRIPTION_SKIP_MESSAGE = %(
+      This test cannot proceed because the PAS client submitted update or delete requests for its
+      Subscription during the _Subscription Update and Deletion_ tests. Re-run the _Subscription Setup_
+      tests to create a new Subscription for use in delivering notifications before re-running the
+      pended scenario tests.
+    ).freeze
+
+    UPDATE_DELETE_SKIP_MESSAGE = %(
+      This test cannot proceed because no Subscription exists to update or delete. Run the
+      _Subscription Setup_ tests to create a Subscription before re-running this test.
+    ).freeze
+
+    # Skips the test unless a successful (201) Subscription-create request was made during this
+    # session.
+    # @param skip_message [String] explanation shown when the test is skipped.
+    # @return [Hash] the created Subscription as returned to the client, parsed from the response body.
+    def require_created_subscription(skip_message: PENDED_SCENARIO_SKIP_MESSAGE)
+      subscription_request = load_tagged_requests(SUBSCRIPTION_CREATE_TAG).find { |req| req.status == 201 }
+      skip_if subscription_request.blank?, skip_message
+      JSON.parse(subscription_request.response_body)
+    end
+
+    # Like require_created_subscription, but also skips if the client has successfully updated or
+    # deleted the created Subscription. Notifications are generated from the Subscription as created,
+    # so the pended scenario must not run against one the client has since changed or removed.
+    # Rejected update and delete requests leave the Subscription unchanged and so are ignored.
+    # @return [Hash] the created Subscription as returned to the client, parsed from the response body.
+    def require_unmodified_subscription
+      subscription = require_created_subscription
+      # Only update and delete requests are tagged with the Subscription id, which is new for each create
+      skip_if load_tagged_requests(subscription['id']).any? { |req| subscription_change_succeeded?(req) },
+              PENDED_SCENARIO_MODIFIED_SUBSCRIPTION_SKIP_MESSAGE
+      subscription
+    end
+
+    private
+
+    # Successful updates respond with 200 and successful deletes with a 2xx status
+    def subscription_change_succeeded?(request)
+      if request.tags.include?(SUBSCRIPTION_DELETE_TAG)
+        request.status.between?(200, 299)
+      else
+        request.status == 200
+      end
+    end
+  end
+end