onc_certification_g10_test_kit 2.3.0 → 3.0.0

data/lib/onc_certification_g10_test_kit/smart_scopes_test.rb

@@ -9,81 +9,165 @@ module ONCCertificationG10TestKit
     input :requested_scopes, :received_scopes
     uses_request :token
 
+    VALID_RESOURCE_TYPES = [
+      '*',
+      'Patient',
+      'AllergyIntolerance',
+      'Binary',
+      'CarePlan',
+      'CareTeam',
+      'Condition',
+      'Device',
+      'DiagnosticReport',
+      'DocumentReference',
+      'Encounter',
+      'Goal',
+      'Immunization',
+      'Location',
+      'Medication',
+      'MedicationOrder',
+      'MedicationRequest',
+      'MedicationStatement',
+      'Observation',
+      'Organization',
+      'Person',
+      'Practitioner',
+      'PractitionerRole',
+      'Procedure',
+      'Provenance',
+      'RelatedPerson'
+    ].freeze
+
+    V5_VALID_RESOURCE_TYPES =
+      (VALID_RESOURCE_TYPES + ['ServiceRequest', 'QuestionnaireResponse']).freeze
+
+    PATIENT_COMPARTMENT_RESOURCE_TYPES = [
+      '*',
+      'Patient',
+      'AllergyIntolerance',
+      'CarePlan',
+      'CareTeam',
+      'Condition',
+      'DiagnosticReport',
+      'DocumentReference',
+      'Goal',
+      'Immunization',
+      'MedicationRequest',
+      'Observation',
+      'Procedure',
+      'Provenance'
+    ].freeze
+
+    V5_PATIENT_COMPARTMENT_RESOURCE_TYPES =
+      (PATIENT_COMPARTMENT_RESOURCE_TYPES + ['ServiceRequest']).freeze
+
+    def patient_compartment_resource_types
+      return PATIENT_COMPARTMENT_RESOURCE_TYPES unless suite_options[:us_core_version] == 'us_core_5'
+
+      V5_PATIENT_COMPARTMENT_RESOURCE_TYPES
+    end
+
     def valid_resource_types
-      [
-        '*',
-        'Patient',
-        'AllergyIntolerance',
-        'Binary',
-        'CarePlan',
-        'CareTeam',
-        'Condition',
-        'Device',
-        'DiagnosticReport',
-        'DocumentReference',
-        'Encounter',
-        'Goal',
-        'Immunization',
-        'Location',
-        'Medication',
-        'MedicationOrder',
-        'MedicationRequest',
-        'MedicationStatement',
-        'Observation',
-        'Organization',
-        'Person',
-        'Practitioner',
-        'PractitionerRole',
-        'Procedure',
-        'Provenance',
-        'RelatedPerson'
-      ]
+      return VALID_RESOURCE_TYPES unless suite_options[:us_core_version] == 'us_core_5'
+
+      V5_VALID_RESOURCE_TYPES
+    end
+
+    def read_format
+      @read_format ||=
+        begin
+          v1_read_format = 'read'
+          v2_read_format = 'c?ru?d?s?'
+
+          case config.options[:scope_version]
+          when :v1
+            "#{v1_read_format} | *"
+          when :v2
+            "#{v2_read_format} | *"
+          else
+            [v1_read_format, v2_read_format, '*'].join(' | ')
+          end
+        end
+    end
+
+    def access_level_regex
+      @access_level_regex ||=
+        case config.options[:scope_version]
+        when :v1
+          /\A(\*|read)/
+        when :v2
+          /\A(\*|c?ru?d?s?\b)/
+        else
+          /\A(\*|read|c?ru?d?s?\b)/
+        end
+    end
+
+    def bad_format_message(scope)
+      %(
+        Requested scope `#{scope}` does not follow the format:
+        `#{required_scope_type}/[ <ResourceType> | * ].[ #{read_format} ]`
+      )
+    end
+
+    def strip_experimental_scope_syntax(full_scope)
+      if config.options[:scope_version] == :v1
+        full_scope
+      else
+        full_scope.split('?').first
+      end
     end
 
     def requested_scope_test(scopes, patient_compartment_resource_types)
-      patient_scope_found = false
+      correct_scope_type_found = false
 
-      scopes.each do |scope|
-        bad_format_message =
-          "Requested scope '#{scope}' does not follow the format: `#{scope_type}" \
-          '/[ resource | * ].[ read | * ]`'
+      scopes.each do |full_scope|
+        scope = strip_experimental_scope_syntax(full_scope)
 
         scope_pieces = scope.split('/')
-        assert scope_pieces.count == 2, bad_format_message
+        assert scope_pieces.count == 2, bad_format_message(scope)
 
-        resource_access = scope_pieces[1].split('.')
-        bad_resource_message = "'#{resource_access[0]}' must be either a valid resource type or '*'"
+        scope_type, resource_scope = scope_pieces
+        resource_scope_parts = resource_scope.split('.')
 
-        if scope_type == 'patient' && patient_compartment_resource_types.exclude?(resource_access[0])
-          assert ['user', 'patient'].include?(scope_pieces[0]),
+        assert resource_scope_parts.length == 2, bad_format_message(scope)
+
+        resource_type, access_level = resource_scope_parts
+        bad_resource_message = "'#{resource_type}' must be either a valid resource type or '*'"
+
+        if required_scope_type == 'patient' && patient_compartment_resource_types.exclude?(resource_type)
+          assert ['user', 'patient'].include?(scope_type),
                  "Requested scope '#{scope}' must begin with either 'user/' or 'patient/'"
         else
-          assert scope_pieces[0] == scope_type, bad_format_message
+          assert scope_type == required_scope_type, bad_format_message(scope)
         end
 
-        assert resource_access.count == 2, bad_format_message
-        assert valid_resource_types.include?(resource_access[0]), bad_resource_message
-        assert resource_access[1] =~ /^(\*|read)/, bad_format_message
+        assert valid_resource_types.include?(resource_type), bad_resource_message
+        assert access_level =~ access_level_regex, bad_format_message(scope)
 
-        patient_scope_found = true
+        correct_scope_type_found = true
       end
 
-      assert patient_scope_found,
-             "#{scope_type.capitalize}-level scope in the format: " \
-             "`#{scope_type}/[ resource | * ].[ read | *]` was not requested."
+      assert correct_scope_type_found,
+             "#{required_scope_type.capitalize}-level scope in the format: " \
+             "`#{required_scope_type}/[ <ResourceType> | * ].[ #{read_format} ]` was not requested."
     end
 
     def received_scope_test(scopes, patient_compartment_resource_types)
       granted_resource_types = []
 
-      scopes.each do |scope|
+      scopes.each do |full_scope|
+        scope = strip_experimental_scope_syntax(full_scope)
+
         scope_pieces = scope.split('/')
         next unless scope_pieces.count == 2
 
-        resource_access = scope_pieces[1].split('.')
-        next unless resource_access.count == 2
+        _scope_type, resource_scope = scope_pieces
 
-        granted_resource_types << resource_access[0] if resource_access[1] =~ /^(\*|read)/
+        resource_scope_parts = resource_scope.split('.')
+        next unless resource_scope_parts.count == 2
+
+        resource_type, access_level = resource_scope_parts
+        granted_resource_types << resource_type if access_level =~ access_level_regex
       end
 
       missing_resource_types =
@@ -100,23 +184,6 @@ module ONCCertificationG10TestKit
     run do
       skip_if request.status != 200, 'Token exchange was unsuccessful'
 
-      patient_compartment_resource_types = [
-        '*',
-        'Patient',
-        'AllergyIntolerance',
-        'CarePlan',
-        'CareTeam',
-        'Condition',
-        'DiagnosticReport',
-        'DocumentReference',
-        'Goal',
-        'Immunization',
-        'MedicationRequest',
-        'Observation',
-        'Procedure',
-        'Provenance'
-      ].freeze
-
       [
         {
           scopes: requested_scopes,

data/lib/onc_certification_g10_test_kit/smart_standalone_patient_app_group.rb

@@ -23,16 +23,22 @@ module ONCCertificationG10TestKit
 
     description %(
         This scenario demonstrates the ability of a system to perform a Patient
-        Standalone Launch to a [SMART on
-        FHIR](http://www.hl7.org/fhir/smart-app-launch/1.0.0/) confidential client
-        with a patient context, refresh token, and [OpenID Connect
-        (OIDC)](https://openid.net/specs/openid-connect-core-1_0.html) identity
-        token. After launch, a simple Patient resource read is performed on the
-        patient in context. The access token is then refreshed, and the Patient
-        resource is read using the new access token to ensure that the refresh
-        was successful. The authentication information provided by OpenID
-        Connect is decoded and validated, and simple queries are performed to
-        ensure that access is granted to all USCDI data elements.
+        Standalone Launch to a SMART on FHIR confidential client with a patient
+        context, refresh token, OpenID Connect (OIDC) identity token, and use
+        the GET HTTP method for code exchange. After launch, a simple Patient
+        resource read is performed on the patient in context. The access token
+        is then refreshed, and the Patient resource is read using the new access
+        token to ensure that the refresh was successful. The authentication
+        information provided by OpenID Connect is decoded and validated, and
+        simple queries are performed to ensure that access is granted to all
+        USCDI data elements.
+
+        * [SMART on FHIR
+          (STU1)](http://www.hl7.org/fhir/smart-app-launch/1.0.0/)
+        * [SMART on FHIR
+          (STU2)](http://hl7.org/fhir/smart-app-launch/STU2)
+        * [OpenID Connect
+          (OIDC)](https://openid.net/specs/openid-connect-core-1_0.html)
       )
     id :g10_smart_standalone_patient_app
     run_as_group
@@ -49,6 +55,8 @@ module ONCCertificationG10TestKit
     input_order :url, :standalone_client_id, :standalone_client_secret
 
     group from: :smart_discovery do
+      required_suite_options(smart_app_launch_version: 'smart_app_launch_1')
+
       test from: 'g10_smart_well_known_capabilities',
            config: {
              options: {
@@ -65,7 +73,32 @@ module ONCCertificationG10TestKit
            }
     end
 
+    group from: :smart_discovery_stu2 do
+      required_suite_options(smart_app_launch_version: 'smart_app_launch_2')
+
+      test from: 'g10_smart_well_known_capabilities',
+           config: {
+             options: {
+               required_capabilities: [
+                 'launch-standalone',
+                 'client-public',
+                 'client-confidential-symmetric',
+                 'sso-openid-connect',
+                 'context-standalone-patient',
+                 'permission-offline',
+                 'permission-patient',
+                 'authorize-post',
+                 'permission-v1',
+                 'permission-v2'
+
+               ]
+             }
+           }
+    end
+
     group from: :smart_standalone_launch do
+      required_suite_options(smart_app_launch_version: 'smart_app_launch_1')
+
       title 'Standalone Launch With Patient Scope'
       description %(
         # Background
@@ -92,11 +125,133 @@ module ONCCertificationG10TestKit
           Sequence](http://hl7.org/fhir/smart-app-launch/1.0.0/index.html#standalone-launch-sequence)
       )
 
+      config(
+        inputs: {
+          requested_scopes: {
+            default: %(
+              launch/patient openid fhirUser offline_access
+              patient/Medication.read patient/AllergyIntolerance.read
+              patient/CarePlan.read patient/CareTeam.read patient/Condition.read
+              patient/Device.read patient/DiagnosticReport.read
+              patient/DocumentReference.read patient/Encounter.read
+              patient/Goal.read patient/Immunization.read patient/Location.read
+              patient/MedicationRequest.read patient/Observation.read
+              patient/Organization.read patient/Patient.read
+              patient/Practitioner.read patient/Procedure.read
+              patient/Provenance.read patient/PractitionerRole.read
+            ).gsub(/\s{2,}/, ' ').strip
+          }
+        }
+      )
+
+      test from: :g10_smart_scopes do
+        config(
+          inputs: {
+            requested_scopes: { name: :standalone_requested_scopes },
+            received_scopes: { name: :standalone_received_scopes }
+          },
+          options: {
+            scope_version: :v1
+          }
+        )
+
+        def required_scopes
+          ['openid', 'fhirUser', 'launch/patient', 'offline_access']
+        end
+
+        def required_scope_type
+          'patient'
+        end
+      end
+
+      test from: :g10_unauthorized_access,
+           config: {
+             inputs: {
+               patient_id: { name: :standalone_patient_id }
+             }
+           }
+
+      test from: :g10_patient_context,
+           config: {
+             inputs: {
+               patient_id: { name: :standalone_patient_id },
+               smart_credentials: { name: :standalone_smart_credentials }
+             }
+           }
+    end
+
+    group from: :smart_standalone_launch_stu2,
+          config: {
+            inputs: {
+              use_pkce: {
+                default: 'true',
+                locked: true
+              },
+              pkce_code_challenge_method: {
+                locked: true
+              },
+              authorization_method: {
+                name: :standalone_authorization_method,
+                default: 'get',
+                locked: true
+              }
+            }
+          } do
+      required_suite_options(smart_app_launch_version: 'smart_app_launch_2')
+
+      title 'Standalone Launch With Patient Scope'
+      description %(
+        # Background
+
+        The [Standalone
+        Launch Sequence](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-standalone-launch)
+        allows an app, like Inferno, to be launched independent of an
+        existing EHR session. It is one of the two launch methods described in
+        the SMART App Launch Framework alongside EHR Launch. The app will
+        request authorization for the provided scope from the authorization
+        endpoint, ultimately receiving an authorization token which can be used
+        to gain access to resources on the FHIR server.
+
+        # Test Methodology
+
+        Inferno will redirect the user to the the authorization endpoint so that
+        they may provide any required credentials and authorize the application.
+        Upon successful authorization, Inferno will exchange the authorization
+        code provided for an access token.
+
+        For more information on the #{title}:
+
+        * [Standalone Launch
+          Sequence](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-standalone-launch)
+      )
+
+      config(
+        inputs: {
+          requested_scopes: {
+            default: %(
+              launch/patient openid fhirUser offline_access
+              patient/Medication.rs patient/AllergyIntolerance.rs
+              patient/CarePlan.rs patient/CareTeam.rs patient/Condition.rs
+              patient/Device.rs patient/DiagnosticReport.rs
+              patient/DocumentReference.rs patient/Encounter.rs
+              patient/Goal.rs patient/Immunization.rs patient/Location.rs
+              patient/MedicationRequest.rs patient/Observation.rs
+              patient/Organization.rs patient/Patient.rs
+              patient/Practitioner.rs patient/Procedure.rs
+              patient/Provenance.rs patient/PractitionerRole.rs
+            ).gsub(/\s{2,}/, ' ').strip
+          }
+        }
+      )
+
       test from: :g10_smart_scopes do
         config(
           inputs: {
             requested_scopes: { name: :standalone_requested_scopes },
             received_scopes: { name: :standalone_received_scopes }
+          },
+          options: {
+            scope_version: :v2
           }
         )
 
@@ -104,7 +259,7 @@ module ONCCertificationG10TestKit
           ['openid', 'fhirUser', 'launch/patient', 'offline_access']
         end
 
-        def scope_type
+        def required_scope_type
           'patient'
         end
       end