onc_certification_g10_test_kit 6.0.3 → 7.0.1

data/lib/onc_certification_g10_test_kit/single_patient_us_core_7_api_group.rb

@@ -0,0 +1,219 @@
+require_relative 'incorrectly_permitted_tls_versions_messages_setup_test'
+
+module ONCCertificationG10TestKit
+  class SinglePatientUSCore7APIGroup < Inferno::TestGroup
+    id :g10_single_patient_us_core_7_api
+    title 'Single Patient API (US Core 7.0.0)'
+    short_title 'Single Patient API'
+    description %(
+      This scenario verifies the ability of a system to provide a 'Single Patient API'
+      as described in the (g)(10) Standardized API certification criterion.
+      Prior to running this scenario, systems must recieve a verified access token
+      from one of the previous SMART App Launch scenarios.
+
+      For each of the relevant USCDI data elements provided in the
+      CapabilityStatement, this scenario executes the [required supported
+      searches](http://hl7.org/fhir/us/core/STU7/CapabilityStatement-us-core-server.html)
+      as defined by the US Core Implementation Guide v7.0.0.
+
+      The test begins by searching by one or more patients, with the expectation
+      that the Bearer token provided to the test grants access to all USCDI
+      resources. It uses results returned from that query to generate other
+      queries and checks that the results are consistent with the provided
+      search parameters. It then performs a read on each Resource returned and
+      validates the response against the relevant
+      [profile](http://hl7.org/fhir/us/core/STU7/profiles-and-extensions.html)
+      as currently defined in the US Core Implementation Guide.
+
+      All MUST SUPPORT elements must be seen before the test can pass, as well
+      as Data Absent Reason to demonstrate that the server can properly handle
+      missing data. Note that Organization, Practitioner, and RelatedPerson
+      resources must be accessible as references in some US Core profiles to
+      satisfy must support requirements, and those references will be validated
+      to their US Core profile. These resources will not be tested for FHIR
+      search support.
+    )
+    run_as_group
+
+    input :url,
+          title: 'FHIR Endpoint',
+          description: 'URL of the FHIR endpoint used by SMART applications'
+    input :patient_id,
+          title: 'Patient ID from SMART App Launch',
+          locked: true
+    input :additional_patient_ids,
+          title: 'Additional Patient IDs',
+          description: <<~DESCRIPTION,
+            Comma separated list of Patient IDs that together with the Patient
+            ID from the SMART App Launch contain all MUST SUPPORT elements.
+          DESCRIPTION
+          optional: true
+    input :smart_credentials,
+          title: 'SMART App Launch Credentials',
+          type: :oauth_credentials,
+          locked: true
+
+    fhir_client do
+      url :url
+      oauth_credentials :smart_credentials
+    end
+
+    input_order :url, :patient_id, :additional_patient_ids, :implantable_device_codes, :smart_credentials
+
+    config(
+      options: {
+        required_profiles: [
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-allergyintolerance',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-careplan',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-careteam',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-condition-encounter-diagnosis',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-condition-problems-health-concerns',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-coverage',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-implantable-device',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-diagnosticreport-lab',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-diagnosticreport-note',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-documentreference',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-encounter',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-goal',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-immunization',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-location',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-medicationdispense',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-medicationrequest',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-observation-lab',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-blood-pressure',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-bmi',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-head-circumference',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-body-height',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-body-weight',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-body-temperature',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-heart-rate',
+          'http://hl7.org/fhir/us/core/StructureDefinition/pediatric-bmi-for-age',
+          'http://hl7.org/fhir/us/core/StructureDefinition/head-occipital-frontal-circumference-percentile',
+          'http://hl7.org/fhir/us/core/StructureDefinition/pediatric-weight-for-height',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-pulse-oximetry',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-respiratory-rate',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-smokingstatus',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-observation-clinical-result',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-observation-occupation',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-observation-pregnancyintent',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-observation-pregnancystatus',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-observation-screening-assessment',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-observation-sexual-orientation',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-treatment-intervention-preference',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-care-experience-preference',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-average-blood-pressure',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-organization',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-patient',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-practitioner',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-procedure',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-provenance',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-relatedperson',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-servicerequest',
+          'http://hl7.org/fhir/us/core/StructureDefinition/us-core-specimen'
+        ],
+        tag_requests: true
+      }
+    )
+
+    config(
+      options: {
+        required_resources: [
+          'Patient',
+          'AllergyIntolerance',
+          'CarePlan',
+          'CareTeam',
+          'Condition',
+          'Coverage',
+          'Device',
+          'DiagnosticReport',
+          'DocumentReference',
+          'Encounter',
+          'Goal',
+          'Immunization',
+          'Location',
+          'MedicationDispense',
+          'MedicationRequest',
+          'Observation',
+          'Procedure',
+          'ServiceRequest',
+          'Specimen',
+          'Organization',
+          'Practitioner',
+          'Provenance',
+          'RelatedPerson'
+        ]
+      }
+    )
+
+    test do
+      id :g10_patient_id_setup
+      title 'Manage patient id list'
+
+      input :patient_id, :additional_patient_ids
+      output :patient_ids
+
+      run do
+        smart_app_launch_patient_id = patient_id.presence
+        additional_patient_ids_list =
+          if additional_patient_ids.present?
+            additional_patient_ids
+              .split(',')
+              .map(&:strip)
+              .map(&:presence)
+              .compact
+          else
+            []
+          end
+
+        all_patient_ids = ([smart_app_launch_patient_id] + additional_patient_ids_list).compact.uniq
+
+        output patient_ids: all_patient_ids.join(',')
+      end
+    end
+
+    USCoreTestKit::USCoreV700::USCoreTestSuite.groups.find { |g| g.title == 'US Core FHIR API' }.groups.each do |group|
+      test_group = group.ancestors[1]
+
+      next if test_group.optional?
+
+      id = test_group.id
+
+      group_config = {}
+      if test_group.respond_to?(:metadata) &&
+         test_group.metadata.delayed? &&
+         !test_group.metadata.searchable_delayed_resource?
+        test_group.children.reject! do |child|
+          child.include?(USCoreTestKit::SearchTest) &&
+            !child.include?(USCoreTestKit::PractitionerAddressTest)
+        end
+        group_config[:options] = { read_all_resources: true }
+      end
+
+      group(from: id, exclude_optional: true, config: group_config)
+    end
+
+    groups.first.description %(
+      The Capability Statement test verifies a FHIR server's ability support the
+      [capabilities
+      operation](https://www.hl7.org/fhir/R4/capabilitystatement.html#instance)
+      to formally describe features supported by the API as a [Capability
+      Statement](https://www.hl7.org/fhir/R4/capabilitystatement.html) resource.
+      The capabilities described in the Capability Statement must be consistent with
+      the required capabilities of a US Core server.  This test also expects that
+      APIs state support for all resources types applicable to USCDI v3, as is
+      expected by the ONC (g)(10) Standardized API for Patient and Populations
+      Services certification criterion.
+
+      This test sequence accesses the server endpoint at `/metadata` using a
+      `GET` request. It parses the Capability Statement and verifies that:
+
+      * The endpoint is secured by an appropriate cryptographic protocol
+      * The resource matches the expected FHIR version defined by the tests
+      * The resource is a valid FHIR resource
+      * The server claims support for JSON encoding of resources
+      * The server claims support for all required USCDI resource types
+    )
+
+    test from: :g10_incorrectly_permitted_tls_versions_messages_setup
+  end
+end

data/lib/onc_certification_g10_test_kit/smart_app_launch_invalid_aud_group.rb

@@ -117,7 +117,47 @@ module ONCCertificationG10TestKit
     end
 
     test from: :smart_app_redirect_stu2 do
-      required_suite_options G10Options::SMART_2_REQUIREMENT
+      id :smart_app_redirect_stu2
+      required_suite_options(G10Options::SMART_2_REQUIREMENT)
+
+      config(
+        inputs: {
+          use_pkce: {
+            default: 'true',
+            locked: true
+          },
+          pkce_code_challenge_method: {
+            locked: true
+          }
+        }
+      )
+
+      input :client_secret,
+            name: :standalone_client_secret,
+            title: 'Standalone Client Secret',
+            description: 'Client Secret provided during registration of Inferno as a standalone application'
+
+      def aud
+        'https://inferno.healthit.gov/invalid_aud'
+      end
+
+      def wait_message(auth_url)
+        %(
+          Inferno will redirect you to an external website for authorization.
+          **It is expected this will fail**. If the server does not return to
+          Inferno automatically, but does provide an error message, you may
+          return to Inferno and confirm that an error was presented in this
+          window.
+
+          * [Perform Invalid Launch](#{auth_url})
+          * [Attest launch
+            failed](#{Inferno::Application['base_url']}/custom/smart/redirect?state=#{state}&confirm_fail=true)
+        )
+      end
+    end
+    test from: :smart_app_redirect_stu2 do
+      required_suite_options(G10Options::SMART_2_2_REQUIREMENT)
+      id :smart_app_redirect_stu2_2 # rubocop:disable Naming/VariableNumber
 
       config(
         inputs: {

data/lib/onc_certification_g10_test_kit/smart_asymmetric_launch_group.rb

@@ -142,9 +142,41 @@ module ONCCertificationG10TestKit
                 :asymmetric_client_auth_type,
                 :client_auth_encryption_method
 
-    group from: :smart_discovery_stu2
+    group from: :smart_discovery_stu2,
+          required_suite_options: G10Options::SMART_2_REQUIREMENT
+    group from: :smart_discovery_stu2_2, # rubocop:disable Naming/VariableNumber
+          required_suite_options: G10Options::SMART_2_2_REQUIREMENT
 
     group from: :smart_standalone_launch_stu2 do
+      required_suite_options(G10Options::SMART_2_REQUIREMENT)
+      test from: :g10_patient_context,
+           config: {
+             inputs: {
+               patient_id: { name: :asymmetric_patient_id },
+               smart_credentials: { name: :asymmetric_smart_credentials }
+             }
+           }
+
+      test do
+        title 'OAuth token exchange response contains OpenID Connect id_token'
+        description %(
+        This test requires that an OpenID Connect id_token is provided to
+        demonstrate authentication capabilies for asymmetric clients.
+      )
+        id :g10_asymmetric_launch_id_token
+
+        input :id_token,
+              name: :asymmetric_id_token,
+              locked: true,
+              optional: true
+
+        run do
+          assert id_token.present?, 'Token response did not provide an id_token as required.'
+        end
+      end
+    end
+    group from: :smart_standalone_launch_stu2_2 do # rubocop:disable Naming/VariableNumber
+      required_suite_options(G10Options::SMART_2_2_REQUIREMENT)
       test from: :g10_patient_context,
            config: {
              inputs: {

data/lib/onc_certification_g10_test_kit/smart_ehr_patient_launch_group_stu2_2.rb

@@ -0,0 +1,128 @@
+require_relative 'patient_scope_test'
+
+module ONCCertificationG10TestKit
+  class SMARTEHRPatientLaunchGroupSTU22 < SMARTAppLaunch::EHRLaunchGroupSTU22
+    title 'EHR Launch with Patient Scopes'
+    description %(
+      Systems are required to support the `permission-patient` capability as
+      part of the [Clinician Access for EHR Launch Capability
+      Set.](http://hl7.org/fhir/smart-app-launch/STU2.2/conformance.html#clinician-access-for-ehr-launch)
+      Previous scenarios do not verify this specific combination of capabilies.
+
+      Additionally, if an application launched from an EHR requests and is
+      granted a clinical scope restricted to a single patient, the EHR SHALL
+      establish a patient in context.
+
+      Register Inferno as an EHR-launched application using patient-level scopes
+      and the following URIs:
+
+      * Launch URI: `#{SMARTAppLaunch::AppLaunchTest.config.options[:launch_uri]}`
+      * Redirect URI: `#{SMARTAppLaunch::AppRedirectTest.config.options[:redirect_uri]}`
+
+      In this scenario, Inferno will attempt an EHR Launch with a clinical scope restricted to a
+      single patient and verify that a patient-level scope is granted and a
+      patient id is received.
+
+      For more information on the #{title}
+
+      * [Apps that launch from the
+        EHR](http://hl7.org/fhir/smart-app-launch/STU2.2/scopes-and-launch-context.html#apps-that-launch-from-the-ehr)
+    )
+    id :g10_ehr_patient_launch_stu2_2 # rubocop:disable Naming/VariableNumber
+    run_as_group
+
+    config(
+      inputs: {
+        client_id: {
+          name: :ehr_patient_client_id
+        },
+        client_secret: {
+          name: :ehr_patient_client_secret,
+          optional: false
+        },
+        requested_scopes: {
+          name: :ehr_patient_requested_scopes,
+          default: 'launch openid fhirUser offline_access patient/Patient.rs',
+          locked: true
+        },
+        code: {
+          name: :ehr_patient_code
+        },
+        state: {
+          name: :ehr_patient_state
+        },
+        launch: {
+          name: :ehr_patient_launch
+        },
+        received_scopes: {
+          name: :ehr_patient_received_scopes
+        },
+        smart_credentials: {
+          name: :ehr_patient_smart_credentials
+        },
+        smart_authorization_url: {
+          title: 'OAuth 2.0 Authorize Endpoint',
+          description: 'OAuth 2.0 Authorize Endpoint provided during the EHR launch'
+        },
+        smart_token_url: {
+          title: 'OAuth 2.0 Token Endpoint',
+          description: 'OAuth 2.0 Token Endpoint provided during the EHR launch'
+        },
+        client_auth_type: {
+          locked: true,
+          default: 'confidential_symmetric'
+        }
+      },
+      outputs: {
+        launch: { name: :ehr_patient_launch },
+        code: { name: :ehr_patient_code },
+        token_retrieval_time: { name: :ehr_patient_token_retrieval_time },
+        state: { name: :ehr_patient_state },
+        id_token: { name: :ehr_patient_id_token },
+        refresh_token: { name: :ehr_patient_refresh_token },
+        access_token: { name: :ehr_patient_access_token },
+        expires_in: { name: :ehr_patient_expires_in },
+        patient_id: { name: :ehr_patient_patient_id },
+        encounter_id: { name: :ehr_patient_encounter_id },
+        received_scopes: { name: :ehr_patient_received_scopes },
+        requested_scopes: { name: :ehr_patient_requested_scopes },
+        intent: { name: :ehr_patient_intent },
+        smart_credentials: { name: :ehr_patient_smart_credentials }
+      },
+      requests: {
+        redirect: { name: :ehr_patient_redirect },
+        token: { name: :ehr_patient_token }
+      }
+    )
+
+    input_order :url,
+                :ehr_patient_client_id,
+                :ehr_patient_client_secret,
+                :smart_authorization_url,
+                :smart_token_url,
+                :ehr_patient_requested_scopes,
+                :authorization_method,
+                :use_pkce,
+                :pkce_code_challenge_method,
+                :client_auth_type
+
+    test from: :g10_patient_context,
+         config: {
+           inputs: {
+             patient_id: { name: :ehr_patient_patient_id },
+             smart_credentials: { name: :ehr_patient_smart_credentials }
+           }
+         }
+
+    test from: :g10_patient_scope,
+         config: {
+           options: {
+             scope_version: :v22
+           }
+         }
+
+    children.each do |child|
+      child.inputs.delete(:client_auth_encryption_method)
+    end
+  end
+end