onc_certification_g10_test_kit 3.3.2 → 3.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9bb1416b5f4a895760df48a2c49468074e882651237b8b76ebc81434b16df44d
-  data.tar.gz: '09d90f9db1f4c5be41a8e7705c5b2809f81da0bb377bcc4c4bde14e5d168943e'
+  metadata.gz: 98375c6a97ac9a9056303f326b8dbe742b636ce9aec9751d8ece7e9d2cc3850f
+  data.tar.gz: 63905d2ab2aed1d6ce3beddeb09ea3670885dbf78d5f86628d0dd9efd4efdbd0
 SHA512:
-  metadata.gz: 3bc7515b56f5680e57f7ef716b34ecf77b04abfdba314bc12d9c8a51a85b31da9a4da8895a32093431d52a18af36f7ca0cb9bb6fa2b2ff2f597f45e42442b151
-  data.tar.gz: d37b1c5641703be96934aeaa96444be227c7eab3653c888dcc37dfd70a41f9b44383a19efb3898337f73a93552ad48c1166b9ddffcef9eb10b8a0f87a493823f
+  metadata.gz: 023317c28042a98b0b9ed4bce639906668463655082abaefe9e033bf133b76f8dec8bb0b9af7005f0aa65ba0bca5bd00a817e3c88b542eaf72bc17cce0818829
+  data.tar.gz: d216f8e2193a35a3a433b4ecda391a73c964f2df029d167b225c64c7f91f72d3bbd0ce7cd67833742ac991325634fa0080668a6cea98d5b295cf127832183db9

data/lib/onc_certification_g10_test_kit/bulk_data_group_export_validation.rb

@@ -17,11 +17,12 @@ module ONCCertificationG10TestKit
           optional: true
     input :bulk_patient_ids_in_group,
           title: 'Patient IDs in exported Group',
-          description: <<~DESCRIPTION
+          description: <<~DESCRIPTION,
             Comma separated list of every Patient ID that is in the specified Group. This information is provided by
             the system under test to verify that data returned matches expectations. Leave blank to not verify Group
             inclusion.
           DESCRIPTION
+          optional: true
     input :bulk_device_types_in_group,
           title: 'Implantable Device Type Codes in exported Group',
           description: <<~DESCRIPTION,

data/lib/onc_certification_g10_test_kit/bulk_export_validation_tester.rb

@@ -107,6 +107,9 @@ module ONCCertificationG10TestKit
           perform_must_support_test(resources[meta.profile_url])
         rescue Inferno::Exceptions::PassException
           next
+        rescue Inferno::Exceptions::SkipException => e
+          e.message.concat " for `#{meta.profile_url}`"
+          raise e
         end
       end
     end
@@ -121,7 +124,7 @@ module ONCCertificationG10TestKit
       line_count = 0
       resources = Hash.new { |h, k| h[k] = [] }
 
-      process_line = proc { |line|
+      process_line = proc do |line|
         next unless lines_to_validate.blank? ||
                     line_count < lines_to_validate.to_i ||
                     (resource_type == 'Patient' && patient_ids_seen.length < MIN_RESOURCE_COUNT)
@@ -139,21 +142,24 @@ module ONCCertificationG10TestKit
                         "defined in output \"#{resource_type}\""
         end
 
-        profile_url = determine_profile(resource)
-        resources[profile_url] << resource
-        scratch[:patient_ids_seen] = patient_ids_seen | [resource.id] if resource_type == 'Patient'
-
-        profile_with_version = versioned_profile_url(profile_url)
-        unless resource_is_valid?(resource:, profile_url: profile_with_version)
-          if first_error.key?(:line_number)
-            @invalid_resource_count += 1
-          else
-            @invalid_resource_count = 1
-            first_error[:line_number] = line_count
-            first_error[:messages] = messages.dup
+        profile_urls = determine_profile(resource)
+        profile_urls.each do |profile_url|
+          resources[profile_url] << resource
+
+          scratch[:patient_ids_seen] = patient_ids_seen | [resource.id] if resource_type == 'Patient'
+
+          profile_with_version = versioned_profile_url(profile_url)
+          unless resource_is_valid?(resource:, profile_url: profile_with_version)
+            if first_error.key?(:line_number)
+              @invalid_resource_count += 1
+            else
+              @invalid_resource_count = 1
+              first_error[:line_number] = line_count
+              first_error[:messages] = messages.dup
+            end
           end
         end
-      }
+      end
 
       process_headers = proc { |response|
         value = (response[:headers].find { |header| header.name.downcase == 'content-type' })&.value

data/lib/onc_certification_g10_test_kit/onc_program_procedure.yml

@@ -960,7 +960,7 @@ procedure:
           implementation specification adopted in § 170.215(a)(3).
         inferno_supported: 'yes'
         inferno_tests:
-          - 9.10.05
+          - 9.10.16
         inferno_notes: |
           Inferno cannot verify the three month token expiration requirement
           automatically during the token refresh tests, but the tester can

data/lib/onc_certification_g10_test_kit/profile_selector.rb

@@ -30,46 +30,50 @@ module ONCCertificationG10TestKit
     end
 
     def select_profile(resource) # rubocop:disable Metrics/CyclomaticComplexity
+      profiles = []
+
       case resource.resourceType
       when 'Condition'
         case us_core_version
         when US_CORE_5
           if resource_contains_category(resource, 'encounter-diagnosis', 'http://terminology.hl7.org/CodeSystem/condition-category')
-            extract_profile('ConditionEncounterDiagnosis')
+            profiles << extract_profile('ConditionEncounterDiagnosis')
           elsif resource_contains_category(resource, 'problem-list-item',
                                            'http://terminology.hl7.org/CodeSystem/condition-category') ||
                 resource_contains_category(resource, 'health-concern', 'http://hl7.org/fhir/us/core/CodeSystem/condition-category')
-            extract_profile('ConditionProblemsHealthConcerns')
+            profiles << extract_profile('ConditionProblemsHealthConcerns')
           end
         else
-          extract_profile(resource.resourceType)
+          profiles << extract_profile(resource.resourceType)
         end
       when 'DiagnosticReport'
-        return extract_profile('DiagnosticReportLab') if resource_contains_category(resource, 'LAB', 'http://terminology.hl7.org/CodeSystem/v2-0074')
-
-        extract_profile('DiagnosticReportNote')
+        profiles << if resource_contains_category(resource, 'LAB', 'http://terminology.hl7.org/CodeSystem/v2-0074')
+                      extract_profile('DiagnosticReportLab')
+                    else
+                      extract_profile('DiagnosticReportNote')
+                    end
       when 'Observation'
-        return extract_profile('Smokingstatus') if observation_contains_code(resource, '72166-2')
+        profiles << extract_profile('Smokingstatus') if observation_contains_code(resource, '72166-2')
 
-        return extract_profile('ObservationLab') if resource_contains_category(resource, 'laboratory', 'http://terminology.hl7.org/CodeSystem/observation-category')
+        profiles << extract_profile('ObservationLab') if resource_contains_category(resource, 'laboratory', 'http://terminology.hl7.org/CodeSystem/observation-category')
 
-        return extract_profile('PediatricBmiForAge') if observation_contains_code(resource, '59576-9')
+        profiles << extract_profile('PediatricBmiForAge') if observation_contains_code(resource, '59576-9')
 
-        return extract_profile('PediatricWeightForHeight') if observation_contains_code(resource, '77606-2')
+        profiles << extract_profile('PediatricWeightForHeight') if observation_contains_code(resource, '77606-2')
 
-        return extract_profile('PulseOximetry') if observation_contains_code(resource, '59408-5')
+        profiles << extract_profile('PulseOximetry') if observation_contains_code(resource, '59408-5')
 
         if observation_contains_code(resource, '8289-1')
-          case us_core_version
-          when US_CORE_3
-            return extract_profile('HeadCircumference')
-          else
-            return extract_profile('HeadCircumferencePercentile')
-          end
+          profiles << case us_core_version
+                      when US_CORE_3
+                        extract_profile('HeadCircumference')
+                      else
+                        extract_profile('HeadCircumferencePercentile')
+                      end
         end
 
         if observation_contains_code(resource, '9843-4') && !using_us_core_3?
-          return extract_profile('HeadCircumference')
+          profiles << extract_profile('HeadCircumference')
         end
 
         # FHIR Vital Signs profiles: https://www.hl7.org/fhir/observation-vitalsigns.html
@@ -77,83 +81,83 @@ module ONCCertificationG10TestKit
         # Body Mass Index is replaced by :pediatric_bmi_age Profile
         # Systolic Blood Pressure, Diastolic Blood Pressure are covered by :blood_pressure Profile
         # Head Circumference is replaced by US Core Head Occipital-frontal Circumference Percentile Profile
-        return extract_profile('Bmi') if observation_contains_code(resource, '39156-5') && !using_us_core_3?
+        profiles << extract_profile('Bmi') if observation_contains_code(resource, '39156-5') && !using_us_core_3?
 
         if observation_contains_code(resource, '85354-9')
-          case us_core_version
-          when US_CORE_3
-            return extract_profile('Bp')
-          else
-            return extract_profile('BloodPressure')
-          end
+          profiles << case us_core_version
+                      when US_CORE_3
+                        extract_profile('Bp')
+                      else
+                        extract_profile('BloodPressure')
+                      end
         end
 
         if observation_contains_code(resource, '8302-2')
-          case us_core_version
-          when US_CORE_3
-            return extract_profile('Bodyheight')
-          else
-            return extract_profile('BodyHeight')
-          end
+          profiles << case us_core_version
+                      when US_CORE_3
+                        extract_profile('Bodyheight')
+                      else
+                        extract_profile('BodyHeight')
+                      end
         end
 
         if observation_contains_code(resource, '8310-5')
-          case us_core_version
-          when US_CORE_3
-            return extract_profile('Bodytemp')
-          else
-            return extract_profile('BodyTemperature')
-          end
+          profiles << case us_core_version
+                      when US_CORE_3
+                        extract_profile('Bodytemp')
+                      else
+                        extract_profile('BodyTemperature')
+                      end
         end
 
         if observation_contains_code(resource, '29463-7')
-          case us_core_version
-          when US_CORE_3
-            return extract_profile('Bodyweight')
-          else
-            return extract_profile('BodyWeight')
-          end
+          profiles << case us_core_version
+                      when US_CORE_3
+                        extract_profile('Bodyweight')
+                      else
+                        extract_profile('BodyWeight')
+                      end
         end
 
         if observation_contains_code(resource, '8867-4')
-          case us_core_version
-          when US_CORE_3
-            return extract_profile('Heartrate')
-          else
-            return extract_profile('HeartRate')
-          end
+          profiles << case us_core_version
+                      when US_CORE_3
+                        extract_profile('Heartrate')
+                      else
+                        extract_profile('HeartRate')
+                      end
         end
 
         if observation_contains_code(resource, '9279-1')
-          case us_core_version
-          when US_CORE_3
-            return extract_profile('Resprate')
-          else
-            return extract_profile('RespiratoryRate')
-          end
+          profiles << case us_core_version
+                      when US_CORE_3
+                        extract_profile('Resprate')
+                      else
+                        extract_profile('RespiratoryRate')
+                      end
         end
 
         if using_us_core_5? &&
            resource_contains_category(
              resource, 'clinical-test', 'http://hl7.org/fhir/us/core/CodeSystem/us-core-observation-category'
            )
-          return extract_profile('ObservationClinicalTest')
+          profiles << extract_profile('ObservationClinicalTest')
         end
 
         if using_us_core_5? && observation_contains_code(resource, '76690-7')
-          return extract_profile('ObservationSexualOrientation')
+          profiles << extract_profile('ObservationSexualOrientation')
         end
 
         if using_us_core_5? &&
            resource_contains_category(resource, 'social-history',
                                       'http://terminology.hl7.org/CodeSystem/observation-category')
-          return extract_profile('ObservationSocialHistory')
+          profiles << extract_profile('ObservationSocialHistory')
         end
 
         if using_us_core_5? &&
            resource_contains_category(resource, 'imaging',
                                       'http://terminology.hl7.org/CodeSystem/observation-category')
-          return extract_profile('ObservationImaging')
+          profiles << extract_profile('ObservationImaging')
         end
 
         # We will simply match all Observations of category "survey" to SDOH,
@@ -171,13 +175,15 @@ module ONCCertificationG10TestKit
            resource_contains_category(resource, 'survey',
                                       'http://terminology.hl7.org/CodeSystem/observation-category')
 
-          return extract_profile('ObservationSdohAssessment')
+          profiles << extract_profile('ObservationSdohAssessment')
         end
 
         nil
       else
-        extract_profile(resource.resourceType)
+        profiles << extract_profile(resource.resourceType)
       end
+
+      profiles
     rescue StandardError
       skip "Could not determine profile of \"#{resource.resourceType}\" resource."
     end

data/lib/onc_certification_g10_test_kit/resource_access_test.rb

@@ -87,7 +87,8 @@ module ONCCertificationG10TestKit
         assert_response_status(200)
         pass "Access expected to be granted and request properly returned #{request.status}"
       else
-        message = "Bad response code: expected 403 (Forbidden) or 401 (Unauthorized), but found #{request.status}."
+        message =
+          "Unexpected response code: expected 403 (Forbidden) or 401 (Unauthorized), but found #{request.status}."
         assert [401, 403].include?(request.status), message
       end
     end

data/lib/onc_certification_g10_test_kit/short_id_map.yml

@@ -1536,3 +1536,4 @@ g10_certification-Group06-g10_visual_inspection_and_attestations-Test12: 9.10.12
 g10_certification-Group06-g10_visual_inspection_and_attestations-Test13: 9.10.13
 g10_certification-Group06-g10_visual_inspection_and_attestations-g10_public_url_attestation: 9.10.14
 g10_certification-Group06-g10_visual_inspection_and_attestations-g10_tls_version_attestation: 9.10.15
+g10_certification-Group06-g10_visual_inspection_and_attestations-g10_refresh_token_refresh_attestation: 9.10.16

data/lib/onc_certification_g10_test_kit/version.rb

@@ -1,3 +1,3 @@
 module ONCCertificationG10TestKit
-  VERSION = '3.3.2'.freeze
+  VERSION = '3.4.0'.freeze
 end

data/lib/onc_certification_g10_test_kit/visual_inspection_and_attestations_group.rb

@@ -155,6 +155,9 @@ module ONCCertificationG10TestKit
       description %(
         Health IT Module attested that it is capable of issuing refresh tokens
         that are valid for a period of no shorter than three months.
+
+        This attestation is necessary because automated tests cannot determine how long
+        the refresh token remains valid.
       )
       id 'Test05'
       input :refresh_token_period_attestation,
@@ -328,16 +331,16 @@ module ONCCertificationG10TestKit
     end
 
     test do
-      title 'Health IT developer confirms the Health IT module does not cache the JWK Set received ' \
+      title 'Health IT developer confirms the Health IT Module does not cache the JWK Set received ' \
             'via a TLS-protected URL for longer than the cache-control header received by an application indicates.'
       description %(
-        The Health IT developer confirms the Health IT module does not cache the
+        The Health IT developer confirms the Health IT Module does not cache the
         JWK Set received via a TLS-protected URL for longer than the
         cache-control header indicates.
       )
       id 'Test10'
       input :jwks_cache_attestation,
-            title: 'Health IT developer confirms the Health IT module does not cache the JWK Set received via a TLS-protected URL for longer than the cache-control header indicates.', # rubocop:disable Layout/LineLength
+            title: 'Health IT developer confirms the Health IT Module does not cache the JWK Set received via a TLS-protected URL for longer than the cache-control header indicates.', # rubocop:disable Layout/LineLength
             type: 'radio',
             default: 'false',
             options: {
@@ -490,7 +493,7 @@ module ONCCertificationG10TestKit
     end
 
     test do
-      title 'Health IT developer demonstrates the public location of its base URLs'
+      title 'Health IT developer demonstrates the public location of its base URLs.'
       description %(
         To fulfill the API Maintenance of Certification requirement at §
         170.404(b)(2), the health IT developer demonstrates the public location
@@ -542,7 +545,7 @@ module ONCCertificationG10TestKit
             locked: true,
             optional: true
       input :tls_documentation_required,
-            title: 'Health IT developers must document how the Health IT Module enforces TLs version 1.2 or above',
+            title: 'Health IT developers must document how the Health IT Module enforces TLs version 1.2 or above.',
             type: 'radio',
             default: 'false',
             locked: true,
@@ -572,5 +575,67 @@ module ONCCertificationG10TestKit
         pass tls_version_attestation_notes if tls_version_attestation_notes.present?
       end
     end
+
+    test do
+      title 'Health IT developer attested that the Health IT Module is capable of issuing refresh tokens ' \
+            'valid for a new period of no shorter than three months without requiring ' \
+            're-authentication and re-authorization when a valid refresh token is supplied ' \
+            'by the application.'
+      description %(
+        Applications that are capable of storing a client secret and that have
+        received a refresh token must be able to use this refresh token to
+        either receive a new refresh token valid for a new period of no less
+        than three months, or to update the duration of the existing refresh
+        token to be valid for a new period of no less than three months.  This
+        occurs during the refresh token request, when the application uses a
+        refresh token to receive a new access token.
+
+        This attestation is necessary because automated tests cannot determine
+        if the expiration date of the refresh token is updated when tokens
+        are refreshed.
+
+        This attestation ensures that the Health IT Module allows applications
+        to use refresh tokens to update the length of authorized access beyond
+        the initial period of no less than three months by issuing a new refresh
+        token or updating the duration of the existing refresh token.  A
+        separate attestation ensures that the Health IT Module is capable of
+        issuing an initial refresh token that is valid for at least three
+        months.
+      )
+      id :g10_refresh_token_refresh_attestation
+      input :refresh_token_refresh_attestation,
+            title: 'Health IT developer attested that the Health IT Module is capable of issuing refresh tokens ' \
+                   'valid for a new period of no shorter than three months without requiring ' \
+                   're-authentication and re-authorization when a valid refresh token is supplied ' \
+                   'by the application.',
+            type: 'radio',
+            default: 'false',
+            options: {
+              list_options: [
+                {
+                  label: 'Yes',
+                  value: 'true'
+                },
+                {
+                  label: 'No',
+                  value: 'false'
+                }
+              ]
+            }
+      input :refresh_token_refresh_notes,
+            title: 'Notes, if applicable:',
+            type: 'textarea',
+            optional: true
+
+      run do
+        assert refresh_token_refresh_attestation == 'true',
+               'Health IT developer did not attest that the Health IT Module is capable of issuing refresh tokens ' \
+               'valid for a new period of no shorter than three months without requiring ' \
+               're-authentication and re-authorization when a valid refresh token is supplied ' \
+               'by the application.'
+
+        pass refresh_token_refresh_notes if refresh_token_refresh_notes.present?
+      end
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: onc_certification_g10_test_kit
 version: !ruby/object:Gem::Version
-  version: 3.3.2
+  version: 3.4.0
 platform: ruby
 authors:
 - Stephen MacVicar
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-12-14 00:00:00.000000000 Z
+date: 2023-01-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bloomer
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.4.2
+        version: 0.4.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.4.2
+        version: 0.4.7
 - !ruby/object:Gem::Dependency
   name: json-jwt
   requirement: !ruby/object:Gem::Requirement
@@ -114,14 +114,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: 0.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: 0.2.1
 - !ruby/object:Gem::Dependency
   name: tls_test_kit
   requirement: !ruby/object:Gem::Requirement
@@ -142,14 +142,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.4.3
+        version: 0.4.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.4.3
+        version: 0.4.4
 - !ruby/object:Gem::Dependency
   name: database_cleaner-sequel
   requirement: !ruby/object:Gem::Requirement