smart_app_launch_test_kit 0.1.0 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7da125d1c3d1b6665088989e563aa9a046fc9e651ab3b1616e153cee1d695a6e
-  data.tar.gz: 329bf68903d2b72988bfbdd1c0525ec1a933c5450b285fc001c4d28d44552f2f
+  metadata.gz: 758773637de38a995aa7943da1291685f655e97f829c2e11d7adfc54d129ad42
+  data.tar.gz: b0c2adfcf695418617999e414a0d85766e440e943787d811ffb54218810fee2c
 SHA512:
-  metadata.gz: '081f7d57660ef9446376fd1fd07753b00014258f9162b3ffc14f57165caa4ca255d3dc970483b30236a7fd9bbfec49c0bda9becb6c3a20f6805e679b6fc24814'
-  data.tar.gz: ee1f2ea1d9b75980516d2098528b229eabbacea1fc305c1242aacff60e1fbd7bf06a2d7b98788f313c000492264e9f5ef79b120ebeb0bd7e7e124e3147a48a47
+  metadata.gz: 9b9aabc2d05bf3b3a3fe49f35fe0be2e634f7c774d86d3d6a0129aa1cd424f1c5cebd03c84c24855445a0baf95ac23c730d614e9f628a946b5ac8d5ca0b6f8fa
+  data.tar.gz: b287eaf62940d60d904af996c0cbbd90d59ba68ce79cdbe6400a20515b9eccb6aa0ff6c094bd07cfd86b928a11c3b6e7e740c896d125c62f5da65a857450ed38

data/lib/smart_app_launch/app_redirect_test.rb

@@ -1,3 +1,5 @@
+require 'uri'
+
 module SMARTAppLaunch
   class AppRedirectTest < Inferno::Test
     title 'OAuth server redirects client browser to app redirect URI'
@@ -63,8 +65,18 @@ module SMARTAppLaunch
       )
     end
 
+    def authorization_url_builder(url, params)
+      uri = URI(url)
+
+      # because the URL might have paramters on it
+      original_parameters = Hash[URI.decode_www_form(uri.query || '')]
+      new_params = original_parameters.merge(params)
+
+      uri.query = URI.encode_www_form(new_params)
+      uri.to_s
+    end
+
     run do
-      info(config.options[:redirect_uri])
       assert_valid_http_uri(
         smart_authorization_url,
         "OAuth2 Authorization Endpoint '#{smart_authorization_url}' is not a valid URI"
@@ -81,10 +93,15 @@ module SMARTAppLaunch
         'aud' => aud
       }
 
-      oauth2_params['launch'] = launch if self.class.inputs.include?(:launch)
+      if config.options[:launch]
+        oauth2_params['launch'] = config.options[:launch]
+      elsif self.class.inputs.include?(:launch)
+        oauth2_params['launch'] = launch
+      end
 
       if use_pkce == 'true'
-        code_verifier = SecureRandom.uuid
+        # code verifier must be between 43 and 128 characters
+        code_verifier = SecureRandom.uuid + '-' + SecureRandom.uuid
         code_challenge =
           if pkce_code_challenge_method == 'S256'
             self.class.calculate_s256_challenge(code_verifier)
@@ -97,20 +114,10 @@ module SMARTAppLaunch
         oauth2_params.merge!('code_challenge' => code_challenge, 'code_challenge_method' => pkce_code_challenge_method)
       end
 
-      authorization_url = smart_authorization_url
-
-      authorization_url +=
-        if authorization_url.include? '?'
-          '&'
-        else
-          '?'
-        end
-
-      oauth2_params.each do |key, value|
-        authorization_url += "#{key}=#{CGI.escape(value)}&"
-      end
-
-      authorization_url.chomp!('&')
+      authorization_url = authorization_url_builder(
+        smart_authorization_url,
+        oauth2_params
+      )
 
       wait(
         identifier: state,

data/lib/smart_app_launch/discovery_group.rb

@@ -8,7 +8,7 @@ module SMARTAppLaunch
 
       The #{title} Sequence test looks for authorization endpoints and SMART
       capabilities as described by the [SMART App Launch
-      Framework](http://hl7.org/fhir/smart-app-launch/conformance/index.html).
+      Framework](https://www.hl7.org/fhir/smart-app-launch/1.0.0/conformance/index.html).
       The SMART launch framework uses OAuth 2.0 to *authorize* apps, like
       Inferno, to access certain information on a FHIR server. The
       authorization service accessed at the endpoint allows users to give
@@ -31,7 +31,7 @@ module SMARTAppLaunch
 
       For more information see:
 
-      * [SMART App Launch Framework](http://hl7.org/fhir/smart-app-launch/index.html)
+      * [SMART App Launch Framework](https://www.hl7.org/fhir/smart-app-launch/1.0.0/conformance/index.html)
       * [The OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749)
       * [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html)
     )

data/lib/smart_app_launch/ehr_launch_group.rb

@@ -16,7 +16,7 @@ module SMARTAppLaunch
       # Background
 
       The [EHR
-      Launch](http://hl7.org/fhir/smart-app-launch/index.html#ehr-launch-sequence)
+      Launch](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#ehr-launch-sequence)
       is one of two ways in which an app can be launched, the other being
       Standalone launch. In an EHR launch, the app is launched from an
       existing EHR session or portal by a redirect to the registered launch
@@ -35,7 +35,7 @@ module SMARTAppLaunch
 
       For more information on the #{title} see:
 
-      * [SMART EHR Launch Sequence](http://hl7.org/fhir/smart-app-launch/index.html#ehr-launch-sequence)
+      * [SMART EHR Launch Sequence](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#ehr-launch-sequence)
     )
 
     config(

data/lib/smart_app_launch/openid_connect_group.rb

@@ -18,7 +18,7 @@ module SMARTAppLaunch
 
       OpenID Connect (OIDC) provides the ability to verify the identity of the
       authorizing user. Within the [SMART App Launch
-      Framework](http://hl7.org/fhir/smart-app-launch/), Applications can
+      Framework](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html), Applications can
       request an `id_token` be provided with by including the `openid fhirUser`
       scopes when requesting authorization.
 
@@ -36,9 +36,9 @@ module SMARTAppLaunch
 
       For more information see:
 
-      * [SMART App Launch Framework](http://hl7.org/fhir/smart-app-launch/)
-      * [Scopes for requesting identity data](http://hl7.org/fhir/smart-app-launch/scopes-and-launch-context/index.html#scopes-for-requesting-identity-data)
-      * [Apps Requesting Authorization](http://hl7.org/fhir/smart-app-launch/#step-1-app-asks-for-authorization)
+      * [SMART App Launch Framework](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html)
+      * [Scopes for requesting identity data](https://www.hl7.org/fhir/smart-app-launch/1.0.0/scopes-and-launch-context/index.html#scopes-for-requesting-identity-data)
+      * [Apps Requesting Authorization](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#step-1-app-asks-for-authorization)
       * [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html)
     )
 

data/lib/smart_app_launch/openid_required_configuration_fields_test.rb

@@ -9,7 +9,7 @@ module SMARTAppLaunch
       `id_token_signing_alg_values_supported`.
 
       Additionally, the [SMART App Launch
-      Framework](http://www.hl7.org/fhir/smart-app-launch/scopes-and-launch-context/index.html#scopes-for-requesting-identity-data)
+      Framework](https://www.hl7.org/fhir/smart-app-launch/1.0.0/scopes-and-launch-context/index.html#scopes-for-requesting-identity-data)
       requires that the RSA SHA-256 signing algorithm be supported.
     )
 

data/lib/smart_app_launch/openid_token_header_test.rb

@@ -3,9 +3,9 @@ module SMARTAppLaunch
     id :smart_openid_token_header
     title 'ID token header contains required information'
     description %(
-      Verify that the id token header indicates that the tokenis signed using
+      Verify that the id token header indicates that the token is signed using
       RSA SHA-256 [as required by the SMART app launch
-      framework](http://www.hl7.org/fhir/smart-app-launch/scopes-and-launch-context/index.html#scopes-for-requesting-identity-data)
+      framework](https://www.hl7.org/fhir/smart-app-launch/1.0.0/scopes-and-launch-context/index.html#scopes-for-requesting-identity-data)
       and that the key used to sign the token can be identified in the JWKS.
     )
 

data/lib/smart_app_launch/openid_token_payload_test.rb

@@ -13,6 +13,7 @@ module SMARTAppLaunch
         configuration
       - `aud` must match the client ID
       - `exp` must represent a time in the future
+      - `sub` must be a non-blank string not exceeding 255 characters in length
     )
 
     REQUIRED_CLAIMS = ['iss', 'sub', 'aud', 'exp', 'iat'].freeze
@@ -47,7 +48,7 @@ module SMARTAppLaunch
             verify_not_before: false,
             verify_iat: false,
             verify_jti: false,
-            verify_sub: false,
+            verify_sub: true,
             verify_iss: true,
             verify_aud: true
           )
@@ -55,6 +56,10 @@ module SMARTAppLaunch
         assert false, "Token validation error: #{e.message}"
       end
 
+      sub_value = payload['sub']
+      assert !sub_value.blank?, "ID token `sub` claim is blank"
+      assert sub_value.length < 256, "ID token `sub` claim exceeds 255 characters in length"
+
       missing_claims = required_claims - payload.keys
       missing_claims_string = missing_claims.map { |claim| "`#{claim}`" }.join(', ')
 

data/lib/smart_app_launch/standalone_launch_group.rb

@@ -14,8 +14,8 @@ module SMARTAppLaunch
       # Background
 
       The [Standalone
-      Launch](http://hl7.org/fhir/smart-app-launch/#standalone-launch-sequence)
-      Sequence allows an app, like Inferno, to be launched independent of an
+      Launch Sequence](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#standalone-launch-sequence)
+      allows an app, like Inferno, to be launched independent of an
       existing EHR session. It is one of the two launch methods described in
       the SMART App Launch Framework alongside EHR Launch. The app will
       request authorization for the provided scope from the authorization
@@ -31,7 +31,7 @@ module SMARTAppLaunch
 
       For more information on the #{title}:
 
-      * [Standalone Launch Sequence](http://hl7.org/fhir/smart-app-launch/#standalone-launch-sequence)
+      * [Standalone Launch Sequence](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#standalone-launch-sequence)
     )
 
     config(

data/lib/smart_app_launch/token_payload_validation.rb

@@ -28,6 +28,12 @@ module SMARTAppLaunch
       end
     end
 
+    def validate_scope_subset(received_scopes, original_scopes)
+      extra_scopes = received_scopes.split - original_scopes.split
+      assert extra_scopes.empty?, "Token response contained scopes which are not a subset of the scope granted to the "\
+                                  "original access token: #{extra_scopes.join(', ')}"
+    end
+
     def validate_token_field_types(body)
       STRING_FIELDS
         .select { |field| body[field].present? }

data/lib/smart_app_launch/token_refresh_body_test.rb

@@ -11,6 +11,8 @@ module SMARTAppLaunch
       an access token or a message indicating that the authorization request
       has been denied. `access_token`, `expires_in`, `token_type`, and `scope` are
       required. `access_token` must be `Bearer`.
+
+      Scopes returned must be a strict subset of the scopes granted in the original launch.
     )
     input :received_scopes
     output :refresh_token, :access_token, :token_retrieval_time, :expires_in, :received_scopes
@@ -36,8 +38,7 @@ module SMARTAppLaunch
       validate_token_field_types(body)
       validate_token_type(body)
 
-      assert received_scopes.split.sort == old_received_scopes.split.sort,
-             'Received scopes not equal to originally granted scopes'
+      validate_scope_subset(received_scopes, old_received_scopes)
     end
   end
 end

data/lib/smart_app_launch/token_refresh_group.rb

@@ -10,7 +10,7 @@ module SMARTAppLaunch
     description %(
       # Background
 
-      The #{title} Sequence tests the ability of the system to successfuly
+      The #{title} Sequence tests the ability of the system to successfully
       exchange a refresh token for an access token. Refresh tokens are typically
       longer lived than access tokens and allow client applications to obtain a
       new access token Refresh tokens themselves cannot provide access to
@@ -18,7 +18,7 @@ module SMARTAppLaunch
 
       Token refreshes are accomplished through a `POST` request to the token
       exchange endpoint as described in the [SMART App Launch
-      Framework](http://www.hl7.org/fhir/smart-app-launch/#step-5-later-app-uses-a-refresh-token-to-obtain-a-new-access-token).
+      Framework](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#step-5-later-app-uses-a-refresh-token-to-obtain-a-new-access-token).
 
       # Test Methodology
 
@@ -31,7 +31,7 @@ module SMARTAppLaunch
       * [The OAuth 2.0 Authorization
         Framework](https://tools.ietf.org/html/rfc6749)
       * [Using a refresh token to obtain a new access
-        token](http://hl7.org/fhir/smart-app-launch/#step-5-later-app-uses-a-refresh-token-to-obtain-a-new-access-token)
+        token](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#step-5-later-app-uses-a-refresh-token-to-obtain-a-new-access-token)
     )
 
     test from: :smart_token_refresh

data/lib/smart_app_launch/version.rb

@@ -1,3 +1,3 @@
 module SMARTAppLaunch
-  VERSION = '0.1.0'
+  VERSION = '0.1.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: smart_app_launch_test_kit
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.3
 platform: ruby
 authors:
 - Stephen MacVicar
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-02-28 00:00:00.000000000 Z
+date: 2022-05-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: inferno_core