smart_app_launch_test_kit 0.1.3 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 758773637de38a995aa7943da1291685f655e97f829c2e11d7adfc54d129ad42
-  data.tar.gz: b0c2adfcf695418617999e414a0d85766e440e943787d811ffb54218810fee2c
+  metadata.gz: c2dbada5c6124d5f5ca37325fd8e5a55c9a38ce827f9129362708559d32c3612
+  data.tar.gz: 55f25f85ffa99273ae104690985c7fbd58bcfc65fc6939b69c96e96c0e379c75
 SHA512:
-  metadata.gz: 9b9aabc2d05bf3b3a3fe49f35fe0be2e634f7c774d86d3d6a0129aa1cd424f1c5cebd03c84c24855445a0baf95ac23c730d614e9f628a946b5ac8d5ca0b6f8fa
-  data.tar.gz: b287eaf62940d60d904af996c0cbbd90d59ba68ce79cdbe6400a20515b9eccb6aa0ff6c094bd07cfd86b928a11c3b6e7e740c896d125c62f5da65a857450ed38
+  metadata.gz: 810a79b3a167dda729558308b165b24a6ed6ed431756584708b3b9ce8107a7361fa7881f3d86ec3f03d6fbc7fbf3fb33d4ef0dc669a696f0abdb7f96e27bffa7
+  data.tar.gz: bb60086d05486463f7b2c9b7b17dc7204e7d7cd0e2960d1df503549a72cabe9f30cae92fe55ae6c9cd4cf39a29601e9960f1e5c5879a859c17910c1205bb479f

data/lib/smart_app_launch/app_launch_test.rb

@@ -12,13 +12,23 @@ module SMARTAppLaunch
 
     config options: { launch_uri: "#{Inferno::Application['base_url']}/custom/smart/launch" }
 
+    def wait_message
+      return instance_exec(&config.options[:launch_message_proc]) if config.options[:launch_message_proc].present?
+
+      %(
+        ### #{self.class.parent&.parent&.title}
+
+        Waiting for Inferno to be launched from the EHR.
+
+        Tests will resume once Inferno receives a launch request at
+        `#{config.options[:launch_uri]}` with an `iss` of `#{url}`.
+      )
+    end
+
     run do
       wait(
         identifier: url,
-        message: %(
-          Waiting to receive a request at
-          `#{config.options[:launch_uri]}` with an `iss` of `#{url}`.
-        )
+        message: wait_message
       )
     end
   end

data/lib/smart_app_launch/app_redirect_test.rb

@@ -58,10 +58,17 @@ module SMARTAppLaunch
     end
 
     def wait_message(auth_url)
+      if config.options[:redirect_message_proc].present?
+        return instance_exec(auth_url, &config.options[:redirect_message_proc])
+      end
+
       %(
+        ### #{self.class.parent&.parent&.title}
+
         [Follow this link to authorize with the SMART server](#{auth_url}).
-        Waiting to receive a request at `#{config.options[:redirect_uri]}` with
-        a state of `#{state}`.
+
+        Tests will resume once Inferno receives a request at
+        `#{config.options[:redirect_uri]}` with a state of `#{state}`.
       )
     end
 

data/lib/smart_app_launch/app_redirect_test_stu2.rb

@@ -0,0 +1,45 @@
+require 'uri'
+require_relative 'app_redirect_test'
+
+module SMARTAppLaunch
+  class AppRedirectTestSTU2 < AppRedirectTest
+    id :smart_app_redirect_stu2
+    description %(
+      Client browser redirected from OAuth server to redirect URI of client
+      app as described in SMART authorization sequence.
+
+      Client SHALL use either the HTTP GET or the HTTP POST method to send the
+      Authorization Request to the Authorization Server.
+
+      [Authorization Code
+      Request](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#request-4)
+    )
+
+    input :authorization_method,
+          title: 'Authorization Method',
+          type: 'radio',
+          default: 'get',
+          options: {
+            list_options: [
+              {
+                label: 'GET',
+                value: 'get'
+              },
+              {
+                label: 'POST',
+                value: 'post'
+              }
+            ]
+          }
+
+    def authorization_url_builder(url, params)
+      return super if authorization_method == 'get'
+
+      post_params = params.merge(auth_url: url)
+
+      post_url = URI(config.options[:post_authorization_uri])
+      post_url.query = URI.encode_www_form(post_params)
+      post_url.to_s
+    end
+  end
+end

data/lib/smart_app_launch/{discovery_group.rb → discovery_stu1_group.rb}

@@ -1,5 +1,8 @@
+require_relative 'well_known_capabilities_stu1_test'
+require_relative 'well_known_endpoint_test'
+
 module SMARTAppLaunch
-  class DiscoveryGroup < Inferno::TestGroup
+  class DiscoverySTU1Group < Inferno::TestGroup
     id :smart_discovery
     title 'SMART on FHIR Discovery'
     short_description 'Retrieve server\'s SMART on FHIR configuration.'
@@ -36,83 +39,10 @@ module SMARTAppLaunch
       * [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html)
     )
 
-    test do
-      title 'FHIR server makes SMART configuration available from well-known endpoint'
-      description %(
-        The authorization endpoints accepted by a FHIR resource server can
-        be exposed as a Well-Known Uniform Resource Identifier
-      )
-      input :url,
-            title: 'FHIR Endpoint',
-            description: 'URL of the FHIR endpoint used by SMART applications'
-      output :well_known_configuration,
-             :well_known_authorization_url,
-             :well_known_introspection_url,
-             :well_known_management_url,
-             :well_known_registration_url,
-             :well_known_revocation_url,
-             :well_known_token_url
-      makes_request :smart_well_known_configuration
-
-      run do
-        well_known_configuration_url = "#{url.chomp('/')}/.well-known/smart-configuration"
-        get(well_known_configuration_url, name: :smart_well_known_configuration)
-
-        assert_response_status(200)
-
-        assert_valid_json(request.response_body)
-
-        config = JSON.parse(request.response_body)
-        output well_known_configuration: request.response_body,
-               well_known_authorization_url: config['authorization_endpoint'],
-               well_known_introspection_url: config['introspection_endpoint'],
-               well_known_management_url: config['management_endpoint'],
-               well_known_registration_url: config['registration_endpoint'],
-               well_known_revocation_url: config['revocation_endpoint'],
-               well_known_token_url: config['token_endpoint']
-
-        content_type = request.response_header('Content-Type')&.value
-
-        assert content_type.present?, 'No `Content-Type` header received.'
-        assert content_type.start_with?('application/json'),
-               "`Content-Type` must be `application/json`, but received: `#{content_type}`"
-      end
-    end
-
-    test do
-      title 'Well-known configuration contains required fields'
-      description %(
-        The JSON from .well-known/smart-configuration contains the following
-        required fields: `authorization_endpoint`, `token_endpoint`,
-        `capabilities`
-      )
-      input :well_known_configuration
-
-      run do
-        skip_if well_known_configuration.blank?, 'No well-known configuration found'
-        config = JSON.parse(well_known_configuration)
-
-        ['authorization_endpoint', 'token_endpoint', 'capabilities'].each do |key|
-          assert config.key?(key), "Well-known configuration does not include `#{key}`"
-          assert config[key].present?, "Well-known configuration field `#{key}` is blank"
-        end
-
-        assert config['authorization_endpoint'].is_a?(String),
-               'Well-known `authorization_endpoint` field must be a string'
-        assert config['token_endpoint'].is_a?(String),
-               'Well-known `token_endpoint` field must be a string'
-        assert config['capabilities'].is_a?(Array),
-               'Well-known `capabilities` field must be an array'
-
-        non_string_capabilities = config['capabilities'].reject { |capability| capability.is_a? String }
-
-        assert non_string_capabilities.blank?, %(
-          Well-known `capabilities` field must be an array of strings, but found
-          non-string values:
-          #{non_string_capabilities.map { |value| "`#{value.nil? ? 'nil' : value}`" }.join(', ')}
-        )
-      end
-    end
+    test from: :well_known_endpoint,
+         id: 'Test01'
+    test from: :well_known_capabilities_stu1,
+         id: 'Test02'
 
     test do
       title 'Conformance/CapabilityStatement provides OAuth 2.0 endpoints'
@@ -141,13 +71,14 @@ module SMARTAppLaunch
           resource
             .rest
             &.map(&:security)
+            &.compact
             &.find do |security|
-            security.service&.any? do |service|
-              service.coding&.any? do |coding|
-                coding.code == 'SMART-on-FHIR'
+              security.service&.any? do |service|
+                service.coding&.any? do |coding|
+                  coding.code == 'SMART-on-FHIR'
+                end
               end
             end
-          end
             &.extension
             &.find do |extension|
               extension.url == 'http://fhir-registry.smarthealthit.org/StructureDefinition/oauth-uris'

data/lib/smart_app_launch/discovery_stu2_group.rb

@@ -0,0 +1,50 @@
+require_relative 'well_known_capabilities_stu2_test'
+require_relative 'well_known_endpoint_test'
+
+module SMARTAppLaunch
+  class DiscoverySTU2Group < Inferno::TestGroup
+    id :smart_discovery_stu2
+    title 'SMART on FHIR Discovery'
+    short_description 'Retrieve server\'s SMART on FHIR configuration.'
+    description %(
+      # Background
+
+      The #{title} Sequence test looks for authorization endpoints and SMART
+      capabilities as described by the [SMART App Launch
+      Framework](http://hl7.org/fhir/smart-app-launch/STU2/).
+      The SMART launch framework uses OAuth 2.0 to *authorize* apps, like
+      Inferno, to access certain information on a FHIR server. The
+      authorization service accessed at the endpoint allows users to give
+      these apps permission without sharing their credentials with the
+      application itself. Instead, the application receives an access token
+      which allows it to access resources on the server. The access token
+      itself has a limited lifetime and permission scopes associated with it.
+      A refresh token may also be provided to the application in order to
+      obtain another access token. Unlike access tokens, a refresh token is
+      not shared with the resource server. If OpenID Connect is used, an id
+      token may be provided as well. The id token can be used to
+      *authenticate* the user. The id token is digitally signed and allows the
+      identity of the user to be verified.
+
+      # Test Methodology
+
+      This test suite will examine the SMART on FHIR configuration contained
+      in the `/.well-known/smart-configuration` endpoint.
+
+      For more information see:
+
+      * [SMART App Launch Framework](http://hl7.org/fhir/smart-app-launch/STU2/)
+      * [The OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749)
+      * [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html)
+    )
+
+    test from: :well_known_endpoint,
+         config: {
+           outputs: {
+             well_known_authorization_url: { name: :smart_authorization_url },
+             well_known_token_url: { name: :smart_token_url }
+           }
+         }
+    test from: :well_known_capabilities_stu2
+  end
+end

data/lib/smart_app_launch/ehr_launch_group_stu2.rb

@@ -0,0 +1,56 @@
+require_relative 'app_redirect_test_stu2'
+require_relative 'ehr_launch_group'
+
+module SMARTAppLaunch
+  class EHRLaunchGroupSTU2 < EHRLaunchGroup
+    id :smart_ehr_launch_stu2
+    description %(
+      # Background
+
+      The [EHR
+      Launch](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-ehr-launch)
+      is one of two ways in which an app can be launched, the other being
+      Standalone launch. In an EHR launch, the app is launched from an
+      existing EHR session or portal by a redirect to the registered launch
+      URL. The EHR provides the app two parameters:
+
+      * `iss` - Which contains the FHIR server url
+      * `launch` - An identifier needed for authorization
+
+      # Test Methodology
+
+      Inferno will wait for the EHR server redirect upon execution. When the
+      redirect is received Inferno will check for the presence of the `iss`
+      and `launch` parameters. The security of the authorization endpoint is
+      then checked and authorization is attempted using the provided `launch`
+      identifier.
+
+      For more information on the #{title} see:
+
+      * [SMART EHR Launch Sequence](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-ehr-launch)
+    )
+
+    config(
+      inputs: {
+        use_pkce: {
+          default: 'true',
+          locked: true
+        },
+        pkce_code_challenge_method: {
+          default: 'S256',
+          locked: true
+        },
+        requested_scopes: {
+          default: 'launch openid fhirUser offline_access user/*.rs'
+        }
+      }
+    )
+
+    test from: :smart_app_redirect_stu2 do
+      input :launch
+    end
+
+    redirect_index = children.find_index { |child| child.id.to_s.end_with? 'app_redirect' }
+    children[redirect_index] = children.pop
+  end
+end

data/lib/smart_app_launch/post_auth.html

@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <!-- Use the highest supported document mode of Internet Explorer -->
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+
+    <meta charset="utf-8" />
+    <title>Inferno POST Authorization Redirect</title>
+  </head>
+  <body>
+    <noscript>You need to enable JavaScript to run this app.</noscript>
+    <form id="form" style="display:none;">
+    </form>
+  </body>
+  <script>
+    const params = Object.fromEntries(new URLSearchParams(window.location.search).entries());
+    const submitUrl = params.auth_url;
+    delete params.auth_url;
+    const form = document.getElementById('form');
+    form.method = 'POST';
+    form.action = submitUrl;
+
+    for (const property in params) {
+      let input = document.createElement('input');
+      input.setAttribute('name', property);
+
+      let value = params[property].replace(/\+/g, ' ');
+      input.setAttribute('value', decodeURIComponent(value));
+
+      form.appendChild(input);
+    }
+
+    form.submit();
+  </script>
+</html>

data/lib/smart_app_launch/smart_stu1_suite.rb

@@ -0,0 +1,154 @@
+require 'tls_test_kit'
+
+require_relative 'version'
+require_relative 'discovery_stu1_group'
+require_relative 'standalone_launch_group'
+require_relative 'ehr_launch_group'
+require_relative 'openid_connect_group'
+require_relative 'token_refresh_group'
+
+module SMARTAppLaunch
+  class SMARTSTU1Suite < Inferno::TestSuite
+    id 'smart'
+    title 'SMART App Launch STU1'
+    version VERSION
+
+    resume_test_route :get, '/launch' do
+      request.query_parameters['iss']
+    end
+
+    resume_test_route :get, '/redirect' do
+      request.query_parameters['state']
+    end
+
+    config options: {
+      redirect_uri: "#{Inferno::Application['base_url']}/custom/smart/redirect",
+      launch_uri: "#{Inferno::Application['base_url']}/custom/smart/launch"
+    }
+
+    group do
+      title 'Standalone Launch'
+      id :smart_full_standalone_launch
+
+      run_as_group
+
+      group from: :smart_discovery
+      group from: :smart_standalone_launch
+
+      group from: :smart_openid_connect,
+            config: {
+              inputs: {
+                id_token: { name: :standalone_id_token },
+                client_id: { name: :standalone_client_id },
+                requested_scopes: { name: :standalone_requested_scopes },
+                access_token: { name: :standalone_access_token },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_standalone_refresh_without_scopes,
+            title: 'SMART Token Refresh Without Scopes',
+            config: {
+              inputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                client_id: { name: :standalone_client_id },
+                client_secret: { name: :standalone_client_secret },
+                received_scopes: { name: :standalone_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                received_scopes: { name: :standalone_received_scopes },
+                access_token: { name: :standalone_access_token },
+                token_retrieval_time: { name: :standalone_token_retrieval_time },
+                expires_in: { name: :standalone_expires_in },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_standalone_refresh_with_scopes,
+            title: 'SMART Token Refresh With Scopes',
+            config: {
+              options: { include_scopes: true },
+              inputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                client_id: { name: :standalone_client_id },
+                client_secret: { name: :standalone_client_secret },
+                received_scopes: { name: :standalone_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                received_scopes: { name: :standalone_received_scopes },
+                access_token: { name: :standalone_access_token },
+                token_retrieval_time: { name: :standalone_token_retrieval_time },
+                expires_in: { name: :standalone_expires_in },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+    end
+
+    group do
+      title 'EHR Launch'
+      id :smart_full_ehr_launch
+
+      run_as_group
+
+      group from: :smart_discovery
+
+      group from: :smart_ehr_launch
+
+      group from: :smart_openid_connect,
+            config: {
+              inputs: {
+                id_token: { name: :ehr_id_token },
+                client_id: { name: :ehr_client_id },
+                requested_scopes: { name: :ehr_requested_scopes },
+                access_token: { name: :ehr_access_token },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_ehr_refresh_without_scopes,
+            title: 'SMART Token Refresh Without Scopes',
+            config: {
+              inputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                client_id: { name: :ehr_client_id },
+                client_secret: { name: :ehr_client_secret },
+                received_scopes: { name: :ehr_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                received_scopes: { name: :ehr_received_scopes },
+                access_token: { name: :ehr_access_token },
+                token_retrieval_time: { name: :ehr_token_retrieval_time },
+                expires_in: { name: :ehr_expires_in },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_ehr_refresh_with_scopes,
+            title: 'SMART Token Refresh With Scopes',
+            config: {
+              options: { include_scopes: true },
+              inputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                client_id: { name: :ehr_client_id },
+                client_secret: { name: :ehr_client_secret },
+                received_scopes: { name: :ehr_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                received_scopes: { name: :ehr_received_scopes },
+                access_token: { name: :ehr_access_token },
+                token_retrieval_time: { name: :ehr_token_retrieval_time },
+                expires_in: { name: :ehr_expires_in },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+    end
+  end
+end

data/lib/smart_app_launch/smart_stu2_suite.rb

@@ -0,0 +1,160 @@
+require 'tls_test_kit'
+
+require_relative 'version'
+require_relative 'discovery_stu2_group'
+require_relative 'standalone_launch_group_stu2'
+require_relative 'ehr_launch_group_stu2'
+require_relative 'openid_connect_group'
+require_relative 'token_refresh_group'
+
+module SMARTAppLaunch
+  class SMARTSTU2Suite < Inferno::TestSuite
+    id 'smart_stu2'
+    title 'SMART App Launch STU2 (Work in Progress)'
+    version VERSION
+
+    resume_test_route :get, '/launch' do
+      request.query_parameters['iss']
+    end
+
+    resume_test_route :get, '/redirect' do
+      request.query_parameters['state']
+    end
+
+    @post_auth_page = File.read(File.join(__dir__, 'post_auth.html'))
+    post_auth_handler = proc { [200, {}, [@post_auth_page]] }
+
+    route :get, '/post_auth', post_auth_handler
+
+    config options: {
+      redirect_uri: "#{Inferno::Application['base_url']}/custom/smart_stu2/redirect",
+      launch_uri: "#{Inferno::Application['base_url']}/custom/smart_stu2/launch",
+      post_authorization_uri: "#{Inferno::Application['base_url']}/custom/smart_stu2/post_auth"
+    }
+
+    group do
+      title 'Standalone Launch'
+      id :smart_full_standalone_launch
+
+      run_as_group
+
+      group from: :smart_discovery_stu2
+      group from: :smart_standalone_launch_stu2
+
+      group from: :smart_openid_connect,
+            config: {
+              inputs: {
+                id_token: { name: :standalone_id_token },
+                client_id: { name: :standalone_client_id },
+                requested_scopes: { name: :standalone_requested_scopes },
+                access_token: { name: :standalone_access_token },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_standalone_refresh_without_scopes,
+            title: 'SMART Token Refresh Without Scopes',
+            config: {
+              inputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                client_id: { name: :standalone_client_id },
+                client_secret: { name: :standalone_client_secret },
+                received_scopes: { name: :standalone_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                received_scopes: { name: :standalone_received_scopes },
+                access_token: { name: :standalone_access_token },
+                token_retrieval_time: { name: :standalone_token_retrieval_time },
+                expires_in: { name: :standalone_expires_in },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_standalone_refresh_with_scopes,
+            title: 'SMART Token Refresh With Scopes',
+            config: {
+              options: { include_scopes: true },
+              inputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                client_id: { name: :standalone_client_id },
+                client_secret: { name: :standalone_client_secret },
+                received_scopes: { name: :standalone_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                received_scopes: { name: :standalone_received_scopes },
+                access_token: { name: :standalone_access_token },
+                token_retrieval_time: { name: :standalone_token_retrieval_time },
+                expires_in: { name: :standalone_expires_in },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+    end
+
+    group do
+      title 'EHR Launch'
+      id :smart_full_ehr_launch
+
+      run_as_group
+
+      group from: :smart_discovery_stu2
+
+      group from: :smart_ehr_launch_stu2
+
+      group from: :smart_openid_connect,
+            config: {
+              inputs: {
+                id_token: { name: :ehr_id_token },
+                client_id: { name: :ehr_client_id },
+                requested_scopes: { name: :ehr_requested_scopes },
+                access_token: { name: :ehr_access_token },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_ehr_refresh_without_scopes,
+            title: 'SMART Token Refresh Without Scopes',
+            config: {
+              inputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                client_id: { name: :ehr_client_id },
+                client_secret: { name: :ehr_client_secret },
+                received_scopes: { name: :ehr_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                received_scopes: { name: :ehr_received_scopes },
+                access_token: { name: :ehr_access_token },
+                token_retrieval_time: { name: :ehr_token_retrieval_time },
+                expires_in: { name: :ehr_expires_in },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_ehr_refresh_with_scopes,
+            title: 'SMART Token Refresh With Scopes',
+            config: {
+              options: { include_scopes: true },
+              inputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                client_id: { name: :ehr_client_id },
+                client_secret: { name: :ehr_client_secret },
+                received_scopes: { name: :ehr_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                received_scopes: { name: :ehr_received_scopes },
+                access_token: { name: :ehr_access_token },
+                token_retrieval_time: { name: :ehr_token_retrieval_time },
+                expires_in: { name: :ehr_expires_in },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+    end
+  end
+end

data/lib/smart_app_launch/standalone_launch_group_stu2.rb

@@ -0,0 +1,52 @@
+require_relative 'app_redirect_test_stu2'
+require_relative 'standalone_launch_group'
+
+module SMARTAppLaunch
+  class StandaloneLaunchGroupSTU2 < StandaloneLaunchGroup
+    id :smart_standalone_launch_stu2
+    description %(
+      # Background
+
+      The [Standalone
+      Launch Sequence](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-standalone-launch)
+      allows an app, like Inferno, to be launched independent of an
+      existing EHR session. It is one of the two launch methods described in
+      the SMART App Launch Framework alongside EHR Launch. The app will
+      request authorization for the provided scope from the authorization
+      endpoint, ultimately receiving an authorization token which can be used
+      to gain access to resources on the FHIR server.
+
+      # Test Methodology
+
+      Inferno will redirect the user to the the authorization endpoint so that
+      they may provide any required credentials and authorize the application.
+      Upon successful authorization, Inferno will exchange the authorization
+      code provided for an access token.
+
+      For more information on the #{title}:
+
+      * [Standalone Launch Sequence](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-standalone-launch)
+    )
+
+    config(
+      inputs: {
+        use_pkce: {
+          default: 'true',
+          locked: true
+        },
+        pkce_code_challenge_method: {
+          default: 'S256',
+          locked: true
+        },
+        requested_scopes: {
+          default: 'launch/patient openid fhirUser offline_access patient/*.rs'
+        }
+      }
+    )
+
+    test from: :smart_app_redirect_stu2
+
+    redirect_index = children.find_index { |child| child.id.to_s.end_with? 'app_redirect' }
+    children[redirect_index] = children.pop
+  end
+end

data/lib/smart_app_launch/token_refresh_test.rb

@@ -16,7 +16,7 @@ module SMARTAppLaunch
       the Pragma response header field with a value of no-cache to be
       consistent with the requirements of the inital access token exchange.
     )
-    input :well_known_token_url, :refresh_token, :client_id, :received_scopes
+    input :smart_token_url, :refresh_token, :client_id, :received_scopes
     input :client_secret, optional: true
     output :smart_credentials, :token_retrieval_time
     makes_request :token_refresh
@@ -39,7 +39,7 @@ module SMARTAppLaunch
         oauth2_params['client_id'] = client_id
       end
 
-      post(well_known_token_url, body: oauth2_params, name: :token_refresh, headers: oauth2_headers)
+      post(smart_token_url, body: oauth2_params, name: :token_refresh, headers: oauth2_headers)
 
       assert_response_status(200)
       assert_valid_json(request.response_body)
@@ -54,7 +54,7 @@ module SMARTAppLaunch
                client_id: client_id,
                client_secret: client_secret,
                token_retrieval_time: token_retrieval_time,
-               token_url: well_known_token_url
+               token_url: smart_token_url
              }.to_json
     end
   end

data/lib/smart_app_launch/token_response_body_test.rb

@@ -43,7 +43,7 @@ module SMARTAppLaunch
       validate_required_fields_present(token_response_body, ['access_token', 'token_type', 'expires_in', 'scope'])
       validate_token_field_types(token_response_body)
       validate_token_type(token_response_body)
-      check_for_missing_scopes(requested_scopes, token_response_body)
+      check_for_missing_scopes(requested_scopes, token_response_body) unless config.options[:ignore_missing_scopes_check]
 
       assert access_token.present?, 'Token response did not contain an access token'
       assert token_response_body['token_type']&.casecmp('Bearer')&.zero?,

data/lib/smart_app_launch/version.rb

@@ -1,3 +1,3 @@
 module SMARTAppLaunch
-  VERSION = '0.1.3'
+  VERSION = '0.1.6'
 end

data/lib/smart_app_launch/well_known_capabilities_stu1_test.rb

@@ -0,0 +1,39 @@
+module SMARTAppLaunch
+  class WellKnownCapabilitiesSTU1Test < Inferno::Test
+    title 'Well-known configuration contains required fields'
+    id :well_known_capabilities_stu1
+    input :well_known_configuration
+    description %(
+      The JSON from .well-known/smart-configuration contains the following
+      required fields: `authorization_endpoint`, `token_endpoint`,
+      `capabilities`
+    )
+
+    def required_capabilities
+      {
+        'authorization_endpoint' => String,
+        'token_endpoint' => String,
+        'capabilities' => Array
+      }
+    end
+
+    run do
+      skip_if well_known_configuration.blank?, 'No well-known configuration found'
+      config = JSON.parse(well_known_configuration)
+
+      required_capabilities.each do |key, type|
+        assert config.key?(key), "Well-known configuration does not include `#{key}`"
+        assert config[key].present?, "Well-known configuration field `#{key}` is blank"
+        assert config[key].is_a?(type), "Well-known `#{key}` must be type: #{type.to_s.downcase}"
+      end
+
+      non_string_capabilities = config['capabilities'].reject { |capability| capability.is_a? String }
+
+      assert non_string_capabilities.blank?, %(
+        Well-known `capabilities` field must be an array of strings, but found
+        non-string values:
+        #{non_string_capabilities.map { |value| "`#{value.nil? ? 'nil' : value}`" }.join(', ')}
+      )
+    end
+  end
+end

data/lib/smart_app_launch/well_known_capabilities_stu2_test.rb

@@ -0,0 +1,61 @@
+module SMARTAppLaunch
+  class WellKnownCapabilitiesSTU2Test < Inferno::Test
+    title 'Well-known configuration contains required fields'
+    id :well_known_capabilities_stu2
+    input :well_known_configuration
+    description %(
+      The JSON from .well-known/smart-configuration contains the following
+      required fields: `authorization_endpoint`, `token_endpoint`,
+      `capabilities`, `grant_types_supported`, `code_challenge_methods_supported`.
+      If the `sso-openid-connect` capability is supported, then `issuer` and `jwks_uri` must be
+      present. If `sso-openid-connect` capability is not supported, then `issuer` must be omitted.
+    )
+ 
+    def required_capabilities
+      {
+        'authorization_endpoint' => String,
+        'token_endpoint' => String,
+        'capabilities' => Array,
+        'grant_types_supported' => Array,
+        'code_challenge_methods_supported' => Array
+      }
+    end
+
+    run do
+      skip_if well_known_configuration.blank?, 'No well-known configuration found'
+      config = JSON.parse(well_known_configuration)
+
+      required_capabilities.each do |key, type|
+        assert config.key?(key), "Well-known configuration does not include `#{key}`"
+        assert config[key].present?, "Well-known configuration field `#{key}` is blank"
+        assert config[key].is_a?(type), "Well-known `#{key}` must be type: #{type.to_s.downcase}"
+      end
+
+      assert config['grant_types_supported'].include?('authorization_code'),
+           'Well-known `grant_types_supported` must include `authorization_code` grant type to indicate SMART App Launch Support'
+      assert config['code_challenge_methods_supported'].include?('S256'),
+           'Well-known `code_challenge_methods_supported` must include `S256`'
+      assert config['code_challenge_methods_supported'].exclude?('plain'),
+           'Well-known `code_challenge_methods_support` must not include `plain`'
+
+      if config['capabilities'].include?('sso-openid-connect')
+        assert config['issuer'].is_a?(String),
+          'Well-known `issuer` field must be a string and present when server capabilities includes `sso-openid-connect`'
+        assert config['jwks_uri'].is_a?(String),
+          'Well-known `jwks_uri` field must be a string and present when server capabilites includes `sso-openid-coneect`'
+      else
+        warning do
+          assert config['issuer'].nil?, 'Well-known `issuer` is omitted when server capabilites does not include `sso-openid-connect`'
+        end
+      end
+
+      non_string_capabilities = config['capabilities'].reject { |capability| capability.is_a? String }
+
+      assert non_string_capabilities.blank?, %(
+        Well-known `capabilities` field must be an array of strings, but found
+        non-string values:
+        #{non_string_capabilities.map { |value| "`#{value.nil? ? 'nil' : value}`" }.join(', ')}
+      )
+    end
+  end
+end

data/lib/smart_app_launch/well_known_endpoint_test.rb

@@ -0,0 +1,46 @@
+module SMARTAppLaunch
+  class WellKnownEndpointTest < Inferno::Test
+    title 'FHIR server makes SMART configuration available from well-known endpoint'
+    id :well_known_endpoint
+    description %(
+      The authorization endpoints accepted by a FHIR resource server can
+      be exposed as a Well-Known Uniform Resource Identifier
+    )
+    input :url,
+          title: 'FHIR Endpoint',
+          description: 'URL of the FHIR endpoint used by SMART applications'
+    output :well_known_configuration,
+           :well_known_authorization_url,
+           :well_known_introspection_url,
+           :well_known_management_url,
+           :well_known_registration_url,
+           :well_known_revocation_url,
+           :well_known_token_url
+    makes_request :smart_well_known_configuration
+
+    run do
+      well_known_configuration_url = "#{url.chomp('/')}/.well-known/smart-configuration"
+      get(well_known_configuration_url,
+          name: :smart_well_known_configuration,
+          headers: { 'Accept' => 'application/json' })
+      assert_response_status(200)
+
+      assert_valid_json(request.response_body)
+
+      config = JSON.parse(request.response_body)
+      output well_known_configuration: request.response_body,
+             well_known_authorization_url: config['authorization_endpoint'],
+             well_known_introspection_url: config['introspection_endpoint'],
+             well_known_management_url: config['management_endpoint'],
+             well_known_registration_url: config['registration_endpoint'],
+             well_known_revocation_url: config['revocation_endpoint'],
+             well_known_token_url: config['token_endpoint']
+
+      content_type = request.response_header('Content-Type')&.value
+
+      assert content_type.present?, 'No `Content-Type` header received.'
+      assert content_type.start_with?('application/json'),
+             "`Content-Type` must be `application/json`, but received: `#{content_type}`"
+    end
+  end
+end

data/lib/smart_app_launch_test_kit.rb

@@ -1,174 +1,4 @@
 require 'tls_test_kit'
 
-require_relative 'smart_app_launch/version'
-require_relative 'smart_app_launch/discovery_group'
-require_relative 'smart_app_launch/standalone_launch_group'
-require_relative 'smart_app_launch/ehr_launch_group'
-require_relative 'smart_app_launch/openid_connect_group'
-require_relative 'smart_app_launch/token_refresh_group'
-
-# TODO: Remove once this functionality is released in core:
-# https://github.com/inferno-framework/inferno-core/pull/86
-module Inferno
-  module DSL
-    module Runnable
-      def required_inputs(prior_outputs = [])
-        required_inputs =
-          inputs
-            .reject { |input| input_definitions[input][:optional] }
-            .map { |input| config.input_name(input) }
-            .reject { |input| prior_outputs.include?(input) }
-        children_required_inputs = children.flat_map { |child| child.required_inputs(prior_outputs) }
-        prior_outputs.concat(outputs.map { |output| config.output_name(output) })
-        (required_inputs + children_required_inputs).flatten.uniq
-      end
-    end
-  end
-end
-
-module SMARTAppLaunch
-  class SMARTSuite < Inferno::TestSuite
-    id 'smart'
-    title 'SMART App Launch STU1'
-    version VERSION
-
-    resume_test_route :get, '/launch' do
-      request.query_parameters['iss']
-    end
-
-    resume_test_route :get, '/redirect' do
-      request.query_parameters['state']
-    end
-
-    config options: {
-      redirect_uri: "#{Inferno::Application['base_url']}/custom/smart/redirect",
-      launch_uri: "#{Inferno::Application['base_url']}/custom/smart/launch"
-    }
-
-    group do
-      title 'Standalone Launch'
-      id :smart_full_standalone_launch
-
-      run_as_group
-
-      group from: :smart_discovery
-
-      group from: :smart_standalone_launch
-
-      group from: :smart_openid_connect,
-            config: {
-              inputs: {
-                id_token: { name: :standalone_id_token },
-                client_id: { name: :standalone_client_id },
-                requested_scopes: { name: :standalone_requested_scopes },
-                access_token: { name: :standalone_access_token },
-                smart_credentials: { name: :standalone_smart_credentials }
-              }
-            }
-
-      group from: :smart_token_refresh,
-            id: :smart_standalone_refresh_without_scopes,
-            title: 'SMART Token Refresh Without Scopes',
-            config: {
-              inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
-                received_scopes: { name: :standalone_received_scopes }
-              },
-              outputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                received_scopes: { name: :standalone_received_scopes },
-                access_token: { name: :standalone_access_token },
-                token_retrieval_time: { name: :standalone_token_retrieval_time },
-                expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
-              }
-            }
-
-      group from: :smart_token_refresh,
-            id: :smart_standalone_refresh_with_scopes,
-            title: 'SMART Token Refresh With Scopes',
-            config: {
-              options: { include_scopes: true },
-              inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
-                received_scopes: { name: :standalone_received_scopes }
-              },
-              outputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                received_scopes: { name: :standalone_received_scopes },
-                access_token: { name: :standalone_access_token },
-                token_retrieval_time: { name: :standalone_token_retrieval_time },
-                expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
-              }
-            }
-    end
-
-    group do
-      title 'EHR Launch'
-      id :smart_full_ehr_launch
-
-      run_as_group
-
-      group from: :smart_discovery
-
-      group from: :smart_ehr_launch
-
-      group from: :smart_openid_connect,
-            config: {
-              inputs: {
-                id_token: { name: :ehr_id_token },
-                client_id: { name: :ehr_client_id },
-                requested_scopes: { name: :ehr_requested_scopes },
-                access_token: { name: :ehr_access_token },
-                smart_credentials: { name: :ehr_smart_credentials }
-              }
-            }
-
-      group from: :smart_token_refresh,
-            id: :smart_ehr_refresh_without_scopes,
-            title: 'SMART Token Refresh Without Scopes',
-            config: {
-              inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
-                received_scopes: { name: :ehr_received_scopes }
-              },
-              outputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                received_scopes: { name: :ehr_received_scopes },
-                access_token: { name: :ehr_access_token },
-                token_retrieval_time: { name: :ehr_token_retrieval_time },
-                expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
-              }
-            }
-
-      group from: :smart_token_refresh,
-            id: :smart_ehr_refresh_with_scopes,
-            title: 'SMART Token Refresh With Scopes',
-            config: {
-              options: { include_scopes: true },
-              inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
-                received_scopes: { name: :ehr_received_scopes }
-              },
-              outputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                received_scopes: { name: :ehr_received_scopes },
-                access_token: { name: :ehr_access_token },
-                token_retrieval_time: { name: :ehr_token_retrieval_time },
-                expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
-              }
-            }
-    end
-  end
-end
+require_relative 'smart_app_launch/smart_stu1_suite'
+require_relative 'smart_app_launch/smart_stu2_suite'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: smart_app_launch_test_kit
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.6
 platform: ruby
 authors:
 - Stephen MacVicar
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-05-09 00:00:00.000000000 Z
+date: 2022-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: inferno_core
@@ -133,9 +133,12 @@ files:
 - LICENSE
 - lib/smart_app_launch/app_launch_test.rb
 - lib/smart_app_launch/app_redirect_test.rb
+- lib/smart_app_launch/app_redirect_test_stu2.rb
 - lib/smart_app_launch/code_received_test.rb
-- lib/smart_app_launch/discovery_group.rb
+- lib/smart_app_launch/discovery_stu1_group.rb
+- lib/smart_app_launch/discovery_stu2_group.rb
 - lib/smart_app_launch/ehr_launch_group.rb
+- lib/smart_app_launch/ehr_launch_group_stu2.rb
 - lib/smart_app_launch/launch_received_test.rb
 - lib/smart_app_launch/openid_connect_group.rb
 - lib/smart_app_launch/openid_decode_id_token_test.rb
@@ -145,7 +148,11 @@ files:
 - lib/smart_app_launch/openid_retrieve_jwks_test.rb
 - lib/smart_app_launch/openid_token_header_test.rb
 - lib/smart_app_launch/openid_token_payload_test.rb
+- lib/smart_app_launch/post_auth.html
+- lib/smart_app_launch/smart_stu1_suite.rb
+- lib/smart_app_launch/smart_stu2_suite.rb
 - lib/smart_app_launch/standalone_launch_group.rb
+- lib/smart_app_launch/standalone_launch_group_stu2.rb
 - lib/smart_app_launch/token_exchange_test.rb
 - lib/smart_app_launch/token_payload_validation.rb
 - lib/smart_app_launch/token_refresh_body_test.rb
@@ -154,6 +161,9 @@ files:
 - lib/smart_app_launch/token_response_body_test.rb
 - lib/smart_app_launch/token_response_headers_test.rb
 - lib/smart_app_launch/version.rb
+- lib/smart_app_launch/well_known_capabilities_stu1_test.rb
+- lib/smart_app_launch/well_known_capabilities_stu2_test.rb
+- lib/smart_app_launch/well_known_endpoint_test.rb
 - lib/smart_app_launch_test_kit.rb
 homepage: https://github.com/inferno_framework/smart-app-launch-test-kit
 licenses:
@@ -161,7 +171,7 @@ licenses:
 metadata:
   homepage_uri: https://github.com/inferno_framework/smart-app-launch-test-kit
   source_code_uri: https://github.com/inferno_framework/smart-app-launch-test-kit
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -177,7 +187,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key:
+signing_key: 
 specification_version: 4
 summary: Inferno Tests for the SMART Application Launch Framework Implementation Guide
 test_files: []