smart_app_launch_test_kit 0.5.1 → 0.6.0

data/lib/smart_app_launch/openid_fhir_user_claim_test.rb

@@ -8,18 +8,19 @@ module SMARTAppLaunch
       the url for a Patient, Practitioner, RelatedPerson, or Person resource
     )
 
-    input :id_token_payload_json, :requested_scopes, :url
-    input :smart_credentials, type: :oauth_credentials
+    input :id_token_payload_json, :url
+    input :smart_auth_info, type: :auth_info
+
     output :id_token_fhir_user
 
     fhir_client do
       url :url
-      oauth_credentials :smart_credentials
+      auth_info :smart_auth_info
     end
 
     run do
       skip_if id_token_payload_json.blank?
-      skip_if !requested_scopes&.include?('fhirUser'), '`fhirUser` scope not requested'
+      skip_if !smart_auth_info.requested_scopes&.include?('fhirUser'), '`fhirUser` scope not requested'
 
       assert_valid_json(id_token_payload_json)
       payload = JSON.parse(id_token_payload_json)

data/lib/smart_app_launch/openid_token_payload_test.rb

@@ -22,16 +22,14 @@ module SMARTAppLaunch
       REQUIRED_CLAIMS.dup
     end
 
-    input :id_token,
-          :openid_configuration_json,
-          :id_token_jwk_json,
-          :client_id
+    input :id_token, :openid_configuration_json, :id_token_jwk_json
+    input :smart_auth_info, type: :auth_info, options: { mode: 'auth' }
 
     run do
       skip_if id_token.blank?, 'No ID Token'
       skip_if openid_configuration_json.blank?, 'No OpenID Configuration found'
       skip_if id_token_jwk_json.blank?, 'No ID Token jwk found'
-      skip_if client_id.blank?, 'No Client ID'
+      skip_if smart_auth_info.client_id.blank?, 'No Client ID'
 
       begin
         configuration = JSON.parse(openid_configuration_json)
@@ -44,7 +42,7 @@ module SMARTAppLaunch
             algorithms: ['RS256'],
             exp_leeway: 60,
             iss: configuration['issuer'],
-            aud: client_id,
+            aud: smart_auth_info.client_id,
             verify_not_before: false,
             verify_iat: false,
             verify_jti: false,
@@ -57,8 +55,8 @@ module SMARTAppLaunch
       end
 
       sub_value = payload['sub']
-      assert !sub_value.blank?, "ID token `sub` claim is blank"
-      assert sub_value.length < 256, "ID token `sub` claim exceeds 255 characters in length"
+      assert !sub_value.blank?, 'ID token `sub` claim is blank'
+      assert sub_value.length < 256, 'ID token `sub` claim exceeds 255 characters in length'
 
       missing_claims = required_claims - payload.keys
       missing_claims_string = missing_claims.map { |claim| "`#{claim}`" }.join(', ')

data/lib/smart_app_launch/smart_stu1_suite.rb

@@ -58,16 +58,22 @@ module SMARTAppLaunch
 
       run_as_group
 
-      group from: :smart_discovery
+      group from: :smart_discovery,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              }
+            }
       group from: :smart_standalone_launch
 
       group from: :smart_openid_connect,
             config: {
               inputs: {
                 id_token: { name: :standalone_id_token },
-                client_id: { name: :standalone_client_id },
-                requested_scopes: { name: :standalone_requested_scopes },
-                access_token: { name: :standalone_access_token },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 smart_credentials: { name: :standalone_smart_credentials }
               }
             }
@@ -77,9 +83,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -88,7 +92,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
 
@@ -98,9 +103,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -109,7 +112,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
     end
@@ -128,7 +132,15 @@ module SMARTAppLaunch
 
       run_as_group
 
-      group from: :smart_discovery
+      group from: :smart_discovery,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              }
+            }
 
       group from: :smart_ehr_launch
 
@@ -136,9 +148,7 @@ module SMARTAppLaunch
             config: {
               inputs: {
                 id_token: { name: :ehr_id_token },
-                client_id: { name: :ehr_client_id },
-                requested_scopes: { name: :ehr_requested_scopes },
-                access_token: { name: :ehr_access_token },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 smart_credentials: { name: :ehr_smart_credentials }
               }
             }
@@ -148,9 +158,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -159,7 +167,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
 
@@ -169,9 +178,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -180,7 +187,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
     end

data/lib/smart_app_launch/smart_stu2_2_suite.rb

@@ -49,7 +49,7 @@ module SMARTAppLaunch
       * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
       If using asymmetric client authentication, register Inferno with the
-      following JWK Set URL:
+      following JWK Set URL or provide a custom JWK Set:
 
       * `#{Inferno::Application[:base_url]}/custom/smart_stu2_2/.well-known/jwks.json`
 
@@ -85,23 +85,29 @@ module SMARTAppLaunch
         * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
         If using asymmetric client authentication, register Inferno with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2_2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2_2
+      group from: :smart_discovery_stu2_2,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              }
+            }
       group from: :smart_standalone_launch_stu2_2
 
       group from: :smart_openid_connect_stu2_2,
             config: {
               inputs: {
                 id_token: { name: :standalone_id_token },
-                client_id: { name: :standalone_client_id },
-                requested_scopes: { name: :standalone_requested_scopes },
-                access_token: { name: :standalone_access_token },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 smart_credentials: { name: :standalone_smart_credentials }
               }
             }
@@ -111,9 +117,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -122,7 +126,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
 
@@ -132,9 +137,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -143,7 +146,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
     end
@@ -160,14 +164,22 @@ module SMARTAppLaunch
         * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
         If using asymmetric client authentication, register Inferno with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2_2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2_2
+      group from: :smart_discovery_stu2_2,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              }
+            }
 
       group from: :smart_ehr_launch_stu2_2
 
@@ -175,9 +187,7 @@ module SMARTAppLaunch
             config: {
               inputs: {
                 id_token: { name: :ehr_id_token },
-                client_id: { name: :ehr_client_id },
-                requested_scopes: { name: :ehr_requested_scopes },
-                access_token: { name: :ehr_access_token },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 smart_credentials: { name: :ehr_smart_credentials }
               }
             }
@@ -187,9 +197,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -198,7 +206,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
 
@@ -208,9 +217,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -219,7 +226,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
     end
@@ -230,15 +238,33 @@ module SMARTAppLaunch
 
       input_instructions <<~INSTRUCTIONS
         Please register the Inferno client with the authorization services with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2_2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2_2
-      group from: :backend_services_authorization
+      group from: :smart_discovery_stu2_2 do
+        config(
+          inputs: {
+            smart_auth_info: { name: :backend_services_smart_auth_info }
+          },
+          outputs: {
+            smart_auth_info: { name: :backend_services_smart_auth_info }
+          }
+        )
+      end
+
+      group from: :backend_services_authorization,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :backend_services_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :backend_services_smart_auth_info }
+              }
+            }
     end
 
     group from: :smart_token_introspection_stu2_2

data/lib/smart_app_launch/smart_stu2_suite.rb

@@ -50,7 +50,7 @@ module SMARTAppLaunch
       * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
       If using asymmetric client authentication, register Inferno with the
-      following JWK Set URL:
+      following JWK Set URL or provide a custom JWK Set:
 
       * `#{Inferno::Application[:base_url]}/custom/smart_stu2/.well-known/jwks.json`
     DESCRIPTION
@@ -83,23 +83,29 @@ module SMARTAppLaunch
         * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
         If using asymmetric client authentication, register Inferno with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2
+      group from: :smart_discovery_stu2,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              }
+            }
       group from: :smart_standalone_launch_stu2
 
       group from: :smart_openid_connect,
             config: {
               inputs: {
                 id_token: { name: :standalone_id_token },
-                client_id: { name: :standalone_client_id },
-                requested_scopes: { name: :standalone_requested_scopes },
-                access_token: { name: :standalone_access_token },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 smart_credentials: { name: :standalone_smart_credentials }
               }
             }
@@ -109,9 +115,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -120,7 +124,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
 
@@ -130,9 +135,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -141,7 +144,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
     end
@@ -158,14 +162,22 @@ module SMARTAppLaunch
         * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
         If using asymmetric client authentication, register Inferno with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2
+      group from: :smart_discovery_stu2,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              }
+            }
 
       group from: :smart_ehr_launch_stu2
 
@@ -173,9 +185,7 @@ module SMARTAppLaunch
             config: {
               inputs: {
                 id_token: { name: :ehr_id_token },
-                client_id: { name: :ehr_client_id },
-                requested_scopes: { name: :ehr_requested_scopes },
-                access_token: { name: :ehr_access_token },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 smart_credentials: { name: :ehr_smart_credentials }
               }
             }
@@ -185,9 +195,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -196,7 +204,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
 
@@ -206,9 +215,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -217,7 +224,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
     end
@@ -228,18 +236,35 @@ module SMARTAppLaunch
 
       input_instructions <<~INSTRUCTIONS
         Please register the Inferno client with the authorization services with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2
-      group from: :backend_services_authorization
+      group from: :smart_discovery_stu2 do
+        config(
+          inputs: {
+            smart_auth_info: { name: :backend_services_smart_auth_info }
+          },
+          outputs: {
+            smart_auth_info: { name: :backend_services_smart_auth_info }
+          }
+        )
+      end
+
+      group from: :backend_services_authorization,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :backend_services_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :backend_services_smart_auth_info }
+              }
+            }
     end
 
     group from: :smart_token_introspection
-
   end
 end

data/lib/smart_app_launch/smart_tls_test.rb

@@ -0,0 +1,14 @@
+require 'tls_test_kit'
+
+module SMARTAppLaunch
+  class SMARTTLSTest < TLSTestKit::TLSVersionTest
+    id :smart_tls
+    input :smart_auth_info, type: :auth_info, options: { mode: 'auth' }
+
+    def url
+      return super if config.options[:smart_endpoint_key].blank?
+
+      smart_auth_info.send(config.options[:smart_endpoint_key])
+    end
+  end
+end