smart_app_launch_test_kit 0.5.1 → 0.6.1

data/lib/smart_app_launch/smart_stu2_2_suite.rb

@@ -49,7 +49,7 @@ module SMARTAppLaunch
       * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
       If using asymmetric client authentication, register Inferno with the
-      following JWK Set URL:
+      following JWK Set URL or provide a custom JWK Set:
 
       * `#{Inferno::Application[:base_url]}/custom/smart_stu2_2/.well-known/jwks.json`
 
@@ -85,23 +85,29 @@ module SMARTAppLaunch
         * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
         If using asymmetric client authentication, register Inferno with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2_2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2_2
+      group from: :smart_discovery_stu2_2,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              }
+            }
       group from: :smart_standalone_launch_stu2_2
 
       group from: :smart_openid_connect_stu2_2,
             config: {
               inputs: {
                 id_token: { name: :standalone_id_token },
-                client_id: { name: :standalone_client_id },
-                requested_scopes: { name: :standalone_requested_scopes },
-                access_token: { name: :standalone_access_token },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 smart_credentials: { name: :standalone_smart_credentials }
               }
             }
@@ -111,9 +117,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -122,7 +126,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
 
@@ -132,9 +137,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -143,7 +146,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
     end
@@ -160,14 +164,22 @@ module SMARTAppLaunch
         * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
         If using asymmetric client authentication, register Inferno with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2_2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2_2
+      group from: :smart_discovery_stu2_2,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              }
+            }
 
       group from: :smart_ehr_launch_stu2_2
 
@@ -175,9 +187,7 @@ module SMARTAppLaunch
             config: {
               inputs: {
                 id_token: { name: :ehr_id_token },
-                client_id: { name: :ehr_client_id },
-                requested_scopes: { name: :ehr_requested_scopes },
-                access_token: { name: :ehr_access_token },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 smart_credentials: { name: :ehr_smart_credentials }
               }
             }
@@ -187,9 +197,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -198,7 +206,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
 
@@ -208,9 +217,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -219,7 +226,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
     end
@@ -230,15 +238,34 @@ module SMARTAppLaunch
 
       input_instructions <<~INSTRUCTIONS
         Please register the Inferno client with the authorization services with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2_2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2_2
-      group from: :backend_services_authorization
+      group from: :smart_discovery_stu2_2 do
+        config(
+          inputs: {
+            smart_auth_info: { name: :backend_services_smart_auth_info }
+          },
+          outputs: {
+            smart_auth_info: { name: :backend_services_smart_auth_info }
+          }
+        )
+      end
+
+      group from: :backend_services_authorization,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :backend_services_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :backend_services_smart_auth_info },
+                received_scopes: { name: :backend_services_received_scopes }
+              }
+            }
     end
 
     group from: :smart_token_introspection_stu2_2

data/lib/smart_app_launch/smart_stu2_suite.rb

@@ -50,7 +50,7 @@ module SMARTAppLaunch
       * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
       If using asymmetric client authentication, register Inferno with the
-      following JWK Set URL:
+      following JWK Set URL or provide a custom JWK Set:
 
       * `#{Inferno::Application[:base_url]}/custom/smart_stu2/.well-known/jwks.json`
     DESCRIPTION
@@ -83,23 +83,29 @@ module SMARTAppLaunch
         * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
         If using asymmetric client authentication, register Inferno with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2
+      group from: :smart_discovery_stu2,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :standalone_smart_auth_info }
+              }
+            }
       group from: :smart_standalone_launch_stu2
 
       group from: :smart_openid_connect,
             config: {
               inputs: {
                 id_token: { name: :standalone_id_token },
-                client_id: { name: :standalone_client_id },
-                requested_scopes: { name: :standalone_requested_scopes },
-                access_token: { name: :standalone_access_token },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 smart_credentials: { name: :standalone_smart_credentials }
               }
             }
@@ -109,9 +115,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -120,7 +124,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
 
@@ -130,9 +135,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
+                smart_auth_info: { name: :standalone_smart_auth_info },
                 received_scopes: { name: :standalone_received_scopes }
               },
               outputs: {
@@ -141,7 +144,8 @@ module SMARTAppLaunch
                 access_token: { name: :standalone_access_token },
                 token_retrieval_time: { name: :standalone_token_retrieval_time },
                 expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
+                smart_credentials: { name: :standalone_smart_credentials },
+                smart_auth_info: { name: :standalone_smart_auth_info }
               }
             }
     end
@@ -158,14 +162,22 @@ module SMARTAppLaunch
         * OAuth Redirect URI: `#{config.options[:redirect_uri]}`
 
         If using asymmetric client authentication, register Inferno with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2
+      group from: :smart_discovery_stu2,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :ehr_smart_auth_info }
+              }
+            }
 
       group from: :smart_ehr_launch_stu2
 
@@ -173,9 +185,7 @@ module SMARTAppLaunch
             config: {
               inputs: {
                 id_token: { name: :ehr_id_token },
-                client_id: { name: :ehr_client_id },
-                requested_scopes: { name: :ehr_requested_scopes },
-                access_token: { name: :ehr_access_token },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 smart_credentials: { name: :ehr_smart_credentials }
               }
             }
@@ -185,9 +195,7 @@ module SMARTAppLaunch
             title: 'SMART Token Refresh Without Scopes',
             config: {
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -196,7 +204,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
 
@@ -206,9 +215,7 @@ module SMARTAppLaunch
             config: {
               options: { include_scopes: true },
               inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
+                smart_auth_info: { name: :ehr_smart_auth_info },
                 received_scopes: { name: :ehr_received_scopes }
               },
               outputs: {
@@ -217,7 +224,8 @@ module SMARTAppLaunch
                 access_token: { name: :ehr_access_token },
                 token_retrieval_time: { name: :ehr_token_retrieval_time },
                 expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
+                smart_credentials: { name: :ehr_smart_credentials },
+                smart_auth_info: { name: :ehr_smart_auth_info }
               }
             }
     end
@@ -228,18 +236,36 @@ module SMARTAppLaunch
 
       input_instructions <<~INSTRUCTIONS
         Please register the Inferno client with the authorization services with the
-        following JWK Set URL:
+        following JWK Set URL or provide a custom JWK Set:
 
         * `#{Inferno::Application[:base_url]}/custom/smart_stu2/.well-known/jwks.json`
       INSTRUCTIONS
 
       run_as_group
 
-      group from: :smart_discovery_stu2
-      group from: :backend_services_authorization
+      group from: :smart_discovery_stu2 do
+        config(
+          inputs: {
+            smart_auth_info: { name: :backend_services_smart_auth_info }
+          },
+          outputs: {
+            smart_auth_info: { name: :backend_services_smart_auth_info }
+          }
+        )
+      end
+
+      group from: :backend_services_authorization,
+            config: {
+              inputs: {
+                smart_auth_info: { name: :backend_services_smart_auth_info }
+              },
+              outputs: {
+                smart_auth_info: { name: :backend_services_smart_auth_info },
+                received_scopes: { name: :backend_services_received_scopes }
+              }
+            }
     end
 
     group from: :smart_token_introspection
-
   end
 end

data/lib/smart_app_launch/smart_tls_test.rb

@@ -0,0 +1,14 @@
+require 'tls_test_kit'
+
+module SMARTAppLaunch
+  class SMARTTLSTest < TLSTestKit::TLSVersionTest
+    id :smart_tls
+    input :smart_auth_info, type: :auth_info, options: { mode: 'auth' }
+
+    def url
+      return super if config.options[:smart_endpoint_key].blank?
+
+      smart_auth_info.send(config.options[:smart_endpoint_key])
+    end
+  end
+end

data/lib/smart_app_launch/standalone_launch_group.rb

@@ -1,5 +1,6 @@
 require_relative 'app_redirect_test'
 require_relative 'code_received_test'
+require_relative 'smart_tls_test'
 require_relative 'token_exchange_test'
 require_relative 'token_response_body_test'
 require_relative 'token_response_headers_test'
@@ -36,23 +37,35 @@ module SMARTAppLaunch
 
     config(
       inputs: {
-        client_id: {
-          name: :standalone_client_id,
-          title: 'Standalone Client ID',
-          description: 'Client ID provided during registration of Inferno as a standalone application'
-        },
-        client_secret: {
-          name: :standalone_client_secret,
-          title: 'Standalone Client Secret',
-          description: 'Client Secret provided during registration of Inferno as a standalone application. ' \
-                       'Only for clients using confidential symmetric authentication.'
-        },
-        requested_scopes: {
-          name: :standalone_requested_scopes,
-          title: 'Standalone Scope',
-          description: 'OAuth 2.0 scope provided by system to enable all required functionality',
-          type: 'textarea',
-          default: 'launch/patient openid fhirUser offline_access patient/*.read'
+        smart_auth_info: {
+          name: :standalone_smart_auth_info,
+          title: 'Standalone Launch Credentials',
+          options: {
+            components: [
+              {
+                name: :auth_type,
+                options: {
+                  list_options: [
+                    { label: 'Public', value: 'public' },
+                    { label: 'Confidential Symmetric', value: 'symmetric' }
+                  ]
+                }
+              },
+              {
+                name: :requested_scopes,
+                default: 'launch/patient openid fhirUser offline_access patient/*.read'
+              },
+              {
+                name: :use_discovery,
+                locked: true
+              },
+              {
+                name: :auth_request_method,
+                default: 'GET',
+                locked: true
+              }
+            ]
+          }
         },
         url: {
           title: 'Standalone FHIR Endpoint',
@@ -67,7 +80,6 @@ module SMARTAppLaunch
         smart_credentials: {
           name: :standalone_smart_credentials
         }
-
       },
       outputs: {
         code: { name: :standalone_code },
@@ -81,7 +93,8 @@ module SMARTAppLaunch
         encounter_id: { name: :standalone_encounter_id },
         received_scopes: { name: :standalone_received_scopes },
         intent: { name: :standalone_intent },
-        smart_credentials: { name: :standalone_smart_credentials }
+        smart_credentials: { name: :standalone_smart_credentials },
+        smart_auth_info: { name: :standalone_smart_auth_info }
       },
       requests: {
         redirect: { name: :standalone_redirect },
@@ -89,7 +102,7 @@ module SMARTAppLaunch
       }
     )
 
-    test from: :tls_version_test,
+    test from: :smart_tls,
          id: :standalone_auth_tls,
          title: 'OAuth 2.0 authorize endpoint secured by transport layer security',
          description: %(
@@ -98,12 +111,14 @@ module SMARTAppLaunch
            servers, over TLS-secured channels.
          ),
          config: {
-           inputs: { url: { name: :smart_authorization_url } },
-           options: {  minimum_allowed_version: OpenSSL::SSL::TLS1_2_VERSION }
+           options: {
+             minimum_allowed_version: OpenSSL::SSL::TLS1_2_VERSION,
+             smart_endpoint_key: :auth_url
+           }
          }
     test from: :smart_app_redirect
     test from: :smart_code_received
-    test from: :tls_version_test,
+    test from: :smart_tls,
          id: :standalone_token_tls,
          title: 'OAuth 2.0 token endpoint secured by transport layer security',
          description: %(
@@ -112,8 +127,10 @@ module SMARTAppLaunch
            servers, over TLS-secured channels.
          ),
          config: {
-           inputs: { url: { name: :smart_token_url } },
-           options: {  minimum_allowed_version: OpenSSL::SSL::TLS1_2_VERSION }
+           options: {
+             minimum_allowed_version: OpenSSL::SSL::TLS1_2_VERSION,
+             smart_endpoint_key: :token_url
+           }
          }
     test from: :smart_token_exchange
     test from: :smart_token_response_body

data/lib/smart_app_launch/standalone_launch_group_stu2.rb

@@ -31,16 +31,32 @@ module SMARTAppLaunch
 
     config(
       inputs: {
-        use_pkce: {
-          default: 'true',
-          locked: true
-        },
-        pkce_code_challenge_method: {
-          default: 'S256',
-          locked: true
-        },
-        requested_scopes: {
-          default: 'launch/patient openid fhirUser offline_access patient/*.rs'
+        smart_auth_info: {
+          name: :standalone_smart_auth_info,
+          title: 'Standalone Launch Credentials',
+          options: {
+            components: [
+              {
+                name: :requested_scopes,
+                default: 'launch/patient openid fhirUser offline_access patient/*.rs'
+              },
+              {
+                name: :pkce_support,
+                default: 'enabled',
+                locked: true
+              },
+              {
+                name: :pkce_code_challenge_method,
+                default: 'S256',
+                locked: true
+              },
+              Inferno::DSL::AuthInfo.default_auth_type_component_without_backend_services,
+              {
+                name: :use_discovery,
+                locked: true
+              }
+            ]
+          }
         }
       }
     )

data/lib/smart_app_launch/standalone_launch_group_stu2_2.rb

@@ -30,22 +30,6 @@ module SMARTAppLaunch
       * [Standalone Launch Sequence](http://hl7.org/fhir/smart-app-launch/STU2.2/app-launch.html#launch-app-standalone-launch)
     )
 
-    config(
-      inputs: {
-        use_pkce: {
-          default: 'true',
-          locked: true
-        },
-        pkce_code_challenge_method: {
-          default: 'S256',
-          locked: true
-        },
-        requested_scopes: {
-          default: 'launch/patient openid fhirUser offline_access patient/*.rs'
-        }
-      }
-    )
-
     test from: :smart_token_exchange_stu2_2
 
     token_exchange_index = children.find_index { |child| child.id.to_s.end_with? 'token_exchange' }

data/lib/smart_app_launch/tags.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module SMARTAppLaunch
+  TOKEN_TAG = 'token'
+  SMART_TAG = 'smart'
+  ACCESS_TAG = 'access'
+end

data/lib/smart_app_launch/token_exchange_stu2_2_test.rb

@@ -4,26 +4,14 @@ module SMARTAppLaunch
   class TokenExchangeSTU22Test < TokenExchangeSTU2Test
     id :smart_token_exchange_stu2_2
 
-    def add_credentials_to_request(oauth2_params, oauth2_headers)
-      if client_auth_type == 'confidential_symmetric'
-        assert client_secret.present?,
-               'A client secret must be provided when using confidential symmetric client authentication.'
+    input :smart_auth_info, type: :auth_info, options: { mode: 'auth' }
 
-        client_credentials = "#{client_id}:#{client_secret}"
-        oauth2_headers['Authorization'] = "Basic #{Base64.strict_encode64(client_credentials)}"
-      elsif client_auth_type == 'public'
-        oauth2_params[:client_id] = client_id
+    def add_credentials_to_request(oauth2_params, oauth2_headers)
+      if smart_auth_info.public_auth?
+        oauth2_params[:client_id] = smart_auth_info.client_id
         oauth2_headers['Origin'] = Inferno::Application['inferno_host']
       else
-        oauth2_params.merge!(
-          client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
-          client_assertion: ClientAssertionBuilder.build(
-            iss: client_id,
-            sub: client_id,
-            aud: smart_token_url,
-            client_auth_encryption_method:
-          )
-        )
+        super
       end
     end
   end