smart_app_launch_test_kit 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 758773637de38a995aa7943da1291685f655e97f829c2e11d7adfc54d129ad42
-  data.tar.gz: b0c2adfcf695418617999e414a0d85766e440e943787d811ffb54218810fee2c
+  metadata.gz: fa36db12fcfc122798d91b90db284ba19912e36f0f9086a8fe193ddcead7417d
+  data.tar.gz: a78b8efce897f363156cfcad7bdcf49279b95da08dd26c4c4b2cc15f6ff424dc
 SHA512:
-  metadata.gz: 9b9aabc2d05bf3b3a3fe49f35fe0be2e634f7c774d86d3d6a0129aa1cd424f1c5cebd03c84c24855445a0baf95ac23c730d614e9f628a946b5ac8d5ca0b6f8fa
-  data.tar.gz: b287eaf62940d60d904af996c0cbbd90d59ba68ce79cdbe6400a20515b9eccb6aa0ff6c094bd07cfd86b928a11c3b6e7e740c896d125c62f5da65a857450ed38
+  metadata.gz: 590164ee28fbcd4d482656268af102328c534315cf55aa193ab55c8b4d4c806bef8735f5abd5ade375f89554849bcf3c6f60fa9206957ee64d6a6d5a491143c0
+  data.tar.gz: 0a779fd7a525a96edb4cc1f0dee37bfe5bc4ca1df772dd07fa92ca95c4f9722c35d81dd63ea4df1d2c038f0b344267be64f5700bf9e80a5f2aedc3514a9c33e9

data/lib/smart_app_launch/app_launch_test.rb

@@ -12,13 +12,23 @@ module SMARTAppLaunch
 
     config options: { launch_uri: "#{Inferno::Application['base_url']}/custom/smart/launch" }
 
+    def wait_message
+      return instance_exec(&config.options[:launch_message_proc]) if config.options[:launch_message_proc].present?
+
+      %(
+        ### #{self.class.parent&.parent&.title}
+
+        Waiting for Inferno to be launched from the EHR.
+
+        Tests will resume once Inferno receives a launch request at
+        `#{config.options[:launch_uri]}` with an `iss` of `#{url}`.
+      )
+    end
+
     run do
       wait(
         identifier: url,
-        message: %(
-          Waiting to receive a request at
-          `#{config.options[:launch_uri]}` with an `iss` of `#{url}`.
-        )
+        message: wait_message
       )
     end
   end

data/lib/smart_app_launch/app_redirect_test.rb

@@ -58,10 +58,17 @@ module SMARTAppLaunch
     end
 
     def wait_message(auth_url)
+      if config.options[:redirect_message_proc].present?
+        return instance_exec(auth_url, &config.options[:redirect_message_proc])
+      end
+
       %(
+        ### #{self.class.parent&.parent&.title}
+
         [Follow this link to authorize with the SMART server](#{auth_url}).
-        Waiting to receive a request at `#{config.options[:redirect_uri]}` with
-        a state of `#{state}`.
+
+        Tests will resume once Inferno receives a request at
+        `#{config.options[:redirect_uri]}` with a state of `#{state}`.
       )
     end
 

data/lib/smart_app_launch/{discovery_group.rb → discovery_stu1_group.rb}

@@ -1,5 +1,8 @@
+require_relative 'well_known_capabilities_stu1_test'
+require_relative 'well_known_endpoint_test'
+
 module SMARTAppLaunch
-  class DiscoveryGroup < Inferno::TestGroup
+  class DiscoverySTU1Group < Inferno::TestGroup
     id :smart_discovery
     title 'SMART on FHIR Discovery'
     short_description 'Retrieve server\'s SMART on FHIR configuration.'
@@ -36,83 +39,10 @@ module SMARTAppLaunch
       * [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html)
     )
 
-    test do
-      title 'FHIR server makes SMART configuration available from well-known endpoint'
-      description %(
-        The authorization endpoints accepted by a FHIR resource server can
-        be exposed as a Well-Known Uniform Resource Identifier
-      )
-      input :url,
-            title: 'FHIR Endpoint',
-            description: 'URL of the FHIR endpoint used by SMART applications'
-      output :well_known_configuration,
-             :well_known_authorization_url,
-             :well_known_introspection_url,
-             :well_known_management_url,
-             :well_known_registration_url,
-             :well_known_revocation_url,
-             :well_known_token_url
-      makes_request :smart_well_known_configuration
-
-      run do
-        well_known_configuration_url = "#{url.chomp('/')}/.well-known/smart-configuration"
-        get(well_known_configuration_url, name: :smart_well_known_configuration)
-
-        assert_response_status(200)
-
-        assert_valid_json(request.response_body)
-
-        config = JSON.parse(request.response_body)
-        output well_known_configuration: request.response_body,
-               well_known_authorization_url: config['authorization_endpoint'],
-               well_known_introspection_url: config['introspection_endpoint'],
-               well_known_management_url: config['management_endpoint'],
-               well_known_registration_url: config['registration_endpoint'],
-               well_known_revocation_url: config['revocation_endpoint'],
-               well_known_token_url: config['token_endpoint']
-
-        content_type = request.response_header('Content-Type')&.value
-
-        assert content_type.present?, 'No `Content-Type` header received.'
-        assert content_type.start_with?('application/json'),
-               "`Content-Type` must be `application/json`, but received: `#{content_type}`"
-      end
-    end
-
-    test do
-      title 'Well-known configuration contains required fields'
-      description %(
-        The JSON from .well-known/smart-configuration contains the following
-        required fields: `authorization_endpoint`, `token_endpoint`,
-        `capabilities`
-      )
-      input :well_known_configuration
-
-      run do
-        skip_if well_known_configuration.blank?, 'No well-known configuration found'
-        config = JSON.parse(well_known_configuration)
-
-        ['authorization_endpoint', 'token_endpoint', 'capabilities'].each do |key|
-          assert config.key?(key), "Well-known configuration does not include `#{key}`"
-          assert config[key].present?, "Well-known configuration field `#{key}` is blank"
-        end
-
-        assert config['authorization_endpoint'].is_a?(String),
-               'Well-known `authorization_endpoint` field must be a string'
-        assert config['token_endpoint'].is_a?(String),
-               'Well-known `token_endpoint` field must be a string'
-        assert config['capabilities'].is_a?(Array),
-               'Well-known `capabilities` field must be an array'
-
-        non_string_capabilities = config['capabilities'].reject { |capability| capability.is_a? String }
-
-        assert non_string_capabilities.blank?, %(
-          Well-known `capabilities` field must be an array of strings, but found
-          non-string values:
-          #{non_string_capabilities.map { |value| "`#{value.nil? ? 'nil' : value}`" }.join(', ')}
-        )
-      end
-    end
+    test from: :well_known_endpoint,
+         id: 'Test01'
+    test from: :well_known_capabilities_stu1,
+         id: 'Test02'
 
     test do
       title 'Conformance/CapabilityStatement provides OAuth 2.0 endpoints'

data/lib/smart_app_launch/discovery_stu2_group.rb

@@ -0,0 +1,50 @@
+require_relative 'well_known_capabilities_stu2_test'
+require_relative 'well_known_endpoint_test'
+
+module SMARTAppLaunch
+  class DiscoverySTU2Group < Inferno::TestGroup
+    id :smart_discovery_stu2
+    title 'SMART on FHIR Discovery'
+    short_description 'Retrieve server\'s SMART on FHIR configuration.'
+    description %(
+      # Background
+
+      The #{title} Sequence test looks for authorization endpoints and SMART
+      capabilities as described by the [SMART App Launch
+      Framework](http://hl7.org/fhir/smart-app-launch/STU2/).
+      The SMART launch framework uses OAuth 2.0 to *authorize* apps, like
+      Inferno, to access certain information on a FHIR server. The
+      authorization service accessed at the endpoint allows users to give
+      these apps permission without sharing their credentials with the
+      application itself. Instead, the application receives an access token
+      which allows it to access resources on the server. The access token
+      itself has a limited lifetime and permission scopes associated with it.
+      A refresh token may also be provided to the application in order to
+      obtain another access token. Unlike access tokens, a refresh token is
+      not shared with the resource server. If OpenID Connect is used, an id
+      token may be provided as well. The id token can be used to
+      *authenticate* the user. The id token is digitally signed and allows the
+      identity of the user to be verified.
+
+      # Test Methodology
+
+      This test suite will examine the SMART on FHIR configuration contained
+      in the `/.well-known/smart-configuration` endpoint.
+
+      For more information see:
+
+      * [SMART App Launch Framework](http://hl7.org/fhir/smart-app-launch/STU2/)
+      * [The OAuth 2.0 Authorization Framework](https://tools.ietf.org/html/rfc6749)
+      * [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html)
+    )
+
+    test from: :well_known_endpoint,
+         config: {
+           outputs: {
+             well_known_authorization_url: { name: :smart_authorization_url },
+             well_known_token_url: { name: :smart_token_url }
+           }
+         }
+    test from: :well_known_capabilities_stu2
+  end
+end

data/lib/smart_app_launch/ehr_launch_group_stu2.rb

@@ -0,0 +1,45 @@
+require_relative 'ehr_launch_group'
+
+module SMARTAppLaunch
+  class EHRLaunchGroupSTU2 < EHRLaunchGroup
+    id :smart_ehr_launch_stu2
+    description %(
+      # Background
+
+      The [EHR
+      Launch](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-ehr-launch)
+      is one of two ways in which an app can be launched, the other being
+      Standalone launch. In an EHR launch, the app is launched from an
+      existing EHR session or portal by a redirect to the registered launch
+      URL. The EHR provides the app two parameters:
+
+      * `iss` - Which contains the FHIR server url
+      * `launch` - An identifier needed for authorization
+
+      # Test Methodology
+
+      Inferno will wait for the EHR server redirect upon execution. When the
+      redirect is received Inferno will check for the presence of the `iss`
+      and `launch` parameters. The security of the authorization endpoint is
+      then checked and authorization is attempted using the provided `launch`
+      identifier.
+
+      For more information on the #{title} see:
+
+      * [SMART EHR Launch Sequence](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-ehr-launch)
+    )
+
+    config(
+      inputs: {
+        use_pkce: {
+          default: 'true',
+          locked: true
+        },
+        pkce_code_challenge_method: {
+          default: 'S256',
+          locked: true
+        }
+      }
+    )
+  end
+end

data/lib/smart_app_launch/smart_stu1_suite.rb

@@ -0,0 +1,154 @@
+require 'tls_test_kit'
+
+require_relative 'version'
+require_relative 'discovery_stu1_group'
+require_relative 'standalone_launch_group'
+require_relative 'ehr_launch_group'
+require_relative 'openid_connect_group'
+require_relative 'token_refresh_group'
+
+module SMARTAppLaunch
+  class SMARTSTU1Suite < Inferno::TestSuite
+    id 'smart'
+    title 'SMART App Launch STU1'
+    version VERSION
+
+    resume_test_route :get, '/launch' do
+      request.query_parameters['iss']
+    end
+
+    resume_test_route :get, '/redirect' do
+      request.query_parameters['state']
+    end
+
+    config options: {
+      redirect_uri: "#{Inferno::Application['base_url']}/custom/smart/redirect",
+      launch_uri: "#{Inferno::Application['base_url']}/custom/smart/launch"
+    }
+
+    group do
+      title 'Standalone Launch'
+      id :smart_full_standalone_launch
+
+      run_as_group
+
+      group from: :smart_discovery
+      group from: :smart_standalone_launch
+
+      group from: :smart_openid_connect,
+            config: {
+              inputs: {
+                id_token: { name: :standalone_id_token },
+                client_id: { name: :standalone_client_id },
+                requested_scopes: { name: :standalone_requested_scopes },
+                access_token: { name: :standalone_access_token },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_standalone_refresh_without_scopes,
+            title: 'SMART Token Refresh Without Scopes',
+            config: {
+              inputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                client_id: { name: :standalone_client_id },
+                client_secret: { name: :standalone_client_secret },
+                received_scopes: { name: :standalone_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                received_scopes: { name: :standalone_received_scopes },
+                access_token: { name: :standalone_access_token },
+                token_retrieval_time: { name: :standalone_token_retrieval_time },
+                expires_in: { name: :standalone_expires_in },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_standalone_refresh_with_scopes,
+            title: 'SMART Token Refresh With Scopes',
+            config: {
+              options: { include_scopes: true },
+              inputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                client_id: { name: :standalone_client_id },
+                client_secret: { name: :standalone_client_secret },
+                received_scopes: { name: :standalone_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                received_scopes: { name: :standalone_received_scopes },
+                access_token: { name: :standalone_access_token },
+                token_retrieval_time: { name: :standalone_token_retrieval_time },
+                expires_in: { name: :standalone_expires_in },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+    end
+
+    group do
+      title 'EHR Launch'
+      id :smart_full_ehr_launch
+
+      run_as_group
+
+      group from: :smart_discovery
+
+      group from: :smart_ehr_launch
+
+      group from: :smart_openid_connect,
+            config: {
+              inputs: {
+                id_token: { name: :ehr_id_token },
+                client_id: { name: :ehr_client_id },
+                requested_scopes: { name: :ehr_requested_scopes },
+                access_token: { name: :ehr_access_token },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_ehr_refresh_without_scopes,
+            title: 'SMART Token Refresh Without Scopes',
+            config: {
+              inputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                client_id: { name: :ehr_client_id },
+                client_secret: { name: :ehr_client_secret },
+                received_scopes: { name: :ehr_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                received_scopes: { name: :ehr_received_scopes },
+                access_token: { name: :ehr_access_token },
+                token_retrieval_time: { name: :ehr_token_retrieval_time },
+                expires_in: { name: :ehr_expires_in },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_ehr_refresh_with_scopes,
+            title: 'SMART Token Refresh With Scopes',
+            config: {
+              options: { include_scopes: true },
+              inputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                client_id: { name: :ehr_client_id },
+                client_secret: { name: :ehr_client_secret },
+                received_scopes: { name: :ehr_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                received_scopes: { name: :ehr_received_scopes },
+                access_token: { name: :ehr_access_token },
+                token_retrieval_time: { name: :ehr_token_retrieval_time },
+                expires_in: { name: :ehr_expires_in },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+    end
+  end
+end

data/lib/smart_app_launch/smart_stu2_suite.rb

@@ -0,0 +1,154 @@
+require 'tls_test_kit'
+
+require_relative 'version'
+require_relative 'discovery_stu2_group'
+require_relative 'standalone_launch_group_stu2'
+require_relative 'ehr_launch_group_stu2'
+require_relative 'openid_connect_group'
+require_relative 'token_refresh_group'
+
+module SMARTAppLaunch
+  class SMARTSTU2Suite < Inferno::TestSuite
+    id 'smart_stu2'
+    title 'SMART App Launch STU2 (Work in Progress)'
+    version VERSION
+
+    resume_test_route :get, '/launch' do
+      request.query_parameters['iss']
+    end
+
+    resume_test_route :get, '/redirect' do
+      request.query_parameters['state']
+    end
+
+    config options: {
+      redirect_uri: "#{Inferno::Application['base_url']}/custom/smart/redirect",
+      launch_uri: "#{Inferno::Application['base_url']}/custom/smart/launch"
+    }
+
+    group do
+      title 'Standalone Launch'
+      id :smart_full_standalone_launch
+
+      run_as_group
+
+      group from: :smart_discovery_stu2
+      group from: :smart_standalone_launch_stu2
+
+      group from: :smart_openid_connect,
+            config: {
+              inputs: {
+                id_token: { name: :standalone_id_token },
+                client_id: { name: :standalone_client_id },
+                requested_scopes: { name: :standalone_requested_scopes },
+                access_token: { name: :standalone_access_token },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_standalone_refresh_without_scopes,
+            title: 'SMART Token Refresh Without Scopes',
+            config: {
+              inputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                client_id: { name: :standalone_client_id },
+                client_secret: { name: :standalone_client_secret },
+                received_scopes: { name: :standalone_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                received_scopes: { name: :standalone_received_scopes },
+                access_token: { name: :standalone_access_token },
+                token_retrieval_time: { name: :standalone_token_retrieval_time },
+                expires_in: { name: :standalone_expires_in },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_standalone_refresh_with_scopes,
+            title: 'SMART Token Refresh With Scopes',
+            config: {
+              options: { include_scopes: true },
+              inputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                client_id: { name: :standalone_client_id },
+                client_secret: { name: :standalone_client_secret },
+                received_scopes: { name: :standalone_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :standalone_refresh_token },
+                received_scopes: { name: :standalone_received_scopes },
+                access_token: { name: :standalone_access_token },
+                token_retrieval_time: { name: :standalone_token_retrieval_time },
+                expires_in: { name: :standalone_expires_in },
+                smart_credentials: { name: :standalone_smart_credentials }
+              }
+            }
+    end
+
+    group do
+      title 'EHR Launch'
+      id :smart_full_ehr_launch
+
+      run_as_group
+
+      group from: :smart_discovery_stu2
+
+      group from: :smart_ehr_launch_stu2
+
+      group from: :smart_openid_connect,
+            config: {
+              inputs: {
+                id_token: { name: :ehr_id_token },
+                client_id: { name: :ehr_client_id },
+                requested_scopes: { name: :ehr_requested_scopes },
+                access_token: { name: :ehr_access_token },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_ehr_refresh_without_scopes,
+            title: 'SMART Token Refresh Without Scopes',
+            config: {
+              inputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                client_id: { name: :ehr_client_id },
+                client_secret: { name: :ehr_client_secret },
+                received_scopes: { name: :ehr_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                received_scopes: { name: :ehr_received_scopes },
+                access_token: { name: :ehr_access_token },
+                token_retrieval_time: { name: :ehr_token_retrieval_time },
+                expires_in: { name: :ehr_expires_in },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+
+      group from: :smart_token_refresh,
+            id: :smart_ehr_refresh_with_scopes,
+            title: 'SMART Token Refresh With Scopes',
+            config: {
+              options: { include_scopes: true },
+              inputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                client_id: { name: :ehr_client_id },
+                client_secret: { name: :ehr_client_secret },
+                received_scopes: { name: :ehr_received_scopes }
+              },
+              outputs: {
+                refresh_token: { name: :ehr_refresh_token },
+                received_scopes: { name: :ehr_received_scopes },
+                access_token: { name: :ehr_access_token },
+                token_retrieval_time: { name: :ehr_token_retrieval_time },
+                expires_in: { name: :ehr_expires_in },
+                smart_credentials: { name: :ehr_smart_credentials }
+              }
+            }
+    end
+  end
+end

data/lib/smart_app_launch/standalone_launch_group_stu2.rb

@@ -0,0 +1,43 @@
+require_relative 'standalone_launch_group'
+
+module SMARTAppLaunch
+  class StandaloneLaunchGroupSTU2 < StandaloneLaunchGroup
+    id :smart_standalone_launch_stu2
+    description %(
+      # Background
+
+      The [Standalone
+      Launch Sequence](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-standalone-launch)
+      allows an app, like Inferno, to be launched independent of an
+      existing EHR session. It is one of the two launch methods described in
+      the SMART App Launch Framework alongside EHR Launch. The app will
+      request authorization for the provided scope from the authorization
+      endpoint, ultimately receiving an authorization token which can be used
+      to gain access to resources on the FHIR server.
+
+      # Test Methodology
+
+      Inferno will redirect the user to the the authorization endpoint so that
+      they may provide any required credentials and authorize the application.
+      Upon successful authorization, Inferno will exchange the authorization
+      code provided for an access token.
+
+      For more information on the #{title}:
+
+      * [Standalone Launch Sequence](http://hl7.org/fhir/smart-app-launch/STU2/app-launch.html#launch-app-standalone-launch)
+    )
+
+    config(
+      inputs: {
+        use_pkce: {
+          default: 'true',
+          locked: true
+        },
+        pkce_code_challenge_method: {
+          default: 'S256',
+          locked: true
+        }
+      }
+    )
+  end
+end

data/lib/smart_app_launch/token_refresh_test.rb

@@ -16,7 +16,7 @@ module SMARTAppLaunch
       the Pragma response header field with a value of no-cache to be
       consistent with the requirements of the inital access token exchange.
     )
-    input :well_known_token_url, :refresh_token, :client_id, :received_scopes
+    input :smart_token_url, :refresh_token, :client_id, :received_scopes
     input :client_secret, optional: true
     output :smart_credentials, :token_retrieval_time
     makes_request :token_refresh
@@ -39,7 +39,7 @@ module SMARTAppLaunch
         oauth2_params['client_id'] = client_id
       end
 
-      post(well_known_token_url, body: oauth2_params, name: :token_refresh, headers: oauth2_headers)
+      post(smart_token_url, body: oauth2_params, name: :token_refresh, headers: oauth2_headers)
 
       assert_response_status(200)
       assert_valid_json(request.response_body)
@@ -54,7 +54,7 @@ module SMARTAppLaunch
                client_id: client_id,
                client_secret: client_secret,
                token_retrieval_time: token_retrieval_time,
-               token_url: well_known_token_url
+               token_url: smart_token_url
              }.to_json
     end
   end

data/lib/smart_app_launch/version.rb

@@ -1,3 +1,3 @@
 module SMARTAppLaunch
-  VERSION = '0.1.3'
+  VERSION = '0.1.4'
 end

data/lib/smart_app_launch/well_known_capabilities_stu1_test.rb

@@ -0,0 +1,39 @@
+module SMARTAppLaunch
+  class WellKnownCapabilitiesSTU1Test < Inferno::Test
+    title 'Well-known configuration contains required fields'
+    id :well_known_capabilities_stu1
+    input :well_known_configuration
+    description %(
+      The JSON from .well-known/smart-configuration contains the following
+      required fields: `authorization_endpoint`, `token_endpoint`,
+      `capabilities`
+    )
+
+    def required_capabilities
+      {
+        'authorization_endpoint' => String,
+        'token_endpoint' => String,
+        'capabilities' => Array
+      }
+    end
+
+    run do
+      skip_if well_known_configuration.blank?, 'No well-known configuration found'
+      config = JSON.parse(well_known_configuration)
+
+      required_capabilities.each do |key, type|
+        assert config.key?(key), "Well-known configuration does not include `#{key}`"
+        assert config[key].present?, "Well-known configuration field `#{key}` is blank"
+        assert config[key].is_a?(type), "Well-known `#{key}` must be type: #{type.to_s.downcase}"
+      end
+
+      non_string_capabilities = config['capabilities'].reject { |capability| capability.is_a? String }
+
+      assert non_string_capabilities.blank?, %(
+        Well-known `capabilities` field must be an array of strings, but found
+        non-string values:
+        #{non_string_capabilities.map { |value| "`#{value.nil? ? 'nil' : value}`" }.join(', ')}
+      )
+    end
+  end
+end

data/lib/smart_app_launch/well_known_capabilities_stu2_test.rb

@@ -0,0 +1,61 @@
+module SMARTAppLaunch
+  class WellKnownCapabilitiesSTU2Test < Inferno::Test
+    title 'Well-known configuration contains required fields'
+    id :well_known_capabilities_stu2
+    input :well_known_configuration
+    description %(
+      The JSON from .well-known/smart-configuration contains the following
+      required fields: `authorization_endpoint`, `token_endpoint`,
+      `capabilities`, `grant_types_supported`, `code_challenge_methods_supported`.
+      If the `sso-openid-connect` capability is supported, then `issuer` and `jwks_uri` must be
+      present. If `sso-openid-connect` capability is not supported, then `issuer` must be omitted.
+    )
+ 
+    def required_capabilities
+      {
+        'authorization_endpoint' => String,
+        'token_endpoint' => String,
+        'capabilities' => Array,
+        'grant_types_supported' => Array,
+        'code_challenge_methods_supported' => Array
+      }
+    end
+
+    run do
+      skip_if well_known_configuration.blank?, 'No well-known configuration found'
+      config = JSON.parse(well_known_configuration)
+
+      required_capabilities.each do |key, type|
+        assert config.key?(key), "Well-known configuration does not include `#{key}`"
+        assert config[key].present?, "Well-known configuration field `#{key}` is blank"
+        assert config[key].is_a?(type), "Well-known `#{key}` must be type: #{type.to_s.downcase}"
+      end
+
+      assert config['grant_types_supported'].include?('authorization_code'),
+           'Well-known `grant_types_supported` must include `authorization_code` grant type to indicate SMART App Launch Support'
+      assert config['code_challenge_methods_supported'].include?('S256'),
+           'Well-known `code_challenge_methods_supported` must include `S256`'
+      assert config['code_challenge_methods_supported'].exclude?('plain'),
+           'Well-known `code_challenge_methods_support` must not include `plain`'
+
+      if config['capabilities'].include?('sso-openid-connect')
+        assert config['issuer'].is_a?(String),
+          'Well-known `issuer` field must be a string and present when server capabilities includes `sso-openid-connect`'
+        assert config['jwks_uri'].is_a?(String),
+          'Well-known `jwks_uri` field must be a string and present when server capabilites includes `sso-openid-coneect`'
+      else
+        warning do
+          assert config['issuer'].nil?, 'Well-known `issuer` is omitted when server capabilites does not include `sso-openid-connect`'
+        end
+      end
+
+      non_string_capabilities = config['capabilities'].reject { |capability| capability.is_a? String }
+
+      assert non_string_capabilities.blank?, %(
+        Well-known `capabilities` field must be an array of strings, but found
+        non-string values:
+        #{non_string_capabilities.map { |value| "`#{value.nil? ? 'nil' : value}`" }.join(', ')}
+      )
+    end
+  end
+end

data/lib/smart_app_launch/well_known_endpoint_test.rb

@@ -0,0 +1,46 @@
+module SMARTAppLaunch
+  class WellKnownEndpointTest < Inferno::Test
+    title 'FHIR server makes SMART configuration available from well-known endpoint'
+    id :well_known_endpoint
+    description %(
+      The authorization endpoints accepted by a FHIR resource server can
+      be exposed as a Well-Known Uniform Resource Identifier
+    )
+    input :url,
+          title: 'FHIR Endpoint',
+          description: 'URL of the FHIR endpoint used by SMART applications'
+    output :well_known_configuration,
+           :well_known_authorization_url,
+           :well_known_introspection_url,
+           :well_known_management_url,
+           :well_known_registration_url,
+           :well_known_revocation_url,
+           :well_known_token_url
+    makes_request :smart_well_known_configuration
+
+    run do
+      well_known_configuration_url = "#{url.chomp('/')}/.well-known/smart-configuration"
+      get(well_known_configuration_url,
+          name: :smart_well_known_configuration,
+          headers: { 'Accept' => 'application/json' })
+      assert_response_status(200)
+
+      assert_valid_json(request.response_body)
+
+      config = JSON.parse(request.response_body)
+      output well_known_configuration: request.response_body,
+             well_known_authorization_url: config['authorization_endpoint'],
+             well_known_introspection_url: config['introspection_endpoint'],
+             well_known_management_url: config['management_endpoint'],
+             well_known_registration_url: config['registration_endpoint'],
+             well_known_revocation_url: config['revocation_endpoint'],
+             well_known_token_url: config['token_endpoint']
+
+      content_type = request.response_header('Content-Type')&.value
+
+      assert content_type.present?, 'No `Content-Type` header received.'
+      assert content_type.start_with?('application/json'),
+             "`Content-Type` must be `application/json`, but received: `#{content_type}`"
+    end
+  end
+end

data/lib/smart_app_launch_test_kit.rb

@@ -1,174 +1,4 @@
 require 'tls_test_kit'
 
-require_relative 'smart_app_launch/version'
-require_relative 'smart_app_launch/discovery_group'
-require_relative 'smart_app_launch/standalone_launch_group'
-require_relative 'smart_app_launch/ehr_launch_group'
-require_relative 'smart_app_launch/openid_connect_group'
-require_relative 'smart_app_launch/token_refresh_group'
-
-# TODO: Remove once this functionality is released in core:
-# https://github.com/inferno-framework/inferno-core/pull/86
-module Inferno
-  module DSL
-    module Runnable
-      def required_inputs(prior_outputs = [])
-        required_inputs =
-          inputs
-            .reject { |input| input_definitions[input][:optional] }
-            .map { |input| config.input_name(input) }
-            .reject { |input| prior_outputs.include?(input) }
-        children_required_inputs = children.flat_map { |child| child.required_inputs(prior_outputs) }
-        prior_outputs.concat(outputs.map { |output| config.output_name(output) })
-        (required_inputs + children_required_inputs).flatten.uniq
-      end
-    end
-  end
-end
-
-module SMARTAppLaunch
-  class SMARTSuite < Inferno::TestSuite
-    id 'smart'
-    title 'SMART App Launch STU1'
-    version VERSION
-
-    resume_test_route :get, '/launch' do
-      request.query_parameters['iss']
-    end
-
-    resume_test_route :get, '/redirect' do
-      request.query_parameters['state']
-    end
-
-    config options: {
-      redirect_uri: "#{Inferno::Application['base_url']}/custom/smart/redirect",
-      launch_uri: "#{Inferno::Application['base_url']}/custom/smart/launch"
-    }
-
-    group do
-      title 'Standalone Launch'
-      id :smart_full_standalone_launch
-
-      run_as_group
-
-      group from: :smart_discovery
-
-      group from: :smart_standalone_launch
-
-      group from: :smart_openid_connect,
-            config: {
-              inputs: {
-                id_token: { name: :standalone_id_token },
-                client_id: { name: :standalone_client_id },
-                requested_scopes: { name: :standalone_requested_scopes },
-                access_token: { name: :standalone_access_token },
-                smart_credentials: { name: :standalone_smart_credentials }
-              }
-            }
-
-      group from: :smart_token_refresh,
-            id: :smart_standalone_refresh_without_scopes,
-            title: 'SMART Token Refresh Without Scopes',
-            config: {
-              inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
-                received_scopes: { name: :standalone_received_scopes }
-              },
-              outputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                received_scopes: { name: :standalone_received_scopes },
-                access_token: { name: :standalone_access_token },
-                token_retrieval_time: { name: :standalone_token_retrieval_time },
-                expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
-              }
-            }
-
-      group from: :smart_token_refresh,
-            id: :smart_standalone_refresh_with_scopes,
-            title: 'SMART Token Refresh With Scopes',
-            config: {
-              options: { include_scopes: true },
-              inputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                client_id: { name: :standalone_client_id },
-                client_secret: { name: :standalone_client_secret },
-                received_scopes: { name: :standalone_received_scopes }
-              },
-              outputs: {
-                refresh_token: { name: :standalone_refresh_token },
-                received_scopes: { name: :standalone_received_scopes },
-                access_token: { name: :standalone_access_token },
-                token_retrieval_time: { name: :standalone_token_retrieval_time },
-                expires_in: { name: :standalone_expires_in },
-                smart_credentials: { name: :standalone_smart_credentials }
-              }
-            }
-    end
-
-    group do
-      title 'EHR Launch'
-      id :smart_full_ehr_launch
-
-      run_as_group
-
-      group from: :smart_discovery
-
-      group from: :smart_ehr_launch
-
-      group from: :smart_openid_connect,
-            config: {
-              inputs: {
-                id_token: { name: :ehr_id_token },
-                client_id: { name: :ehr_client_id },
-                requested_scopes: { name: :ehr_requested_scopes },
-                access_token: { name: :ehr_access_token },
-                smart_credentials: { name: :ehr_smart_credentials }
-              }
-            }
-
-      group from: :smart_token_refresh,
-            id: :smart_ehr_refresh_without_scopes,
-            title: 'SMART Token Refresh Without Scopes',
-            config: {
-              inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
-                received_scopes: { name: :ehr_received_scopes }
-              },
-              outputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                received_scopes: { name: :ehr_received_scopes },
-                access_token: { name: :ehr_access_token },
-                token_retrieval_time: { name: :ehr_token_retrieval_time },
-                expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
-              }
-            }
-
-      group from: :smart_token_refresh,
-            id: :smart_ehr_refresh_with_scopes,
-            title: 'SMART Token Refresh With Scopes',
-            config: {
-              options: { include_scopes: true },
-              inputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                client_id: { name: :ehr_client_id },
-                client_secret: { name: :ehr_client_secret },
-                received_scopes: { name: :ehr_received_scopes }
-              },
-              outputs: {
-                refresh_token: { name: :ehr_refresh_token },
-                received_scopes: { name: :ehr_received_scopes },
-                access_token: { name: :ehr_access_token },
-                token_retrieval_time: { name: :ehr_token_retrieval_time },
-                expires_in: { name: :ehr_expires_in },
-                smart_credentials: { name: :ehr_smart_credentials }
-              }
-            }
-    end
-  end
-end
+require_relative 'smart_app_launch/smart_stu1_suite'
+require_relative 'smart_app_launch/smart_stu2_suite'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: smart_app_launch_test_kit
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: ruby
 authors:
 - Stephen MacVicar
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-05-09 00:00:00.000000000 Z
+date: 2022-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: inferno_core
@@ -134,8 +134,10 @@ files:
 - lib/smart_app_launch/app_launch_test.rb
 - lib/smart_app_launch/app_redirect_test.rb
 - lib/smart_app_launch/code_received_test.rb
-- lib/smart_app_launch/discovery_group.rb
+- lib/smart_app_launch/discovery_stu1_group.rb
+- lib/smart_app_launch/discovery_stu2_group.rb
 - lib/smart_app_launch/ehr_launch_group.rb
+- lib/smart_app_launch/ehr_launch_group_stu2.rb
 - lib/smart_app_launch/launch_received_test.rb
 - lib/smart_app_launch/openid_connect_group.rb
 - lib/smart_app_launch/openid_decode_id_token_test.rb
@@ -145,7 +147,10 @@ files:
 - lib/smart_app_launch/openid_retrieve_jwks_test.rb
 - lib/smart_app_launch/openid_token_header_test.rb
 - lib/smart_app_launch/openid_token_payload_test.rb
+- lib/smart_app_launch/smart_stu1_suite.rb
+- lib/smart_app_launch/smart_stu2_suite.rb
 - lib/smart_app_launch/standalone_launch_group.rb
+- lib/smart_app_launch/standalone_launch_group_stu2.rb
 - lib/smart_app_launch/token_exchange_test.rb
 - lib/smart_app_launch/token_payload_validation.rb
 - lib/smart_app_launch/token_refresh_body_test.rb
@@ -154,6 +159,9 @@ files:
 - lib/smart_app_launch/token_response_body_test.rb
 - lib/smart_app_launch/token_response_headers_test.rb
 - lib/smart_app_launch/version.rb
+- lib/smart_app_launch/well_known_capabilities_stu1_test.rb
+- lib/smart_app_launch/well_known_capabilities_stu2_test.rb
+- lib/smart_app_launch/well_known_endpoint_test.rb
 - lib/smart_app_launch_test_kit.rb
 homepage: https://github.com/inferno_framework/smart-app-launch-test-kit
 licenses: