us_core_test_kit 0.11.2 → 0.11.3

data/lib/us_core_test_kit/client/generator/templates/auth_udap_group.rb.erb

@@ -0,0 +1,31 @@
+require 'udap_security_test_kit'
+require_relative 'tags'
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class ClientAuthUDAPGroup < Inferno::TestGroup
+        id :us_core_client_<%= version %>_auth_udap
+        title 'Review UDAP Authentication Interactions'
+        description %(
+          During these tests, Inferno will verify that the client interacted with Inferno's
+          simulated UDAP authorization server in a conformant manner when requesting access tokens
+          and that the client under test was able to use provided access tokens to make US Core
+          requests.
+        )
+        run_as_group
+
+        test from: :udap_client_authorization_request_verification,
+            id: :us_core_client_<%= version %>_authorization_udap_verification,
+            config: { options: { endpoint_suite_id: :us_core_client_<%= version %> } }
+        test from: :udap_client_token_request_ac_verification,
+            id: :us_core_client_<%= version %>_token_udap_verification,
+            config: { options: { endpoint_suite_id: :us_core_client_<%= version %> } }
+        test from: :udap_client_token_use_verification,
+              config: {
+                options: { access_request_tags: [READ_REQUEST_TAG, SEARCH_REQUEST_TAG] }
+              }
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/authorization_endpoint.rb.erb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'udap_security_test_kit'
+require 'smart_app_launch_test_kit'
+require_relative 'urls'
+require_relative 'tags'
+require_relative '../../us_core_client_options'
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      module MockUdapSmartServer
+        class AuthorizationEndpoint < Inferno::DSL::SuiteEndpoint
+          include SMARTAppLaunch::MockSMARTServer::SMARTAuthorizationResponseCreation
+          include UDAPSecurityTestKit::MockUDAPServer::UDAPAuthorizationResponseCreation
+          include USCoreClientOptions
+
+          def test_run_identifier
+            request.params[:client_id]
+          end
+
+          def suite_options
+            @suite_options ||=
+              Inferno::Repositories::TestSessions.new.find(result.test_session_id)
+                &.suite_options&.map { |so| [so.id, so.value] }&.to_h
+          end
+
+          def make_response
+            if selected_security_ig(suite_options) == UDAPSecurityTestKit::UDAP_TAG
+              make_udap_authorization_response
+            else
+              make_smart_authorization_response
+            end
+          end
+
+          def update_result
+            nil # never update for now
+          end
+
+          def tags
+            tags = [UDAPSecurityTestKit::AUTHORIZATION_TAG, UDAPSecurityTestKit::AUTHORIZATION_CODE_TAG]
+            tags <<
+              if selected_security_ig(suite_options) == UDAPSecurityTestKit::UDAP_TAG
+                UDAPSecurityTestKit::UDAP_TAG
+              else
+                SMARTAppLaunch::SMART_TAG
+              end
+
+            tags
+          end
+        end
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/group.rb.erb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+<%- test_file_list.each do |file_name| -%>
+require_relative '<%= file_name %>'
+<%- end -%>
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class <%= class_name %> < Inferno::TestGroup
+        id :<%= group_id %>
+
+        title '<%= title %>'
+
+        description %(
+          <%= description %>
+        )
+
+        run_as_group
+
+        <%- test_id_list.each do |test| -%>
+        test from: :<%= test %>
+        <%- end -%>
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/read_endpoint.rb.erb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require_relative '../../server_proxy'
+require_relative 'tags'
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class ReadEndpoint < Inferno::DSL::SuiteEndpoint
+        include ServerProxy
+
+        def test_run_identifier
+          UDAPSecurityTestKit::MockUDAPServer.issued_token_to_client_id(
+            request.headers['authorization']&.delete_prefix('Bearer ')
+          )
+        end
+
+        def make_response
+          server_response = proxy_request
+          response.status = server_response.status
+          response.body = server_response.body
+        end
+
+        def proxy_request
+          proxy_client.get("#{resource_type}/#{resource_id}", request_params)
+        end
+
+        def tags
+          [READ_REQUEST_TAG, resource_to_tag(resource_type)]
+        end
+
+        def resource_to_tag(resource)
+          case resource
+            <%- resources.each do |resource| -%>
+            when '<%= resource %>'
+              READ_<%= resource.underscore.upcase %>_TAG
+            <%- end -%>
+          end
+        end
+
+        def resource_id
+          request.params[:resource_id]
+        end
+
+        def resource_type
+          request.params[:resource_type]
+        end
+
+        def request_params
+          request.params.to_h.except(:resource_id, :resource_type).stringify_keys
+        end
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/read_test.rb.erb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class <%= class_name %> < Inferno::Test
+        include TestHelper
+
+        id :<%= test_id %>
+
+        title '<%= title %>'
+
+        description %(
+          <%= description %>
+        )
+
+        def failure_message
+          "Did not receive a request for `<%= resource_type %>` with id: `<%= expected_resource_id %>`."
+        end
+
+        run do
+          requests = load_tagged_requests(READ_<%= resource.underscore.upcase %>_TAG)
+          requests = load_tagged_requests(READ_REQUEST_TAG) if requests.empty?
+          requests_of_type = filter_requests_by_resource_type(requests, '<%= resource_type %>')
+          requests_for_id = filter_requests_by_resource_id(requests_of_type, '<%= expected_resource_id %>')
+          assert requests_for_id.any?, failure_message
+        end
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/registration_configuration_display_test.rb.erb

@@ -0,0 +1,40 @@
+require_relative '../urls'
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class RegistrationConfiguration<%= protocol.upcase %>Display < Inferno::Test
+        include URLs
+
+        id :us_core_client_<%= version %>_reg_config_<%= protocol.downcase %>_display
+        title 'Confirm client configuration'
+        description %(
+          This test provides all the information needed for testers to configure
+          the client under test to communicate with Inferno's simulated US Core server
+          including <%= protocol.upcase %> endpoints to obtain access tokens.
+        )
+
+        input :client_id
+
+        run do
+          wait(
+            identifier: client_id,
+            message: %(
+              **Inferno Simulated Server Details**:
+
+              FHIR Base URL: `#{fhir_url}`
+
+              Authentication Details:
+              - <%= protocol.upcase %> Client Id: `#{client_id}`
+              - Authorization endpoint: `#{authorization_url}`
+              - Token endpoint: `#{token_url}`
+
+              [Click here](#{resume_pass_url}?token=#{client_id}) once you have configured
+              the client to connect to Inferno at the above endpoints.
+            )
+          )
+        end
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/registration_group.rb.erb

@@ -0,0 +1,69 @@
+require 'udap_security_test_kit'
+require 'smart_app_launch_test_kit'
+require_relative '../../us_core_client_options'
+require_relative 'registration/configuration_display_smart_test'
+require_relative 'registration/configuration_display_udap_test'
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class RegistrationGroup < Inferno::TestGroup
+        id :us_core_client_<%= version %>_registration
+        title 'Client Registration'
+        description %(
+          Register the client under test with Inferno's simulated US Core Server,
+          including configuration of the system under test to hit the correct endpoints and
+          enable authentication and authorization of US Core requests.
+        )
+        run_as_group
+
+        # smart registration tests
+        test from: :smart_client_registration_alca_verification,
+              required_suite_options: {
+                client_type: USCoreClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_ASYMMETRIC
+              }
+        test from: :smart_client_registration_alcs_verification,
+              required_suite_options: {
+                client_type: USCoreClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_SYMMETRIC
+              }
+        test from: :smart_client_registration_alp_verification,
+              required_suite_options: {
+                client_type: USCoreClientOptions::SMART_APP_LAUNCH_PUBLIC
+              }
+        test from: :us_core_client_<%= version %>_reg_config_smart_display,
+              id: :us_core_client_<%= version %>_reg_config_smart_alca_display,
+              required_suite_options: {
+                client_type: USCoreClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_ASYMMETRIC
+              }
+        test from: :us_core_client_<%= version %>_reg_config_smart_display,
+              id: :us_core_client_<%= version %>_reg_config_smart_alcs_display,
+              required_suite_options: {
+                client_type: USCoreClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_SYMMETRIC
+              }
+        test from: :us_core_client_<%= version %>_reg_config_smart_display,
+              id: :us_core_client_<%= version %>_reg_config_smart_alp_display,
+              required_suite_options: {
+                client_type: USCoreClientOptions::SMART_APP_LAUNCH_PUBLIC
+              }
+
+        # udap registration tests
+        test from: :udap_client_registration_interaction,
+            id: :us_core_client_<%= version %>_reg_udap_interaction,
+            config: { options: { endpoint_suite_id: :us_core_client_<%= version %> } },
+            required_suite_options: {
+              client_type: USCoreClientOptions::UDAP_AUTHORIZATION_CODE
+            }
+        test from: :udap_client_registration_ac_verification,
+            id: :us_core_client_<%= version %>_reg_udap_verification,
+            config: { options: { endpoint_suite_id: :us_core_client_<%= version %> } },
+            required_suite_options: {
+              client_type: USCoreClientOptions::UDAP_AUTHORIZATION_CODE
+            }
+        test from: :us_core_client_<%= version %>_reg_config_udap_display,
+              required_suite_options: {
+                client_type: USCoreClientOptions::UDAP_AUTHORIZATION_CODE
+              }
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/search_endpoint.rb.erb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require_relative '../../server_proxy'
+require_relative 'tags'
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class SearchEndpoint < Inferno::DSL::SuiteEndpoint
+        include ServerProxy
+
+        def test_run_identifier
+          UDAPSecurityTestKit::MockUDAPServer.issued_token_to_client_id(
+            request.headers['authorization']&.delete_prefix('Bearer ')
+          )
+        end
+
+        def make_response
+          server_response = proxy_request
+          response.status = server_response.status
+          response.body = server_response.body
+        end
+
+        def proxy_request
+          puts request_params
+          proxy_client.get(resource_type, request_params)
+        end
+
+        def tags
+          [SEARCH_REQUEST_TAG, resource_to_tag(resource_type)]
+        end
+
+        def resource_to_tag(resource)
+          case resource
+            <%- resources.each do |resource| -%>
+            when '<%= resource %>'
+              SEARCH_<%= resource.underscore.upcase %>_TAG
+            <%- end -%>
+          end
+        end
+
+        def resource_type
+          request.params[:resource_type]
+        end
+
+        def request_params
+          request.params.to_h.except(:resource_type).stringify_keys
+        end
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/search_test.rb.erb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class <%= class_name %> < Inferno::Test
+        include TestHelper
+
+        id :<%= test_id %>
+
+        title '<%= title %>'
+
+        description %(
+          <%= description %>
+        )
+
+        def required_params
+          <%= search_metadata[:names] %>
+        end
+
+        def failure_message
+          "Did not receive a request for `<%= resource_type %>` with required search parameters: `#{required_params.join(' + ')}`"
+        end
+
+        run do
+          requests = load_tagged_requests(SEARCH_<%= resource.underscore.upcase %>_TAG)
+          requests = load_tagged_requests(SEARCH_REQUEST_TAG) if requests.empty?
+          requests_of_type = filter_requests_by_resource_type(requests, '<%= resource_type %>')
+          requests_with_params = filter_requests_by_search_parameters(requests_of_type, required_params)
+          assert requests_with_params.any?, failure_message
+        end
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/suite.rb.erb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+require 'udap_security_test_kit'
+require 'smart_app_launch_test_kit'
+require_relative '../../../version'
+require_relative 'tags'
+require_relative 'urls'
+require_relative '../../metadata_helper'
+require_relative 'authorization_endpoint'
+require_relative 'token_endpoint'
+require_relative 'read_endpoint'
+require_relative 'search_endpoint'
+require_relative '../../test_helper'
+require_relative '../../us_core_client_options'
+require_relative 'registration_group'
+require_relative 'wait_group'
+require_relative 'auth_smart_alca_group'
+require_relative 'auth_smart_alcs_group'
+require_relative 'auth_smart_alp_group'
+require_relative 'auth_udap_group'
+<%- group_file_list.each do |group| -%>
+require_relative '<%= group %>'
+<%- end -%>
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      class <%= class_name %> < Inferno::TestSuite
+        include URLs
+
+        id :<%= suite_id %>
+
+        title '<%= title %>'
+
+        description %(
+          <%= description %>
+        )
+
+        links [
+          {
+            type: 'report_issue',
+            label: 'Report Issue',
+            url: 'https://github.com/inferno-framework/us-core-test-kit/issues/'
+          },
+          {
+            type: 'source_code',
+            label: 'Open Source',
+            url: 'https://github.com/inferno-framework/us-core-test-kit/'
+          },
+          {
+            type: 'download',
+            label: 'Download',
+            url: 'https://github.com/inferno-framework/us-core-test-kit/releases/'
+          }
+        ]
+
+        suite_option  :client_type,
+                      title: 'Client Security Type',
+                      list_options: [
+                        {
+                          label: 'SMART App Launch Public Client',
+                          value: USCoreClientOptions::SMART_APP_LAUNCH_PUBLIC
+                        },
+                        {
+                          label: 'SMART App Launch Confidential Symmetric Client',
+                          value: USCoreClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_SYMMETRIC
+                        },
+                        {
+                          label: 'SMART App Launch Confidential Asymmetric Client',
+                          value: USCoreClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_ASYMMETRIC
+                        },
+                        {
+                          label: 'UDAP Authorization Code Client',
+                          value: USCoreClientOptions::UDAP_AUTHORIZATION_CODE
+                        }
+                      ]
+
+        route(:get, METADATA_PATH, USCoreTestKit::Client::MetadataHelper.get_metadata('<%= ig_metadata.reformatted_version.downcase %>'))
+        route(:get, UDAPSecurityTestKit::UDAP_DISCOVERY_PATH, lambda { |_env|
+          UDAPSecurityTestKit::MockUDAPServer.udap_server_metadata(id)
+        })
+        route(:get, SMARTAppLaunch::SMART_DISCOVERY_PATH, lambda { |_env|
+          SMARTAppLaunch::MockSMARTServer.smart_server_metadata(id)
+        })
+        route(:get, SMARTAppLaunch::OIDC_DISCOVERY_PATH, ->(_env) {SMARTAppLaunch::MockSMARTServer.openid_connect_metadata(id) }) 
+        route(
+          :get,
+          SMARTAppLaunch::OIDC_JWKS_PATH,
+          ->(_env) { [200, { 'Content-Type' => 'application/json' }, [SMARTAppLaunch::OIDCJWKS.jwks_json]] }
+        )
+
+        suite_endpoint :post, UDAPSecurityTestKit::REGISTRATION_PATH,
+                        UDAPSecurityTestKit::MockUDAPServer::RegistrationEndpoint
+        suite_endpoint :post, UDAPSecurityTestKit::TOKEN_PATH, MockUdapSmartServer::TokenEndpoint
+        suite_endpoint :get,  UDAPSecurityTestKit::AUTHORIZATION_PATH, MockUdapSmartServer::AuthorizationEndpoint
+        suite_endpoint :post, UDAPSecurityTestKit::AUTHORIZATION_PATH, MockUdapSmartServer::AuthorizationEndpoint
+
+        suite_endpoint :post, SEARCH_POST_ROUTE, SearchEndpoint
+        suite_endpoint :get, SEARCH_ROUTE, SearchEndpoint
+        suite_endpoint :get, READ_ROUTE, ReadEndpoint
+
+        resume_test_route :get, RESUME_PASS_ROUTE do |request|
+          request.query_parameters['token']
+        end
+
+        group from: :<%= registration_group_id %>
+
+        group do
+          id :us_core_client_read_search_group_<%= ig_metadata.reformatted_version.downcase %>
+          title 'Read & Search'
+
+          run_as_group
+
+          group from: :<%= wait_group_id %>
+
+          group from: :us_core_client_<%= ig_metadata.reformatted_version.downcase %>_auth_smart_alca,
+              required_suite_options: {
+                client_type: USCoreClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_ASYMMETRIC
+              }
+          group from: :us_core_client_<%= ig_metadata.reformatted_version.downcase %>_auth_smart_alcs,
+                required_suite_options: {
+                  client_type: USCoreClientOptions::SMART_APP_LAUNCH_CONFIDENTIAL_SYMMETRIC
+                }
+          group from: :us_core_client_<%= ig_metadata.reformatted_version.downcase %>_auth_smart_alp,
+                required_suite_options: {
+                  client_type: USCoreClientOptions::SMART_APP_LAUNCH_PUBLIC
+                }
+          group from: :us_core_client_<%= ig_metadata.reformatted_version.downcase %>_auth_udap,
+                required_suite_options: {
+                  client_type: USCoreClientOptions::UDAP_AUTHORIZATION_CODE
+                }
+
+          <%- group_id_list.each do |group| -%>
+          group from: :<%= group %>
+          <%- end -%>
+        end
+      end
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/tags.rb.erb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      # READ tags
+
+      READ_REQUEST_TAG = 'us_core_read_request'
+
+      <%- resources.each do |resource| -%>
+      READ_<%= resource.underscore.upcase %>_TAG = 'us_core_<%= resource.underscore.downcase %>_read'
+      <%- end -%>
+
+      # SEARCH tags
+
+      SEARCH_REQUEST_TAG = 'us_core_search_request'
+
+      <%- resources.each do |resource| -%>
+      SEARCH_<%= resource.underscore.upcase %>_TAG = 'us_core_<%= resource.underscore.downcase %>_search'
+      <%- end -%>
+    end
+  end
+end

data/lib/us_core_test_kit/client/generator/templates/token_endpoint.rb.erb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'udap_security_test_kit'
+require 'smart_app_launch_test_kit'
+require_relative 'urls'
+require_relative 'tags'
+
+module USCoreTestKit
+  module Client
+    module <%= module_name %>
+      module MockUdapSmartServer
+        class TokenEndpoint < Inferno::DSL::SuiteEndpoint
+          include SMARTAppLaunch::MockSMARTServer::SMARTTokenResponseCreation
+          include UDAPSecurityTestKit::MockUDAPServer::UDAPTokenResponseCreation
+          include URLs
+
+          def test_run_identifier
+            case request.params[:grant_type]
+            when UDAPSecurityTestKit::CLIENT_CREDENTIALS_TAG
+              UDAPSecurityTestKit::MockUDAPServer.client_id_from_client_assertion(request.params[:client_assertion])
+            when UDAPSecurityTestKit::AUTHORIZATION_CODE_TAG
+              UDAPSecurityTestKit::MockUDAPServer.issued_token_to_client_id(request.params[:code])
+            when UDAPSecurityTestKit::REFRESH_TOKEN_TAG
+              UDAPSecurityTestKit::MockUDAPServer.issued_token_to_client_id(
+                UDAPSecurityTestKit::MockUDAPServer.refresh_token_to_authorization_code(request.params[:refresh_token])
+              )
+            end
+          end
+
+          def make_response
+            if request.params[:udap].present?
+              case request.params[:grant_type]
+              when UDAPSecurityTestKit::AUTHORIZATION_CODE_TAG
+                make_udap_authorization_code_token_response
+              when UDAPSecurityTestKit::REFRESH_TOKEN_TAG
+                make_udap_refresh_token_response
+              else
+                UDAPSecurityTestKit::MockUDAPServer.update_response_for_invalid_assertion(
+                  response,
+                  "unsupported grant_type: #{request.params[:grant_type]}"
+                )
+              end
+            else
+              suite_options_list = Inferno::Repositories::TestSessions.new.find(result.test_session_id)&.suite_options
+              suite_options_hash = suite_options_list&.map { |option| [option.id, option.value] }&.to_h
+              smart_authentication_approach =
+                SMARTAppLaunch::SMARTClientOptions.smart_authentication_approach(suite_options_hash)
+              
+              case request.params[:grant_type]
+              when SMARTAppLaunch::AUTHORIZATION_CODE_TAG
+                make_smart_authorization_code_token_response(smart_authentication_approach)
+              when SMARTAppLaunch::REFRESH_TOKEN_TAG
+                make_smart_refresh_token_response(smart_authentication_approach)
+              else
+                SMARTAppLaunch::MockSMARTServer.update_response_for_invalid_assertion(
+                  response,
+                  "unsupported grant_type: #{request.params[:grant_type]}"
+                )
+              end
+            end
+          end
+
+          def update_result
+            nil # never update for now
+          end
+
+          def tags
+            tags = [UDAPSecurityTestKit::TOKEN_TAG]
+            tags << (request.params[:udap].present? ? UDAPSecurityTestKit::UDAP_TAG : SMARTAppLaunch::SMART_TAG)
+            if [UDAPSecurityTestKit::CLIENT_CREDENTIALS_TAG, 
+                UDAPSecurityTestKit::AUTHORIZATION_CODE_TAG, 
+                UDAPSecurityTestKit::REFRESH_TOKEN_TAG].include?(request.params[:grant_type])
+              tags << request.params[:grant_type]
+            end
+
+            tags
+          end
+        end
+      end
+    end
+  end
+end