fhirsmith 0.13.3 → 0.14.0

package/testing/search.js

@@ -0,0 +1,378 @@
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+/**
+ * FHIR search parameter handling for the /testing module.
+ *
+ * Turns a query (as express parses it: repeated parameters arrive as arrays) into SQL
+ * clauses over the reports table. None of the parameters here are formally defined as
+ * SearchParameter resources yet, so the behaviour is simply what this file does:
+ *
+ *   name, tester         string: starts-with, case-insensitive; :exact, :contains, :missing
+ *   status, result       token: exact code (a system| prefix is ignored); :not, :missing
+ *   testscript           uri: exact; :below (starts-with), :missing
+ *   participant          uri of any participant: exact; :below
+ *   score                number: eq ne gt lt ge le sa eb ap, with implicit precision for eq
+ *   issued, _lastUpdated date: eq ne gt lt ge le sa eb ap, compared as ranges
+ *   _id                  exact
+ *   _sort                any of the above (not _id), comma separated, '-' for descending
+ *   _count, _offset      paging; _summary=count for the total alone
+ *
+ * Comma separated values are ORed, repeated parameters are ANDed. Empty values are
+ * ignored, as the spec says. Unknown parameters and modifiers are reported back in
+ * `unknown` so the caller can decide whether to be lenient or strict; values that
+ * can't be understood (a bad date or number) are reported in `errors`, and those are
+ * always an error.
+ *
+ * @module testing/search
+ */
+
+const DEFAULT_COUNT = 50;
+const MAX_COUNT = 500;
+
+// the column each parameter searches, and the one it sorts on
+const PARAMS = {
+  _id: { type: 'id', col: 'r.id' },
+  name: { type: 'string', col: 'r.name', lc: 'r.name_lc', sort: 'r.name_lc' },
+  tester: { type: 'string', col: 'r.tester', lc: 'r.tester_lc', sort: 'r.tester_lc' },
+  status: { type: 'token', col: 'r.status', sort: 'r.status' },
+  result: { type: 'token', col: 'r.result', sort: 'r.result' },
+  testscript: { type: 'uri', col: 'r.test_script', sort: 'r.test_script' },
+  participant: { type: 'participant' },
+  score: { type: 'number', col: 'r.score', sort: 'r.score' },
+  issued: { type: 'date', lo: 'r.issued_lo', hi: 'r.issued_hi', sort: 'r.issued_lo' },
+  _lastUpdated: { type: 'date', lo: 'r.received_ms', hi: '(r.received_ms + 1)', sort: 'r.received_ms' }
+};
+
+const MODIFIERS = {
+  id: [],
+  string: ['exact', 'contains', 'missing'],
+  token: ['not', 'missing'],
+  uri: ['below', 'missing'],
+  participant: ['below'],
+  number: ['missing'],
+  date: []
+};
+
+// parameters that control the search rather than filter it
+const CONTROL = new Set(['_sort', '_count', '_offset', '_summary', '_format', '_total', '_pretty']);
+
+const PREFIXES = ['eq', 'ne', 'gt', 'lt', 'ge', 'le', 'sa', 'eb', 'ap'];
+
+const DATE_RE = /^(\d{4})(?:-(\d{2})(?:-(\d{2})(?:T(\d{2}):(\d{2})(?::(\d{2})(\.\d+)?)?(Z|[+-]\d{2}:\d{2})?)?)?)?$/;
+
+/**
+ * The range of instants a FHIR date, dateTime or instant covers, as [lo, hi) in epoch
+ * milliseconds. "2026" covers the whole year; "2026-09-24T10:00:00.5Z" covers 100ms.
+ * A time with no zone is taken as UTC (FHIR requires a zone, but search values often
+ * leave it off).
+ *
+ * @param {string} value
+ * @returns {{lo: number, hi: number}|null} null if the value isn't a date
+ */
+function dateRange(value) {
+  if (typeof value !== 'string') {
+    return null;
+  }
+  const m = DATE_RE.exec(value.trim());
+  if (!m) {
+    return null;
+  }
+  const [, y, mo, d, h, mi, s, frac, tz] = m;
+  const year = parseInt(y, 10);
+  if (!mo) {
+    return { lo: Date.UTC(year, 0, 1), hi: Date.UTC(year + 1, 0, 1) };
+  }
+  const month = parseInt(mo, 10) - 1;
+  if (month < 0 || month > 11) {
+    return null;
+  }
+  if (!d) {
+    return { lo: Date.UTC(year, month, 1), hi: Date.UTC(year, month + 1, 1) };
+  }
+  const day = parseInt(d, 10);
+  if (day < 1 || day > new Date(Date.UTC(year, month + 1, 0)).getUTCDate()) {
+    return null;
+  }
+  if (!h) {
+    return { lo: Date.UTC(year, month, day), hi: Date.UTC(year, month, day + 1) };
+  }
+  const zone = tz || 'Z';
+  const text = `${y}-${mo}-${d}T${h}:${mi}:${s || '00'}${frac || ''}${zone}`;
+  const lo = Date.parse(text);
+  if (Number.isNaN(lo) || parseInt(h, 10) > 23 || parseInt(mi, 10) > 59 || (s && parseInt(s, 10) > 59)) {
+    return null;
+  }
+  let width;
+  if (!s) {
+    width = 60000;
+  } else if (!frac) {
+    width = 1000;
+  } else {
+    // .5 is 100ms wide, .50 10ms, .500 and beyond 1ms
+    width = Math.max(1, Math.pow(10, 3 - (frac.length - 1)));
+  }
+  return { lo, hi: lo + width };
+}
+
+function splitPrefix(value) {
+  const p = value.substring(0, 2);
+  if (PREFIXES.includes(p) && value.length > 2 && !/^[a-z]/.test(value.substring(2))) {
+    return { prefix: p, rest: value.substring(2) };
+  }
+  return { prefix: 'eq', rest: value };
+}
+
+function escapeLike(value) {
+  return value.replace(/[\\%_]/g, (c) => '\\' + c);
+}
+
+/**
+ * Split a parameter value on commas, honouring \, as an escaped comma.
+ */
+function splitValues(value) {
+  const out = [];
+  let cur = '';
+  for (let i = 0; i < value.length; i++) {
+    const c = value[i];
+    if (c === '\\' && i + 1 < value.length) {
+      cur += value[i + 1];
+      i++;
+    } else if (c === ',') {
+      out.push(cur);
+      cur = '';
+    } else {
+      cur += c;
+    }
+  }
+  out.push(cur);
+  return out.filter(v => v.length > 0);
+}
+
+function dateClause(def, prefix, range) {
+  const { lo, hi } = def;
+  switch (prefix) {
+    case 'eq': return { sql: `(${lo} >= ? AND ${hi} <= ?)`, args: [range.lo, range.hi] };
+    case 'ne': return { sql: `NOT (${lo} >= ? AND ${hi} <= ?)`, args: [range.lo, range.hi] };
+    case 'gt': return { sql: `${hi} > ?`, args: [range.hi] };
+    case 'lt': return { sql: `${lo} < ?`, args: [range.lo] };
+    case 'ge': return { sql: `${hi} > ?`, args: [range.lo] };
+    case 'le': return { sql: `${lo} < ?`, args: [range.hi] };
+    case 'sa': return { sql: `${lo} >= ?`, args: [range.hi] };
+    case 'eb': return { sql: `${hi} <= ?`, args: [range.lo] };
+    case 'ap': return { sql: `(${lo} < ? AND ${hi} > ?)`, args: [range.hi, range.lo] };
+  }
+  return null;
+}
+
+function numberClause(col, prefix, text) {
+  if (!/^[+-]?\d+(\.\d+)?([eE][+-]?\d+)?$/.test(text)) {
+    return null;
+  }
+  const n = Number(text);
+  // implicit precision: "90" means [89.5, 90.5), "90.0" means [89.95, 90.05)
+  const dot = text.split(/[eE]/)[0].split('.')[1];
+  const half = /[eE]/.test(text) ? 0 : 0.5 * Math.pow(10, -(dot ? dot.length : 0));
+  switch (prefix) {
+    case 'eq': return half ? { sql: `(${col} >= ? AND ${col} < ?)`, args: [n - half, n + half] } : { sql: `${col} = ?`, args: [n] };
+    case 'ne': return half ? { sql: `NOT (${col} >= ? AND ${col} < ?)`, args: [n - half, n + half] } : { sql: `${col} <> ?`, args: [n] };
+    case 'gt': case 'sa': return { sql: `${col} > ?`, args: [n] };
+    case 'lt': case 'eb': return { sql: `${col} < ?`, args: [n] };
+    case 'ge': return { sql: `${col} >= ?`, args: [n] };
+    case 'le': return { sql: `${col} <= ?`, args: [n] };
+    case 'ap': {
+      const d = Math.abs(n) * 0.1;
+      return { sql: `(${col} >= ? AND ${col} <= ?)`, args: [n - d, n + d] };
+    }
+  }
+  return null;
+}
+
+function valueClause(def, modifier, value) {
+  switch (def.type) {
+    case 'id':
+      return { sql: `${def.col} = ?`, args: [value] };
+    case 'string': {
+      if (modifier === 'exact') {
+        return { sql: `${def.col} = ?`, args: [value] };
+      }
+      const v = escapeLike(value.toLowerCase());
+      return {
+        sql: `${def.lc} LIKE ? ESCAPE '\\'`,
+        args: [modifier === 'contains' ? `%${v}%` : `${v}%`]
+      };
+    }
+    case 'token': {
+      // system|code - these elements are plain codes, so the system is ignored
+      const code = value.includes('|') ? value.substring(value.indexOf('|') + 1) : value;
+      return { sql: modifier === 'not' ? `(${def.col} IS NULL OR ${def.col} <> ?)` : `${def.col} = ?`, args: [code] };
+    }
+    case 'uri':
+      if (modifier === 'below') {
+        return { sql: `${def.col} LIKE ? ESCAPE '\\'`, args: [escapeLike(value) + '%'] };
+      }
+      return { sql: `${def.col} = ?`, args: [value] };
+    case 'participant':
+      if (modifier === 'below') {
+        return {
+          sql: `EXISTS (SELECT 1 FROM participants p WHERE p.report_id = r.id AND p.uri LIKE ? ESCAPE '\\')`,
+          args: [escapeLike(value) + '%']
+        };
+      }
+      return { sql: 'EXISTS (SELECT 1 FROM participants p WHERE p.report_id = r.id AND p.uri = ?)', args: [value] };
+    case 'number': {
+      const { prefix, rest } = splitPrefix(value);
+      return numberClause(def.col, prefix, rest);
+    }
+    case 'date': {
+      const { prefix, rest } = splitPrefix(value);
+      const range = dateRange(rest);
+      return range ? dateClause(def, prefix, range) : null;
+    }
+  }
+  return null;
+}
+
+function asList(v) {
+  if (v === undefined || v === null) {
+    return [];
+  }
+  return (Array.isArray(v) ? v : [v]).filter(x => typeof x === 'string');
+}
+
+function intParam(v, dflt) {
+  const s = asList(v)[0];
+  if (s === undefined || s === '') {
+    return dflt;
+  }
+  return /^\d+$/.test(s) ? parseInt(s, 10) : NaN;
+}
+
+/**
+ * Parse a search.
+ *
+ * @param {Object} query - parsed query string; values are strings or arrays of strings
+ * @returns {{
+ *   where: string[], args: any[], orderBy: string, count: number, offset: number,
+ *   summaryCount: boolean, used: Array<[string,string]>, sort: string|null,
+ *   unknown: string[], errors: string[]
+ * }}
+ */
+function parseSearch(query) {
+  const result = {
+    where: [], args: [], orderBy: 'r.received_ms DESC, r.rowid DESC', count: DEFAULT_COUNT, offset: 0,
+    summaryCount: false, used: [], sort: null, unknown: [], errors: []
+  };
+  for (const [key, raw] of Object.entries(query || {})) {
+    if (CONTROL.has(key)) {
+      continue;
+    }
+    const colon = key.indexOf(':');
+    const name = colon < 0 ? key : key.substring(0, colon);
+    const modifier = colon < 0 ? null : key.substring(colon + 1);
+    const def = Object.prototype.hasOwnProperty.call(PARAMS, name) ? PARAMS[name] : null;
+    if (!def) {
+      result.unknown.push(key);
+      continue;
+    }
+    if (modifier !== null && !MODIFIERS[def.type].includes(modifier)) {
+      result.unknown.push(key);
+      continue;
+    }
+    for (const value of asList(raw)) {
+      if (value === '') {
+        continue;
+      }
+      if (modifier === 'missing') {
+        if (value !== 'true' && value !== 'false') {
+          result.errors.push(`${key}: '${value}' is not true or false`);
+          continue;
+        }
+        result.where.push(`${def.col} IS ${value === 'true' ? '' : 'NOT '}NULL`);
+        result.used.push([key, value]);
+        continue;
+      }
+      const clauses = [];
+      for (const v of splitValues(value)) {
+        const c = valueClause(def, modifier, v);
+        if (!c) {
+          result.errors.push(`${key}: '${v}' is not a valid ${def.type}`);
+        } else {
+          clauses.push(c);
+        }
+      }
+      if (clauses.length > 0) {
+        result.where.push(clauses.length === 1 ? clauses[0].sql : '(' + clauses.map(c => c.sql).join(' OR ') + ')');
+        for (const c of clauses) {
+          result.args.push(...c.args);
+        }
+        result.used.push([key, value]);
+      }
+    }
+  }
+
+  // _sort
+  const sortSpec = asList(query && query._sort).join(',');
+  if (sortSpec) {
+    const parts = [];
+    for (const item of sortSpec.split(',').map(s => s.trim()).filter(Boolean)) {
+      const desc = item.startsWith('-');
+      const name = desc ? item.substring(1) : item;
+      const def = Object.prototype.hasOwnProperty.call(PARAMS, name) ? PARAMS[name] : null;
+      if (!def || !def.sort) {
+        result.errors.push(`_sort: cannot sort on '${name}'`);
+        continue;
+      }
+      parts.push(`${def.sort} ${desc ? 'DESC' : 'ASC'}`);
+    }
+    if (parts.length > 0) {
+      result.orderBy = parts.join(', ') + ', r.received_ms DESC, r.rowid DESC';
+      result.sort = sortSpec;
+    }
+  }
+
+  const count = intParam(query && query._count, DEFAULT_COUNT);
+  if (Number.isNaN(count)) {
+    result.errors.push('_count must be a non-negative integer');
+  } else {
+    result.count = Math.min(count, MAX_COUNT);
+  }
+  const offset = intParam(query && query._offset, 0);
+  if (Number.isNaN(offset)) {
+    result.errors.push('_offset must be a non-negative integer');
+  } else {
+    result.offset = offset;
+  }
+  result.summaryCount = asList(query && query._summary)[0] === 'count' || result.count === 0;
+  return result;
+}
+
+/**
+ * The search parameters, for the CapabilityStatement.
+ */
+function capabilitySearchParams() {
+  const docs = {
+    _id: 'The logical id of the report',
+    name: 'TestReport.name - starts with, case insensitive; :exact, :contains',
+    tester: 'TestReport.tester - starts with, case insensitive; :exact, :contains',
+    status: 'TestReport.status',
+    result: 'TestReport.result',
+    testscript: 'TestReport.testScript (canonical, or R4 reference); :below for starts with',
+    participant: 'TestReport.participant.uri - any participant; :below for starts with',
+    score: 'TestReport.score',
+    issued: 'TestReport.issued',
+    _lastUpdated: 'When the report was received by this server'
+  };
+  const types = { id: 'token', string: 'string', token: 'token', uri: 'uri', participant: 'uri', number: 'number', date: 'date' };
+  return Object.entries(PARAMS).map(([name, def]) => ({
+    name, type: types[def.type], documentation: docs[name]
+  }));
+}
+
+module.exports = {
+  parseSearch, dateRange, splitValues, capabilitySearchParams,
+  PARAMS, DEFAULT_COUNT, MAX_COUNT
+};

package/testing/store.js

@@ -0,0 +1,266 @@
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+/**
+ * SQLite storage for received TestReports.
+ *
+ * Each report is kept whole, as the JSON that was stored (with the server's id and
+ * meta.lastUpdated), alongside the columns the searches use. Reports are never edited
+ * once received, so there is no versioning. The submitter's IP address is recorded for
+ * tracing abuse, and is never returned by anything in this module.
+ *
+ * @module testing/store
+ */
+
+const Database = require('better-sqlite3');
+const { dateRange } = require('./search');
+
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS reports (
+    id           TEXT PRIMARY KEY,
+    received     TEXT NOT NULL,      -- meta.lastUpdated
+    received_ms  INTEGER NOT NULL,
+    ip           TEXT,               -- never shared
+    name         TEXT NOT NULL,
+    name_lc      TEXT NOT NULL,
+    status       TEXT NOT NULL,
+    result       TEXT NOT NULL,
+    score        REAL,
+    tester       TEXT NOT NULL,
+    tester_lc    TEXT NOT NULL,
+    test_script  TEXT,
+    issued       TEXT NOT NULL,
+    issued_lo    INTEGER NOT NULL,
+    issued_hi    INTEGER NOT NULL,
+    size         INTEGER NOT NULL,
+    json         TEXT NOT NULL
+  );
+
+  CREATE TABLE IF NOT EXISTS participants (
+    report_id    TEXT NOT NULL REFERENCES reports(id) ON DELETE CASCADE,
+    seq          INTEGER NOT NULL,
+    type         TEXT,
+    uri          TEXT NOT NULL,
+    version      TEXT,
+    display      TEXT
+  );
+
+  CREATE INDEX IF NOT EXISTS idx_reports_received ON reports(received_ms);
+  CREATE INDEX IF NOT EXISTS idx_reports_name ON reports(name_lc);
+  CREATE INDEX IF NOT EXISTS idx_reports_tester ON reports(tester_lc);
+  CREATE INDEX IF NOT EXISTS idx_reports_status ON reports(status);
+  CREATE INDEX IF NOT EXISTS idx_reports_result ON reports(result);
+  CREATE INDEX IF NOT EXISTS idx_reports_score ON reports(score);
+  CREATE INDEX IF NOT EXISTS idx_reports_script ON reports(test_script);
+  CREATE INDEX IF NOT EXISTS idx_reports_issued ON reports(issued_lo, issued_hi);
+  CREATE INDEX IF NOT EXISTS idx_participants_report ON participants(report_id);
+  CREATE INDEX IF NOT EXISTS idx_participants_uri ON participants(uri);
+`;
+
+/**
+ * TestReport.testScript is a canonical in R5 and a Reference in R4; either way we want
+ * the URL.
+ */
+function testScriptOf(report) {
+  const ts = report.testScript;
+  if (typeof ts === 'string') {
+    return ts;
+  }
+  if (ts && typeof ts === 'object') {
+    if (typeof ts.reference === 'string') {
+      return ts.reference;
+    }
+    if (ts.identifier && typeof ts.identifier.value === 'string') {
+      return ts.identifier.value;
+    }
+  }
+  return null;
+}
+
+function str(v) {
+  return typeof v === 'string' ? v : null;
+}
+
+class TestReportStore {
+  /**
+   * @param {string} dbPath - file name, or ':memory:'
+   */
+  constructor(dbPath) {
+    this.db = new Database(dbPath);
+    this.db.pragma('journal_mode = WAL');
+    this.db.pragma('foreign_keys = ON');
+    this.db.exec(SCHEMA);
+    // participants.version was added after the first databases were made
+    if (!this.db.prepare('PRAGMA table_info(participants)').all().some(c => c.name === 'version')) {
+      this.db.exec('ALTER TABLE participants ADD COLUMN version TEXT');
+    }
+    this.stmts = {
+      insert: this.db.prepare(`
+        INSERT INTO reports (id, received, received_ms, ip, name, name_lc, status, result, score,
+          tester, tester_lc, test_script, issued, issued_lo, issued_hi, size, json)
+        VALUES (@id, @received, @received_ms, @ip, @name, @name_lc, @status, @result, @score,
+          @tester, @tester_lc, @test_script, @issued, @issued_lo, @issued_hi, @size, @json)`),
+      insertParticipant: this.db.prepare(
+        'INSERT INTO participants (report_id, seq, type, uri, version, display) VALUES (?, ?, ?, ?, ?, ?)'),
+      read: this.db.prepare('SELECT json FROM reports WHERE id = ?'),
+      delete: this.db.prepare('DELETE FROM reports WHERE id = ?'),
+      purge: this.db.prepare('DELETE FROM reports WHERE received_ms < ?'),
+      count: this.db.prepare('SELECT COUNT(*) AS n FROM reports')
+    };
+  }
+
+  close() {
+    if (this.db) {
+      this.db.close();
+      this.db = null;
+    }
+  }
+
+  /**
+   * Store a report that has already been validated and given its id and meta.lastUpdated.
+   *
+   * @param {Object} report
+   * @param {{ip?: string, receivedMs: number}} info
+   */
+  insert(report, info) {
+    const json = JSON.stringify(report);
+    const issued = dateRange(report.issued);
+    const row = {
+      id: report.id,
+      received: report.meta.lastUpdated,
+      received_ms: info.receivedMs,
+      ip: info.ip || null,
+      name: report.name,
+      name_lc: report.name.toLowerCase(),
+      status: report.status,
+      result: report.result,
+      score: typeof report.score === 'number' && Number.isFinite(report.score) ? report.score : null,
+      tester: report.tester,
+      tester_lc: report.tester.toLowerCase(),
+      test_script: testScriptOf(report),
+      issued: report.issued,
+      issued_lo: issued.lo,
+      issued_hi: issued.hi,
+      size: Buffer.byteLength(json, 'utf8'),
+      json
+    };
+    this.db.transaction(() => {
+      this.stmts.insert.run(row);
+      report.participant.forEach((p, i) => {
+        this.stmts.insertParticipant.run(report.id, i, str(p.type), p.uri, str(p.version), str(p.display));
+      });
+    })();
+  }
+
+  /** @returns {Object|null} the stored report */
+  read(id) {
+    const row = this.stmts.read.get(id);
+    return row ? JSON.parse(row.json) : null;
+  }
+
+  /** @returns {boolean} whether there was such a report */
+  delete(id) {
+    return this.stmts.delete.run(id).changes > 0;
+  }
+
+  /** Delete reports received before the given time. @returns {number} how many */
+  purgeBefore(ms) {
+    return this.stmts.purge.run(ms).changes;
+  }
+
+  count() {
+    return this.stmts.count.get().n;
+  }
+
+  /**
+   * Run a parsed search (see search.js).
+   *
+   * @param {Object} search - from parseSearch
+   * @param {{withJson?: boolean}} options - include the stored JSON (FHIR API), or just
+   *   the columns the HTML list needs
+   * @returns {{total: number, rows: Object[]}}
+   */
+  search(search, options = {}) {
+    const where = search.where.length > 0 ? 'WHERE ' + search.where.join(' AND ') : '';
+    const total = this.db.prepare(`SELECT COUNT(*) AS n FROM reports r ${where}`).get(...search.args).n;
+    if (search.summaryCount || search.count === 0) {
+      return { total, rows: [] };
+    }
+    const cols = options.withJson
+      ? 'r.id, r.json'
+      : 'r.id, r.received, r.name, r.status, r.result, r.score, r.tester, r.test_script, r.issued';
+    const rows = this.db.prepare(
+      `SELECT ${cols} FROM reports r ${where} ORDER BY ${search.orderBy} LIMIT ? OFFSET ?`
+    ).all(...search.args, search.count, search.offset);
+    if (!options.withJson && rows.length > 0) {
+      const byId = new Map(rows.map(r => [r.id, r]));
+      for (const r of rows) {
+        r.participants = [];
+      }
+      const ph = rows.map(() => '?').join(',');
+      const parts = this.db.prepare(
+        `SELECT report_id, type, uri, version, display FROM participants WHERE report_id IN (${ph}) ORDER BY report_id, seq`
+      ).all(...rows.map(r => r.id));
+      for (const p of parts) {
+        byId.get(p.report_id).participants.push(p);
+      }
+    }
+    return { total, rows };
+  }
+
+  /** The distinct values in a column, for filter drop-downs. */
+  distinct(column) {
+    if (!['status', 'result'].includes(column)) {
+      throw new Error('Not a filterable column: ' + column);
+    }
+    return this.db.prepare(`SELECT DISTINCT ${column} AS v FROM reports ORDER BY ${column}`).all().map(r => r.v);
+  }
+
+  /**
+   * How many reports each tester has sent, with how they came out, and when the latest
+   * was received. Most reports first.
+   *
+   * @returns {Array<{tester: string, reports: number, pass: number, fail: number, other: number,
+   *   latest: string}>}
+   */
+  testerCounts() {
+    return this.db.prepare(`
+      SELECT tester, COUNT(*) AS reports,
+        SUM(CASE WHEN result = 'pass' THEN 1 ELSE 0 END) AS pass,
+        SUM(CASE WHEN result = 'fail' THEN 1 ELSE 0 END) AS fail,
+        SUM(CASE WHEN result NOT IN ('pass', 'fail') THEN 1 ELSE 0 END) AS other,
+        MAX(received) AS latest
+      FROM reports GROUP BY tester ORDER BY reports DESC, tester_lc`).all();
+  }
+
+  /**
+   * The latest report for each test script against each participant (or tester): the
+   * one with the latest issued date, then the latest received. Test engines are not
+   * participants in this sense - the columns are the things that were tested.
+   *
+   * @param {'participant'|'tester'} by
+   * @returns {Array<{test_script: string|null, col: string, id: string, name: string,
+   *   result: string, score: number|null, issued: string, runs: number}>}
+   */
+  summary(by) {
+    const source = by === 'tester'
+      ? 'SELECT r.*, r.tester AS col FROM reports r'
+      : `SELECT r.*, p.uri AS col FROM reports r
+           JOIN (SELECT DISTINCT report_id, uri FROM participants
+                 WHERE type IS NULL OR type <> 'test-engine') p ON p.report_id = r.id`;
+    return this.db.prepare(`
+      SELECT test_script, col, id, name, result, score, issued, runs FROM (
+        SELECT s.*,
+          COUNT(*) OVER (PARTITION BY s.test_script, s.col) AS runs,
+          ROW_NUMBER() OVER (PARTITION BY s.test_script, s.col
+                             ORDER BY s.issued_lo DESC, s.received_ms DESC) AS rn
+        FROM (${source}) s
+      ) WHERE rn = 1
+      ORDER BY test_script, col`).all();
+  }
+}
+
+module.exports = { TestReportStore, testScriptOf };