fhirsmith 0.14.0 → 0.14.1

package/CHANGELOG.md

@@ -5,6 +5,35 @@ All notable changes to Health Intersections FHIRsmith will be documented in this
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+
+## [0.14.1] - 2026-09-29
+
+### Added
+
+- TestReport module: user administration - the administrator (`adminPassword`) manages users at /testing/admin/users, with rights to edit named links and/or delete reports
+- TestReport module: named links - test script and participant URLs shown by name, maintained at /testing/admin/links
+- TestReport module: the report list shows the test engine, client and server, the number of tests and the run length; a report page shows setup, each test with its operations and assertions, and teardown
+- Test reports from the FHIRsmith build name the test modes they ran with
+
+### Changed
+
+- Security: the publisher and testing web pages require a CSRF token on every form post (lusca), a SameSite=Lax session cookie, and a same-origin `Origin` on posts; the session id is regenerated on login
+- Security: the publisher rate limits task actions (create, approve, delete, retry) and task output reads, as well as logins
+- `server.trustProxy` now defaults to trusting only loopback, link-local and private-network proxies (was `true`, which let anyone reaching the port directly set their own client address and get round the rate limits). See nginx.md - a proxy elsewhere needs to be configured, and the proxy must pass on `Host` or `X-Forwarded-Host`, or form posts are refused
+- $expand: the `displayLanguage` expansion parameter is written without spaces (`en,*;q=0`, not `en, *; q=0`)
+- $translate: `result` is only true if at least one match is a translation - a `not-related-to` (R4: `disjoint`/`unmatched`) or `noMap` match is still returned, but `result` is false
+- SNOMED CT edition names are held in one table (tx/sct/editions.js), used by the provider and the unknown code messages
+
+### Fixed
+
+- $validate-code: when the code is not in the value set, it is looked up in the code system version the value set selects (`compose.include.version`), not the server's default version - so the version and display reported come from the right edition
+- $validate-code: the unknown code message named the SNOMED CT test edition as "unknown"; it is now "Test Edition"
+- Registry: the SNOMED CT test edition (`http://snomed.info/xsct/31000003106`) is labelled, rather than shown as `??`
+
+### Tx Conformance Statement
+
+FHIRsmith passed all 3585 HL7 terminology service tests (modes tx.fhir.org+omop+general+snomed+mimetypes+icd-11+closure, tests v1.9.6, runner v6.10.4)
+
 ## [0.14.0] - 2026-09-27
 
 ### Added

package/config-template.json

@@ -88,6 +88,10 @@
       "cookieSecure": true,
       // failed-login attempts allowed per IP per 15 minutes (default 20)
       "loginAttemptsPerWindow": 20,
+      // per IP address per minute: task actions (create, approve, delete, retry), and reads
+      // of task output, history and QA pages and files
+      "taskActionsPerMinute": 30,
+      "taskReadsPerMinute": 300,
       "workspaceRoot": "/absolute/path/to/workspaces",
       "igPublisherTimeoutMinutes": 60,
       // where to put files the IG Publisher leaves in the web folder that are too big for GitHub
@@ -261,6 +265,13 @@
       "tokenHeader": "Authorization",
       // DELETE of a report needs this token, in the same header. No adminToken, no deletes
       // "adminToken": "<!-- secret -->",
+      // the web administration pages: log in as 'admin' with this password to manage users
+      // (who can edit the named links and/or delete reports). No adminPassword, no administrator
+      // "adminPassword": "<!-- secret -->",
+      // signs the login cookie; without it logins don't survive a restart
+      // "sessionSecret": "<!-- random string -->",
+      // the login cookie is HTTPS-only unless this is false (e.g. for local testing over http)
+      // "cookieSecure": true,
       // bytes
       "maxSize": 512000,
       // reports per IP address per window; max 0 turns the limit off

package/library/languages.js

@@ -562,6 +562,21 @@ class Languages {
     }
     return parts.join(', ');
   }
+
+  /**
+   * The languages as they were asked for, in the form a displayLanguage parameter takes
+   * (the Accept-Language syntax: "en,it;q=0.8,*"). Unlike asString, which is for reading
+   * in messages, there are no spaces; unlike toString, implicit languages are left out.
+   */
+  asParameter() {
+    return this.languages.filter(lang => !lang.implicit).map(lang => {
+      if (lang.quality === undefined || lang.quality === 1.0) {
+        return lang.code;
+      } else {
+        return `${lang.code};q=${lang.quality}`;
+      }
+    }).join(',');
+  }
 }
 
 /**

package/library/same-origin.js

@@ -0,0 +1,62 @@
+/**
+ * Refuse form posts that come from another site (CSRF).
+ *
+ * The session-cookie modules (publisher, testing) take state-changing actions on a POST
+ * from a logged-in browser. A page on another site can make the browser send such a
+ * POST, cookie and all, unless something stops it. Two things do here:
+ *
+ *  - the session cookie is SameSite=Lax, so current browsers leave it off a POST that
+ *    starts on another site;
+ *  - this check: every browser sends an Origin header on a cross-site POST (and on
+ *    same-site ones), so a POST whose Origin names another host is refused, whatever
+ *    the browser did with the cookie.
+ *
+ * A request with no Origin at all (curl, older browsers on same-origin posts) is let
+ * through - it can't be a browser being driven by another site's page. Behind a proxy,
+ * the proxy must pass on Host or X-Forwarded-Host, or every post is refused.
+ *
+ * @module library/same-origin
+ */
+
+const SAFE = new Set(['GET', 'HEAD', 'OPTIONS']);
+
+/**
+ * Is this request allowed by the same-origin rule?
+ * @param {import('express').Request} req
+ * @returns {boolean}
+ */
+function isSameOrigin(req) {
+  if (SAFE.has(req.method)) {
+    return true;
+  }
+  const origin = req.get('Origin');
+  if (!origin) {
+    return true;
+  }
+  let host;
+  try {
+    // "null" (a sandboxed page, a file: URL, some redirects) does not parse, and is refused
+    host = new URL(origin).host;
+  } catch {
+    return false;
+  }
+  return host === req.get('host') || host === req.get('x-forwarded-host');
+}
+
+/**
+ * Middleware that refuses cross-site requests that change things.
+ * @param {function(req, res): void} [reject] - sends the refusal; default a plain 403
+ */
+function requireSameOrigin(reject) {
+  return (req, res, next) => {
+    if (isSameOrigin(req)) {
+      return next();
+    }
+    if (reject) {
+      return reject(req, res);
+    }
+    res.status(403).type('text/plain').send('Cross-site form posts are not accepted');
+  };
+}
+
+module.exports = { isSameOrigin, requireSameOrigin };

package/nginx.md

@@ -13,13 +13,13 @@ public servers (tx.fhir.org, packages.fhir.org and so on) use.
 
 ### Headers to pass to the server
 
-FHIRsmith runs Express with `trust proxy` enabled (`server.trustProxy` in config.json,
-default `true`). That means it takes the client address, scheme and host from the
-`X-Forwarded-*` headers, so nginx has to set them:
+FHIRsmith runs Express with `trust proxy` enabled (`server.trustProxy` in config.json; by
+default it trusts proxies on the same host or a private network). That means it takes the
+client address, scheme and host from the `X-Forwarded-*` headers, so nginx has to set them:
 
 | Header | nginx value | What FHIRsmith uses it for |
 |---|---|---|
-| `Host` | `$host` | The base URL in the CapabilityStatement, TerminologyCapabilities and other self-references. It is taken from the host the client asked for |
+| `Host` | `$host` | The base URL in the CapabilityStatement, TerminologyCapabilities and other self-references. It is taken from the host the client asked for. The publisher and testing modules also check the `Origin` of every form post against it, and refuse posts from anywhere else - so if nginx sends a different `Host` (e.g. `proxy_pass` with the default `$proxy_host`), every login and form fails with a 403 |
 | `X-Forwarded-Proto` | `$scheme` | The scheme of those same base URLs, and the `Secure` session cookie used by the publisher and token modules. If this header is missing, an HTTPS server advertises `http://` URLs and publisher login fails silently: you are sent back to the login page, still logged out |
 | `X-Forwarded-For` | `$proxy_add_x_forwarded_for` | The client IP address in audit and security logs (`req.ip`). If this header is missing, every request is logged as coming from `127.0.0.1` |
 | `X-Request-Id` | `$request_id` | Optional. FHIRsmith echoes it back on the response, so a client's report can be matched to a line in the nginx log (add `$request_id` to your `log_format`) |
@@ -49,11 +49,19 @@ them:
 
 ### Trusting the proxy
 
-With `trustProxy: true`, anyone who can reach the FHIRsmith port directly can forge
-`X-Forwarded-For`. FHIRsmith listens on all interfaces, so firewall the port so that only
-nginx can reach it. You can also set `server.trustProxy` to `"loopback"`, or to the proxy's
-address; any value that Express's `trust proxy` setting accepts will work. If you run
-FHIRsmith without a proxy, set it to `false`.
+By default FHIRsmith believes the `X-Forwarded-*` headers only when the request comes from
+a loopback, link-local or private address (`"loopback, linklocal, uniquelocal"`) - nginx on
+the same machine, or on the same docker or private network. A request straight from the
+internet can't set its own client address, so it can't get round the rate limits on logins,
+report submission and the publisher's task actions.
+
+If your proxy is somewhere else (a cloud load balancer with a public address, say), set
+`server.trustProxy` to its address, or to the number of proxy hops; any value Express's
+`trust proxy` setting accepts will work. If you run FHIRsmith without a proxy, set it to
+`false`. Avoid `true`: it believes any `X-Forwarded-For`, so anyone who can reach the
+FHIRsmith port directly can name their own IP address, and express-rate-limit logs
+`ERR_ERL_PERMISSIVE_TRUST_PROXY` to say so. Either way, firewalling the port so that only
+nginx can reach it is still a good idea.
 
 ### Upstream connections
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fhirsmith",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "txVersion": "1.9.5-SNAPSHOT",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",

package/publisher/publisher-template.html

@@ -91,6 +91,7 @@
             <a href="/publisher" style="color: gold">Publisher Home</a> &nbsp;|&nbsp;
             <a href="/publisher/tasks" style="color: gold">Tasks</a> &nbsp;|&nbsp;
             <form method="[%loginAction%]" action="/publisher/[%loginPath%]" style="display:inline">
+                <input type="hidden" name="_csrf" value="[%csrfToken%]"/>
                 <button type="submit" style="background:none; border:none; color:gold; cursor:pointer; font:inherit; padding:0">[%loginTitle%]</button>
             </form>
         </div>  <!-- /container -->

package/publisher/publisher.js

@@ -7,10 +7,12 @@ const githubRelease = require('./github-release');
 const Database = require('sqlite3').Database;
 const bcrypt = require('bcrypt');
 const session = require('express-session');
+const lusca = require('lusca');
 const rateLimit = require('express-rate-limit');
 const crypto = require('crypto');
 const folders = require('../library/folder-setup');
 const escape = require('escape-html');
+const { requireSameOrigin } = require('../library/same-origin');
 const {Utilities} = require("../library/utilities");
 
 // GitHub refuses any file larger than this at the pre-receive hook, and the rejection takes down
@@ -59,14 +61,29 @@ class PublisherModule {
         // plain HTTP - without it the browser will not send the cookie back and login
         // appears to succeed and then silently do nothing.
         secure: this.config.cookieSecure ?? true,
+        // CSRF: the browser leaves the cookie off a POST that starts on another site. That,
+        // with the Origin check below, is what stops another site's page from driving a
+        // logged-in browser to create, approve or delete tasks, or to add users
+        sameSite: 'lax',
+        httpOnly: true,
         maxAge: 24 * 60 * 60 * 1000 // 24 hours
       }
       // Not using SQLiteStore to avoid the database conflict
     }));
 
+    // every POST must come from one of our own pages - see library/same-origin.js
+    this.router.use(requireSameOrigin());
+
     // Parse form data
     this.router.use(express.urlencoded({ extended: true }));
 
+    // CSRF tokens (lusca): every form carries the session's token in a hidden _csrf field,
+    // and every POST route has this.csrf in it, written out so static analysis can see it.
+    // Pages only make a token for someone logged in (making one stores a secret in the
+    // session, and anonymous visitors should not get sessions); the login page always does
+    this.csrf = lusca.csrf({ key: '_csrf' });
+    this.csrfIfLoggedIn = (req, res, next) => req.session && req.session.userId ? this.csrf(req, res, next) : next();
+
     // Set up routes
     this.setupRoutes();
 
@@ -308,7 +325,7 @@ class PublisherModule {
 
   setupRoutes() {
     // Main dashboard
-    this.router.get('/', this.renderDashboard.bind(this));
+    this.router.get('/', this.csrfIfLoggedIn, this.renderDashboard.bind(this));
 
     // Authentication. The login post is rate limited: besides slowing down guessing, it
     // is the one unauthenticated route that runs bcrypt, and bcrypt.compare holds a libuv
@@ -322,20 +339,39 @@ class PublisherModule {
       legacyHeaders: false
     });
 
-    this.router.get('/login', this.renderLogin.bind(this));
-    this.router.post('/login', loginLimiter, this.handleLogin.bind(this));
-    this.router.post('/logout', this.handleLogout.bind(this));
+    // Task actions delete build output from disk or queue new builds: a logged-in user can't
+    // be allowed to hammer them either
+    const taskActionLimiter = rateLimit({
+      windowMs: 60 * 1000,
+      max: this.config.taskActionsPerMinute ?? 30,
+      message: 'Too many task actions, please try again later.',
+      standardHeaders: true,
+      legacyHeaders: false
+    });
+
+    // the task pages read build logs and QA output from disk
+    const taskReadLimiter = rateLimit({
+      windowMs: 60 * 1000,
+      max: this.config.taskReadsPerMinute ?? 300,
+      message: 'Too many requests, please try again later.',
+      standardHeaders: true,
+      legacyHeaders: false
+    });
+
+    this.router.get('/login', this.csrf, this.renderLogin.bind(this));
+    this.router.post('/login', loginLimiter, this.csrf, this.handleLogin.bind(this));
+    this.router.post('/logout', this.csrf, this.handleLogout.bind(this));
 
     // Tasks
-    this.router.get('/tasks', this.renderTasks.bind(this));
-    this.router.post('/tasks', this.requireAuth.bind(this), this.createTask.bind(this));
-    this.router.post('/tasks/:id/approve', this.requireAuth.bind(this), this.approveTask.bind(this));
-    this.router.post('/tasks/:id/delete', this.requireAuth.bind(this), this.deleteTask.bind(this));
-    this.router.post('/tasks/:id/retry', this.requireAuth.bind(this), this.retryTask.bind(this));
-    this.router.get('/tasks/:id/output', this.getTaskOutput.bind(this));
-    this.router.get('/tasks/:id/history', this.getTaskHistory.bind(this));
-    this.router.get('/tasks/:id/qa', this.getTaskQA.bind(this));
-    this.router.use('/tasks/:id/qa-files', (req, res, next) => {
+    this.router.get('/tasks', this.csrfIfLoggedIn, this.renderTasks.bind(this));
+    this.router.post('/tasks', taskActionLimiter, this.csrf, this.requireAuth.bind(this), this.createTask.bind(this));
+    this.router.post('/tasks/:id/approve', taskActionLimiter, this.csrf, this.requireAuth.bind(this), this.approveTask.bind(this));
+    this.router.post('/tasks/:id/delete', taskActionLimiter, this.csrf, this.requireAuth.bind(this), this.deleteTask.bind(this));
+    this.router.post('/tasks/:id/retry', taskActionLimiter, this.csrf, this.requireAuth.bind(this), this.retryTask.bind(this));
+    this.router.get('/tasks/:id/output', taskReadLimiter, this.csrfIfLoggedIn, this.getTaskOutput.bind(this));
+    this.router.get('/tasks/:id/history', taskReadLimiter, this.csrfIfLoggedIn, this.getTaskHistory.bind(this));
+    this.router.get('/tasks/:id/qa', taskReadLimiter, this.csrfIfLoggedIn, this.getTaskQA.bind(this));
+    this.router.use('/tasks/:id/qa-files', taskReadLimiter, (req, res, next) => {
       const taskId = req.params.id;
       this.getTask(taskId).then(task => {
         if (!task || !task.local_folder) {
@@ -347,13 +383,27 @@ class PublisherModule {
     });
 
     // Admin routes
-    this.router.get('/admin/websites', this.requireAdmin.bind(this), this.renderWebsites.bind(this));
-    this.router.post('/admin/websites', this.requireAdmin.bind(this), this.createWebsite.bind(this));
-    this.router.get('/admin/websites/:id/edit', this.requireAdmin.bind(this), this.renderEditWebsite.bind(this));
-    this.router.post('/admin/websites/:id/edit', this.requireAdmin.bind(this), this.updateWebsite.bind(this));
-    this.router.get('/admin/users', this.requireAdmin.bind(this), this.renderUsers.bind(this));
-    this.router.post('/admin/users', this.requireAdmin.bind(this), this.createUser.bind(this));
-    this.router.post('/admin/permissions', this.requireAdmin.bind(this), this.updatePermissions.bind(this));
+    this.router.get('/admin/websites', this.csrf, this.requireAdmin.bind(this), this.renderWebsites.bind(this));
+    this.router.post('/admin/websites', this.csrf, this.requireAdmin.bind(this), this.createWebsite.bind(this));
+    this.router.get('/admin/websites/:id/edit', this.csrf, this.requireAdmin.bind(this), this.renderEditWebsite.bind(this));
+    this.router.post('/admin/websites/:id/edit', this.csrf, this.requireAdmin.bind(this), this.updateWebsite.bind(this));
+    this.router.get('/admin/users', this.csrf, this.requireAdmin.bind(this), this.renderUsers.bind(this));
+    this.router.post('/admin/users', this.csrf, this.requireAdmin.bind(this), this.createUser.bind(this));
+    this.router.post('/admin/permissions', this.csrf, this.requireAdmin.bind(this), this.updatePermissions.bind(this));
+
+    // lusca rejects a post with a missing or wrong token by passing on an error
+    this.router.use((err, req, res, next) => {
+      if (err && typeof err.message === 'string' && err.message.startsWith('CSRF token')) {
+        return res.status(403).type('text/plain').send('The form has expired or did not come from this site - go back, reload the page and try again');
+      }
+      next(err);
+    });
+  }
+
+  /** The hidden field every POST form carries: the session's CSRF token. */
+  csrfField(res) {
+    const token = res.locals && res.locals._csrf;
+    return token ? '<input type="hidden" name="_csrf" value="' + escape(token) + '">' : '';
   }
 
   // Background Task Processing
@@ -1476,7 +1526,7 @@ class PublisherModule {
             content += '<a href="/publisher/admin/websites" class="btn btn-secondary me-2">Manage Websites</a>';
             content += '<a href="/publisher/admin/users" class="btn btn-secondary">Manage Users</a>';
           }
-          content += '<form style="display: inline-block; margin-left: 10px;" method="post" action="/publisher/logout">';
+          content += '<form style="display: inline-block; margin-left: 10px;" method="post" action="/publisher/logout">' + this.csrfField(res);
           content += '<button type="submit" class="btn btn-outline-secondary">' + escape(req.session.userName) + ' \u2014 Logout</button>';
           content += '</form>';
           content += '</div>';
@@ -1517,7 +1567,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }
         });
 
@@ -1541,7 +1591,7 @@ class PublisherModule {
       let content = '<div class="row justify-content-center">';
       content += '<div class="col-md-6">';
       content += '<h3>Login</h3>';
-      content += '<form method="post" action="/publisher/login">';
+      content += '<form method="post" action="/publisher/login">' + this.csrfField(res);
       content += '<div class="mb-3">';
       content += '<label for="login" class="form-label">Username</label>';
       content += '<input type="text" class="form-control" id="login" name="login" required>';
@@ -1559,7 +1609,7 @@ class PublisherModule {
         templateVars: {
           loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
           loginPath: req.session.userId ? "logout" : 'login',
-          loginAction: req.session.userId ? "POST" : 'GET'
+          loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
         }});
       res.setHeader('Content-Type', 'text/html');
       res.send(html);
@@ -1595,6 +1645,9 @@ class PublisherModule {
           return res.redirect('/publisher/login?error=invalid');
         }
 
+        // a new session id on login, so an id planted in the browser before login
+        // (session fixation) does not become a logged-in session
+        await new Promise((resolve, reject) => req.session.regenerate(e => e ? reject(e) : resolve()));
         req.session.userId = user.id;
         req.session.userName = user.name;
         req.session.isAdmin = user.is_admin;
@@ -1640,7 +1693,7 @@ class PublisherModule {
           content += '<button class="btn btn-primary" onclick="document.getElementById(\'create-task-panel\').style.display = document.getElementById(\'create-task-panel\').style.display === \'none\' ? \'block\' : \'none\'">New Publication Task</button>';
           content += '<div id="create-task-panel" style="display: none;" class="mt-3">';
           content += '<h3>Create New Publication Task</h3>';
-          content += '<form id="create-task-form" method="post" action="/publisher/tasks" class="row g-3">';
+          content += '<form id="create-task-form" method="post" action="/publisher/tasks" class="row g-3">' + this.csrfField(res);
           content += '<div class="col-md-3">';
           content += '<label for="website_id" class="form-label">Target Website</label>';
           content += '<select class="form-select" id="website_id" name="website_id" required>';
@@ -1718,7 +1771,7 @@ class PublisherModule {
               content += '<a href="/publisher/tasks/' + task.id + '/qa-files/index.html" class="btn btn-sm btn-outline-secondary me-1">View IG</a>';
               content += '<a href="/publisher/tasks/' + task.id + '/qa" class="btn btn-sm btn-outline-secondary me-1">View QA</a>';
               if (canApprove) {
-                content += '<form method="post" action="/publisher/tasks/' + task.id + '/approve" style="display: inline;">';
+                content += '<form method="post" action="/publisher/tasks/' + task.id + '/approve" style="display: inline;">' + this.csrfField(res);
                 content += '<button type="submit" name="approve" class="btn btn-sm btn-success me-1">Approve</button>';
                 content += '</form>';
               }
@@ -1735,13 +1788,13 @@ class PublisherModule {
             }
 
             if (canDelete) {
-              content += '<form method="post" action="/publisher/tasks/' + task.id + '/delete" style="display: inline;" onsubmit="return confirm(\'Delete task #' + task.id + ' and all its build output? This cannot be undone.\')">';
+              content += '<form method="post" action="/publisher/tasks/' + task.id + '/delete" style="display: inline;" onsubmit="return confirm(\'Delete task #' + task.id + ' and all its build output? This cannot be undone.\')">' + this.csrfField(res);
               content += '<button type="submit" class="btn btn-sm btn-danger">Delete</button>';
               content += '</form>';
             }
 
             if (req.session.userId && task.status === 'failed') {
-              content += ' <form method="post" action="/publisher/tasks/' + task.id + '/retry" style="display: inline;">';
+              content += ' <form method="post" action="/publisher/tasks/' + task.id + '/retry" style="display: inline;">' + this.csrfField(res);
               content += '<button type="submit" class="btn btn-sm btn-warning">Retry</button>';
               content += '</form>';
             }
@@ -1761,7 +1814,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }});
         res.setHeader('Content-Type', 'text/html');
         res.send(html);
@@ -1951,7 +2004,7 @@ class PublisherModule {
         res.redirect('/publisher/tasks');
       } catch (error) {
         this.logger.error('Error deleting task:', error);
-        res.status(500).send('Failed to delete task: ' + error.message);
+        res.status(500).type('text/plain').send('Failed to delete task: ' + escape(error.message));
       }
     } finally {
       this.stats.countRequest('delete-task', Date.now() - start);
@@ -1982,7 +2035,7 @@ class PublisherModule {
         res.redirect('/publisher/tasks/' + newTaskId + '/history');
       } catch (error) {
         this.logger.error('Error retrying task:', error);
-        res.status(500).send('Failed to retry task: ' + error.message);
+        res.status(500).type('text/plain').send('Failed to retry task: ' + escape(error.message));
       }
     } finally {
       this.stats.countRequest('retry-task', Date.now() - start);
@@ -2093,7 +2146,7 @@ class PublisherModule {
             templateVars: {
               loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
               loginPath: req.session.userId ? "logout" : 'login',
-              loginAction: req.session.userId ? "POST" : 'GET'
+              loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
             }});
           res.setHeader('Content-Type', 'text/html');
           res.send(html);
@@ -2310,7 +2363,7 @@ class PublisherModule {
           content += '<a href="/publisher/tasks/' + task.id + '/qa" class="btn btn-outline-secondary me-2">View QA Report</a>';
         }
         if (req.session.userId && task.status === 'failed') {
-          content += '<form method="post" action="/publisher/tasks/' + task.id + '/retry" style="display: inline;" class="me-2">';
+          content += '<form method="post" action="/publisher/tasks/' + task.id + '/retry" style="display: inline;" class="me-2">' + this.csrfField(res);
           content += '<button type="submit" class="btn btn-warning">Retry</button>';
           content += '</form>';
         }
@@ -2324,7 +2377,7 @@ class PublisherModule {
             (detailIsPostApprovalFailed && req.session.isAdmin)
         );
         if (detailCanDelete) {
-          content += '<form method="post" action="/publisher/tasks/' + task.id + '/delete" style="display: inline;" class="me-2" onsubmit="return confirm(\'Delete task #' + task.id + ' and all its build output? This cannot be undone.\')">';
+          content += '<form method="post" action="/publisher/tasks/' + task.id + '/delete" style="display: inline;" class="me-2" onsubmit="return confirm(\'Delete task #' + task.id + ' and all its build output? This cannot be undone.\')">' + this.csrfField(res);
           content += '<button type="submit" class="btn btn-danger">Delete</button>';
           content += '</form>';
         }
@@ -2335,7 +2388,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }});
         res.setHeader('Content-Type', 'text/html');
         res.send(html);
@@ -2356,7 +2409,7 @@ class PublisherModule {
       if (!website) return res.status(404).send('Website not found');
 
       let content = '<h3>Edit Website</h3>';
-      content += '<form method="post" action="/publisher/admin/websites/' + website.id + '/edit" class="row g-3">';
+      content += '<form method="post" action="/publisher/admin/websites/' + website.id + '/edit" class="row g-3">' + this.csrfField(res);
       content += '<div class="col-md-4"><label class="form-label">Website Name</label>';
       content += '<input type="text" class="form-control" name="name" value="' + escape(website.name) + '" required></div>';
       content += '<div class="col-md-4"><label class="form-label">Local Folder</label>';
@@ -2376,7 +2429,7 @@ class PublisherModule {
       content += '</form>';
 
       const html = htmlServer.renderPage('publisher', 'Edit Website - FHIR Publisher', content, {
-        templateVars: { loginTitle: (req.session.userName || '') + ' \u2014 Logout', loginPath: 'logout', loginAction: 'POST' }
+        templateVars: { loginTitle: (req.session.userName || '') + ' \u2014 Logout', loginPath: 'logout', loginAction: 'POST', csrfToken: res.locals._csrf || '' }
       });
       res.setHeader('Content-Type', 'text/html');
       res.send(html);
@@ -2427,7 +2480,7 @@ class PublisherModule {
         content += '<button class="btn btn-primary" onclick="document.getElementById(\'add-website-panel\').style.display = document.getElementById(\'add-website-panel\').style.display === \'none\' ? \'block\' : \'none\'">Add New Website</button>';
         content += '<div id="add-website-panel" style="display: none;" class="mt-3">';
         content += '<h3>Add New Website</h3>';
-        content += '<form method="post" action="/publisher/admin/websites" class="row g-3">';
+        content += '<form method="post" action="/publisher/admin/websites" class="row g-3">' + this.csrfField(res);
         content += '<div class="col-md-4">';
         content += '<label for="name" class="form-label">Website Name</label>';
         content += '<input type="text" class="form-control" id="name" name="name" required>';
@@ -2496,7 +2549,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }});
         res.setHeader('Content-Type', 'text/html');
         res.send(html);
@@ -2556,7 +2609,7 @@ class PublisherModule {
         content += '<button class="btn btn-primary" onclick="document.getElementById(\'add-user-panel\').style.display = document.getElementById(\'add-user-panel\').style.display === \'none\' ? \'block\' : \'none\'">Add New User</button>';
         content += '<div id="add-user-panel" style="display: none;" class="mt-3">';
         content += '<h3>Add New User</h3>';
-        content += '<form method="post" action="/publisher/admin/users" class="row g-3">';
+        content += '<form method="post" action="/publisher/admin/users" class="row g-3">' + this.csrfField(res);
         content += '<div class="col-md-3">';
         content += '<label for="name" class="form-label">Full Name</label>';
         content += '<input type="text" class="form-control" id="name" name="name" required>';
@@ -2601,7 +2654,7 @@ class PublisherModule {
             if (websites.length === 0) {
               content += '<p>No websites available for permission assignment.</p>';
             } else {
-              content += '<form method="post" action="/publisher/admin/permissions">';
+              content += '<form method="post" action="/publisher/admin/permissions">' + this.csrfField(res);
               content += '<input type="hidden" name="user_id" value="' + user.id + '">';
               content += '<div class="permission-grid">';
               content += '<div><strong>Website</strong></div>';
@@ -2638,7 +2691,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }});
         res.setHeader('Content-Type', 'text/html');
         res.send(html);

package/registry/registry.js

@@ -721,7 +721,8 @@ class RegistryModule {
    * @returns {string} Formatted URL with edition description
    */
   _describeSnomedEdition(url) {
-    if (!url.startsWith('http://snomed.info/sct')) {
+    // the test edition is published under xsct (http://snomed.info/xsct/31000003106/...)
+    if (!url.startsWith('http://snomed.info/sct') && !url.startsWith('http://snomed.info/xsct')) {
       return url;
     }
 
@@ -745,6 +746,7 @@ class RegistryModule {
     // Match edition code to description
     switch (editionCode) {
       case '900000000000207008': edition = 'Intl'; break;
+      case '31000003106': edition = 'Test'; break; // tx-ecosystem test edition (xsct)
       case '731000124108': edition = 'US'; break;
       case '32506021000036107': edition = 'AU'; break;
       case '449081005': edition = 'ES/Intl'; break;

package/server.js

@@ -79,7 +79,12 @@ const app = express();
 
 // Behind nginx (or any reverse proxy): honor X-Forwarded-* so req.protocol and
 // req.hostname reflect what the client actually requested, not the loopback hop.
-app.set('trust proxy', config.server.trustProxy ?? true);
+// Only proxies on the same host or a private network are trusted by default. `true` would
+// trust every X-Forwarded-For hop, so anyone who could reach the port directly could name
+// their own IP address and walk around every rate limit (express-rate-limit refuses to be
+// quiet about it: ERR_ERL_PERMISSIVE_TRUST_PROXY). See nginx.md.
+const DEFAULT_TRUST_PROXY = 'loopback, linklocal, uniquelocal';
+app.set('trust proxy', config.server.trustProxy ?? DEFAULT_TRUST_PROXY);
 
 const PORT = process.env.PORT || config.server.port || 3000;
 

package/testing/readme.md

@@ -78,6 +78,38 @@ Everything in a report comes from whoever sent it, so all of it is escaped, and
 URLs become links. The narrative (`text.div`) is never rendered as HTML - it appears only as
 text in the raw JSON.
 
+## What the pages show
+
+The list has a column each for the test engine, client and server participants (the client
+column only appears once some report has a client; a participant of any other type is shown
+as a server). **Tests** is the number of entries in `TestReport.test`. **Run Length** is how long the run took, from the earliest `test.period.start`
+to the latest `test.period.end`; it is blank when the report's tests have no periods. Both are
+worked out when the report is received, and for reports received before they existed, the
+first time the server starts with this version.
+
+Where a test script or participant URL, ignoring any `|version`, is one of the **named
+links**, its name is shown instead of the URL - linked to the named link's link, with the
+full URL in the tooltip and the version after the name.
+
+## Administration
+
+`/testing/login`. The administrator logs in as `admin` with the `adminPassword` from the
+configuration, and manages the other users at `/testing/admin/users`. A user can have either
+or both of two rights:
+
+* **edit named links** - `/testing/admin/links`: the canonical URLs that are shown by name
+* **delete reports** - a Delete button on each report's page
+
+Logins work as the publisher's do: a session cookie (set `sessionSecret`, and `cookieSecure:
+false` if the server is reached over plain http), bcrypt password hashes, and a rate limited
+login (`loginAttemptsPerWindow`, default 20 per 15 minutes). Rights are checked on every
+request, so changing or deleting a user takes effect at once. Every form post must come from
+the server's own pages: each form carries a per-session CSRF token (lusca) that the post must
+return, the cookie is SameSite=Lax, and a post whose `Origin` is another host is refused
+(behind a proxy, that needs the proxy to pass on `Host` or `X-Forwarded-Host`). The session
+and CSRF checks are only on the web pages: the FHIR API is authenticated by the header
+token, and sets no cookie.
+
 ## Deleting
 
     DELETE /testing/TestReport/{id}