fhirsmith 0.14.0 → 0.14.2

package/testing/store.js

@@ -36,6 +36,8 @@ const SCHEMA = `
     issued_lo    INTEGER NOT NULL,
     issued_hi    INTEGER NOT NULL,
     size         INTEGER NOT NULL,
+    run_ms       INTEGER,            -- how long the run took, when the report says
+    test_count   INTEGER,            -- how many entries in TestReport.test
     json         TEXT NOT NULL
   );
 
@@ -48,6 +50,26 @@ const SCHEMA = `
     display      TEXT
   );
 
+  -- people who can maintain the named links and delete reports. The administrator is not
+  -- in here: their password is in the configuration
+  CREATE TABLE IF NOT EXISTS users (
+    id                  INTEGER PRIMARY KEY AUTOINCREMENT,
+    login               TEXT UNIQUE NOT NULL,
+    name                TEXT NOT NULL,
+    password_hash       TEXT NOT NULL,
+    can_edit_links      INTEGER NOT NULL DEFAULT 0,
+    can_delete_reports  INTEGER NOT NULL DEFAULT 0,
+    created             TEXT NOT NULL
+  );
+
+  -- names (and links) shown in place of known canonical URLs
+  CREATE TABLE IF NOT EXISTS links (
+    id          INTEGER PRIMARY KEY AUTOINCREMENT,
+    canonical   TEXT UNIQUE NOT NULL,   -- without any |version
+    name        TEXT NOT NULL,
+    link        TEXT
+  );
+
   CREATE INDEX IF NOT EXISTS idx_reports_received ON reports(received_ms);
   CREATE INDEX IF NOT EXISTS idx_reports_name ON reports(name_lc);
   CREATE INDEX IF NOT EXISTS idx_reports_tester ON reports(tester_lc);
@@ -84,6 +106,41 @@ function str(v) {
   return typeof v === 'string' ? v : null;
 }
 
+/**
+ * How long the run took, in milliseconds, if the report says: from the earliest
+ * period.start to the latest period.end across its tests. null if no test has a period
+ * with both ends.
+ */
+function runLengthOf(report) {
+  let lo = null;
+  let hi = null;
+  for (const t of Array.isArray(report.test) ? report.test : []) {
+    const p = t && typeof t === 'object' ? t.period : null;
+    if (!p || typeof p !== 'object') {
+      continue;
+    }
+    const s = typeof p.start === 'string' ? Date.parse(p.start) : NaN;
+    const e = typeof p.end === 'string' ? Date.parse(p.end) : NaN;
+    if (!Number.isNaN(s) && (lo === null || s < lo)) {
+      lo = s;
+    }
+    if (!Number.isNaN(e) && (hi === null || e > hi)) {
+      hi = e;
+    }
+  }
+  return lo !== null && hi !== null && hi >= lo ? hi - lo : null;
+}
+
+/** How many tests the report has (entries in TestReport.test). */
+function testCountOf(report) {
+  return Array.isArray(report.test) ? report.test.length : 0;
+}
+
+/** A canonical URL without its |version. */
+function unversioned(url) {
+  return typeof url === 'string' && url.includes('|') ? url.substring(0, url.indexOf('|')) : url;
+}
+
 class TestReportStore {
   /**
    * @param {string} dbPath - file name, or ':memory:'
@@ -93,16 +150,13 @@ class TestReportStore {
     this.db.pragma('journal_mode = WAL');
     this.db.pragma('foreign_keys = ON');
     this.db.exec(SCHEMA);
-    // participants.version was added after the first databases were made
-    if (!this.db.prepare('PRAGMA table_info(participants)').all().some(c => c.name === 'version')) {
-      this.db.exec('ALTER TABLE participants ADD COLUMN version TEXT');
-    }
+    this.migrate();
     this.stmts = {
       insert: this.db.prepare(`
         INSERT INTO reports (id, received, received_ms, ip, name, name_lc, status, result, score,
-          tester, tester_lc, test_script, issued, issued_lo, issued_hi, size, json)
+          tester, tester_lc, test_script, issued, issued_lo, issued_hi, size, run_ms, test_count, json)
         VALUES (@id, @received, @received_ms, @ip, @name, @name_lc, @status, @result, @score,
-          @tester, @tester_lc, @test_script, @issued, @issued_lo, @issued_hi, @size, @json)`),
+          @tester, @tester_lc, @test_script, @issued, @issued_lo, @issued_hi, @size, @run_ms, @test_count, @json)`),
       insertParticipant: this.db.prepare(
         'INSERT INTO participants (report_id, seq, type, uri, version, display) VALUES (?, ?, ?, ?, ?, ?)'),
       read: this.db.prepare('SELECT json FROM reports WHERE id = ?'),
@@ -112,6 +166,31 @@ class TestReportStore {
     };
   }
 
+  /** Bring a database made by an earlier version of the module up to date. */
+  migrate() {
+    const has = (table, col) => this.db.prepare(`PRAGMA table_info(${table})`).all().some(c => c.name === col);
+    if (!has('participants', 'version')) {
+      this.db.exec('ALTER TABLE participants ADD COLUMN version TEXT');
+    }
+    // columns worked out from the report: add them, and fill them in for the reports
+    // already there
+    const derived = [['run_ms', runLengthOf], ['test_count', testCountOf]];
+    for (const [col, fn] of derived) {
+      if (!has('reports', col)) {
+        this.db.exec(`ALTER TABLE reports ADD COLUMN ${col} INTEGER`);
+        const update = this.db.prepare(`UPDATE reports SET ${col} = ? WHERE id = ?`);
+        this.db.transaction(() => {
+          for (const row of this.db.prepare('SELECT id, json FROM reports').all()) {
+            const v = fn(JSON.parse(row.json));
+            if (v !== null) {
+              update.run(v, row.id);
+            }
+          }
+        })();
+      }
+    }
+  }
+
   close() {
     if (this.db) {
       this.db.close();
@@ -145,6 +224,8 @@ class TestReportStore {
       issued_lo: issued.lo,
       issued_hi: issued.hi,
       size: Buffer.byteLength(json, 'utf8'),
+      run_ms: runLengthOf(report),
+      test_count: testCountOf(report),
       json
     };
     this.db.transaction(() => {
@@ -191,7 +272,7 @@ class TestReportStore {
     }
     const cols = options.withJson
       ? 'r.id, r.json'
-      : 'r.id, r.received, r.name, r.status, r.result, r.score, r.tester, r.test_script, r.issued';
+      : 'r.id, r.received, r.name, r.status, r.result, r.score, r.tester, r.test_script, r.issued, r.run_ms, r.test_count';
     const rows = this.db.prepare(
       `SELECT ${cols} FROM reports r ${where} ORDER BY ${search.orderBy} LIMIT ? OFFSET ?`
     ).all(...search.args, search.count, search.offset);
@@ -211,6 +292,69 @@ class TestReportStore {
     return { total, rows };
   }
 
+  /** Whether any report has a participant of this type. */
+  hasParticipantType(type) {
+    return !!this.db.prepare('SELECT 1 FROM participants WHERE type = ? LIMIT 1').get(type);
+  }
+
+  // ---- named links ----
+
+  /** @returns {Array<{id, canonical, name, link}>} sorted by name */
+  links() {
+    return this.db.prepare('SELECT id, canonical, name, link FROM links ORDER BY name COLLATE NOCASE, canonical').all();
+  }
+
+  /** Add a link, or replace the one for the same canonical. */
+  saveLink(canonical, name, link) {
+    this.db.prepare(`INSERT INTO links (canonical, name, link) VALUES (?, ?, ?)
+      ON CONFLICT(canonical) DO UPDATE SET name = excluded.name, link = excluded.link`)
+      .run(unversioned(canonical), name, link || null);
+  }
+
+  updateLink(id, canonical, name, link) {
+    return this.db.prepare('UPDATE links SET canonical = ?, name = ?, link = ? WHERE id = ?')
+      .run(unversioned(canonical), name, link || null, id).changes > 0;
+  }
+
+  deleteLink(id) {
+    return this.db.prepare('DELETE FROM links WHERE id = ?').run(id).changes > 0;
+  }
+
+  // ---- users ----
+
+  /** @returns {Array} users, without their password hashes */
+  users() {
+    return this.db.prepare('SELECT id, login, name, can_edit_links, can_delete_reports, created FROM users ORDER BY login').all();
+  }
+
+  /** @returns {Object|null} the user, including the password hash */
+  userByLogin(login) {
+    return this.db.prepare('SELECT * FROM users WHERE login = ?').get(login) || null;
+  }
+
+  userById(id) {
+    return this.db.prepare('SELECT id, login, name, can_edit_links, can_delete_reports FROM users WHERE id = ?').get(id) || null;
+  }
+
+  createUser(login, name, passwordHash, rights) {
+    this.db.prepare(`INSERT INTO users (login, name, password_hash, can_edit_links, can_delete_reports, created)
+      VALUES (?, ?, ?, ?, ?, ?)`).run(login, name, passwordHash, rights.editLinks ? 1 : 0, rights.deleteReports ? 1 : 0,
+      new Date().toISOString());
+  }
+
+  updateUser(id, name, rights, passwordHash) {
+    const n = this.db.prepare('UPDATE users SET name = ?, can_edit_links = ?, can_delete_reports = ? WHERE id = ?')
+      .run(name, rights.editLinks ? 1 : 0, rights.deleteReports ? 1 : 0, id).changes;
+    if (n > 0 && passwordHash) {
+      this.db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(passwordHash, id);
+    }
+    return n > 0;
+  }
+
+  deleteUser(id) {
+    return this.db.prepare('DELETE FROM users WHERE id = ?').run(id).changes > 0;
+  }
+
   /** The distinct values in a column, for filter drop-downs. */
   distinct(column) {
     if (!['status', 'result'].includes(column)) {
@@ -263,4 +407,4 @@ class TestReportStore {
   }
 }
 
-module.exports = { TestReportStore, testScriptOf };
+module.exports = { TestReportStore, testScriptOf, runLengthOf, testCountOf, unversioned };

package/testing/testing-template.html

@@ -9,6 +9,7 @@
   <meta content="http://hl7.org/fhir" name="author"/>
   <meta charset="utf-8" http-equiv="X-UA-Compatible" content="IE=edge" />
 
+  <link rel="service-desc" type="application/json" href="/testing/openapi.json"/>
   <link rel="stylesheet" href="/fhir.css"/>
 
 
@@ -59,6 +60,7 @@
   <a href="/" style="color: gold"> Server Home</a> &nbsp;|&nbsp;
   <a href="/testing" style="color: gold">Test Reports</a>  &nbsp;|&nbsp;
   <a href="/testing/summary" style="color: gold">Summary</a>  &nbsp;|&nbsp;
+  <a href="/testing/openapi" style="color: gold">API</a>
 		</div>  <!-- /container -->
 		</div>  <!-- /container -->
 </div>

package/testing/testing.js

@@ -15,6 +15,14 @@
  *   GET    {base}/metadata          CapabilityStatement
  *   GET    {base}                   the filterable list (HTML)
  *   GET    {base}/summary           latest result per test script x participant (HTML)
+ *   GET    {base}/login             login for the administration pages; POST {base}/logout
+ *   GET    {base}/admin/links       names for known canonical URLs (users who can edit links)
+ *   GET    {base}/admin/users       users and their rights (the administrator only)
+ *
+ * Logins work as the publisher's do: a session cookie, bcrypt password hashes, a rate
+ * limited login. The administrator logs in as 'admin' with the adminPassword from the
+ * configuration, and manages the other users; a user can have either or both of the
+ * rights to edit the named links and to delete reports.
  *
  * R4 and R5 TestReports are treated as the same thing. Reports can't be changed once
  * received: each POST is a new report, even when it's the same report as before.
@@ -27,14 +35,21 @@ const path = require('path');
 const crypto = require('crypto');
 const rateLimit = require('express-rate-limit');
 const escape = require('escape-html');
+const session = require('express-session');
+const lusca = require('lusca');
+const bcrypt = require('bcrypt');
 
 const folders = require('../library/folder-setup');
 const htmlServer = require('../library/html-server');
 const { tokenMatches, tokenConfigured } = require('../library/request-token');
+const { requireSameOrigin } = require('../library/same-origin');
 const packageJson = require('../package.json');
 const { TestReportStore } = require('./store');
 const { parseSearch, dateRange, capabilitySearchParams } = require('./search');
-const { renderList, renderSummary, renderReport, listQueryToSearch } = require('./render');
+const testingOpenApi = require('./openapi');
+const {
+  renderList, renderSummary, renderReport, renderLogin, renderLinks, renderUsers, listQueryToSearch
+} = require('./render');
 
 const TEMPLATE = 'testing';
 const DEFAULT_MAX_SIZE = 500 * 1024;
@@ -80,6 +95,11 @@ function validateReport(r) {
   if (r.meta !== undefined && (r.meta === null || typeof r.meta !== 'object' || Array.isArray(r.meta))) {
     problems.push('TestReport.meta must be an object');
   }
+  // contained resources aren't accepted: nothing in a report needs them, and allowing them
+  // would mean describing (and rendering) any resource at all
+  if (r.contained !== undefined) {
+    problems.push('TestReport.contained is not allowed: reports may not contain resources');
+  }
   return problems;
 }
 
@@ -140,12 +160,60 @@ class TestingModule {
 
     htmlServer.loadTemplate(TEMPLATE, path.join(__dirname, 'testing-template.html'));
 
+    // the administrator's password is checked the same way as everyone else's: bcrypt against
+    // a hash, made once here, of the configured password
+    this.adminHash = tokenConfigured(this.config.adminPassword) ? bcrypt.hashSync(this.config.adminPassword, 10) : null;
+
+    this.setupSession();
     this.setupRoutes();
+    this.setupAdminRoutes();
     this.setupRetention();
     this.log.info(`Testing module: ${this.store.count()} reports in ${dbPath}; ` +
       `posting ${tokenConfigured(this.config.token) ? 'requires a token' : 'is open'}, max ${this.maxSize} bytes`);
   }
 
+  /**
+   * The session (login) cookie and CSRF protection. Neither is put on the whole router:
+   * the FHIR API (POST and DELETE of TestReports) is authenticated by a token in a header,
+   * not a cookie, so it needs neither and must not be made to carry a CSRF token. The web
+   * pages get this.web; every form post gets sameOrigin + this.session + a form parser +
+   * this.csrf (see setupAdminRoutes).
+   *
+   * CSRF has two layers: lusca's per-session token, which every form carries in a hidden
+   * _csrf field, and the Origin check (library/same-origin). The cookie is also SameSite=Lax.
+   */
+  setupSession() {
+    if (!this.config.sessionSecret) {
+      // as for the publisher: never a constant secret, which would be a published signing key
+      this.log.warn('testing: no sessionSecret configured - using a random one, so logins will not ' +
+        'survive a restart. Set modules.testing.sessionSecret.');
+    }
+    this.session = session({
+      name: 'testing.sid',
+      secret: this.config.sessionSecret || crypto.randomBytes(64).toString('hex'),
+      resave: false,
+      saveUninitialized: false,
+      cookie: {
+        // HTTPS only unless cookieSecure is false - see the publisher's notes on nginx
+        secure: this.config.cookieSecure ?? true,
+        // the browser will not send the cookie on a form posted from another site, which,
+        // with the Origin check on every form post, is the CSRF protection
+        sameSite: 'lax',
+        httpOnly: true,
+        maxAge: 24 * 60 * 60 * 1000
+      }
+    });
+    // used directly (not wrapped) in every form post's route, so static analysis can see
+    // it there. A bad or missing token comes out as an error, which the error handler at the
+    // end of setupAdminRoutes turns into a page
+    this.csrf = lusca.csrf({ key: '_csrf' });
+    // the pages show a logout form (which needs a token) only to someone logged in. Making
+    // a token stores a secret in the session, so doing it for every visitor would give
+    // every crawler a session
+    const csrfIfLoggedIn = (req, res, next) => this.currentUser(req) ? this.csrf(req, res, next) : next();
+    this.web = [this.session, csrfIfLoggedIn];
+  }
+
   setupRoutes() {
     const r = this.router;
     const rl = this.config.rateLimit || {};
@@ -161,13 +229,31 @@ class TestingModule {
       }));
     }
 
-    r.get('/', (req, res) => this.handle(req, res, 'list', () => this.htmlList(req, res)));
-    r.get('/summary', (req, res) => this.handle(req, res, 'summary', () => this.htmlSummary(req, res)));
+    // RFC 8631: where to find the machine-readable description of this API
+    r.use((req, res, next) => {
+      res.setHeader('Link', `<${req.baseUrl}/openapi.json>; rel="service-desc", <${req.baseUrl}/openapi>; rel="service-doc"`);
+      next();
+    });
+
+    // the OpenAPI description: /openapi.json, /openapi.yaml, and /openapi (an HTML reference
+    // for browsers, the JSON otherwise)
+    r.get('/openapi.json', (req, res) => this.handle(req, res, 'openapi', () => res.type('application/json').send(testingOpenApi.getJson())));
+    r.get('/openapi.yaml', (req, res) => this.handle(req, res, 'openapi', () =>
+      res.set('Content-Type', 'application/yaml').send(testingOpenApi.getYaml())));
+    r.get('/openapi', (req, res) => this.handle(req, res, 'openapi', () => {
+      if (!wantsHtml(req)) {
+        return res.type('application/json').send(testingOpenApi.getJson());
+      }
+      return this.sendHtml(res, 'Test Report API', testingOpenApi.renderHtml(), Date.now());
+    }));
+
+    r.get('/', ...this.web, (req, res) => this.handle(req, res, 'list', () => this.htmlList(req, res)));
+    r.get('/summary', ...this.web, (req, res) => this.handle(req, res, 'summary', () => this.htmlSummary(req, res)));
     r.get('/metadata', (req, res) => this.handle(req, res, 'metadata', () => this.metadata(req, res)));
     r.post('/TestReport', ...posting, (req, res) => this.handle(req, res, 'create', () => this.create(req, res)));
-    r.get('/TestReport', (req, res) => this.handle(req, res, 'search', () =>
+    r.get('/TestReport', ...this.web, (req, res) => this.handle(req, res, 'search', () =>
       wantsHtml(req) ? this.htmlList(req, res) : this.search(req, res)));
-    r.get('/TestReport/:id', (req, res) => this.handle(req, res, 'read', () => this.read(req, res)));
+    r.get('/TestReport/:id', ...this.web, (req, res) => this.handle(req, res, 'read', () => this.read(req, res)));
     r.delete('/TestReport/:id', (req, res) => this.handle(req, res, 'delete', () => this.remove(req, res)));
   }
 
@@ -337,7 +423,7 @@ class TestingModule {
         return htmlServer.sendErrorResponse(res, TEMPLATE, new Error(`No report with id '${req.params.id}'`), 404);
       }
       return this.sendHtml(res, 'Test Report: ' + (typeof report.name === 'string' ? report.name : report.id),
-        renderReport(report, req.baseUrl), start);
+        renderReport(report, req.baseUrl, { names: this.names(), user: this.currentUser(req), csrf: res.locals._csrf }), start);
     }
     if (!report) {
       return this.sendOutcome(res, 404, 'not-found', `No TestReport with id '${req.params.id}'`);
@@ -468,9 +554,12 @@ class TestingModule {
     }
     const results = this.store.search(search);
     const content = prefix + renderList(query, results, search, {
-      statuses: this.store.distinct('status'),
       results: this.store.distinct('result'),
-      base: req.baseUrl
+      base: req.baseUrl,
+      names: this.names(),
+      user: this.currentUser(req),
+      csrf: res.locals._csrf,
+      showClient: this.store.hasParticipantType('client')
     });
     this.sendHtml(res, 'Test Reports', content, start);
   }
@@ -478,7 +567,216 @@ class TestingModule {
   async htmlSummary(req, res) {
     const start = Date.now();
     const by = req.query.by === 'tester' ? 'tester' : 'participant';
-    this.sendHtml(res, 'Test Report Summary', renderSummary(this.store.summary(by), by, req.baseUrl, this.store.testerCounts()), start);
+    this.sendHtml(res, 'Test Report Summary', renderSummary(this.store.summary(by), by, req.baseUrl, this.store.testerCounts(),
+      { names: this.names(), user: this.currentUser(req), csrf: res.locals._csrf }), start);
+  }
+
+  // ---- users, named links, and the administration pages ----
+
+  /** The named links, by unversioned canonical. Cached until they change. */
+  names() {
+    if (!this.namesCache) {
+      this.namesCache = new Map(this.store.links().map(l => [l.canonical, l]));
+    }
+    return this.namesCache;
+  }
+
+  /**
+   * Who is logged in, with their rights as they are now (not as they were at login, so
+   * taking a right away, or deleting the user, takes effect at once).
+   */
+  currentUser(req) {
+    const s = req.session;
+    if (!s) {
+      return null;
+    }
+    if (s.testingAdmin) {
+      return { name: 'Administrator', isAdmin: true, canEditLinks: true, canDeleteReports: true };
+    }
+    if (s.testingUserId) {
+      const u = this.store.userById(s.testingUserId);
+      if (u) {
+        return { id: u.id, name: u.name, isAdmin: false, canEditLinks: !!u.can_edit_links, canDeleteReports: !!u.can_delete_reports };
+      }
+    }
+    return null;
+  }
+
+  setupAdminRoutes() {
+    const r = this.router;
+    const form = express.urlencoded({ extended: false, limit: '64kb' });
+    const loginLimiter = rateLimit({
+      windowMs: 15 * 60 * 1000,
+      limit: this.config.loginAttemptsPerWindow ?? 20,
+      standardHeaders: 'draft-7',
+      legacyHeaders: false,
+      handler: (req, res) => this.sendLogin(req, res, 429, 'Too many login attempts - try again later')
+    });
+    // every form post must come from one of our own pages
+    const sameOrigin = requireSameOrigin((req, res) =>
+      htmlServer.sendErrorResponse(res, TEMPLATE, new Error('Cross-site form posts are not accepted'), 403));
+    // a right, or the administrator
+    const need = (right) => (req, res, next) => {
+      const user = this.currentUser(req);
+      if (!user) {
+        return res.redirect(req.baseUrl + '/login');
+      }
+      if (!(user.isAdmin || (right && user[right]))) {
+        return htmlServer.sendErrorResponse(res, TEMPLATE, new Error('You do not have permission to do that'), 403);
+      }
+      req.user = user;
+      next();
+    };
+    const h = (name, fn) => (req, res) => this.handle(req, res, name, () => fn(req, res));
+    // Every page with a form has this.session, this.csrf; every form post has sameOrigin,
+    // this.session, form, this.csrf. They are written out in each route rather than spread
+    // from an array, so that CodeQL can see the CSRF middleware on every cookie-using route.
+
+    r.get('/login', this.session, this.csrf, h('login', (req, res) => this.sendLogin(req, res, 200)));
+    r.post('/login', sameOrigin, loginLimiter, this.session, form, this.csrf, h('login', (req, res) => this.login(req, res)));
+    r.post('/logout', sameOrigin, this.session, form, this.csrf, h('logout', (req, res) => {
+      req.session.destroy(() => res.redirect(req.baseUrl || '/'));
+    }));
+
+    r.get('/admin/links', this.session, this.csrf, need('canEditLinks'), h('links', (req, res) => this.sendLinks(req, res)));
+    r.post('/admin/links', sameOrigin, this.session, form, this.csrf, need('canEditLinks'), h('links', (req, res) => this.saveLink(req, res, null)));
+    r.post('/admin/links/:id', sameOrigin, this.session, form, this.csrf, need('canEditLinks'), h('links', (req, res) => this.saveLink(req, res, req.params.id)));
+    r.post('/admin/links/:id/delete', sameOrigin, this.session, form, this.csrf, need('canEditLinks'), h('links', (req, res) => {
+      this.store.deleteLink(parseInt(req.params.id, 10));
+      this.namesCache = null;
+      res.redirect(req.baseUrl + '/admin/links');
+    }));
+
+    r.get('/admin/users', this.session, this.csrf, need(null), h('users', (req, res) => this.sendUsers(req, res)));
+    r.post('/admin/users', sameOrigin, this.session, form, this.csrf, need(null), h('users', (req, res) => this.saveUser(req, res, null)));
+    r.post('/admin/users/:id', sameOrigin, this.session, form, this.csrf, need(null), h('users', (req, res) => this.saveUser(req, res, req.params.id)));
+    r.post('/admin/users/:id/delete', sameOrigin, this.session, form, this.csrf, need(null), h('users', (req, res) => {
+      this.store.deleteUser(parseInt(req.params.id, 10));
+      this.log.info(`Testing module: user ${req.params.id} deleted`);
+      res.redirect(req.baseUrl + '/admin/users');
+    }));
+
+    r.post('/TestReport/:id/delete', sameOrigin, this.session, form, this.csrf, need('canDeleteReports'), h('delete', (req, res) => {
+      if (!this.store.delete(req.params.id)) {
+        return htmlServer.sendErrorResponse(res, TEMPLATE, new Error(`No report with id '${req.params.id}'`), 404);
+      }
+      this.log.info(`Testing module: report ${req.params.id} deleted by ${req.user.name}`);
+      res.redirect(req.baseUrl);
+    }));
+
+    // lusca rejects a form post with a missing or wrong token by passing on an error
+    // ("CSRF token missing" / "CSRF token mismatch"); anything else goes on as it was
+    r.use((err, req, res, next) => {
+      if (err && typeof err.message === 'string' && err.message.startsWith('CSRF token')) {
+        return htmlServer.sendErrorResponse(res, TEMPLATE,
+          new Error('The form has expired or did not come from this site - reload the page and try again'), 403);
+      }
+      next(err);
+    });
+  }
+
+  sendLogin(req, res, status, error) {
+    res.status(status);
+    this.sendHtml(res, 'Login', renderLogin(req.baseUrl, error, res.locals._csrf), Date.now());
+  }
+
+  async login(req, res) {
+    const login = typeof req.body.login === 'string' ? req.body.login.trim() : '';
+    const password = typeof req.body.password === 'string' ? req.body.password : '';
+    let ok = false;
+    const regenerate = () => new Promise((resolve, reject) => req.session.regenerate(e => e ? reject(e) : resolve()));
+    if (login === 'admin') {
+      if (this.adminHash && await bcrypt.compare(password, this.adminHash)) {
+        await regenerate();
+        req.session.testingAdmin = true;
+        ok = true;
+      }
+    } else if (login) {
+      const user = this.store.userByLogin(login);
+      if (user && await bcrypt.compare(password, user.password_hash)) {
+        await regenerate();
+        req.session.testingUserId = user.id;
+        ok = true;
+      }
+    }
+    if (!ok) {
+      this.log.info(`Testing module: failed login for '${login}' from ${req.ip}`);
+      return this.sendLogin(req, res, 401, 'Unknown username or wrong password');
+    }
+    this.log.info(`Testing module: '${login}' logged in from ${req.ip}`);
+    res.redirect(req.baseUrl || '/');
+  }
+
+  sendLinks(req, res, message, status = 200) {
+    res.status(status);
+    this.sendHtml(res, 'Named Links', renderLinks(this.store.links(), { base: req.baseUrl, user: req.user, csrf: res.locals._csrf }, message), Date.now());
+  }
+
+  saveLink(req, res, id) {
+    const canonical = typeof req.body.canonical === 'string' ? req.body.canonical.trim() : '';
+    const name = typeof req.body.name === 'string' ? req.body.name.trim() : '';
+    const link = typeof req.body.link === 'string' ? req.body.link.trim() : '';
+    let problem = null;
+    if (!canonical || /\s/.test(canonical) || canonical.length > 1024) {
+      problem = 'The canonical must be a URL with no spaces';
+    } else if (!name || name.length > 200) {
+      problem = 'A name is required (up to 200 characters)';
+    } else if (link && !/^https?:\/\/[^\s"'<>]+$/i.test(link)) {
+      problem = 'The link must be an http or https URL';
+    }
+    if (problem) {
+      return this.sendLinks(req, res, problem, 400);
+    }
+    try {
+      if (id === null) {
+        this.store.saveLink(canonical, name, link);
+      } else if (!this.store.updateLink(parseInt(id, 10), canonical, name, link)) {
+        return this.sendLinks(req, res, 'That link no longer exists', 404);
+      }
+    } catch (e) {
+      if (/UNIQUE/.test(e.message)) {
+        return this.sendLinks(req, res, `There is already a name for ${canonical}`, 409);
+      }
+      throw e;
+    }
+    this.namesCache = null;
+    res.redirect(req.baseUrl + '/admin/links');
+  }
+
+  sendUsers(req, res, message, status = 200) {
+    res.status(status);
+    this.sendHtml(res, 'Users', renderUsers(this.store.users(), { base: req.baseUrl, user: req.user, csrf: res.locals._csrf }, message), Date.now());
+  }
+
+  async saveUser(req, res, id) {
+    const login = typeof req.body.login === 'string' ? req.body.login.trim() : '';
+    const name = typeof req.body.name === 'string' ? req.body.name.trim() : '';
+    const password = typeof req.body.password === 'string' ? req.body.password : '';
+    const rights = { editLinks: req.body.editLinks === '1', deleteReports: req.body.deleteReports === '1' };
+    let problem = null;
+    if (id === null && !/^[A-Za-z0-9._@-]{1,64}$/.test(login)) {
+      problem = 'The username must be 1-64 letters, digits, or . _ @ -';
+    } else if (id === null && login.toLowerCase() === 'admin') {
+      problem = "'admin' is the administrator's login";
+    } else if (!name || name.length > 100) {
+      problem = 'A name is required (up to 100 characters)';
+    } else if ((id === null || password) && password.length < 8) {
+      problem = 'Passwords must be at least 8 characters';
+    }
+    if (problem) {
+      return this.sendUsers(req, res, problem, 400);
+    }
+    const hash = password ? await bcrypt.hash(password, 10) : null;
+    if (id === null) {
+      if (this.store.userByLogin(login)) {
+        return this.sendUsers(req, res, `There is already a user '${login}'`, 409);
+      }
+      this.store.createUser(login, name, hash, rights);
+      this.log.info(`Testing module: user '${login}' created`);
+    } else if (!this.store.updateUser(parseInt(id, 10), name, rights, hash)) {
+      return this.sendUsers(req, res, 'That user no longer exists', 404);
+    }
+    res.redirect(req.baseUrl + '/admin/users');
   }
 }
 

package/translations/Messages.properties

@@ -1288,6 +1288,7 @@ VALUESET_INCLUDE_CSVER_NOT_FOUND = No matching contained code system found for s
 VALUESET_INCLUDE_CSVER_SUPPLEMENT = The value set references CodeSystem ''{0}'' version ''{2}'' which is a supplement. It must reference the underlying CodeSystem ''{1}'' and use the http://hl7.org/fhir/StructureDefinition/valueset-supplement extension for the supplement
 VALUESET_INCLUDE_INVALID_CONCEPT_CODE = The code ''{1}'' is not valid in the system {0} ({2})
 VALUESET_INCLUDE_INVALID_CONCEPT_CODE_VER = The code ''{2}'' is not valid in the system {0} version {1} ({2})
+VALUESET_NO_COMPOSE = The value set {0} has no compose and no expansion, so it cannot be expanded
 VALUESET_INCLUDE_SYSTEM_ABSOLUTE = URI values in ValueSet.compose.include.system must be absolute
 VALUESET_INCLUDE_SYSTEM_ABSOLUTE_FRAG = URI values in ValueSet.compose.include.system must be absolute. To reference a contained code system, use the full CodeSystem URL and reference it using the http://hl7.org/fhir/StructureDefinition/valueset-system extension
 VALUESET_INCLUDE_WRONG_CS_OID = It is not valid to refer to a CodeSystem by an identifier like this ''{0}'' - use ''{1}''