fhirsmith 0.14.0 → 0.14.2

package/nginx.md

@@ -13,13 +13,13 @@ public servers (tx.fhir.org, packages.fhir.org and so on) use.
 
 ### Headers to pass to the server
 
-FHIRsmith runs Express with `trust proxy` enabled (`server.trustProxy` in config.json,
-default `true`). That means it takes the client address, scheme and host from the
-`X-Forwarded-*` headers, so nginx has to set them:
+FHIRsmith runs Express with `trust proxy` enabled (`server.trustProxy` in config.json; by
+default it trusts proxies on the same host or a private network). That means it takes the
+client address, scheme and host from the `X-Forwarded-*` headers, so nginx has to set them:
 
 | Header | nginx value | What FHIRsmith uses it for |
 |---|---|---|
-| `Host` | `$host` | The base URL in the CapabilityStatement, TerminologyCapabilities and other self-references. It is taken from the host the client asked for |
+| `Host` | `$host` | The base URL in the CapabilityStatement, TerminologyCapabilities and other self-references. It is taken from the host the client asked for. The publisher and testing modules also check the `Origin` of every form post against it, and refuse posts from anywhere else - so if nginx sends a different `Host` (e.g. `proxy_pass` with the default `$proxy_host`), every login and form fails with a 403 |
 | `X-Forwarded-Proto` | `$scheme` | The scheme of those same base URLs, and the `Secure` session cookie used by the publisher and token modules. If this header is missing, an HTTPS server advertises `http://` URLs and publisher login fails silently: you are sent back to the login page, still logged out |
 | `X-Forwarded-For` | `$proxy_add_x_forwarded_for` | The client IP address in audit and security logs (`req.ip`). If this header is missing, every request is logged as coming from `127.0.0.1` |
 | `X-Request-Id` | `$request_id` | Optional. FHIRsmith echoes it back on the response, so a client's report can be matched to a line in the nginx log (add `$request_id` to your `log_format`) |
@@ -49,11 +49,19 @@ them:
 
 ### Trusting the proxy
 
-With `trustProxy: true`, anyone who can reach the FHIRsmith port directly can forge
-`X-Forwarded-For`. FHIRsmith listens on all interfaces, so firewall the port so that only
-nginx can reach it. You can also set `server.trustProxy` to `"loopback"`, or to the proxy's
-address; any value that Express's `trust proxy` setting accepts will work. If you run
-FHIRsmith without a proxy, set it to `false`.
+By default FHIRsmith believes the `X-Forwarded-*` headers only when the request comes from
+a loopback, link-local or private address (`"loopback, linklocal, uniquelocal"`) - nginx on
+the same machine, or on the same docker or private network. A request straight from the
+internet can't set its own client address, so it can't get round the rate limits on logins,
+report submission and the publisher's task actions.
+
+If your proxy is somewhere else (a cloud load balancer with a public address, say), set
+`server.trustProxy` to its address, or to the number of proxy hops; any value Express's
+`trust proxy` setting accepts will work. If you run FHIRsmith without a proxy, set it to
+`false`. Avoid `true`: it believes any `X-Forwarded-For`, so anyone who can reach the
+FHIRsmith port directly can name their own IP address, and express-rate-limit logs
+`ERR_ERL_PERMISSIVE_TRUST_PROXY` to say so. Either way, firewalling the port so that only
+nginx can reach it is still a good idea.
 
 ### Upstream connections
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fhirsmith",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "txVersion": "1.9.5-SNAPSHOT",
   "description": "A Node.js server that provides a collection of tools to serve the FHIR ecosystem",
   "main": "server.js",
@@ -41,7 +41,7 @@
     "cli-progress": "^3.12.0",
     "commander": "^14.0.3",
     "commonmark": "^0.31.2",
-    "connect-sqlite3": "^0.9.16",
+    "connect-sqlite3": "^0.9.18",
     "cors": "^2.8.6",
     "express": "^5.2.1",
     "express-rate-limit": "^7.4.1",
@@ -64,7 +64,7 @@
     "properties-file": "^3.6.4",
     "re2js": "^2.8.0",
     "rimraf": "^5.0.10",
-    "sqlite3": "^5.1.7",
+    "sqlite3": "^6.0.1",
     "tar": "^7.5.7",
     "winston": "^3.19.0",
     "winston-daily-rotate-file": "^4.7.1",
@@ -74,6 +74,7 @@
     "@types/jest": "^29.5.8",
     "@typescript-eslint/eslint-plugin": "^8.54.0",
     "@typescript-eslint/parser": "^8.54.0",
+    "ajv": "^8.20.0",
     "eslint": "^8.57.1",
     "eslint-plugin-promise": "^7.2.1",
     "jest": "^29.7.0",
@@ -111,7 +112,12 @@
     "inquirer": {
       "lodash": "4.18.1"
     },
-    "brace-expansion": "^5.0.8"
+    "brace-expansion": "^5.0.8",
+    "csv-parse": "^7.0.3",
+    "uuid": "^11.1.1",
+    "connect-sqlite3": {
+      "sqlite3": "$sqlite3"
+    }
   },
   "bin": {
     "tx-import": "./tx/importers/tx-import.js",

package/packages/openapi.js

@@ -0,0 +1,13 @@
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+// The package server's OpenAPI description. openapi.yaml is the source of truth; see the
+// comment at its top.
+
+const path = require('path');
+const { createOpenApiDoc } = require('../library/openapi-doc');
+
+module.exports = createOpenApiDoc(path.join(__dirname, 'openapi.yaml'), '/packages');