fhirsmith 0.16.1 → 0.18.0

package/extension-tracker/extension-tracker.js

@@ -4,9 +4,100 @@ const Database = require('better-sqlite3');
 const htmlServer = require('../library/html-server');
 const escape = require('escape-html');
 const packageJson = require('../package.json');
+const { tokenMatches, tokenConfigured } = require('../library/request-token');
 
 const TEMPLATE_NAME = 'ext-tracker';
 
+// What the IG Publisher submits (ExtensionTracker.generate() in the publisher): anything
+// that doesn't look like that is refused, which keeps what anyone can put in the database
+// (and so in these pages) to the shapes the pages expect
+const CODE = /^[A-Za-z0-9._-]{1,100}$/;
+const VERSION = /^[A-Za-z0-9._+-]{1,50}$/;
+const FHIR_VERSION = /^\d+\.\d+\.\d+(-[A-Za-z0-9.-]+)?$/;
+const URL_LIKE = /^[A-Za-z][A-Za-z0-9+.-]*:[^\s"'<>\\]{1,1000}$/;
+const RESOURCE_TYPE = /^[A-Za-z][A-Za-z0-9_]{0,99}$/;
+// an element path, e.g. Patient.name or ImplementationGuide.definition.page (a logical
+// model's type can be a URL)
+const PATH = /^[A-Za-z][\w.:/#%[\]-]{0,511}$/;
+const TYPE_CODE = /^[^\s"'<>\\]{1,256}$/;
+const MAX_TITLE = 1024;
+const MAX_ITEMS = 20000;
+
+/**
+ * Checks that a submission looks like what the IG Publisher sends.
+ *
+ * @returns {string[]} what is wrong (empty if nothing)
+ */
+function validateSubmission(data) {
+  const errors = [];
+  const check = (ok, message) => {
+    if (!ok && errors.length < 10) {
+      errors.push(message);
+    }
+  };
+  const isObject = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+  const str = (v, re) => typeof v === 'string' && re.test(v);
+  const optionalTitle = (v) => v === undefined || v === null || (typeof v === 'string' && v.length <= MAX_TITLE);
+  const onlyKeys = (obj, keys, where) => {
+    for (const k of Object.keys(obj)) {
+      check(keys.includes(k), `${where}: unexpected property ${JSON.stringify(k.substring(0, 50))}`);
+    }
+  };
+
+  if (!isObject(data)) {
+    return ['the submission must be a JSON object'];
+  }
+  onlyKeys(data, ['package', 'version', 'fhirVersion', 'jurisdiction', 'extensions', 'profiles', 'usage'], 'submission');
+  check(str(data.package, CODE), 'package must be a package id');
+  check(str(data.version, VERSION), 'version must be a version');
+  check(str(data.fhirVersion, FHIR_VERSION), 'fhirVersion must be a FHIR version (e.g. 4.0.1)');
+  check(data.jurisdiction === undefined || data.jurisdiction === null || str(data.jurisdiction, CODE), 'jurisdiction must be a code');
+
+  let items = 0;
+  if (data.extensions !== undefined) {
+    check(Array.isArray(data.extensions), 'extensions must be an array');
+    for (const [i, ext] of (Array.isArray(data.extensions) ? data.extensions : []).entries()) {
+      items++;
+      if (!isObject(ext)) {
+        check(false, `extensions[${i}] must be an object`);
+        continue;
+      }
+      onlyKeys(ext, ['url', 'title', 'types'], `extensions[${i}]`);
+      check(str(ext.url, URL_LIKE), `extensions[${i}].url must be a URL`);
+      check(optionalTitle(ext.title), `extensions[${i}].title must be text`);
+      check(ext.types === undefined || (Array.isArray(ext.types) && ext.types.every(t => str(t, TYPE_CODE))), `extensions[${i}].types must be an array of type codes`);
+      items += Array.isArray(ext.types) ? ext.types.length : 0;
+    }
+  }
+  if (data.profiles !== undefined) {
+    check(isObject(data.profiles), 'profiles must be an object');
+    for (const [type, list] of Object.entries(isObject(data.profiles) ? data.profiles : {})) {
+      check(RESOURCE_TYPE.test(type), `profiles: ${JSON.stringify(type.substring(0, 50))} is not a resource type`);
+      check(Array.isArray(list), `profiles.${type} must be an array`);
+      for (const [i, prof] of (Array.isArray(list) ? list : []).entries()) {
+        items++;
+        if (!isObject(prof)) {
+          check(false, `profiles.${type}[${i}] must be an object`);
+          continue;
+        }
+        onlyKeys(prof, ['url', 'title'], `profiles.${type}[${i}]`);
+        check(str(prof.url, URL_LIKE), `profiles.${type}[${i}].url must be a URL`);
+        check(optionalTitle(prof.title), `profiles.${type}[${i}].title must be text`);
+      }
+    }
+  }
+  if (data.usage !== undefined) {
+    check(isObject(data.usage), 'usage must be an object');
+    for (const [url, locations] of Object.entries(isObject(data.usage) ? data.usage : {})) {
+      check(URL_LIKE.test(url), `usage: ${JSON.stringify(url.substring(0, 50))} is not a URL`);
+      check(Array.isArray(locations) && locations.every(l => str(l, PATH)), `usage[${JSON.stringify(url.substring(0, 50))}] must be an array of element paths`);
+      items += Array.isArray(locations) ? locations.length : 0;
+    }
+  }
+  check(items <= MAX_ITEMS, `the submission has more than ${MAX_ITEMS} items`);
+  return errors;
+}
+
 class ExtensionTrackerModule {
   constructor(stats) {
     this.stats = stats;
@@ -15,6 +106,7 @@ class ExtensionTrackerModule {
   }
 
   initialize(config, app) {
+    this.config = config;
     const dbPath = config.database || path.join(config.folder || '.', 'extension-tracker.db');
     this.db = new Database(dbPath);
     this.db.pragma('journal_mode = WAL');
@@ -130,10 +222,12 @@ class ExtensionTrackerModule {
    * @param {string} cookiePrefix - cookie name prefix for persistence
    */
   buildColumnFilters(tableId, columns, cookiePrefix) {
+    // goes inside a <script>, and the options are submitted data: with no '<' in it, no
+    // value can close the script element
     const colsJson = JSON.stringify(columns.map(c => ({
       type: c.type || 'text',
       options: c.options || []
-    })));
+    }))).replace(/</g, '\\u003c');
 
     return `
       <script>
@@ -246,8 +340,21 @@ class ExtensionTrackerModule {
     const startTime = Date.now();
     const data = req.body;
 
-    if (!data.package || !data.version || !data.fhirVersion) {
-      return res.status(400).json({ error: 'Missing required fields: package, version, fhirVersion' });
+    // The IG Publisher sends a token. It is in the publisher's source, so it is no secret,
+    // but it keeps out anything that isn't trying to look like the publisher
+    if (tokenConfigured(this.config.token)) {
+      const auth = req.get('Authorization') || '';
+      const supplied = auth.replace(/^Bearer\s+/i, '');
+      if (!tokenMatches(this.config.token, supplied)) {
+        return res.status(401).json({ error: 'A valid token is required in the Authorization header' });
+      }
+    }
+
+    const errors = validateSubmission(data);
+    if (errors.length > 0) {
+      // logged, so that a real publisher submission refused by a rule that is too strict is seen
+      console.log(`Extension tracker: refused a submission for ${String(data?.package).substring(0, 100)} from ${req.ip}: ${errors.slice(0, 3).join('; ')}`);
+      return res.status(400).json({ error: 'Not a valid submission', issues: errors });
     }
 
     try {
@@ -695,3 +802,4 @@ class ExtensionTrackerModule {
 }
 
 module.exports = ExtensionTrackerModule;
+module.exports.validateSubmission = validateSubmission;

package/extension-tracker/readme.md

@@ -14,11 +14,14 @@ Tracks extensions, profiles, and extension usage across FHIR Implementation Guid
 
 - **database**: path to the SQLite database file (auto-created if missing)
 - **url** (optional): URL base to mount at (defaults to `/ext-tracker`)
+- **token** (optional): the token a submission must carry, as `Authorization: Bearer <token>`. The IG Publisher sends `9D1C23C0-3915-4542-882E-2BCC55645DF8`. It is in the publisher's source, so it is not a secret, but it keeps out submissions that aren't from the publisher. Without it, submissions need no token
 
 ## POST — Submit IG Data
 
 POST JSON to the module root. Required fields: `package`, `version`, `fhirVersion`. Optional: `jurisdiction`, `extensions`, `profiles`, `usage`.
 
+A submission must look like what the IG Publisher sends, or it is refused (400): no other properties; `package`, `version`, `fhirVersion` and `jurisdiction` are codes; extension, profile and usage keys are URLs; `profiles` is keyed by resource type; usage locations are element paths; titles are text of at most 1024 characters; and no more than 20000 items in all.
+
 ```
 POST /ext-tracker
 Content-Type: application/json

package/ips/ai-client.js

@@ -0,0 +1,263 @@
+//
+// Copyright 2026, Health Intersections Pty Ltd (http://www.healthintersections.com.au)
+//
+// Licensed under BSD-3: https://opensource.org/license/bsd-3-clause
+//
+
+/**
+ * A client for the AI services the assessment step can use: two API shapes, which between
+ * them cover most of what there is.
+ *
+ *   openai     the chat-completions API: OpenAI, OpenRouter, LiteLLM, Groq, Ollama, Azure,
+ *              Gemini's compatibility endpoint... POST {baseUrl}/chat/completions
+ *   anthropic  the Messages API: POST {baseUrl}/v1/messages
+ *
+ * An account is { provider, baseUrl, model, apiKey }. The client sends one system prompt
+ * and one user message and returns the text that comes back, with the token counts the
+ * service reports. Responses are bounded, and nothing about the account is in an error's
+ * message beyond the provider and model.
+ *
+ * Also here: the encryption of API keys at rest (AES-256-GCM, a key derived from a server
+ * secret), so a copy of the database is not a copy of the accounts.
+ *
+ * @module ips/ai-client
+ */
+
+const crypto = require('crypto');
+
+const PROVIDERS = {
+  openai: { name: 'OpenAI-compatible (chat completions)', defaultBaseUrl: 'https://api.openai.com/v1' },
+  anthropic: { name: 'Anthropic (Messages API)', defaultBaseUrl: 'https://api.anthropic.com' }
+};
+const DEFAULT_TIMEOUT_MS = 120000;
+// of the answer: a thorough assessment of a big document runs to several thousand tokens
+const DEFAULT_MAX_TOKENS = 16384;
+const MAX_RESPONSE_BYTES = 1024 * 1024;
+const ANTHROPIC_VERSION = '2023-06-01';
+
+function isObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+/** Check an account's shape; throws with a message fit for a settings page. */
+function checkAccount(account) {
+  if (!isObject(account)) {
+    throw new Error('No AI account');
+  }
+  if (!PROVIDERS[account.provider]) {
+    throw new Error(`Unknown AI provider '${account.provider}' (openai or anthropic)`);
+  }
+  if (typeof account.model !== 'string' || !account.model.trim()) {
+    throw new Error('The AI account has no model');
+  }
+  if (typeof account.apiKey !== 'string' || !account.apiKey) {
+    throw new Error('The AI account has no API key');
+  }
+  const base = typeof account.baseUrl === 'string' && account.baseUrl.trim() ? account.baseUrl.trim() : PROVIDERS[account.provider].defaultBaseUrl;
+  let u;
+  try {
+    u = new URL(base);
+  } catch {
+    throw new Error('The AI account\'s base URL is not a URL');
+  }
+  if (u.protocol !== 'https:' && u.protocol !== 'http:') {
+    throw new Error('The AI account\'s base URL must be http(s)');
+  }
+  return { ...account, baseUrl: base.replace(/\/+$/, '') };
+}
+
+/** Read a response body, up to a limit. */
+async function readBounded(res, limit) {
+  const reader = res.body?.getReader ? res.body.getReader() : null;
+  if (!reader) {
+    const t = await res.text();
+    return t.length > limit ? t.substring(0, limit) : t;
+  }
+  const chunks = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    size += value.length;
+    if (size > limit) {
+      await reader.cancel();
+      throw new Error('The AI service\'s response was too large');
+    }
+    chunks.push(value);
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
+/**
+ * Ask the service.
+ *
+ * @param {{provider: string, baseUrl?: string, model: string, apiKey: string}} account
+ * @param {{system: string, user: string, maxTokens?: number, timeoutMs?: number, fetch?: Function}} request
+ * @returns {Promise<{text: string, usage: {input: number|null, output: number|null, cost: number|null}, model: string, provider: string, truncated: boolean, maxTokens: number}>}
+ *   usage.cost: in USD, when the service says (OpenRouter does); truncated: the answer was
+ *   cut off at maxTokens
+ */
+async function complete(account, request) {
+  const a = checkAccount(account);
+  const doFetch = request.fetch || fetch;
+  const maxTokens = Number.isInteger(request.maxTokens) && request.maxTokens > 0 ? request.maxTokens : DEFAULT_MAX_TOKENS;
+  const timeoutMs = Number.isInteger(request.timeoutMs) && request.timeoutMs > 0 ? request.timeoutMs : DEFAULT_TIMEOUT_MS;
+  let url;
+  let headers;
+  let body;
+  if (a.provider === 'anthropic') {
+    url = `${a.baseUrl}/v1/messages`;
+    headers = { 'content-type': 'application/json', 'x-api-key': a.apiKey, 'anthropic-version': ANTHROPIC_VERSION };
+    body = { model: a.model, max_tokens: maxTokens, system: request.system, messages: [{ role: 'user', content: request.user }] };
+  } else {
+    url = `${a.baseUrl}/chat/completions`;
+    headers = { 'content-type': 'application/json', authorization: `Bearer ${a.apiKey}` };
+    body = { model: a.model, max_tokens: maxTokens, temperature: 0, messages: [{ role: 'system', content: request.system }, { role: 'user', content: request.user }] };
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let res;
+  let text;
+  try {
+    res = await doFetch(url, { method: 'POST', headers, body: JSON.stringify(body), signal: controller.signal, redirect: 'manual' });
+    text = await readBounded(res, MAX_RESPONSE_BYTES);
+  } catch (e) {
+    throw new Error(e.name === 'AbortError' ? `The AI service (${a.provider}, ${a.model}) did not answer within ${timeoutMs} ms` : `The AI service (${a.provider}, ${a.model}) could not be reached: ${e.message}`);
+  } finally {
+    clearTimeout(timer);
+  }
+  let json = null;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    // not JSON: reported below
+  }
+  if (res.status < 200 || res.status >= 300) {
+    const detail = json?.error?.message || json?.message || (typeof json?.error === 'string' ? json.error : '') || '';
+    throw new Error(`The AI service (${a.provider}, ${a.model}) answered HTTP ${res.status}${detail ? `: ${String(detail).substring(0, 300)}` : ''}`);
+  }
+  if (!isObject(json)) {
+    throw new Error(`The AI service (${a.provider}, ${a.model}) did not answer with JSON`);
+  }
+  let out;
+  let usage;
+  const num = (v) => (typeof v === 'number' && Number.isFinite(v) ? v : null);
+  // whether the answer was cut off at the token limit
+  let truncated;
+  if (a.provider === 'anthropic') {
+    out = (Array.isArray(json.content) ? json.content : []).filter(c => c?.type === 'text' && typeof c.text === 'string').map(c => c.text).join('\n');
+    usage = { input: num(json.usage?.input_tokens), output: num(json.usage?.output_tokens), cost: null };
+    truncated = json.stop_reason === 'max_tokens';
+  } else {
+    const choice = Array.isArray(json.choices) ? json.choices[0] : null;
+    const msg = choice?.message;
+    out = typeof msg?.content === 'string' ? msg.content : (Array.isArray(msg?.content) ? msg.content.filter(c => typeof c?.text === 'string').map(c => c.text).join('\n') : '');
+    // OpenRouter says what the call cost (in USD) in usage.cost; others don't
+    usage = { input: num(json.usage?.prompt_tokens), output: num(json.usage?.completion_tokens), cost: num(json.usage?.cost) };
+    truncated = choice?.finish_reason === 'length';
+  }
+  if (typeof out !== 'string' || !out.trim()) {
+    throw new Error(`The AI service (${a.provider}, ${a.model}) answered with no text`);
+  }
+  return { text: out, usage, model: typeof json.model === 'string' ? json.model : a.model, provider: a.provider, truncated: truncated === true, maxTokens };
+}
+
+/**
+ * The JSON object in a model's answer: the whole answer, or the first {...} in it (models
+ * wrap JSON in prose or code fences however they are asked not to), or null.
+ */
+function jsonIn(text) {
+  if (typeof text !== 'string') {
+    return null;
+  }
+  const tries = [text.trim()];
+  const fence = /```(?:json)?\s*([\s\S]*?)```/.exec(text);
+  if (fence) {
+    tries.push(fence[1].trim());
+  }
+  const first = text.indexOf('{');
+  const last = text.lastIndexOf('}');
+  if (first >= 0 && last > first) {
+    tries.push(text.substring(first, last + 1));
+  }
+  for (const t of tries) {
+    try {
+      const v = JSON.parse(t);
+      if (isObject(v)) {
+        return v;
+      }
+    } catch {
+      // the next
+    }
+  }
+  return null;
+}
+
+// list prices, USD per million tokens, for the models a server is likely to use without
+// configuring prices (Anthropic's, as published October 2026). They go stale: the
+// configuration's prices (modules.ips.ai.prices) override them, by model name or prefix
+const DEFAULT_PRICES = {
+  'claude-fable-5-1': { input: 10, output: 50 },
+  'claude-opus-5-5': { input: 4, output: 20 },
+  'claude-sonnet-5-5': { input: 2, output: 10 },
+  'claude-haiku-5-5': { input: 0.1, output: 0.5 }
+};
+
+/**
+ * What a call cost, in USD: what the service said, else from a price list - model name (or
+ * a prefix of it, the longest wins) -> { input, output } in USD per million tokens - else null.
+ */
+function costOf(usage, model, prices) {
+  if (typeof usage?.cost === 'number') {
+    return usage.cost;
+  }
+  if (!isObject(prices) || typeof model !== 'string' || typeof usage?.input !== 'number' || typeof usage?.output !== 'number') {
+    return null;
+  }
+  let best = null;
+  for (const [name, p] of Object.entries(prices)) {
+    if ((model === name || model.startsWith(name)) && isObject(p) && (!best || name.length > best.name.length)) {
+      best = { name, p };
+    }
+  }
+  if (!best || typeof best.p.input !== 'number' || typeof best.p.output !== 'number') {
+    return null;
+  }
+  return usage.input / 1e6 * best.p.input + usage.output / 1e6 * best.p.output;
+}
+
+// ---- keys at rest ----
+
+function keyFrom(secret) {
+  return crypto.createHash('sha256').update(`ips-ai-key:${secret}`).digest();
+}
+
+/** Encrypt an API key for the database: v1:iv:tag:ciphertext, base64. */
+function encryptKey(apiKey, secret) {
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', keyFrom(secret), iv);
+  const enc = Buffer.concat([cipher.update(apiKey, 'utf8'), cipher.final()]);
+  return `v1:${iv.toString('base64')}:${cipher.getAuthTag().toString('base64')}:${enc.toString('base64')}`;
+}
+
+/** @returns {string|null} the key, or null when it cannot be read (another secret, or damaged) */
+function decryptKey(stored, secret) {
+  if (typeof stored !== 'string') {
+    return null;
+  }
+  const parts = stored.split(':');
+  if (parts.length !== 4 || parts[0] !== 'v1') {
+    return null;
+  }
+  try {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', keyFrom(secret), Buffer.from(parts[1], 'base64'));
+    decipher.setAuthTag(Buffer.from(parts[2], 'base64'));
+    return Buffer.concat([decipher.update(Buffer.from(parts[3], 'base64')), decipher.final()]).toString('utf8');
+  } catch {
+    return null;
+  }
+}
+
+module.exports = { complete, checkAccount, jsonIn, costOf, encryptKey, decryptKey, DEFAULT_PRICES, PROVIDERS, MAX_RESPONSE_BYTES, DEFAULT_TIMEOUT_MS, DEFAULT_MAX_TOKENS };