fhirsmith 0.18.2 → 1.0.0

package/library/role.js

@@ -0,0 +1,197 @@
+/**
+ * Process roles, for running one master and several terminology workers on one data
+ * directory (see cluster.md).
+ *
+ *   node server.js                                   no role: everything exactly as before
+ *   node server.js --role=master --instance-code=m0 --port=3001
+ *   node server.js --role=tx-worker --instance-code=tx1 --port=3002
+ *
+ * The role also comes from FHIRSMITH_ROLE and the instance code from FHIRSMITH_INSTANCE_CODE
+ * (flags win). With no role, nothing here changes the configuration: server.js only calls
+ * applyRole when parseRole returns a role.
+ *
+ * - master: every configured module, every background job, $closure and the syndication
+ *   feed. The VSAC provider syncs and, after each sync, bumps a generation counter that the
+ *   workers watch.
+ * - tx-worker: the tx module only. No background jobs, no statistics database, no $closure
+ *   or syndication store (those requests go to the master), and the VSAC provider only
+ *   reads what the master's sync wrote.
+ *
+ * @module library/role
+ */
+
+const ROLES = ['master', 'tx-worker'];
+
+/**
+ * An instance code goes in front of every cache-id the process issues, and a front door
+ * routes on it (nginx.md's map on "^tx1\."). It has to be 1-16 letters and digits: the
+ * longest cache-id, "<code>.<generation>.<random>" (two 22-character tokens) or
+ * "<code>.<start>.<uuid>", is then 62 characters, inside a FHIR id's 64. The tx module
+ * checks the same (ResourceCache.checkInstanceCode); this fails before anything starts.
+ * @param {string} code
+ * @param {string} where - what to call it in the error
+ */
+function checkInstanceCode(code, where = 'instance code') {
+  if (typeof code !== 'string' || !/^[A-Za-z0-9]{1,16}$/.test(code)) {
+    throw new Error(`The ${where} '${code}' is not valid: it must be 1-16 letters and digits`);
+  }
+  return code;
+}
+const FLAGS = ['role', 'instance-code', 'port'];
+
+// the IPC message a process started by the launcher sends from its listen callback: the
+// launcher marks it ready on this, from this child, rather than on whoever answers its port
+const READY = 'fhirsmith:ready';
+
+// The address a process with a role listens on (server.cluster.bindAddress): loopback, since
+// only the front door (cluster.js, or nginx on the same host) should reach the master and
+// the workers. "0.0.0.0" or "::" for every interface; a specific address for one
+const DEFAULT_BIND_ADDRESS = '127.0.0.1';
+
+// server.cluster.sharedCacheMaxMB: the most client resource JSON the shared cache file holds,
+// all endpoints together, in MB. The largest IG Publisher cache session in our corpus of
+// builds against tx.fhir.org (2,817 sessions) held 3.5 MB (p99 2.8 MB, median 55 KB), so 256
+// is about 70x the largest: the room cacheMaxTotalConcepts gives one endpoint (about 40x the
+// largest session's concepts), for two busy endpoints. 0: no cap
+const DEFAULT_SHARED_CACHE_MAX_MB = 256;
+
+// stats.sampleSeconds with a role, when not given: the graphs' sample interval, at most this,
+// so a short session on a cluster can be read (cluster.md, "Graphs"). The counters are still
+// written every stats.intervalMinutes
+const ROLE_SAMPLE_SECONDS = 60;
+
+// server.memory.trimAllocator with a role: on, unless the config says false. N+1 processes
+// share one limit, and malloc_trim gives back what loading the library leaves resident
+// (0.6-0.7 GB a process) and what a burst leaves (cluster.md, "Memory"). With no role the
+// memory guard's own default (off) applies
+const ROLE_TRIM_ALLOCATOR = true;
+
+/**
+ * The address a process with a role listens on; with no role (null), none: every interface,
+ * as before.
+ * @param {Object} config - config.json
+ */
+function bindAddress(config) {
+  return (config.server && config.server.cluster && config.server.cluster.bindAddress) ?? DEFAULT_BIND_ADDRESS;
+}
+
+/**
+ * The address to reach a process listening on `bind` at: loopback for every interface.
+ * @param {string} bind
+ */
+function connectAddress(bind) {
+  return bind === '0.0.0.0' ? '127.0.0.1' : bind === '::' ? '::1' : bind;
+}
+
+/**
+ * The role this process was started with, or null for none.
+ * @param {string[]} argv - process.argv.slice(2)
+ * @param {Object} env - process.env
+ * @returns {{role: string, instanceCode: string|null, port: number|null}|null}
+ */
+function parseRole(argv = [], env = {}) {
+  const flags = {};
+  for (let i = 0; i < argv.length; i++) {
+    const m = /^--([a-z-]+)(?:=(.*))?$/.exec(argv[i]);
+    if (m && FLAGS.includes(m[1])) {
+      flags[m[1]] = m[2] !== undefined ? m[2] : argv[++i];
+    }
+  }
+  const role = flags.role || env.FHIRSMITH_ROLE || null;
+  if (!role) {
+    if (flags['instance-code'] !== undefined || flags.port !== undefined) {
+      throw new Error('--instance-code and --port are only used with --role (master or tx-worker)');
+    }
+    return null;
+  }
+  if (!ROLES.includes(role)) {
+    throw new Error(`Unknown role '${role}': use master or tx-worker`);
+  }
+  let port = null;
+  if (flags.port !== undefined) {
+    port = Number(flags.port);
+    if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+      throw new Error(`--port '${flags.port}' is not a port number`);
+    }
+  }
+  return { role, instanceCode: flags['instance-code'] || env.FHIRSMITH_INSTANCE_CODE || null, port };
+}
+
+/**
+ * Change the configuration (in place) for the role.
+ * @param {Object} config - the parsed config.json
+ * @param {{role: string, instanceCode: string|null}} role - from parseRole
+ * @returns {Object} config
+ */
+function applyRole(config, role) {
+  const tx = config.modules && config.modules.tx;
+  if (!tx || !tx.enabled) {
+    throw new Error(`--role=${role.role} needs the tx module enabled in config.json`);
+  }
+  if (role.role === 'tx-worker' && !role.instanceCode) {
+    // the config's code is the master's: every process needs its own
+    throw new Error('A tx-worker needs its own instance code: --instance-code or FHIRSMITH_INSTANCE_CODE');
+  }
+  tx.instanceCode = role.instanceCode || tx.instanceCode;
+  if (!tx.instanceCode) {
+    throw new Error('The master needs an instance code: --instance-code, FHIRSMITH_INSTANCE_CODE or modules.tx.instanceCode');
+  }
+  checkInstanceCode(tx.instanceCode);
+  tx.clusterRole = role.role;
+  // the options in server.cluster (cluster.md, "Options"). Every process reads the same
+  // config.json, so they all agree; without a role these are never looked at
+  const options = (config.server && config.server.cluster) || {};
+  for (const name of ['sharedCache', 'cacheAffinity', 'sharedClosure']) {
+    if (options[name] !== undefined && typeof options[name] !== 'boolean') {
+      throw new Error(`server.cluster.${name} must be true or false`);
+    }
+  }
+  if (options.bindAddress != null && (typeof options.bindAddress !== 'string' || !options.bindAddress)) {
+    throw new Error('server.cluster.bindAddress must be an address to listen on, e.g. "127.0.0.1" (the default) or "0.0.0.0"');
+  }
+  if (options.sharedCache === true) {
+    tx.sharedCache = true;
+    const mb = Number(options.sharedCacheMaxMB ?? DEFAULT_SHARED_CACHE_MAX_MB);
+    if (!Number.isFinite(mb) || mb < 0) {
+      throw new Error('server.cluster.sharedCacheMaxMB must be a number of megabytes (0: no cap)');
+    }
+    tx.sharedCacheMaxBytes = Math.round(mb * 1024 * 1024);
+  }
+  if (options.sharedClosure === true) {
+    tx.sharedClosure = true;
+  }
+  if (tx.vsacCfg) {
+    tx.vsacCfg = { ...tx.vsacCfg, cluster: role.role === 'master' ? 'leader' : 'follower' };
+  }
+  config.server = config.server || {};
+  // the memory limit is the whole group's (master and workers in one cgroup)
+  const memory = config.server.memory || {};
+  config.server.memory = { ...memory, group: true, trimAllocator: memory.trimAllocator ?? ROLE_TRIM_ALLOCATOR };
+  const stats = config.stats || {};
+  if (stats.sampleSeconds === undefined) {
+    const interval = stats.intervalMinutes > 0 ? stats.intervalMinutes * 60 : 600;
+    config.stats = { ...stats, sampleSeconds: Math.min(ROLE_SAMPLE_SECONDS, interval) };
+  }
+  if (role.role === 'tx-worker') {
+    for (const [name, mod] of Object.entries(config.modules)) {
+      if (name !== 'tx' && mod) {
+        mod.enabled = false;
+      }
+    }
+    // the master keeps the statistics database, runs the npm audit and sends the report
+    config.stats = { ...(config.stats || {}), enabled: false };
+    config.npmAudit = { ...(config.npmAudit || {}), enabled: false };
+    config.dailyReport = { ...(config.dailyReport || {}), enabled: false };
+  }
+  return config;
+}
+
+function describeRole(role, config) {
+  const code = config.modules.tx.instanceCode;
+  return role.role === 'master'
+    ? `Role: master (instance code ${code}): all modules, background jobs, $closure`
+    : `Role: tx-worker (instance code ${code}): the tx module only, no background jobs`;
+}
+
+module.exports = { parseRole, applyRole, describeRole, checkInstanceCode, bindAddress, connectAddress, DEFAULT_BIND_ADDRESS,
+  DEFAULT_SHARED_CACHE_MAX_MB, ROLE_TRIM_ALLOCATOR, ROLE_SAMPLE_SECONDS, READY, ROLES };

package/library/server-credentials.js

@@ -0,0 +1,169 @@
+// Credentials for other terminology servers: an API key, or an OAuth2 client_credentials token,
+// under the server's code in the registry. Used by the registry crawler (registry/crawler.js) and
+// by the tx module when it asks other servers in the ecosystem (tx/ecosystem-resolver.js)
+
+const axios = require('axios');
+
+class ServerCredentials {
+  /**
+   * @param {Object} options
+   * @param {Object} options.apiKeys - server code -> API key (sent as Api-Key)
+   * @param {Object} options.oauth - server code -> { tokenEndpoint, clientId, clientSecret, scope }
+   * @param {number} [options.timeout] - for the token request, in ms
+   * @param {string} [options.userAgent]
+   * @param {function(): {httpAgent, httpsAgent}} [options.agents] - for the token request (the crawler's SSRF guard)
+   * @param {function(): AbortSignal} [options.signal] - for the token request
+   * @param {function(string, string)} [options.log] - (level, message)
+   */
+  constructor(options = {}) {
+    this.apiKeys = options.apiKeys || {};
+    this.oauth = options.oauth || {};
+    this.timeout = options.timeout || 30000;
+    this.userAgent = options.userAgent || 'FHIRsmith';
+    this.agents = options.agents || (() => ({}));
+    this.signal = options.signal || (() => undefined);
+    this.log = options.log || (() => {});
+    // server code -> { token, renewAt } or { pending: Promise }
+    this.tokens = new Map();
+  }
+
+  /**
+   * The API key for a server code, or null
+   */
+  getApiKey(code) {
+    if (code && Object.prototype.hasOwnProperty.call(this.apiKeys, code)) {
+      return this.apiKeys[code];
+    }
+    return null;
+  }
+
+  /**
+   * The OAuth client credentials configured for a server code, or null
+   */
+  getOAuthConfig(code) {
+    if (code && Object.prototype.hasOwnProperty.call(this.oauth, code)) {
+      return this.oauth[code] || null;
+    }
+    return null;
+  }
+
+  /**
+   * 'oauth', 'api-key' or 'open': what is sent to the server with this code
+   */
+  security(code) {
+    return this.getOAuthConfig(code) ? 'oauth' : this.getApiKey(code) == null ? 'open' : 'api-key';
+  }
+
+  hasCredentials(code) {
+    return this.security(code) !== 'open';
+  }
+
+  /**
+   * The headers that carry a server's credentials: an OAuth bearer token if the server has
+   * an oauth entry, otherwise its API key, otherwise none
+   * @param {string} code
+   * @param {boolean} renewToken - discard the cached token (the server refused it)
+   */
+  async headers(code, renewToken = false) {
+    if (this.getOAuthConfig(code)) {
+      return { 'Authorization': `Bearer ${await this.getAccessToken(code, renewToken)}` };
+    }
+    const apiKey = this.getApiKey(code);
+    return apiKey ? { 'Api-Key': apiKey } : {};
+  }
+
+  /**
+   * An access token for a server, from the cache while it has more than a minute (or a tenth
+   * of its life, if less) to run, otherwise from the token endpoint. Concurrent callers share
+   * one token request.
+   * @param {string} code
+   * @param {boolean} renew - discard the cached token (the server refused it)
+   * @returns {Promise<string>}
+   */
+  async getAccessToken(code, renew = false) {
+    const cached = this.tokens.get(code);
+    if (cached) {
+      if (cached.pending) {
+        return cached.pending;
+      }
+      if (!renew && Date.now() < cached.renewAt) {
+        return cached.token;
+      }
+    }
+    const pending = this.requestAccessToken(code)
+      .then(t => {
+        this.tokens.set(code, t);
+        return t.token;
+      })
+      .catch(err => {
+        this.tokens.delete(code);
+        throw err;
+      });
+    this.tokens.set(code, { pending });
+    return pending;
+  }
+
+  /**
+   * The client_credentials grant (RFC 6749 4.4), the client authenticating with its secret in
+   * the form body (client_secret_post). Error messages name the server and the endpoint, but
+   * never carry the secret or anything the endpoint said beyond its error code.
+   */
+  async requestAccessToken(code) {
+    const cfg = this.getOAuthConfig(code);
+    const endpoint = cfg.tokenEndpoint;
+    const fail = (why) => new Error(`Could not get an OAuth token for ${code} from ${endpoint}: ${why}`);
+    if (!endpoint || !/^https:\/\//i.test(endpoint)) {
+      throw new Error(`The OAuth tokenEndpoint for ${code} must be an https: URL`);
+    }
+    if (!cfg.clientId || !cfg.clientSecret) {
+      throw new Error(`The OAuth configuration for ${code} needs a clientId and clientSecret`);
+    }
+
+    const form = new URLSearchParams();
+    form.set('grant_type', 'client_credentials');
+    form.set('client_id', cfg.clientId);
+    form.set('client_secret', cfg.clientSecret);
+    if (cfg.scope) {
+      form.set('scope', cfg.scope);
+    }
+
+    let response;
+    try {
+      response = await axios.post(endpoint, form.toString(), {
+        timeout: this.timeout,
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'Accept': 'application/json',
+          'User-Agent': this.userAgent
+        },
+        signal: this.signal(),
+        validateStatus: () => true,
+        maxContentLength: 1024 * 1024,
+        maxRedirects: 0, // the form carries the secret: it goes where it was configured to, or nowhere
+        httpAgent: this.agents().httpAgent,
+        httpsAgent: this.agents().httpsAgent
+      });
+    } catch (error) {
+      throw fail(error.response ? `HTTP ${error.response.status}` : `no response (${error.code || error.message})`);
+    }
+
+    const body = response.data && typeof response.data === 'object' ? response.data : {};
+    if (response.status !== 200) {
+      const ec = typeof body.error === 'string' && /^[\w.-]{1,64}$/.test(body.error) ? ` ${body.error}` : '';
+      throw fail(`HTTP ${response.status}${ec}`);
+    }
+    if (typeof body.access_token !== 'string' || !body.access_token) {
+      throw fail('the response has no access_token');
+    }
+    if (body.token_type && String(body.token_type).toLowerCase() !== 'bearer') {
+      throw fail(`unsupported token_type ${String(body.token_type).substring(0, 20)}`);
+    }
+
+    const lifetime = Number(body.expires_in) > 0 ? Number(body.expires_in) * 1000 : 5 * 60 * 1000;
+    const margin = Math.min(60 * 1000, lifetime / 10);
+    this.log('info', `  Got an OAuth token for ${code} from ${endpoint}, valid for ${Math.round(lifetime / 1000)}s`);
+    return { token: body.access_token, renewAt: Date.now() + lifetime - margin };
+  }
+}
+
+module.exports = { ServerCredentials };

package/library/sqlite-utilities.js

@@ -0,0 +1,59 @@
+/**
+ * node-sqlite3 runs its callbacks from native code. An exception thrown inside
+ * one leaves whatever was waiting on it unsettled (a promise never settles, a
+ * request never gets a response), and N-API keeps it pending: the process aborts
+ * (napi_throw FATAL) when the statement is finalized, at the latest on exit. So
+ * callbacks are wrapped, and what one throws goes to onError instead:
+ *
+ *   db.all(sql, params, guarded(reject, (err, rows) => { ... }));    // in a promise
+ *   db.get(sql, params, guarded(next, (err, row) => { ... }));       // in a route handler
+ *   db.run(sql, guarded(null, err => { ... }));                      // nothing waits: log only
+ *
+ * `this` is passed through, for run() callbacks that read this.lastID / this.changes.
+ * What it throws is also logged, because after resolve() a reject does nothing.
+ *
+ * (better-sqlite3, used by ips, testing, registry and extension-tracker, is synchronous:
+ * its exceptions are ordinary ones, and need none of this.)
+ *
+ * @param {function(Error)|null} onError - reject, next, failRequest(res), or null
+ * @param {Function} callback
+ */
+function guarded(onError, callback) {
+  return function (...args) {
+    try {
+      return callback.apply(this, args);
+    } catch (e) {
+      require('./logger').getInstance().child({ module: 'sqlite' }).warn(`sqlite callback threw: ${e.message}`);
+      if (typeof onError === 'function') {
+        onError(e);
+      }
+    }
+  };
+}
+
+/**
+ * For a route helper that has the response but no next: answer 500, if nothing has been
+ * sent yet (what Express does with an error passed to next).
+ * @param {Object} res
+ * @returns {function(Error)}
+ */
+function failRequest(res) {
+  return () => {
+    if (!res.headersSent) {
+      res.status(500).send('Internal Server Error');
+    }
+  };
+}
+
+/**
+ * A string for the inside of a '...' literal in SQLite: each ' doubled (SQLite has no backslash
+ * escapes, so that is all a literal needs). Prefer a ? parameter wherever the SQL allows one.
+ * @param {string} str
+ * @returns {string} '' for a missing value
+ */
+function sqlEscapeString(str) {
+  if (!str) return '';
+  return str.replace(/'/g, "''");
+}
+
+module.exports = { guarded, failRequest, sqlEscapeString };

package/library/ssrf-guard.js

@@ -0,0 +1,100 @@
+// The SSRF guard for outbound http(s) requests to addresses that came from somewhere else (a
+// registry, a feed, a server's "next" link): http/https agents that refuse to connect to anything
+// but a public address. Used by the registry crawler (registry/crawler.js) and by the tx module
+// when it asks other servers in the ecosystem (tx/ecosystem-resolver.js)
+//
+// The check is made when the connection is made, after the DNS lookup, so it also covers redirect
+// targets and defeats DNS rebinding. Node doesn't do a lookup when the host is an IP address
+// (http://127.0.0.1/, http://169.254.169.254/), so those are checked as well.
+
+const dns = require('dns');
+const http = require('http');
+const https = require('https');
+const net = require('net');
+const ipaddr = require('ipaddr.js');
+
+// True if an IP literal is anything other than a normal public (unicast) address:
+// loopback, private, link-local (incl. 169.254.169.254 cloud metadata), unique-local,
+// CGNAT, multicast, reserved, etc. IPv4-mapped IPv6 addresses are unwrapped first.
+function isNonPublicAddress(ip) {
+  try {
+    let addr = ipaddr.parse(ip);
+    if (addr.kind() === 'ipv6' && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    return addr.range() !== 'unicast';
+  } catch (e) {
+    return true; // unparseable - treat as unsafe
+  }
+}
+
+/**
+ * A dns.lookup replacement that fails if the host resolves to any non-public address
+ *
+ * @param {boolean} allowPrivate - don't check (e.g. for local test servers)
+ */
+function guardedLookup(allowPrivate = false) {
+  return (hostname, options, callback) => {
+    if (typeof options === 'function') {
+      callback = options;
+      options = {};
+    }
+    const wantAll = !!(options && options.all);
+    dns.lookup(hostname, Object.assign({}, options, { all: true }), (err, addresses) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      if (!allowPrivate) {
+        for (const a of addresses) {
+          if (isNonPublicAddress(a.address)) {
+            callback(new Error('Blocked request to non-public address ' + a.address + ' (host ' + hostname + ')'));
+            return;
+          }
+        }
+      }
+      if (wantAll) {
+        callback(null, addresses);
+      } else {
+        callback(null, addresses[0].address, addresses[0].family);
+      }
+    });
+  };
+}
+
+/**
+ * http and https agents (keep-alive) that only connect to public addresses. Pass them to axios
+ * as httpAgent and httpsAgent
+ *
+ * @param {Object} [options]
+ * @param {boolean} [options.allowPrivate] - don't check (e.g. for local test servers)
+ * @returns {{httpAgent: http.Agent, httpsAgent: https.Agent}}
+ */
+function createGuardedAgents({ allowPrivate = false } = {}) {
+  const lookup = guardedLookup(allowPrivate);
+  const blockedLiteral = (options) => {
+    const host = String(options.host || options.hostname || '').replace(/^\[(.*)\]$/, '$1');
+    if (!allowPrivate && net.isIP(host) && isNonPublicAddress(host)) {
+      return new Error('Blocked request to non-public address ' + host);
+    }
+    return null;
+  };
+  const guard = (Base) => class extends Base {
+    createConnection(options, cb) {
+      const err = blockedLiteral(options);
+      if (err) {
+        process.nextTick(() => cb(err));
+        return undefined;
+      }
+      return super.createConnection(Object.assign({}, options, { lookup }), cb);
+    }
+  };
+  const GuardedHttpAgent = guard(http.Agent);
+  const GuardedHttpsAgent = guard(https.Agent);
+  return {
+    httpAgent: new GuardedHttpAgent({ keepAlive: true }),
+    httpsAgent: new GuardedHttpsAgent({ keepAlive: true })
+  };
+}
+
+module.exports = { isNonPublicAddress, guardedLookup, createGuardedAgents };

package/library/static-response-stats.js

@@ -0,0 +1,16 @@
+// Count only responses handled by the static-file middleware. A fall-through
+// request belongs to a later API/page route, even when that route returns 200.
+function countStaticResponses(middleware, onHit) {
+  return (req, res, next) => {
+    const finished = () => {
+      if (res.statusCode >= 200 && res.statusCode < 300) onHit();
+    };
+    res.once('finish', finished);
+    middleware(req, res, error => {
+      res.removeListener('finish', finished);
+      next(error);
+    });
+  };
+}
+
+module.exports = { countStaticResponses };

package/library/version-utilities.js

@@ -857,6 +857,56 @@ class VersionUtilities {
         }
     }
 
+    /**
+     * Whether a resource's version matches the version a search asks for (the version search
+     * parameter): version-aware matching (see versionMatchesByAlgorithm), so 3.0.x finds 3.0.2,
+     * but 0 doesn't find 3.0.0
+     * @param {string} criteria - the version asked for
+     * @param {string} candidate - the resource's version
+     * @param {string} [versionAlgorithm] - the resource's versionAlgorithm, if it has one
+     * @returns {boolean}
+     */
+    static versionSearchMatches(criteria, candidate, versionAlgorithm = null) {
+        if (!criteria) {
+            return true;
+        }
+        if (!candidate) {
+            return false;
+        }
+        try {
+            return this.versionMatchesByAlgorithm(criteria, candidate, versionAlgorithm);
+        } catch (e) {
+            return criteria === candidate;
+        }
+    }
+
+    /**
+     * What every version that matches the criteria (see versionSearchMatches) starts with - the
+     * criteria up to its first wildcard - so a database can narrow a search before the
+     * matching is done
+     * @param {string} criteria
+     * @returns {string}
+     */
+    static versionSearchPrefix(criteria) {
+        const i = criteria.search(/[xX*?]/);
+        return i < 0 ? criteria : criteria.substring(0, i);
+    }
+
+    /**
+     * The versionAlgorithm of a resource (JSON), if it states one
+     * @param {Object} json
+     * @returns {string|null}
+     */
+    static versionAlgorithmOf(json) {
+        if (!json) {
+            return null;
+        }
+        if (json.versionAlgorithmCoding && json.versionAlgorithmCoding.code) {
+            return json.versionAlgorithmCoding.code;
+        }
+        return json.versionAlgorithmString || null;
+    }
+
     static versionMatchesByAlgorithm(criteria, candidate, versionAlgorithm) {
         validateOptionalParameter(criteria, "criteria", String);
         validateOptionalParameter(candidate, "candidate", String);