fhirsmith 0.9.7 → 0.10.1

package/registry/crawler.js

@@ -2,15 +2,34 @@
 // Crawler for gathering server information from terminology servers
 
 const axios = require('axios');
-const { 
-  ServerRegistries, 
-  ServerRegistry, 
-  ServerInformation, 
+const dns = require('dns');
+const http = require('http');
+const https = require('https');
+const ipaddr = require('ipaddr.js');
+const {
+  ServerRegistries,
+  ServerRegistry,
+  ServerInformation,
   ServerVersionInformation,
 } = require('./model');
 const {Extensions} = require("../tx/library/extensions");
 const {debugLog} = require("../tx/operation-context");
 
+// True if an IP literal is anything other than a normal public (unicast) address:
+// loopback, private, link-local (incl. 169.254.169.254 cloud metadata), unique-local,
+// CGNAT, multicast, reserved, etc. IPv4-mapped IPv6 addresses are unwrapped first.
+function isNonPublicAddress(ip) {
+  try {
+    let addr = ipaddr.parse(ip);
+    if (addr.kind() === 'ipv6' && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    return addr.range() !== 'unicast';
+  } catch (e) {
+    return true; // unparseable - treat as unsafe
+  }
+}
+
 const MASTER_URL = 'https://fhir.github.io/ig-registry/tx-servers.json';
 
 class RegistryCrawler {
@@ -22,7 +41,8 @@ class RegistryCrawler {
       masterUrl: config.masterUrl || MASTER_URL,
       userAgent: config.userAgent || 'HealthIntersections/FhirServer',
       crawlInterval: config.crawlInterval || 5 * 60 * 1000, // 5 minutes default
-      apiKeys: config.apiKeys || {} // Map of server URL or code to API key
+      apiKeys: config.apiKeys || {}, // Map of server URL or code to API key
+      allowPrivateAddresses: config.allowPrivateAddresses || false // SSRF opt-out for local test servers
     };
     this.stats = stats;
 
@@ -39,6 +59,63 @@ class RegistryCrawler {
     this.log = logv;
   }
 
+  // A DNS lookup wrapper that rejects any host resolving to a non-public address.
+  // Enforced at connection time (so it also covers redirect targets and defeats
+  // DNS-rebinding), this is the SSRF guard for outbound fetches. The registry is
+  // crawled from server-supplied "next" links, so the target host is not trusted.
+  // Set config.allowPrivateAddresses = true to disable (e.g. for local test servers).
+  ssrfLookup() {
+    const allowPrivate = !!(this.config && this.config.allowPrivateAddresses);
+    return (hostname, options, callback) => {
+      if (typeof options === 'function') {
+        callback = options;
+        options = {};
+      }
+      const wantAll = !!(options && options.all);
+      dns.lookup(hostname, Object.assign({}, options, { all: true }), (err, addresses) => {
+        if (err) {
+          callback(err);
+          return;
+        }
+        if (!allowPrivate) {
+          for (const a of addresses) {
+            if (isNonPublicAddress(a.address)) {
+              callback(new Error('Blocked request to non-public address ' + a.address + ' (host ' + hostname + ')'));
+              return;
+            }
+          }
+        }
+        if (wantAll) {
+          callback(null, addresses);
+        } else {
+          callback(null, addresses[0].address, addresses[0].family);
+        }
+      });
+    };
+  }
+
+  // http/https agents that route every connection through the SSRF lookup.
+  guardedAgents() {
+    if (!this._guardedAgents) {
+      const lookup = this.ssrfLookup();
+      class GuardedHttpAgent extends http.Agent {
+        createConnection(options, cb) {
+          return super.createConnection(Object.assign({}, options, { lookup }), cb);
+        }
+      }
+      class GuardedHttpsAgent extends https.Agent {
+        createConnection(options, cb) {
+          return super.createConnection(Object.assign({}, options, { lookup }), cb);
+        }
+      }
+      this._guardedAgents = {
+        httpAgent: new GuardedHttpAgent({ keepAlive: true }),
+        httpsAgent: new GuardedHttpsAgent({ keepAlive: true })
+      };
+    }
+    return this._guardedAgents;
+  }
+
 
   /**
    * Main entry point - crawl the registry starting from the master URL
@@ -455,7 +532,9 @@ class RegistryCrawler {
         timeout: this.config.timeout,
         headers: headers,
         signal: this.abortController?.signal,
-        validateStatus: (status) => status < 500 // Don't throw on 4xx
+        validateStatus: (status) => status < 500, // Don't throw on 4xx
+        httpAgent: this.guardedAgents().httpAgent,
+        httpsAgent: this.guardedAgents().httpsAgent
       });
       
       if (response.status >= 400) {

package/registry/registry.js

@@ -976,7 +976,15 @@ class RegistryModule {
 
       try {
         const params = this._normalizeQueryParams(req.query);
-        const {fhirVersion, url, valueSet, usage} = params;
+        const {fhirVersion, valueSet, usage, version} = params;
+        let {url} = params;
+
+        // If a version was supplied separately, fold it into the code system
+        // URL using the canonical url|version syntax that the resolver expects.
+        // Don't double up if the caller already encoded a version in the url.
+        if (version && url && !url.includes('|')) {
+          url = `${url}|${version}`;
+        }
 
         // Convert authoritativeOnly to boolean
         const authoritativeOnly = params.authoritativeOnly === 'true';
@@ -1219,6 +1227,7 @@ class RegistryModule {
   buildResolveFormContent(queryParams = {}) {
     const fhirVersion = queryParams.fhirVersion || '';
     const url = queryParams.url || '';
+    const version = queryParams.version || '';
     const valueSet = queryParams.valueSet || '';
     const authoritativeOnly = queryParams.authoritativeOnly === 'true';
 
@@ -1246,6 +1255,14 @@ class RegistryModule {
     html += '</p>';
     html += '<p class="text-muted small">Example: http://loinc.org</p>';
 
+    // Code System Version field (optional)
+    html += '<p>';
+    html += '<label for="version" class="form-label fw-bold">Code System Version</label>';
+    html += `<input type="text" class="form-control" id="version" name="version"
+           value="${escape(version)}">`;
+    html += '</p>';
+    html += '<p class="text-muted small">Optional. Example: 2.74 (combined with the Code System URL as url|version)</p>';
+
     // ValueSet URL field - now vertical
     html += '<p>';
     html += '<label for="valueSet" class="form-label fw-bold">Value Set URL</label>';

package/server.js

@@ -430,6 +430,11 @@ async function buildRootPageContent() {
   content += `<td style="background-color:${pctColor(processPCT)}"><strong>Process Memory:</strong> ${rssMB} MB of ${memLimitMB} MB (${processPCT.toFixed(0)}%)</td>`;
   content += `<td style="background-color:${pctColor(sysMemPCT)}"><strong>System Memory:</strong> ${usedMemMB} MB of ${totalMemMB} MB (${sysMemPCT.toFixed(0)}%)</td>`;
   content += '</tr>';
+  content += '<tr>';
+  content += `<td><strong>Expansion Cache:</strong> ${stats.expansionItems()} items</td>`;
+  content += `<td><strong>Client Cache:</strong> ${stats.clientCaches()} caches / ${stats.clientConcepts()} concepts</td>`;
+  content += `<td><strong>Max Client Cache:</strong> ${stats.maxClientCaches()} caches / ${stats.maxClientConcepts()} concepts</td>`;
+  content += '</tr>';
   content += getLogStats();
   content += '</table>';
 

package/stats.js

@@ -36,24 +36,26 @@ class ServerStats {
         : (now - this.startTime) / 60000;
       const requestsPerMin = minutesSinceStart > 0 ? requestsDelta / minutesSinceStart : 0;
 
-      const currentCpu = this.readSystemCpu();
-      const idleDelta = currentCpu.idle - this.lastUsage.idle;
-      const totalDelta = currentCpu.total - this.lastUsage.total;
-      const percent = totalDelta > 0 ? 100 * (1 - idleDelta / totalDelta) : 0;
-
       const loopDelay = this.eventLoopMonitor.mean / 1e6;
-      let cacheCount = 0;
+      // Two distinct caches: the expansion cache (count entries) and the client
+      // (resource) cache (count concepts held - a sense of how much it's carrying).
+      let expansionItems = 0;
+      let clientConcepts = 0;
       for (let m of this.cachingModules) {
-        cacheCount = cacheCount + m.cacheCount();
+        if (typeof m.expansionItemCount === 'function') {
+          expansionItems = expansionItems + m.expansionItemCount();
+        }
+        if (typeof m.clientConceptCount === 'function') {
+          clientConcepts = clientConcepts + m.clientConceptCount();
+        }
       }
 
-      this.history.push({time: now, mem: currentMem - this.startMem, rpm: requestsPerMin, tat: requestsTat, cpu: percent, block: loopDelay, cache : cacheCount});
+      this.history.push({time: now, mem: currentMem - this.startMem, rpm: requestsPerMin, tat: requestsTat, block: loopDelay, expansion: expansionItems, clientConcepts: clientConcepts});
 
       this.eventLoopMonitor.reset();
       this.requestCountSnapshot = combinedCount;
       this.requestTime = 0;
       this.lastTime = now;
-      this.lastUsage = currentCpu;
 
       // Prune old data (keep 24 hours)
       const cutoff = now - (24 * 60 * 60 * 1000); // 24 hours ago
@@ -65,7 +67,6 @@ class ServerStats {
     this.started = true;
     this.startMem = process.memoryUsage().heapUsed;
     this.startTime = Date.now();
-    this.lastUsage = this.readSystemCpu();
     this.lastTime = this.startTime;
     this.eventLoopMonitor = monitorEventLoopDelay({ resolution: 20 });
     this.eventLoopMonitor.enable();
@@ -141,17 +142,24 @@ class ServerStats {
     clearInterval(this.timer);
   }
 
-  readSystemCpu() {
-    const os = require('os');
-    const cpus = os.cpus();
-    let idle = 0, total = 0;
-    for (const cpu of cpus) {
-      idle += cpu.times.idle;
-      total += cpu.times.user + cpu.times.nice + cpu.times.sys + cpu.times.idle + cpu.times.irq;
+  // Live cache aggregates across all registered caching modules (defensive: a
+  // module that doesn't expose a given metric contributes 0).
+  _sumCachingModules(method) {
+    let total = 0;
+    for (let m of this.cachingModules) {
+      if (typeof m[method] === 'function') {
+        total = total + m[method]();
+      }
     }
-    return { idle, total };
+    return total;
   }
 
+  expansionItems() { return this._sumCachingModules('expansionItemCount'); }
+  clientCaches() { return this._sumCachingModules('clientCacheCount'); }
+  clientConcepts() { return this._sumCachingModules('clientConceptCount'); }
+  maxClientCaches() { return this._sumCachingModules('maxClientCacheCount'); }
+  maxClientConcepts() { return this._sumCachingModules('maxClientConceptCount'); }
+
   getTaskColor(status) {
     switch (status) {
       case "started": return "LightGrey";

package/translations/Messages.properties

@@ -1100,6 +1100,7 @@ Unable_to_resolve_system__value_set_has_multiple_matches = The System URI could
 Unable_to_resolve_system__value_set_has_no_includes_or_expansion = The System URI could not be determined for the code ''{0}'' in the ValueSet ''{1}'': value set has no includes or expansion
 UNABLE_TO_RESOLVE_SYSTEM_SYSTEM_IS_INDETERMINATE = The code system {1} referred to from value set {0} has a grammar, and the code might be valid in it
 Unable_to_resolve_value_Set_ = A definition for the value Set ''{0}'' could not be found
+CACHE_ID_UNKNOWN = The cache ''{0}'' is not known to this server. Caches are created with $cache-control?mode=start; this one was never created, or has expired or been released
 Unable_to_validate_code_without_using_server = Unable to validate code without using server because: {0}
 Undefined_attribute__on__for_type__properties__ = Undefined attribute ''@{0}'' on {1} for type {2}
 Undefined_element_ = Undefined element ''{0}'' at {1}

package/tx/html/home-metrics.liquid

@@ -4,7 +4,7 @@
     <canvas id="memoryChart" height="200"></canvas>
   </div>
   <div style="flex: 1;">
-    <h6>Cache</h6>
+    <h6>Expansion Cache</h6>
     <canvas id="cacheChart" height="200"></canvas>
   </div>
   <div style="flex: 1;">
@@ -18,8 +18,8 @@
     <canvas id="requestChart" height="200"></canvas>
   </div>
   <div style="flex: 1;">
-    <h6>CPU Usage (%)</h6>
-    <canvas id="cpuChart" height="200"></canvas>
+    <h6>Client Cache</h6>
+    <canvas id="clientCacheChart" height="200"></canvas>
   </div>
   <div style="flex: 1;">
     <h6>Node Blocking</h6>
@@ -99,13 +99,13 @@
     }
   });
 
-  // Cache chart
+  // Expansion cache chart
   new Chart(document.getElementById('cacheChart'), {
     type: 'line',
     data: {
       labels: historyData.map(d => formatTime(d.time)),
       datasets: [{
-        data: historyData.map(d => d.cache),
+        data: historyData.map(d => d.expansion),
         borderColor: '#7b7b7b',
         backgroundColor: 'rgba(123, 123, 123, 0.1)',
         fill: true,
@@ -121,7 +121,7 @@
           ...chartOptions.scales.y,
           title: {
             display: true,
-            text: '# cached items'
+            text: 'Expansion cache # items'
           }
         }
       }
@@ -158,13 +158,13 @@
     }
   });
 
-  // CPU chart
-  new Chart(document.getElementById('cpuChart'), {
+  // Client cache concepts chart
+  new Chart(document.getElementById('clientCacheChart'), {
     type: 'line',
     data: {
       labels: historyData.map(d => formatTime(d.time)),
       datasets: [{
-        data: historyData.map(d => parseFloat(formatMB(d.cpu))),
+        data: historyData.map(d => d.clientConcepts),
         borderColor: '#ff7b00',
         backgroundColor: 'rgba(255, 123, 0, 0.1)',
         fill: true,
@@ -180,7 +180,7 @@
           ...chartOptions.scales.y,
           title: {
             display: true,
-            text: '%'
+            text: 'Client Cache # concepts'
           }
         }
       }

package/tx/library/codesystem.js

@@ -42,6 +42,37 @@ class CodeSystem extends CanonicalResource {
       }
       this.buildMaps();
     }
+    // Precalculated at construction so callers (e.g. the resource cache) have a
+    // cheap O(1) sense of how large this resource is.
+    this._conceptCount = CodeSystem._countConcepts(this.jsonObj.concept);
+  }
+
+  /**
+   * Number of concepts defined in this CodeSystem, counted recursively (nested
+   * concepts included). Precalculated at construction time.
+   * @returns {number}
+   */
+  conceptCount() {
+    return this._conceptCount;
+  }
+
+  /**
+   * Recursively count concepts (including nested `concept` children).
+   * @param {Array} concepts
+   * @returns {number}
+   */
+  static _countConcepts(concepts) {
+    if (!Array.isArray(concepts)) {
+      return 0;
+    }
+    let n = 0;
+    for (const c of concepts) {
+      n++;
+      if (c && c.concept) {
+        n += CodeSystem._countConcepts(c.concept);
+      }
+    }
+    return n;
   }
 
   /**

package/tx/library/conceptmap.js

@@ -20,6 +20,30 @@ class ConceptMap extends CanonicalResource {
     this.jsonObj = conceptMapToR5(jsonObj, fhirVersion);
     this.validate();
     this.id = this.jsonObj.id;
+    // Precalculated at construction so callers (e.g. the resource cache) have a
+    // cheap O(1) sense of how large this resource is.
+    this._conceptCount = ConceptMap._countConcepts(this.jsonObj);
+  }
+
+  /**
+   * Number of concept nodes this ConceptMap carries: every source `element` plus
+   * every `target` across all groups (each is a coded node, so this approximates
+   * the resource's size). Precalculated at construction time.
+   * @returns {number}
+   */
+  conceptCount() {
+    return this._conceptCount;
+  }
+
+  static _countConcepts(jsonObj) {
+    let n = 0;
+    for (const g of ((jsonObj && jsonObj.group) || [])) {
+      for (const e of (g.element || [])) {
+        n++;
+        n += Array.isArray(e.target) ? e.target.length : 0;
+      }
+    }
+    return n;
   }
 
   /**

package/tx/library/renderer.js

@@ -340,12 +340,12 @@ class Renderer {
     }
   }
 
-  renderLinkComma(x, uri) {
-    let {desc, url} = (this.linkResolver ? this.linkResolver.resolveURL(this.opContext, uri) : null) || {};
-    if (url) {
-      x.commaItem(desc, url);
+  async renderLinkComma(x, uri) {
+    let {description, link} = await (this.linkResolver ? this.linkResolver.resolveURL(this.opContext, uri) : null) || {};
+    if (link) {
+      x.commaItem(description, link);
     } else {
-      x.commaItem(uri);
+      x.commaItem(link);
     }
   }
 
@@ -673,7 +673,7 @@ class Renderer {
       p.tx(" ");
       p.startCommaList("and");
       for (let ext of supplements) {
-        this.renderLinkComma(p, getValuePrimitive(ext));
+        await this.renderLinkComma(p, getValuePrimitive(ext));
       }
       p.stopCommaList();
       p.tx(".");
@@ -762,10 +762,10 @@ class Renderer {
         li.stopCommaList();
       }
     } else if (inc.valueSet && inc.valueSet.length > 0) {
-      li.tx(this.translatePlural(inc.valueSet.length, 'VALUE_SET_RULES_INC'));
+      li.tx(this.translatePlural(inc.valueSet.length, 'VALUE_SET_IMPORT')+" ");
       li.startCommaList("and");
       for (let vs of inc.valueSet) {
-        this.renderLinkComma(li, vs);
+        await this.renderLinkComma(li, vs);
       }
       li.stopCommaList();
     } else {

package/tx/library/valueset.js

@@ -25,6 +25,52 @@ class ValueSet extends CanonicalResource {
     this.jsonObj = valueSetToR5(jsonObj, fhirVersion);
     this.validate();
     this.buildMaps();
+    // Precalculated at construction so callers (e.g. the resource cache) have a
+    // cheap O(1) sense of how large this resource is.
+    this._conceptCount = ValueSet._countConcepts(this.jsonObj);
+  }
+
+  /**
+   * Number of concepts this ValueSet carries: the enumerated concepts in its
+   * compose (include + exclude `concept` lists) plus any concepts in an inline
+   * expansion (`expansion.contains`, counted recursively). Note this counts the
+   * concepts *present in the resource*, not the (possibly unbounded) size of the
+   * value set's full expansion. Precalculated at construction time.
+   * @returns {number}
+   */
+  conceptCount() {
+    return this._conceptCount;
+  }
+
+  static _countConcepts(jsonObj) {
+    let n = 0;
+    const compose = jsonObj && jsonObj.compose;
+    if (compose) {
+      for (const inc of (compose.include || [])) {
+        n += Array.isArray(inc.concept) ? inc.concept.length : 0;
+      }
+      for (const exc of (compose.exclude || [])) {
+        n += Array.isArray(exc.concept) ? exc.concept.length : 0;
+      }
+    }
+    if (jsonObj && jsonObj.expansion) {
+      n += ValueSet._countContains(jsonObj.expansion.contains);
+    }
+    return n;
+  }
+
+  static _countContains(items) {
+    if (!Array.isArray(items)) {
+      return 0;
+    }
+    let n = 0;
+    for (const it of items) {
+      n++;
+      if (it && it.contains) {
+        n += ValueSet._countContains(it.contains);
+      }
+    }
+    return n;
   }
 
   /**