diff --git a/docs/package-lock.json b/docs/package-lock.json index 609fc5469..fc5fed6a0 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -1966,6 +1966,22 @@ "dev": true, "license": "MIT" }, + "node_modules/@standard-schema/spec": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz", + "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==", + "dev": true + }, + "node_modules/@types/chai": { + "version": "5.2.3", + "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz", + "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==", + "dev": true, + "dependencies": { + "@types/deep-eql": "*", + "assertion-error": "^2.0.1" + } + }, "node_modules/@types/debug": { "version": "4.1.12", "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz", @@ -1976,6 +1992,12 @@ "@types/ms": "*" } }, + "node_modules/@types/deep-eql": { + "version": "4.0.2", + "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz", + "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==", + "dev": true + }, "node_modules/@types/estree": { "version": "1.0.8", "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz", @@ -2136,6 +2158,119 @@ "vue": "^3.2.25" } }, + "node_modules/@vitest/expect": { + "version": "4.0.18", + "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.0.18.tgz", + "integrity": "sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==", + "dev": true, + "dependencies": { + "@standard-schema/spec": "^1.0.0", + "@types/chai": "^5.2.2", + "@vitest/spy": "4.0.18", + "@vitest/utils": "4.0.18", + "chai": "^6.2.1", + "tinyrainbow": "^3.0.3" + }, + "funding": { + "url": "https://opencollective.com/vitest" + } + }, + "node_modules/@vitest/mocker": { + "version": "4.0.18", + "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.0.18.tgz", + "integrity": "sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==", + "dev": true, + "dependencies": { + "@vitest/spy": "4.0.18", + "estree-walker": "^3.0.3", + "magic-string": "^0.30.21" + }, + "funding": { + "url": "https://opencollective.com/vitest" + }, + "peerDependencies": { + "msw": "^2.4.9", + "vite": "^6.0.0 || ^7.0.0-0" + }, + "peerDependenciesMeta": { + "msw": { + "optional": true + }, + "vite": { + "optional": true + } + } + }, + "node_modules/@vitest/mocker/node_modules/estree-walker": { + "version": "3.0.3", + "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz", + "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==", + "dev": true, + "dependencies": { + "@types/estree": "^1.0.0" + } + }, + "node_modules/@vitest/pretty-format": { + "version": "4.0.18", + "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.0.18.tgz", + "integrity": "sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==", + "dev": true, + "dependencies": { + "tinyrainbow": "^3.0.3" + }, + "funding": { + "url": "https://opencollective.com/vitest" + } + }, + "node_modules/@vitest/runner": { + "version": "4.0.18", + "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.0.18.tgz", + "integrity": "sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==", + "dev": true, + "dependencies": { + "@vitest/utils": "4.0.18", + "pathe": "^2.0.3" + }, + "funding": { + "url": "https://opencollective.com/vitest" + } + }, + "node_modules/@vitest/snapshot": { + "version": "4.0.18", + "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.0.18.tgz", + "integrity": "sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==", + "dev": true, + "dependencies": { + "@vitest/pretty-format": "4.0.18", + "magic-string": "^0.30.21", + "pathe": "^2.0.3" + }, + "funding": { + "url": "https://opencollective.com/vitest" + } + }, + "node_modules/@vitest/spy": { + "version": "4.0.18", + "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.0.18.tgz", + "integrity": "sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==", + "dev": true, + "funding": { + "url": "https://opencollective.com/vitest" + } + }, + "node_modules/@vitest/utils": { + "version": "4.0.18", + "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.0.18.tgz", + "integrity": "sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==", + "dev": true, + "dependencies": { + "@vitest/pretty-format": "4.0.18", + "tinyrainbow": "^3.0.3" + }, + "funding": { + "url": "https://opencollective.com/vitest" + } + }, "node_modules/@vue/compiler-core": { "version": "3.5.28", "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.28.tgz", @@ -3188,6 +3323,15 @@ "sprintf-js": "~1.0.2" } }, + "node_modules/assertion-error": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz", + "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==", + "dev": true, + "engines": { + "node": ">=12" + } + }, "node_modules/autoprefixer": { "version": "10.4.21", "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.21.tgz", @@ -3364,6 +3508,15 @@ "url": "https://github.com/sponsors/wooorm" } }, + "node_modules/chai": { + "version": "6.2.2", + "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz", + "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==", + "dev": true, + "engines": { + "node": ">=18" + } + }, "node_modules/chalk": { "version": "5.6.2", "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz", @@ -3824,6 +3977,12 @@ "node": ">=4" } }, + "node_modules/es-module-lexer": { + "version": "1.7.0", + "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz", + "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==", + "dev": true + }, "node_modules/esbuild": { "version": "0.25.12", "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz", @@ -3896,6 +4055,15 @@ "dev": true, "license": "MIT" }, + "node_modules/expect-type": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz", + "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==", + "dev": true, + "engines": { + "node": ">=12.0.0" + } + }, "node_modules/extend": { "version": "3.0.2", "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz", @@ -4767,6 +4935,16 @@ "url": "https://github.com/fb55/nth-check?sponsor=1" } }, + "node_modules/obug": { + "version": "2.1.1", + "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz", + "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==", + "dev": true, + "funding": [ + "https://github.com/sponsors/sxzz", + "https://opencollective.com/debug" + ] + }, "node_modules/onetime": { "version": "7.0.0", "resolved": "https://registry.npmjs.org/onetime/-/onetime-7.0.0.tgz", @@ -4923,6 +5101,12 @@ "node": ">=8" } }, + "node_modules/pathe": { + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz", + "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==", + "dev": true + }, "node_modules/perfect-debounce": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-2.1.0.tgz", @@ -5729,6 +5913,12 @@ "@types/hast": "^3.0.4" } }, + "node_modules/siginfo": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz", + "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==", + "dev": true + }, "node_modules/signal-exit": { "version": "4.1.0", "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz", @@ -5808,6 +5998,18 @@ "dev": true, "license": "BSD-3-Clause" }, + "node_modules/stackback": { + "version": "0.0.2", + "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz", + "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==", + "dev": true + }, + "node_modules/std-env": { + "version": "3.10.0", + "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz", + "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==", + "dev": true + }, "node_modules/stdin-discarder": { "version": "0.3.1", "resolved": "https://registry.npmjs.org/stdin-discarder/-/stdin-discarder-0.3.1.tgz", @@ -5943,6 +6145,21 @@ "url": "https://opencollective.com/synckit" } }, + "node_modules/tinybench": { + "version": "2.9.0", + "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz", + "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==", + "dev": true + }, + "node_modules/tinyexec": { + "version": "1.2.4", + "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz", + "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==", + "dev": true, + "engines": { + "node": ">=18" + } + }, "node_modules/tinyglobby": { "version": "0.2.15", "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz", @@ -5991,6 +6208,15 @@ "url": "https://github.com/sponsors/jonschlinkert" } }, + "node_modules/tinyrainbow": { + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz", + "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==", + "dev": true, + "engines": { + "node": ">=14.0.0" + } + }, "node_modules/to-regex-range": { "version": "5.0.1", "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz", @@ -6821,6 +7047,95 @@ "url": "https://github.com/sponsors/jonschlinkert" } }, + "node_modules/vitest": { + "version": "4.0.18", + "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.0.18.tgz", + "integrity": "sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==", + "dev": true, + "dependencies": { + "@vitest/expect": "4.0.18", + "@vitest/mocker": "4.0.18", + "@vitest/pretty-format": "4.0.18", + "@vitest/runner": "4.0.18", + "@vitest/snapshot": "4.0.18", + "@vitest/spy": "4.0.18", + "@vitest/utils": "4.0.18", + "es-module-lexer": "^1.7.0", + "expect-type": "^1.2.2", + "magic-string": "^0.30.21", + "obug": "^2.1.1", + "pathe": "^2.0.3", + "picomatch": "^4.0.3", + "std-env": "^3.10.0", + "tinybench": "^2.9.0", + "tinyexec": "^1.0.2", + "tinyglobby": "^0.2.15", + "tinyrainbow": "^3.0.3", + "vite": "^6.0.0 || ^7.0.0", + "why-is-node-running": "^2.3.0" + }, + "bin": { + "vitest": "vitest.mjs" + }, + "engines": { + "node": "^20.0.0 || ^22.0.0 || >=24.0.0" + }, + "funding": { + "url": "https://opencollective.com/vitest" + }, + "peerDependencies": { + "@edge-runtime/vm": "*", + "@opentelemetry/api": "^1.9.0", + "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", + "@vitest/browser-playwright": "4.0.18", + "@vitest/browser-preview": "4.0.18", + "@vitest/browser-webdriverio": "4.0.18", + "@vitest/ui": "4.0.18", + "happy-dom": "*", + "jsdom": "*" + }, + "peerDependenciesMeta": { + "@edge-runtime/vm": { + "optional": true + }, + "@opentelemetry/api": { + "optional": true + }, + "@types/node": { + "optional": true + }, + "@vitest/browser-playwright": { + "optional": true + }, + "@vitest/browser-preview": { + "optional": true + }, + "@vitest/browser-webdriverio": { + "optional": true + }, + "@vitest/ui": { + "optional": true + }, + "happy-dom": { + "optional": true + }, + "jsdom": { + "optional": true + } + } + }, + "node_modules/vitest/node_modules/picomatch": { + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", + "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==", + "dev": true, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/jonschlinkert" + } + }, "node_modules/vue": { "version": "3.5.28", "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.28.tgz", @@ -7257,6 +7572,22 @@ "dev": true, "license": "ISC" }, + "node_modules/why-is-node-running": { + "version": "2.3.0", + "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz", + "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==", + "dev": true, + "dependencies": { + "siginfo": "^2.0.0", + "stackback": "0.0.2" + }, + "bin": { + "why-is-node-running": "cli.js" + }, + "engines": { + "node": ">=8" + } + }, "node_modules/wrap-ansi": { "version": "6.2.0", "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz", diff --git a/docs/package.json b/docs/package.json index 74c0059da..1c78d5e7e 100644 --- a/docs/package.json +++ b/docs/package.json @@ -9,7 +9,9 @@ "docs:clean-dev": "vuepress dev src --clean-cache", "docs:dev": "vuepress dev src", "docs:generate-llms": "npx tsx src/.vuepress/scripts/generate-llms.ts", - "docs:update-package": "npx vp-update" + "docs:update-package": "npx vp-update", + "test": "vitest run", + "test:watch": "vitest" }, "devDependencies": { "@vuepress/bundler-vite": "2.0.0-rc.26", @@ -21,6 +23,7 @@ "sass-embedded": "1.97.3", "sass-loader": "16.0.7", "tsx": "4.22.4", + "vitest": "4.0.18", "vue": "3.5.28", "vuepress": "2.0.0-rc.26", "vuepress-theme-hope": "2.0.0-rc.102" diff --git a/docs/src/.vuepress/client.ts b/docs/src/.vuepress/client.ts index 7ee02bc47..9bb3e64a0 100644 --- a/docs/src/.vuepress/client.ts +++ b/docs/src/.vuepress/client.ts @@ -4,12 +4,14 @@ import { Layout as ParentLayout } from "vuepress-theme-hope/client"; import Layout from './layouts/PageLayout.vue' import NotFoundLayout from './layouts/NotFoundLayout.vue' import BlogLayout from './layouts/BlogLayout.vue'; +import AllowListGenerator from './components/AllowListGenerator.vue'; import OldVersions from './components/OldVersions.vue'; export default defineClientConfig({ enhance({ app }) { app.component('OldVersions', OldVersions); + app.component('AllowListGenerator', AllowListGenerator); }, layouts: { ParentLayout, diff --git a/docs/src/.vuepress/components/AllowListGenerator.vue b/docs/src/.vuepress/components/AllowListGenerator.vue new file mode 100644 index 000000000..3300f5e71 --- /dev/null +++ b/docs/src/.vuepress/components/AllowListGenerator.vue @@ -0,0 +1,385 @@ + + + + + diff --git a/docs/src/.vuepress/components/allowlist-bundle.js b/docs/src/.vuepress/components/allowlist-bundle.js new file mode 100644 index 000000000..0e95bca4a --- /dev/null +++ b/docs/src/.vuepress/components/allowlist-bundle.js @@ -0,0 +1,194 @@ +const META_TAG = { + system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag', + code: 'ALL', +}; + +export function deriveEndpointIdentifier(url) { + if (!url || !url.trim()) return ''; + try { + const hostname = new URL(url.trim()).hostname; + return hostname ? hostname + '-endpoint' : ''; + } catch { + return ''; + } +} + +export function getEndpointIdentifier(org) { + return org.endpointIdentifierOverride?.trim() || deriveEndpointIdentifier(org.endpointUrl); +} + +export function validate(parentOrg, members) { + const errors = []; + if (!parentOrg.identifier.trim()) errors.push('Parent organization identifier is required.'); + + if (members.length === 0) errors.push('At least one member organization is required.'); + + members.forEach((m, i) => { + const n = i + 1; + if (!m.identifier.trim()) errors.push(`Member ${n}: Identifier is required.`); + if (!m.endpointUrl.trim()) errors.push(`Member ${n}: DSF FHIR Server Endpoint URL is required.`); + if (!getEndpointIdentifier(m)) errors.push(`Member ${n}: Endpoint identifier could not be derived. Please enter the URL or override manually.`); + const mTps = m.thumbprints.filter(t => t.trim()); + if (mTps.length === 0) errors.push(`Member ${n}: At least one certificate thumbprint is required.`); + if (m.roles.length === 0) errors.push(`Member ${n}: At least one role must be selected.`); + }); + + return errors; +} + +export function buildParentOrganization(org) { + return { + resourceType: 'Organization', + meta: { + profile: ['http://dsf.dev/fhir/StructureDefinition/organization-parent'], + tag: [META_TAG], + }, + active: true, + identifier: [{ + system: 'http://dsf.dev/sid/organization-identifier', + value: org.identifier.trim(), + }], + name: org.name.trim() || undefined, + }; +} + +export function buildMemberOrganization(org, endpointId) { + const thumbprintExtensions = org.thumbprints + .filter(t => t.trim()) + .map(t => ({ + url: 'http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint', + valueString: t.trim(), + })); + + return { + resourceType: 'Organization', + meta: { + profile: ['http://dsf.dev/fhir/StructureDefinition/organization'], + tag: [META_TAG], + }, + extension: thumbprintExtensions, + active: true, + identifier: [{ + system: 'http://dsf.dev/sid/organization-identifier', + value: org.identifier.trim(), + }], + name: org.name.trim() || undefined, + endpoint: [{ + reference: `urn:uuid:${endpointId}`, + type: 'Endpoint', + }], + }; +} + +export function buildEndpoint(org, managingOrgId) { + return { + resourceType: 'Endpoint', + meta: { + profile: ['http://dsf.dev/fhir/StructureDefinition/endpoint'], + tag: [META_TAG], + }, + status: 'active', + identifier: [{ + system: 'http://dsf.dev/sid/endpoint-identifier', + value: getEndpointIdentifier(org), + }], + connectionType: { + system: 'http://terminology.hl7.org/CodeSystem/endpoint-connection-type', + code: 'hl7-fhir-rest', + }, + name: `DSF Endpoint for ${org.identifier.trim()}`, + managingOrganization: { + reference: `urn:uuid:${managingOrgId}`, + type: 'Organization', + }, + payloadType: [{ + coding: [{ + system: 'http://hl7.org/fhir/resource-types', + code: 'Task', + }], + }], + payloadMimeType: ['application/fhir+json', 'application/fhir+xml'], + address: org.endpointUrl.trim(), + }; +} + +export function buildAffiliation(parentOrgId, memberOrgId, endpointId, roles) { + return { + resourceType: 'OrganizationAffiliation', + meta: { + profile: ['http://dsf.dev/fhir/StructureDefinition/organization-affiliation'], + tag: [META_TAG], + }, + active: true, + organization: { + reference: `urn:uuid:${parentOrgId}`, + type: 'Organization', + }, + participatingOrganization: { + reference: `urn:uuid:${memberOrgId}`, + type: 'Organization', + }, + code: roles.map(r => ({ + coding: [{ + system: 'http://dsf.dev/fhir/CodeSystem/organization-role', + code: r, + }], + })), + endpoint: [{ + reference: `urn:uuid:${endpointId}`, + type: 'Endpoint', + }], + }; +} + +export function generateBundle(parentOrg, members, uuidFn) { + const entries = []; + const parentOrgId = uuidFn(); + + entries.push({ + fullUrl: `urn:uuid:${parentOrgId}`, + resource: buildParentOrganization(parentOrg), + request: { + method: 'PUT', + url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}`, + }, + }); + + members.forEach(member => { + const memberOrgId = uuidFn(); + const memberEndpointId = uuidFn(); + + entries.push({ + fullUrl: `urn:uuid:${memberOrgId}`, + resource: buildMemberOrganization(member, memberEndpointId), + request: { + method: 'PUT', + url: `Organization?identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`, + }, + }); + + entries.push({ + fullUrl: `urn:uuid:${memberEndpointId}`, + resource: buildEndpoint(member, memberOrgId), + request: { + method: 'PUT', + url: `Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|${encodeURIComponent(getEndpointIdentifier(member))}`, + }, + }); + + entries.push({ + fullUrl: `urn:uuid:${uuidFn()}`, + resource: buildAffiliation(parentOrgId, memberOrgId, memberEndpointId, member.roles), + request: { + method: 'PUT', + url: `OrganizationAffiliation?primary-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(parentOrg.identifier.trim())}&participating-organization:identifier=http://dsf.dev/sid/organization-identifier|${encodeURIComponent(member.identifier.trim())}`, + }, + }); + }); + + return { + resourceType: 'Bundle', + type: 'transaction', + entry: entries, + }; +} diff --git a/docs/src/.vuepress/components/allowlist-bundle.test.js b/docs/src/.vuepress/components/allowlist-bundle.test.js new file mode 100644 index 000000000..30e01d532 --- /dev/null +++ b/docs/src/.vuepress/components/allowlist-bundle.test.js @@ -0,0 +1,497 @@ +import { describe, it, expect } from 'vitest'; +import { + deriveEndpointIdentifier, + getEndpointIdentifier, + validate, + buildParentOrganization, + buildMemberOrganization, + buildEndpoint, + buildAffiliation, + generateBundle, +} from './allowlist-bundle.js'; + +// -- Helper: valid member org data -- +function validMember(overrides = {}) { + return { + identifier: 'hospital.example.org', + name: 'Example Hospital', + endpointUrl: 'https://dsf.hospital.example.org/fhir', + endpointIdentifierOverride: '', + thumbprints: ['aabbccdd'], + roles: ['DIC'], + ...overrides, + }; +} + +function validParent(overrides = {}) { + return { identifier: 'dsf.dev', name: 'DSF Community', ...overrides }; +} + +// ============================================= +// deriveEndpointIdentifier +// ============================================= +describe('deriveEndpointIdentifier', () => { + it('extracts hostname and appends -endpoint', () => { + expect(deriveEndpointIdentifier('https://dsf.hospital.example.org/fhir')) + .toBe('dsf.hospital.example.org-endpoint'); + }); + + it('works with plain hostname URL', () => { + expect(deriveEndpointIdentifier('https://example.org')) + .toBe('example.org-endpoint'); + }); + + it('returns empty string for empty input', () => { + expect(deriveEndpointIdentifier('')).toBe(''); + expect(deriveEndpointIdentifier(null)).toBe(''); + expect(deriveEndpointIdentifier(undefined)).toBe(''); + }); + + it('returns empty string for invalid URL', () => { + expect(deriveEndpointIdentifier('not-a-url')).toBe(''); + }); + + it('handles whitespace around URL', () => { + expect(deriveEndpointIdentifier(' https://example.org/fhir ')) + .toBe('example.org-endpoint'); + }); + + it('handles URL with port', () => { + expect(deriveEndpointIdentifier('https://dsf.example.org:8443/fhir')) + .toBe('dsf.example.org-endpoint'); + }); +}); + +// ============================================= +// getEndpointIdentifier +// ============================================= +describe('getEndpointIdentifier', () => { + it('uses override when provided', () => { + const org = { endpointUrl: 'https://example.org/fhir', endpointIdentifierOverride: 'custom-id' }; + expect(getEndpointIdentifier(org)).toBe('custom-id'); + }); + + it('derives from URL when no override', () => { + const org = { endpointUrl: 'https://dsf.example.org/fhir', endpointIdentifierOverride: '' }; + expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint'); + }); + + it('derives from URL when override is whitespace only', () => { + const org = { endpointUrl: 'https://dsf.example.org/fhir', endpointIdentifierOverride: ' ' }; + expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint'); + }); + + it('handles missing override property', () => { + const org = { endpointUrl: 'https://dsf.example.org/fhir' }; + expect(getEndpointIdentifier(org)).toBe('dsf.example.org-endpoint'); + }); +}); + +// ============================================= +// validate +// ============================================= +describe('validate', () => { + it('returns no errors for valid input', () => { + const errors = validate(validParent(), [validMember()]); + expect(errors).toEqual([]); + }); + + it('requires parent identifier', () => { + const errors = validate(validParent({ identifier: '' }), [validMember()]); + expect(errors).toContain('Parent organization identifier is required.'); + }); + + it('requires at least one member', () => { + const errors = validate(validParent(), []); + expect(errors).toContain('At least one member organization is required.'); + }); + + it('requires member identifier', () => { + const errors = validate(validParent(), [validMember({ identifier: '' })]); + expect(errors).toContain('Member 1: Identifier is required.'); + }); + + it('requires member endpoint URL', () => { + const errors = validate(validParent(), [validMember({ endpointUrl: '' })]); + expect(errors).toContain('Member 1: DSF FHIR Server Endpoint URL is required.'); + }); + + it('requires derivable endpoint identifier', () => { + const errors = validate(validParent(), [validMember({ endpointUrl: 'not-a-url', endpointIdentifierOverride: '' })]); + expect(errors).toContain('Member 1: Endpoint identifier could not be derived. Please enter the URL or override manually.'); + }); + + it('accepts manual endpoint identifier override for invalid URL', () => { + const errors = validate(validParent(), [validMember({ endpointUrl: 'not-a-url', endpointIdentifierOverride: 'my-endpoint' })]); + expect(errors).not.toContain(expect.stringContaining('Endpoint identifier')); + }); + + it('requires at least one thumbprint', () => { + const errors = validate(validParent(), [validMember({ thumbprints: [''] })]); + expect(errors).toContain('Member 1: At least one certificate thumbprint is required.'); + }); + + it('requires at least one role', () => { + const errors = validate(validParent(), [validMember({ roles: [] })]); + expect(errors).toContain('Member 1: At least one role must be selected.'); + }); + + it('validates multiple members independently', () => { + const members = [ + validMember(), + validMember({ identifier: '', endpointUrl: '' }), + ]; + const errors = validate(validParent(), members); + expect(errors).toContain('Member 2: Identifier is required.'); + expect(errors).toContain('Member 2: DSF FHIR Server Endpoint URL is required.'); + expect(errors).not.toContain(expect.stringContaining('Member 1')); + }); +}); + +// ============================================= +// buildParentOrganization +// ============================================= +describe('buildParentOrganization', () => { + it('uses organization-parent profile', () => { + const org = buildParentOrganization(validParent()); + expect(org.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization-parent']); + }); + + it('sets resourceType to Organization', () => { + const org = buildParentOrganization(validParent()); + expect(org.resourceType).toBe('Organization'); + }); + + it('sets identifier correctly', () => { + const org = buildParentOrganization(validParent()); + expect(org.identifier[0].system).toBe('http://dsf.dev/sid/organization-identifier'); + expect(org.identifier[0].value).toBe('dsf.dev'); + }); + + it('includes read-access-tag ALL', () => { + const org = buildParentOrganization(validParent()); + expect(org.meta.tag).toEqual([{ system: 'http://dsf.dev/fhir/CodeSystem/read-access-tag', code: 'ALL' }]); + }); + + it('sets active to true', () => { + const org = buildParentOrganization(validParent()); + expect(org.active).toBe(true); + }); + + it('includes name when provided', () => { + const org = buildParentOrganization(validParent({ name: 'My Consortium' })); + expect(org.name).toBe('My Consortium'); + }); + + it('omits name when empty', () => { + const org = buildParentOrganization(validParent({ name: '' })); + expect(org.name).toBeUndefined(); + }); + + it('has no endpoint reference', () => { + const org = buildParentOrganization(validParent()); + expect(org.endpoint).toBeUndefined(); + }); + + it('has no certificate thumbprint extensions', () => { + const org = buildParentOrganization(validParent()); + expect(org.extension).toBeUndefined(); + }); + + it('trims whitespace from identifier', () => { + const org = buildParentOrganization(validParent({ identifier: ' dsf.dev ' })); + expect(org.identifier[0].value).toBe('dsf.dev'); + }); +}); + +// ============================================= +// buildMemberOrganization +// ============================================= +describe('buildMemberOrganization', () => { + it('uses organization profile (not organization-parent)', () => { + const org = buildMemberOrganization(validMember(), 'ep-uuid'); + expect(org.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization']); + }); + + it('includes certificate thumbprint extensions', () => { + const org = buildMemberOrganization(validMember({ thumbprints: ['abc123', 'def456'] }), 'ep-uuid'); + expect(org.extension).toHaveLength(2); + expect(org.extension[0].url).toBe('http://dsf.dev/fhir/StructureDefinition/extension-certificate-thumbprint'); + expect(org.extension[0].valueString).toBe('abc123'); + expect(org.extension[1].valueString).toBe('def456'); + }); + + it('filters empty thumbprints', () => { + const org = buildMemberOrganization(validMember({ thumbprints: ['abc123', '', ' '] }), 'ep-uuid'); + expect(org.extension).toHaveLength(1); + }); + + it('includes endpoint reference', () => { + const org = buildMemberOrganization(validMember(), 'my-ep-id'); + expect(org.endpoint[0].reference).toBe('urn:uuid:my-ep-id'); + expect(org.endpoint[0].type).toBe('Endpoint'); + }); + + it('includes read-access-tag ALL', () => { + const org = buildMemberOrganization(validMember(), 'ep-uuid'); + expect(org.meta.tag[0].code).toBe('ALL'); + }); +}); + +// ============================================= +// buildEndpoint +// ============================================= +describe('buildEndpoint', () => { + it('sets resourceType to Endpoint', () => { + const ep = buildEndpoint(validMember(), 'org-uuid'); + expect(ep.resourceType).toBe('Endpoint'); + }); + + it('uses endpoint profile', () => { + const ep = buildEndpoint(validMember(), 'org-uuid'); + expect(ep.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/endpoint']); + }); + + it('derives endpoint identifier from URL', () => { + const ep = buildEndpoint(validMember(), 'org-uuid'); + expect(ep.identifier[0].value).toBe('dsf.hospital.example.org-endpoint'); + expect(ep.identifier[0].system).toBe('http://dsf.dev/sid/endpoint-identifier'); + }); + + it('uses override endpoint identifier when set', () => { + const ep = buildEndpoint(validMember({ endpointIdentifierOverride: 'custom-ep' }), 'org-uuid'); + expect(ep.identifier[0].value).toBe('custom-ep'); + }); + + it('sets connectionType to hl7-fhir-rest', () => { + const ep = buildEndpoint(validMember(), 'org-uuid'); + expect(ep.connectionType.code).toBe('hl7-fhir-rest'); + }); + + it('sets address to endpoint URL', () => { + const ep = buildEndpoint(validMember(), 'org-uuid'); + expect(ep.address).toBe('https://dsf.hospital.example.org/fhir'); + }); + + it('references managing organization', () => { + const ep = buildEndpoint(validMember(), 'org-uuid-123'); + expect(ep.managingOrganization.reference).toBe('urn:uuid:org-uuid-123'); + expect(ep.managingOrganization.type).toBe('Organization'); + }); + + it('sets payloadType to Task', () => { + const ep = buildEndpoint(validMember(), 'org-uuid'); + expect(ep.payloadType[0].coding[0].code).toBe('Task'); + }); + + it('includes both FHIR MIME types', () => { + const ep = buildEndpoint(validMember(), 'org-uuid'); + expect(ep.payloadMimeType).toContain('application/fhir+json'); + expect(ep.payloadMimeType).toContain('application/fhir+xml'); + }); + + it('sets status to active', () => { + const ep = buildEndpoint(validMember(), 'org-uuid'); + expect(ep.status).toBe('active'); + }); +}); + +// ============================================= +// buildAffiliation +// ============================================= +describe('buildAffiliation', () => { + it('sets resourceType to OrganizationAffiliation', () => { + const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']); + expect(aff.resourceType).toBe('OrganizationAffiliation'); + }); + + it('uses organization-affiliation profile', () => { + const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']); + expect(aff.meta.profile).toEqual(['http://dsf.dev/fhir/StructureDefinition/organization-affiliation']); + }); + + it('references parent organization', () => { + const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']); + expect(aff.organization.reference).toBe('urn:uuid:parent-id'); + expect(aff.organization.type).toBe('Organization'); + }); + + it('references participating organization', () => { + const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']); + expect(aff.participatingOrganization.reference).toBe('urn:uuid:member-id'); + }); + + it('references endpoint', () => { + const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']); + expect(aff.endpoint[0].reference).toBe('urn:uuid:ep-id'); + }); + + it('maps roles to CodeSystem codes', () => { + const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC', 'TTP']); + expect(aff.code).toHaveLength(2); + expect(aff.code[0].coding[0].system).toBe('http://dsf.dev/fhir/CodeSystem/organization-role'); + expect(aff.code[0].coding[0].code).toBe('DIC'); + expect(aff.code[1].coding[0].code).toBe('TTP'); + }); + + it('sets active to true', () => { + const aff = buildAffiliation('parent-id', 'member-id', 'ep-id', ['DIC']); + expect(aff.active).toBe(true); + }); +}); + +// ============================================= +// generateBundle +// ============================================= +describe('generateBundle', () => { + let uuidCounter; + function deterministicUuid() { + return `uuid-${uuidCounter++}`; + } + + function setup() { + uuidCounter = 0; + } + + it('generates a transaction bundle', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + expect(bundle.resourceType).toBe('Bundle'); + expect(bundle.type).toBe('transaction'); + }); + + it('creates correct number of entries for one member', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + // 1 parent org + 1 member org + 1 endpoint + 1 affiliation = 4 + expect(bundle.entry).toHaveLength(4); + }); + + it('creates correct number of entries for two members', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember(), validMember({ identifier: 'other.org' })], deterministicUuid); + // 1 parent org + 2 * (member org + endpoint + affiliation) = 7 + expect(bundle.entry).toHaveLength(7); + }); + + it('first entry is parent organization with organization-parent profile', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + const parentEntry = bundle.entry[0]; + expect(parentEntry.resource.resourceType).toBe('Organization'); + expect(parentEntry.resource.meta.profile[0]).toContain('organization-parent'); + expect(parentEntry.fullUrl).toBe('urn:uuid:uuid-0'); + }); + + it('parent org has no endpoint or extensions', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + const parentResource = bundle.entry[0].resource; + expect(parentResource.endpoint).toBeUndefined(); + expect(parentResource.extension).toBeUndefined(); + }); + + it('member organization uses organization profile', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + const memberEntry = bundle.entry[1]; + expect(memberEntry.resource.meta.profile[0]).toContain('/organization'); + expect(memberEntry.resource.meta.profile[0]).not.toContain('organization-parent'); + }); + + it('member org references its endpoint', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + // uuid-0 = parent, uuid-1 = member org, uuid-2 = member endpoint + const memberOrg = bundle.entry[1].resource; + expect(memberOrg.endpoint[0].reference).toBe('urn:uuid:uuid-2'); + }); + + it('endpoint references its managing organization', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + const endpoint = bundle.entry[2].resource; + expect(endpoint.managingOrganization.reference).toBe('urn:uuid:uuid-1'); + }); + + it('affiliation references parent and member', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + const aff = bundle.entry[3].resource; + expect(aff.organization.reference).toBe('urn:uuid:uuid-0'); // parent + expect(aff.participatingOrganization.reference).toBe('urn:uuid:uuid-1'); // member + expect(aff.endpoint[0].reference).toBe('urn:uuid:uuid-2'); // endpoint + }); + + it('all PUT URLs use identifiers, not UUIDs', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + bundle.entry.forEach(entry => { + expect(entry.request.method).toBe('PUT'); + // No URL should contain uuid- (all should use identifier-based search) + expect(entry.request.url).not.toContain('uuid-'); + }); + }); + + it('parent org PUT URL uses organization identifier', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + expect(bundle.entry[0].request.url).toBe( + 'Organization?identifier=http://dsf.dev/sid/organization-identifier|dsf.dev' + ); + }); + + it('member org PUT URL uses organization identifier', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + expect(bundle.entry[1].request.url).toBe( + 'Organization?identifier=http://dsf.dev/sid/organization-identifier|hospital.example.org' + ); + }); + + it('endpoint PUT URL uses endpoint identifier', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + expect(bundle.entry[2].request.url).toBe( + 'Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|dsf.hospital.example.org-endpoint' + ); + }); + + it('affiliation PUT URL uses primary and participating organization identifiers', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + const affUrl = bundle.entry[3].request.url; + expect(affUrl).toContain('OrganizationAffiliation?'); + expect(affUrl).toContain('primary-organization:identifier=http://dsf.dev/sid/organization-identifier|dsf.dev'); + expect(affUrl).toContain('participating-organization:identifier=http://dsf.dev/sid/organization-identifier|hospital.example.org'); + }); + + it('all resources have read-access-tag ALL', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember()], deterministicUuid); + bundle.entry.forEach(entry => { + const tag = entry.resource.meta.tag[0]; + expect(tag.system).toBe('http://dsf.dev/fhir/CodeSystem/read-access-tag'); + expect(tag.code).toBe('ALL'); + }); + }); + + it('uses endpoint identifier override in PUT URL', () => { + setup(); + const bundle = generateBundle(validParent(), [validMember({ endpointIdentifierOverride: 'my-custom-ep' })], deterministicUuid); + expect(bundle.entry[2].request.url).toBe( + 'Endpoint?identifier=http://dsf.dev/sid/endpoint-identifier|my-custom-ep' + ); + }); + + it('encodes special characters in identifiers', () => { + setup(); + const bundle = generateBundle( + validParent({ identifier: 'org with spaces' }), + [validMember({ identifier: 'member/special' })], + deterministicUuid + ); + expect(bundle.entry[0].request.url).toContain(encodeURIComponent('org with spaces')); + expect(bundle.entry[1].request.url).toContain(encodeURIComponent('member/special')); + }); +}); diff --git a/docs/src/.vuepress/public/llms-full.txt b/docs/src/.vuepress/public/llms-full.txt index 419f480a1..13352a176 100644 --- a/docs/src/.vuepress/public/llms-full.txt +++ b/docs/src/.vuepress/public/llms-full.txt @@ -2306,13 +2306,6 @@ Source: https://dsf.dev/operations/latest/fhir-reverse-proxy/configuration.html - **Example:** `/run/secrets/ssl_certificate_chain_file.pem` -### SSL_CERTIFICATE_CHAIN_FILE -- **Required:** No -- **Description:** Certificate chain file, PEM encoded, must contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate), sets the apache httpd parameter `SSLCertificateChainFile`; can be omitted if either no chain is needed (self signed server certificate) or the file specified via *SSL_CERTIFICATE_FILE* contains the certificate chain -- **Recommendation:** Use docker secret file to configure -- **Example:** `/run/secrets/ssl_certificate_chain_file.pem` - - ### SSL_CERTIFICATE_FILE - **Required:** Yes - **Description:** Server certificate file, PEM encoded, sets the apache httpd parameter `SSLCertificateFile`, may contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate). Omit *SSL_CERTIFICATE_CHAIN_FILE* if chain included @@ -5146,7 +5139,7 @@ All other elements can technically be omitted. Still, the following elements are ## Related Topics -[ActivityDefinition](../fhir/activitydefinition.md), [Creating CodeSystems for DSF Processes](creating-codesystems-for-dsf-processes.md), [Creating ValueSets for DSF Processes](creating-valuesets-for-dsf-processes.md), [Task](../fhir/task.md) +[ActivityDefinition](../fhir/activitydefinition.md), [Creating CodeSystems for DSF Processes](creating-codesystems-for-dsf-processes.md), [Creating ValueSets for DSF Processes](creating-valuesets-for-dsf-processes.md), [Requester and Recipient Examples](../dsf/requester-and-recipient.md), [Task](../fhir/task.md), [Understanding the Process Authorization Extension](../dsf/understanding-the-process-authorization-extension.md) --- @@ -6026,7 +6019,7 @@ Below is a template for a [Questionnaire](https://www.hl7.org/fhir/R4/questionna ```xml - + @@ -7017,6 +7010,28 @@ The linter performs comprehensive validation on BPMN 2.0 process definitions usi - The process engine only deploys and executes processes marked as executable - Non-executable processes are typically used for documentation or as templates +##### Process Version Tag Validation + +- **Requirement**: + - Process must define `camunda:versionTag` + - Expected placeholder value in DSF process plugins: `#{version}` + - Error: `BPMN_PROCESS_VERSION_TAG_MISSING_OR_EMPTY` (missing, empty/blank, or literal `"null"`) + - Warning: `BPMN_PROCESS_VERSION_TAG_NO_PLACEHOLDER` (present but without `#{version}`) + - Success: `SUCCESS` when `camunda:versionTag` contains `#{version}` + +- **Valid Example**: + - ✅ `` + +- **Error Examples**: + - ❌ `` (missing `camunda:versionTag`) + - ❌ `` (empty value) + - ❌ `` (literal `null`) + +- **Warning Examples**: + - ⚠️ `` + - ⚠️ `` + + #### Task Validation ##### Service Tasks @@ -7543,9 +7558,51 @@ Task resources are validated against the DSF Task base profile (`http://dsf.dev/ - Error: `FHIR_TASK_INPUT_SLICE_COUNT_BELOW_SLICE_MIN` - Error: `FHIR_TASK_INPUT_SLICE_COUNT_EXCEEDS_SLICE_MAX` -- **Terminology Validation**: - - Code/system combinations validated against DSF CodeSystems - - Error: `FHIR_TASK_UNKNOWN_CODE` + - **Terminology Validation**: + - Generic coding validation (outside `Task.input.type.coding`) checks code/system pairs against known DSF CodeSystems + - Error: `FHIR_TASK_UNKNOWN_CODE` + +- **Task.input.type.coding Terminology Validation (binding-driven)**: + - Validation for `Task.input.type.coding` is performed in three strict, ordered checks: + 1. **Known CodeSystem check**: + - `Task.input.type.coding.system` must be a known CodeSystem URI + - Error: `FHIR_TASK_INPUT_CODING_SYSTEM_UNKNOWN` + - If this check fails, subsequent checks for that input are skipped + 2. **Binding context check**: + - The system must be allowed by the slice-specific binding context from the referenced `StructureDefinition` + - Resolution order: + - `fixedUri` on `Task.input:sliceName.type.coding.system` (exact match required) + - `binding.valueSet` on `Task.input:sliceName.type` (fallback: `...type.coding`) and membership in `ValueSet.compose.include.system` + - Error: `FHIR_TASK_INPUT_CODING_SYSTEM_NOT_IN_VALUE_SET` + - If this check fails, code validation for that input is skipped + 3. **Code-in-system check**: + - `Task.input.type.coding.code` must exist in the specified CodeSystem + - Error: `FHIR_TASK_INPUT_CODING_CODE_UNKNOWN_FOR_SYSTEM` + +- **Binding Resolution Notes**: + - ValueSet checks are strict and context-aware; no permissive fallback to unrelated ValueSets is used + - If a slice declares `binding.valueSet` but the ValueSet is not loaded into the cache, validation fails explicitly with: + `FHIR_TASK_INPUT_CODING_SYSTEM_NOT_IN_VALUE_SET` + - If no resolvable binding context exists for a slice (`fixedUri` and `binding.valueSet` both missing), validation fails explicitly with: + `FHIR_TASK_INPUT_CODING_SYSTEM_NOT_IN_VALUE_SET` + - Inputs already failing structural checks (`FHIR_TASK_INPUT_REQUIRED_CODING_SYSTEM_AND_CODING_CODE`) are not re-reported by terminology checks + +- **Task.input Fixed Constraint Validation (`fixedUri` / `fixedCode`)**: + - Validates actual `Task.input.type.coding.system` and `Task.input.type.coding.code` pairs against fixed constraints declared in the referenced `StructureDefinition` slices + - Validation direction is **Task → StructureDefinition** (actual instance values are checked against allowed fixed pairs) + - **System mismatch for existing code**: + - If a Task input code exists in SD constraints, but with a different system + - Error: `FHIR_TASK_INPUT_FIXED_URI_MISMATCH` + - **Code mismatch for existing system**: + - If a Task input system exists in SD constraints, but with a different code + - Error: `FHIR_TASK_INPUT_FIXED_CODE_MISMATCH` + - **Pair not allowed by SD constraints**: + - If a non-BPMN Task input `(system, code)` pair is not defined by any SD `fixedUri/fixedCode` constraint + - Error: `FHIR_TASK_INPUT_PAIR_NOT_ALLOWED_BY_SD` + - **Validation Behavior**: + - Check runs only when profile can be resolved and fixed constraints are extractable from the referenced `StructureDefinition` + - BPMN message inputs (`http://dsf.dev/fhir/CodeSystem/bpmn-message`) are excluded from this specific pair-not-allowed check because they are validated in dedicated Task input rules + #### StructureDefinition Resources @@ -7607,6 +7664,24 @@ According to FHIR profiling specification §5.1.0.14: - No individual slice's maximum cardinality may exceed base element's maximum - Error: `STRUCTURE_DEFINITION_SLICE_MAX_TOO_HIGH` +##### Binding and Fixed Coding Validation +- **`binding.valueSet` Reference Validation**: + - Checks whether `binding.valueSet` URLs in differential elements can be resolved to a known ValueSet in project resources + - For unresolved references with `strength="required"`: + - Warning: `STRUCTURE_DEFINITION_BINDING_VALUESET_UNRESOLVED` + - For unresolved references with non-required strengths (`extensible`, `preferred`, `example`): + - Info: `STRUCTURE_DEFINITION_BINDING_VALUESET_UNRESOLVED_NON_REQUIRED` + - Success: `SUCCESS` when the referenced ValueSet is resolvable +- **`fixedUri` / `fixedCode` Validation Against CodeSystems**: + - For differential elements using `fixedUri` on `*.system`, verifies that the referenced CodeSystem exists in project terminology cache + - If referenced CodeSystem is unknown: + - Info: `STRUCTURE_DEFINITION_FIXED_URI_CODESYSTEM_NOT_FOUND` + - Note: `fixedCode` validation is skipped for this path when CodeSystem is unknown + - If `fixedCode` is present and the CodeSystem is known, verifies that the code exists in that CodeSystem + - Error: `STRUCTURE_DEFINITION_FIXED_CODE_NOT_IN_CODESYSTEM` + - Success: `SUCCESS` when `fixedUri` resolves (and `fixedCode`, if present, is valid) + + #### ValueSet Resources ValueSet resources are validated against the DSF ValueSet base profile. @@ -7928,6 +8003,99 @@ ValueSet resources are validated against the DSF ValueSet base profile. - `dsf-bpe/dsf-bpe-process-api-v2/src/main/java/dev/dsf/bpe/v2/ProcessPluginDefinition.java` - The `getResourceVersion()` method extracts the resource version from the plugin version +#### Spring Configuration Registration + +In the DSF runtime, the Camunda engine does not instantiate Java delegate or +listener classes directly. Spring creates those instances via `@Bean` methods +declared in `@Configuration` classes. For those beans to be available to the +BPE at runtime, the corresponding `@Configuration` classes must be explicitly +returned by `ProcessPluginDefinition#getSpringConfigurations()`. Forgetting +to add a `@Bean` for a BPMN-referenced class typically surfaces as a +`BeanCreationException` or `ClassNotFoundException` only at deployment time. + +- **Every BPMN-referenced class must be provided as a `@Bean`**: + - The linter collects every `camunda:class` reference used by + `serviceTask`, `sendTask`, `messageEventDefinition`, + `camunda:executionListener` and `camunda:taskListener` elements in the + plugin's BPMN files (List 1). + - The linter calls `getSpringConfigurations()` to get the registered + `@Configuration` classes and inspects the return types of their + `@Bean` methods (List 2). + - For every class in List 1, the linter checks whether it is provided + as a `@Bean` (exact type or supertype) in any `@Configuration` from + List 2. + - If a BPMN-referenced class has **no matching `@Bean`** in any + registered configuration, this is reported as an error. + - Error: `PLUGIN_DEFINITION_SPRING_CONFIGURATION_MISSING` + - Success: `SUCCESS` when all BPMN delegate/listener references are + covered by a `@Bean` in a registered `@Configuration`, or when no + BPMN delegate/listener references exist. + +- **Code Example**: + ```java + @Override + public List> getSpringConfigurations() { + return List.of(DataSharingConfig.class, DataSharingVariablesConfig.class); + } + ``` + ```java + @Configuration + public class DataSharingConfig { + + // Every class referenced via camunda:class in the BPMN must have + // a corresponding @Bean here (or in another registered @Configuration). + @Bean + public SelectDicTargets selectDicTargets() { + return new SelectDicTargets(api); + } + + @Bean + public SelectDmsTarget selectDmsTarget() { + return new SelectDmsTarget(api); + } + } + ``` +#### Spring Bean Scope (`SpringConfigurationLinter`) + +In Camunda and the Data Sharing Framework (DSF), Spring beans that act as delegates, execution listeners, or task listeners should usually be configured with **prototype** scope (`SCOPE_PROTOTYPE`). If the `@Scope` annotation is omitted, Spring defaults to **singleton**. That can be acceptable for strictly stateless classes; as soon as someone adds mutable instance state, the risk of race conditions and hard-to-debug concurrency bugs rises sharply—often only visible under load. + +After a BPMN-referenced class is **covered** by a `@Bean` in a registered `@Configuration` (see [Spring Configuration Registration](#spring-configuration-registration)), the linter inspects the covering `@Bean` method for `@Scope` and the referenced implementation class for **mutable** instance fields (not `static`, not `final`). Emitted rules: + + - **Success** – `SPRING_BEAN_SCOPE_PROTOTYPE`: `@Scope` is **prototype** (e.g. `ConfigurableBeanFactory.SCOPE_PROTOTYPE` or `@Scope("prototype")`). No further scope items for that reference in this pass. + - **Error** – `SPRING_BEAN_SCOPE_MUTABLE_SINGLETON`: The bean is **effectively singleton** (missing `@Scope` *or* explicit non-prototype scope such as `singleton`) **and** the referenced class has **mutable** instance fields. Emitted **once** per reference before the following warnings. + - **Warning** – `SPRING_BEAN_SCOPE_MISSING`: The covering `@Bean` has **no** `@Scope` (Spring’s default is singleton, which is risky for Camunda hooks unless the implementation is provably stateless). + - **Warning** – `SPRING_BEAN_SCOPE_SINGLETON_EXPLICIT`: `@Scope` is **explicitly** set to a **non-prototype** value (typically `singleton`); the developer should verify that the delegate or listener is safe to share across process instances. + + **Why this matters:** The rule stays aligned with DSF wiring (only configurations from `getSpringConfigurations()`) and surfaces dangerous combinations—singleton or default-singleton scope plus mutable instance state—before they appear in production. + + **Example scenarios** + + *Missing `@Scope` → warning (and error if the delegate/listener class has mutable instance fields)* + + ```java + @Bean + // Missing @Scope annotation + public SetCorrelationKeyListener setCorrelationKeyListener() { + return new SetCorrelationKeyListener(api); + } + ``` + + *Explicit singleton → warning (and error if mutable instance fields exist)* + ```java + @Bean + @Scope(ConfigurableBeanFactory.SCOPE_SINGLETON) // or @Scope("singleton") + public SetCorrelationKeyListener setCorrelationKeyListener() { + return new SetCorrelationKeyListener(api); + } + ``` + *Prototype (recommended) → success* + ```java + @Bean + @Scope(ConfigurableBeanFactory.SCOPE_PROTOTYPE) // or @Scope("prototype") + public SetCorrelationKeyListener setCorrelationKeyListener() { + return new SetCorrelationKeyListener(api); + } + ``` #### Leftover Resource Detection The linter performs project-level analysis to identify unreferenced resources: @@ -10910,7 +11078,7 @@ The `recipeint` element uses one of the following Codings: ## Related Topics -[ActivityDefinition](../fhir/activitydefinition.md) +[ActivityDefinition](../fhir/activitydefinition.md), [Understanding the Process Authorization Extension](./understanding-the-process-authorization-extension.md) --- diff --git a/docs/src/.vuepress/sidebar/operations-v2.ts b/docs/src/.vuepress/sidebar/operations-v2.ts index 55f018c27..2a5090e1b 100644 --- a/docs/src/.vuepress/sidebar/operations-v2.ts +++ b/docs/src/.vuepress/sidebar/operations-v2.ts @@ -4,7 +4,7 @@ export function generate_v2_latest_sidebar() { icon: "tool", link: "./", }, - "release-notes", "install", "upgrade-from-2", "upgrade-from-1", "allowList-mgm", "root-certificates", "passwords-secrets", "image-verification", "hardening-measures", { + "release-notes", "install", "upgrade-from-2", "upgrade-from-1", "allowList-mgm", "allowlist-generator", "root-certificates", "passwords-secrets", "image-verification", "hardening-measures", { text: "FHIR Reverse Proxy", icon: "module", prefix: "fhir-reverse-proxy/", diff --git a/docs/src/operations/v2.1.0/allowlist-generator.md b/docs/src/operations/v2.1.0/allowlist-generator.md new file mode 100644 index 000000000..691e84a69 --- /dev/null +++ b/docs/src/operations/v2.1.0/allowlist-generator.md @@ -0,0 +1,23 @@ +--- +title: Allow List Generator +icon: tool +--- + +## Overview + +This tool generates a FHIR R4 Bundle (type `transaction`) for deploying an Allow List to a DSF FHIR server. The bundle contains [Organization](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-organization.html), [Endpoint](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-endpoint.html) and [OrganizationAffiliation](https://dsf.dev/fhir/ImplementationGuide/dev.dsf/StructureDefinition-organization-affiliation.html) resources conforming to the DSF profiles. + +For more information about the Allow List concept, see the [Allow List documentation](/explore/concepts/allow-list.html). + +::: tip Certificate Thumbprints +SHA-512 certificate thumbprints in HEX form `[a-f0-9]{128}` can be calculated using: +```sh +certtool --fingerprint --hash=sha512 --infile=certificate.pem +``` +::: + +::: warning +This tool generates a basic Allow List bundle. For production deployments, consider using the [Allow List Management Portal](allowList-mgm) for centralized management. +::: + +