Perfuse v0.1.15

New

• A PAS decision service. serve -pas -pas-decider-url https://… asks an outside service about every PAS item the rules file leaves to a reviewer. The service is sent the request Bundle and the request's id (X-PAS-Request-Id), and answers approve, deny with a reason, or pend with the information needed.
  • Rules that approve or deny are not overruled.
  • Any failure pends the item: an error, a timeout, a denial with no reason, or an unknown decision. Nothing turns a failure into an approval.
  • A service with its own reviewers can decide a pended item later through Claim/$decide, using that id.
  • The URL must be https, or plain http to this machine.
  • Perfuse's own PAS decisions work as before with none configured.
• PAS.Decide sees the whole request, not only the service's codes: the conditions, questionnaire answers and documents.
• Published packages fhir and pas. fhir is the FHIR model. pas is the PAS request reader Perfuse's server uses. Another program can import them to read FHIR and PAS requests exactly as Perfuse does.

Verified

• A decision service end to end: approve, deny and two kinds of pend, then a reviewer's later decision returned through Claim/$decide (docs/verification.md).

Perfuse v0.1.14

New

• Sign-on grants all six roles. OpenID Connect, SAML and LDAP group mappings can now grant monitor and operator as well as viewer, editor, admin and platform.
• Sign-on sets channel groups. A directory group can be limited to channel groups: a second box on its row in Administer → Sign-on, or channel_groups in the file. Once any group names one, every sign-in sets the person's channel groups from the groups that granted their role, so the strongest role is never joined to the widest reach. While no group names any, channel groups stay as an administrator set them.
• A different role in each channel group. Someone limited to channel groups can edit one and only view another: lab=editor, adt in Users. Every action is checked against the role in that channel's own group, and a refusal names the role the person holds there. Sign-in derives the same thing from directory groups. An account that sees every channel keeps one role. A facility's administrator grants roles only in the groups they administer, and never above their own role there.

Perfuse v0.1.13

Fixed

• File destinations honour their naming and pruning settings. The channel builder offered File name, Suffix while writing and Delete after, and the manual described them, but a channel file refused file_name, temp_suffix, append and retain_hours and the engine ignored them. They work now: file_name makes one file per message (written under a temporary name and renamed into place, and never overwriting a duplicate control ID), append: true writes every message into the named file, and retain_hours deletes plain files in the folder older than that. With none of them set, a file destination behaves as before: one file per day and message type.
• Filters accept &&, || and !. The manual and the builder's examples used them; the parser only knew and, or and not. Both spellings work.
• The builder's file name placeholder said ${messageType}; the placeholder is ${message_type}.

Test server

https://test.perfuse.health now runs six demonstration channels fed with invented HL7 v2 traffic every minute, so the console has something to show. Sign in with username demo, password try-perfuse-demo.

Perfuse v0.1.12

New

• A public demo account. serve -demo-account user:password creates a shared viewer account and shows its username and password on the sign-in page, with a button that signs in with them. It can look at everything and change nothing; it cannot change its password or add a passkey, and each start restores it. For demonstration servers holding test data only. Try it on https://test.perfuse.health: username demo, password try-perfuse-demo.
• Limits for a FHIR endpoint open to strangers (Settings → FHIR, off by default): Writes a minute from one client (-fhir-writes-per-minute, answered 429 with Retry-After) and Most resources held (-fhir-max-resources, new resources refused with 507 while updates and deletes still work). Reads and searches are never counted.

Security

• Subscription notifications, SAML metadata fetches and SMART Health Link fetches now check the address each connection actually reaches, not only the hostname beforehand. A name that resolved to an ordinary address when checked and to a cloud metadata address when connected (DNS rebinding) was let through before; it is refused now.

Also in this release, since v0.1.11: the perfuse.health site shows the console beside the headline, images no longer slide, and cards light up on hover.

Perfuse v0.1.11

Several facilities on one engine

• Channel groups. Limit a person or an API token to some channel groups, and they see and act on those channels only: the channel list, dashboard, flow map, messages and content search, counts, charts, queue, alerts, metrics, certificates and contracts. A channel outside their groups does not exist for them. Set it in Users and Tokens; the header shows a person's groups.
• Facility administrators. An administrator limited to groups manages their own groups' people and tokens, starts and stops their channels and clears their queues. Server-wide settings, sign-on, restart and alert rules stay with unlimited administrators.
• Two new roles. Monitor sees status, counts, alerts, charts and queue depth, with no message contents and no channel files: for a help desk or a wall screen. Operator can resend, replay and retry, but not change a channel. Roles are now monitor, viewer, operator, editor, admin and platform.
• Limits per tenant. On a shared server (-multi-tenant), the platform operator sets each organisation's maximum channels, messages a minute and stored megabytes on a new Tenants screen. Over a limit, work is refused the way a busy receiver refuses it (no MLLP acknowledgement, HTTP 429, SOAP 503, DICOM retryable), so senders resend; nothing is dropped. The channel limit also applies on a single-tenant server.

Also new

• Restart from the console. Settings that apply at a restart can be applied with a button (administrators only, audited as server.restart). On Linux and macOS the process keeps its PID.
• Prior-authorization tracker can be kept in a file (written atomically, mode 0600), so pending and expiring requests survive a restart. A decision now replaces its pending entry instead of sitting beside it.

Fixed

• Content search crossed tenants. On a multi-tenant server, POST /api/messages/search (searching inside message content) returned every tenant's messages. It is now limited to the caller's tenant. Upgrade if you run -multi-tenant.
• Prior-authorization decisions are recorded correctly.

Not yet

• Single sign-on (OIDC, SAML, LDAP) maps directory groups to viewer, editor and admin only, not yet to monitor, operator or channel groups.
• A person has one role across all their groups.

See docs/multi-facility.md and the Security chapter of the manual.

Perfuse v0.1.10

What's new

Every CMS-0057-F API tested with Inferno's hosted kits, against the public test server test.perfuse.health:
Bulk Data 2.0 48 of 48, PDex 2.0 payer-to-payer 19 of 19 and API coverage 312 pass with 1 skip, SMART App Launch 80 of 80,
CRD 92 pass with none failed, PAS 82 of 84, DTR 43 of 45.

A provider directory. Da Vinci Plan-Net 1.1.0: its search parameters, includes, reverse chaining (_has) and profiles.
Inferno 199 pass; the 10 failures are the kit's choice of search values (davinci-plan-net-test-kit issue 34).

Four connectors, each as a source and a destination, in the builder, and tested against the real software or the
vendor's emulator:

• MQTT 3.1.1 (Mosquitto, EMQX, HiveMQ, AWS IoT Core, Azure Event Grid)
• IBM MQ, through the queue manager's messaging REST API, with no MQ client to install
• Google Cloud Pub/Sub and Cloud Storage, with service-account sign-in

The AMQP connector was also tested against Microsoft's Azure Service Bus emulator.

Everything in the console. Each perfuse serve flag that turns on a feature is now a setting in the console, applied
at the next restart. Alert rules and single sign-on (OIDC, SAML, LDAP) can be saved without start-up flags.

Fixes

• Saving a running channel now applies the change. Before, the old version kept running until the server restarted.
• A setting saved in the console that needs a restart was ignored at the restart. It is now applied.
• FHIR search: a chain whose condition matched several resources found nothing; _id=a,b did not work; searches on
  extensions never matched.
• $everything and Bulk Data export on an R4 server returned R5 resources.
• $member-match was refused for read-only tokens.
• Searches on R4 Encounter status and on ExplanationOfBenefit service dates missed records.
• The console's favicon was missing.
• The error-rate alert's threshold was mislabelled.
• Message dialogs did not close with Escape.
• On a phone, the Users view ran off the side of the screen.

The full record of what was tested, and what was not, is in docs/verification.md.

Perfuse v0.1.9

Perfuse v0.1.9: Windows fixes, a public test server, and CRD withpa.

Fixed

Windows is now tested on every push: the full test suite on Windows Server and Windows 11 on Arm, plus a real service install. Testing found these bugs:

• FHIR data loss on Windows. Two creates in quick succession could get the same id, and the second overwrote the first. Ids are now random. Files written by the S3, FTP, SFTP, document and CDA senders and by the file poller were named the same way and are fixed too.
• One-time administrator password lost on Windows. A Windows service has no console, so the log and the first administrator's password went nowhere. The new serve -log-file writes both to a file only its owner can read. Under the service manager this defaults to perfuse.log beside the database, and install-service.ps1 uses logs\perfuse.log.
• SMART signing key refused on restart (Windows).
• Windows service install left the data folder readable by every local user. The install now grants access only to SYSTEM, Administrators and the service account.
• Refused or unreachable connections showed as bare errors on Windows. The connection test now explains them.

New

• Public test server: https://test.perfuse.health. It serves FHIR, Da Vinci CRD, DTR and PAS, SMART App Launch and Backend Services, with test data only. Inferno's clients are registered. It is built from deploy/test-instance.
• CRD doc-purpose withpa. A rules file can now send it by setting allow_withpa: true. It is off by default, because the current validator rejects it pending an HL7 correction.
• perfuse fhir convert -report <file> describes how a feed converted using counts and paths only, with no message contents, so a site can share the result.
• Repeatable SMART App Launch STU2.2 Inferno run in conformance/inferno (run.sh smart).

Full detail: docs/verification.md.

Perfuse v0.1.8

FHIR: API tokens beside SMART tokens

A server with SMART apps configured (-smart-clients or -smart-issuer) accepts only SMART tokens on its FHIR endpoint, so every caller is held to its scopes. That is unchanged, and still the default.

New: Settings → FHIR → Accept Perfuse API tokens beside SMART tokens (or -fhir-api-tokens at start-up) lets Perfuse API tokens in as well, for an internal system that has no SMART client. It is off by default, takes effect at once in either direction, and is written to the audit log. An API token has a role and no scopes, so where you can, give such a system a SMART Backend Services client instead. The manual's Security chapter has a new section, "Who may call the FHIR endpoint".

Console

• The console downloads about a fifth as much when it first opens: each screen, the channel builder and the script editor are fetched when first used. The first load is about 340 kB, down from 1.66 MB.
• Every switch and slider on the Settings page is now named by its label, so a screen reader says what it controls.
• When the channel builder refuses a save, it no longer lists the same problems twice.

Verification you can repeat

• conformance/inferno/run.sh crd|dtr|pas|uscore runs ONC's Inferno test kits against Perfuse at the versions recorded in docs/verification.md. All four now pass with Perfuse's own authorization server, with the results recorded there: CRD 2.2.1 passes, DTR 2.2.0 43 of 46, PAS 2.2.1 82 of 84, and the US Core 7 SMART launch and granular-scope groups.
• The strongSwan tunnel reader is tested against a live IKEv2 tunnel between two strongSwan gateways (scripts/strongswan-up.sh).

The manual covers all of the above: https://perfuse.health

Perfuse v0.1.7

Payers: Da Vinci PAS

• Reviewer queue in the console (CMS-0057 → Reviewer queue). Pended requests are listed soonest due first. Open one to read the request and the documents sent for it, then approve, deny, or modify it (fewer units, or another service instead). The decision goes to the provider over the PAS subscription.
• Documents for a pended request are received with CDex $submit-attachment.
• Deciding in an X12 utilization management system over 278, with the decision returned to the provider as PAS.
• A modification must certify fewer units than were asked for. Certifying as many or more is refused, in the console and by Claim/$decide.

SMART on FHIR

• People can sign in at the organisation's identity provider (OIDC) to authorize apps, alongside passwords.
• Users → SMART apps adds, edits and removes the registered apps and people.
• Removing an app or a person stops the tokens already issued to it, straight away rather than when they expire.
• Grants, refresh tokens and revocations are kept in the database, so a restart signs nobody out.
• Inferno's US Core 7 SMART granular-scope groups pass.

Public health: ELR

• A channel destination can send lab results to the state as ELR 2.5.1. Only the reportable results are sent.
• MSH-2 is written as ^~\&#, the five characters the ELR R1 errata require. Set encoding_characters: "^~\\&" for a state that asks for four.
• Child orders and patient notes are kept as the lab sent them.
• ONC's ELR certification tool reports all 28 of its example messages valid.
• The ELR file beside a channel is no longer reported as a broken channel, and the channel editor opens such a channel in the form.

Dashboards

• The Connections dashboard shows each partner VPN tunnel's state, read from AWS, Azure or strongSwan, and whether both sides' settings agree. Each tunnel has a printable connection sheet.
• The Prior authorization dashboard shows CMS-0057 timeframes met, decided late and overdue, and how the services asked for were answered.

Fixes

• The reviewer queue no longer crashes on a request nobody has sent documents for.
• #/cms0057 now opens CMS-0057 from a link, a reload or Back, instead of the Dashboard.
• The console has a favicon. The Passkeys card names the right flag (-passkey-domain).

The manual covers all of the above: https://perfuse.health

Perfuse v0.1.6

Everything since v0.1.5. Each item was checked against real software; docs/verification.md says what with, and what remains unverified.

SMART on FHIR

• A built-in SMART authorization server: standalone and EHR launch with PKCE, consent, refresh and ID tokens; Backend Services; granular scopes enforced, includes held to the caller's scopes; token introspection and revocation; CORS for browser apps.
• Inferno SMART App Launch STU2.2: 80 of 80 with a public client.

Prior authorization (CMS-0057)

• A Da Vinci PAS 2.2.1 payer server: Claim/$submit, $inquire and a reviewer's $decide, with pended decisions delivered by subscription. Inferno PAS Server suite 82 of 84.
• DTR: stored value sets, $expand/$validate-code, adaptive questionnaires ($next-question). Inferno DTR Payer Server 2.2.0: 43 of 45.
• CRD passes Inferno's CRD Server 2.2.1 suite.

FHIR server

• Inferno US Core 6.1.0 FHIR API: from 225 to 323 passing (multiple-or search, POST _search, a public capability statement, date ranges).

Public health

• eCR: Reportability Responses are received at $process-message (serve -ecr-responses) and stored where the sent report said to look; serve -ecr-agency plays an agency for testing. Proven between two Perfuse servers; the RR validates with 0 errors against eCR 2.1.2.
• ELR: perfuse elr reshapes a lab's ORU^R01 into an HL7 2.5.1 ELR message.

HL7 v2 to FHIR

• Checked on Microsoft FHIR-Converter's 139 samples, 81 French national and NHS Wales samples, and the NHS nw-gmsa set.
• Embedded PDFs whose Base64 holds spaces are now decoded (27 of nw-gmsa's 28 CE-labelled PDFs, previously 9); undecodable data stays text, never a code.
• An EVN-1 that disagrees with MSH-9 is reported; ICD codes sent without the dot get it; vital signs get their category.

Operations

• Team dashboards: one per persona, saved views, Grafana export, connection checks.

Fixes

• bearer_token: ${VAR} on FHIR, CDA and HTTP destinations, and the HTTP password, were sent as the literal text. They are now read from the environment, as the configuration recommends.
• A granular SMART scope's query was read as permission letters.
• A time of birth with no offset anywhere is dropped rather than labelled UTC.