FI-2325: Check fhirContext

Gemfile.lock

@@ -286,6 +286,7 @@ GEM
 PLATFORMS
   arm64-darwin-21
   x86_64-darwin-20
+  x86_64-darwin-22
   x86_64-linux
 
 DEPENDENCIES

lib/smart_app_launch/token_payload_validation.rb

@@ -116,7 +116,7 @@ def validate_token_field_types(body)
     def validate_fhir_context(fhir_context)
       return if fhir_context.nil?
 
-      assert fhir_context.is_a?(Array), "`fhirContext` field is a #{fihr_context.class.name}, but should be an Array"
+      assert fhir_context.is_a?(Array), "`fhirContext` field is a #{fhir_context.class.name}, but should be an Array"
 
       fhir_context.each do |reference|
         assert reference.is_a?(String), "`#{reference.inspect}` is not a string"

spec/smart_app_launch/token_response_body_test_spec.rb

@@ -117,15 +117,63 @@ def create_token_request(body: nil, status: 200, headers: nil)
   end
 
   context 'when the fhirContext field is present' do
-    it 'fails if fhirContext is not an Array'
+    it 'passes if fhirContext valid' do
+      numericalElement = 123
+      body = valid_body.merge(fhirContext: ["Organization/123", "DiagnosticReport/123"])
+      create_token_request(body: body)
+
+      result = run(test, requested_scopes: 'patient/*.*')
+      expect(result.result).to eq('pass')
+    end
+
+    it 'fails if fhirContext is not an Array' do
+      body = valid_body.merge(fhirContext: "Organization/123")
+      create_token_request(body: body)
+
+      result = run(test, requested_scopes: 'patient/*.*')
+      expect(result.result).to eq('fail')
+      expect(result.result_message).to match("`fhirContext` field is a String, but should be an Array")
+    end
+
+    it 'fails if fhirContext contains a non-string element' do
+      numericalElement = 123
+      body = valid_body.merge(fhirContext: ["Organization/123", numericalElement])
+      create_token_request(body: body)
+
+      result = run(test, requested_scopes: 'patient/*.*')
+      expect(result.result).to eq('fail')
+      expect(result.result_message).to match("`#{numericalElement}` is not a string")
+    end
 
-    it 'fails if fhirContext contains a non-string element'
+    it 'fails if fhirContext contains an absolute reference' do
+      canonicalURL = "https://example.org/Organization/123/|v2023-05-03"
+      body = valid_body.merge(fhirContext: [canonicalURL])
+      create_token_request(body: body)
 
-    it 'fails if fhirContext contains an absolute reference'
+      result = run(test, requested_scopes: 'patient/*.*')
+      expect(result.result).to eq('fail')
+      expect(result.result_message).to match("`#{canonicalURL}` is not a relative reference")
+    end
 
-    it 'fails if fhirContext contains a reference with an invalid resource type'
+    it 'fails if fhirContext contains a reference with an invalid resource type' do
+      invalidResourceType = "Hospital"
+      body = valid_body.merge(fhirContext: ["#{invalidResourceType}/123"])
+      create_token_request(body: body)
 
-    it 'fails if fhirContext contains a reference with an invalid id'
+      result = run(test, requested_scopes: 'patient/*.*')
+      expect(result.result).to eq('fail')
+      expect(result.result_message).to match("`#{invalidResourceType}` is not a valid FHIR resource type")
+    end
+
+    it 'fails if fhirContext contains a reference with an invalid id' do
+      invalidFhirID = '@#'
+      body = valid_body.merge(fhirContext: ["Organization/#{invalidFhirID}"])
+      create_token_request(body: body)
+
+      result = run(test, requested_scopes: 'patient/*.*')
+      expect(result.result).to eq('fail')
+      expect(result.result_message).to match("`#{invalidFhirID}` is not a valid FHIR id")
+    end
   end
 
   it 'persists outputs' do