From b66f6a6ed7f221a4bbcf59262cb5a9ff81b79964 Mon Sep 17 00:00:00 2001 From: glebmark <87950237+glebmark@users.noreply.github.com> Date: Wed, 29 Jul 2026 18:07:00 +0400 Subject: [PATCH 1/2] [HealthSamurai/smartbox#631] sync init bundles with villagecare prod Co-Authored-By: Claude Fable 5 --- .../quickstart/init-bundle-admin.json | 1864 ++++++++++++----- .../quickstart/init-bundle-developer.json | 662 +++++- 2 files changed, 1903 insertions(+), 623 deletions(-) diff --git a/assets/get-started/quickstart/init-bundle-admin.json b/assets/get-started/quickstart/init-bundle-admin.json index 06203e8..7d81243 100644 --- a/assets/get-started/quickstart/init-bundle-admin.json +++ b/assets/get-started/quickstart/init-bundle-admin.json @@ -26,37 +26,104 @@ } }, { + "request": { + "method": "POST", + "url": "/$fhir-package-install" + }, "resource": { - "resourceType": "FHIRSchema", - "url": "http://aidbox.app/StructureDefinition/Client/created-by", + "resourceType": "Parameters", + "parameter": [ + { + "name": "package", + "valueString": "hl7.fhir.us.core@6.1.0" + }, + { + "name": "package", + "valueString": "hl7.fhir.us.carin-bb@2.0.0" + }, + { + "name": "package", + "valueString": "hl7.fhir.us.davinci-pdex@2.0.0" + }, + { + "name": "package", + "valueString": "hl7.fhir.us.davinci-drug-formulary@2.0.1" + }, + { + "name": "package", + "valueString": "hl7.fhir.us.davinci-pdex-plan-net@1.1.0" + }, + { + "name": "package", + "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-pas%402.0.1.tar.gz" + }, + { + "name": "package", + "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-dtr%402.0.1.tar.gz" + }, + { + "name": "package", + "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-crd%402.0.1.tar.gz" + } + ] + } + }, + { + "resource": { + "resourceType": "StructureDefinition", "id": "client-created-by", - "base": "Extension", + "url": "http://aidbox.app/StructureDefinition/Client/created-by", "name": "client-created-by", + "status": "active", "kind": "complex-type", + "abstract": false, "type": "Extension", - "version": "0.0.1", - "elements": { - "url": { - "fixed": "http://aidbox.app/StructureDefinition/Client/created-by" - }, - "value": { - "choices": [ - "valueReference" - ] - }, - "valueReference": { - "type": "Reference", - "refers": [ - "User" - ], - "choiceOf": "value" + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension", + "derivation": "constraint", + "context": [ + { + "type": "element", + "expression": "Client" } - }, - "derivation": "constraint" + ], + "differential": { + "element": [ + { + "id": "Extension", + "path": "Extension", + "min": 0, + "max": "1" + }, + { + "id": "Extension.extension", + "path": "Extension.extension", + "max": "0" + }, + { + "id": "Extension.url", + "path": "Extension.url", + "fixedUri": "http://aidbox.app/StructureDefinition/Client/created-by" + }, + { + "id": "Extension.value[x]", + "path": "Extension.value[x]", + "min": 1, + "max": "1", + "type": [ + { + "code": "Reference", + "targetProfile": [ + "http://health-samurai.io/fhir/core/StructureDefinition/User" + ] + } + ] + } + ] + } }, "request": { "method": "PUT", - "url": "FHIRSchema/client-created-by" + "url": "StructureDefinition/client-created-by" } }, { @@ -81,39 +148,65 @@ }, { "resource": { - "resourceType": "FHIRSchema", - "url": "http://aidbox.app/StructureDefinition/Client/status", + "resourceType": "StructureDefinition", "id": "client-status", - "base": "Extension", + "url": "http://aidbox.app/StructureDefinition/Client/status", "name": "client-status", + "status": "active", "kind": "complex-type", + "abstract": false, "type": "Extension", - "version": "0.0.2", - "elements": { - "url": { - "fixed": "http://aidbox.app/StructureDefinition/Client/status" - }, - "value": { - "choices": [ - "valueCode" - ] - }, - "valueCode": { - "type": "code", - "choiceOf": "value", - "constraints": { - "enum-client-status": { - "severity": "error", - "expression": "%context.subsetOf('draft' | 'review' | 'active' | 'rejected')" - } - } + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension", + "derivation": "constraint", + "context": [ + { + "type": "element", + "expression": "Client" } - }, - "derivation": "constraint" + ], + "differential": { + "element": [ + { + "id": "Extension", + "path": "Extension", + "min": 0, + "max": "1" + }, + { + "id": "Extension.extension", + "path": "Extension.extension", + "max": "0" + }, + { + "id": "Extension.url", + "path": "Extension.url", + "fixedUri": "http://aidbox.app/StructureDefinition/Client/status" + }, + { + "id": "Extension.value[x]", + "path": "Extension.value[x]", + "min": 1, + "max": "1", + "type": [ + { + "code": "code" + } + ], + "constraint": [ + { + "key": "enum-client-status", + "severity": "error", + "human": "status must be one of draft | review | active | rejected", + "expression": "$this.subsetOf('draft' | 'review' | 'active' | 'rejected')" + } + ] + } + ] + } }, "request": { "method": "PUT", - "url": "FHIRSchema/client-status" + "url": "StructureDefinition/client-status" } }, { @@ -142,7 +235,8 @@ "id": "smartbox-admin-portal", "first_party": true, "grant_types": [ - "code" + "code", + "password" ], "scope": [ "openid", @@ -157,6 +251,9 @@ "pkce": true, "refresh_token": true, "refresh_token_expiration": 86400 + }, + "password": { + "access_token_expiration": 300 } } }, @@ -180,92 +277,54 @@ } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-session" + }, "resource": { "resourceType": "AccessPolicy", - "id": "admin-api", + "id": "admin-api-session", "engine": "matcho", - "description": "Scoped access for admin API client (sessions, orgs, clients, users, tos/privacy)", "matcho": { "client": { "id": "admin-api" }, - "$one-of": [ - { - "params": { - "resource/type": "Session" - }, - "operation": { - "id": { - "$one-of": [ - "FhirCreate", - "FhirSearch", - "FhirRead", - "FhirUpdate", - "FhirPatch" - ] - } - } - }, - { - "params": { - "resource/type": "Organization" - }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead" - ] - } - } - }, - { - "params": { - "resource/type": "Client" - }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead" - ] - } - } - }, - { - "params": { - "resource/type": "User" - }, - "operation": { - "id": "FhirRead" - } - }, - { - "params": { - "resource/type": "DocumentReference", - "resource/id": { - "$one-of": [ - "smartbox-tos", - "smartbox-privacy" - ] - } - }, - "operation": { - "id": { - "$one-of": [ - "FhirRead", - "FhirUpdate", - "FhirCreate" - ] - } - } - } - ] - } - }, + "request-method": { + "$one-of": [ + "get", + "post", + "put", + "patch", + "delete" + ] + }, + "uri": { + "$one-of": [ + "#^/fhir/Session.*", + "#^/Session.*" + ] + } + }, + "description": "Full CRUD access to Session for admin API client" + } + }, + { "request": { "method": "PUT", - "url": "AccessPolicy/admin-api" + "url": "AccessPolicy/admin-api-identity-provider" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-identity-provider", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "request-method": "get", + "uri": "#^/IdentityProvider.*" + }, + "description": "Read-only IdentityProvider access for admin API client (backend maps OIDC third-party initiated login iss to an IdP id)" } }, { @@ -290,361 +349,671 @@ } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-grant" + }, "resource": { "resourceType": "AccessPolicy", - "id": "allow-read-settings", + "id": "admin-api-grant", "engine": "matcho", - "description": "Allow admin-api client to read Aidbox settings", "matcho": { "client": { "id": "admin-api" }, + "request-method": { + "$one-of": [ + "get", + "post", + "put", + "patch", + "delete" + ] + }, "uri": { "$one-of": [ - "/api/v1/settings/introspect", - "^/api/v1/settings/.*" + "#^/fhir/Grant.*", + "#^/Grant.*" ] } - } - }, - "request": { - "method": "PUT", - "url": "AccessPolicy/allow-read-settings" + }, + "description": "Full CRUD access to Grant for admin API client" } }, { - "resource": { - "resourceType": "SearchParameter", - "id": "Communication.about", - "url": "http://smartbox.hs/sp/Communication-about", - "name": "communication-about", - "status": "active", - "code": "about", - "base": [ - "Communication" - ], - "type": "reference", - "description": "Search Communication by Communication.about (any reference, incl. Aidbox system resources)", - "expression": "Communication.about" - }, "request": { "method": "PUT", - "url": "SearchParameter/Communication.about" - } - }, - { - "resource": { - "resourceType": "SearchParameter", - "id": "Session.client", - "url": "http://smartbox.hs/sp/Session-client", - "name": "session-client", - "status": "active", - "code": "client", - "base": [ - "Session" - ], - "type": "reference", - "description": "Search Session by client reference", - "expression": "Session.client", - "target": [ - "Client" - ] + "url": "AccessPolicy/admin-api-batch" }, - "request": { - "method": "PUT", - "url": "SearchParameter/Session.client" - } - }, - { "resource": { - "roles": [ - { - "type": "admin" - } - ] - }, - "request": { - "method": "PATCH", - "url": "User/admin" + "resourceType": "AccessPolicy", + "id": "admin-api-batch", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "request-method": "post", + "uri": "#^/fhir$" + }, + "description": "Allow batch/transaction operations for admin API client" } }, { "request": { "method": "PUT", - "url": "AccessPolicy/patient-can-get-launch-uri" + "url": "AccessPolicy/admin-api-organization" }, "resource": { "resourceType": "AccessPolicy", - "id": "patient-can-get-launch-uri", - "type": "rpc", - "engine": "matcho-rpc", - "rpc": { - "aidbox.smart/get-launch-uri": { - "user": { - "fhirUser": { - "resourceType": "Patient" - } + "id": "admin-api-organization", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "params": { + "resource/type": "Organization" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead" + ] } } - } + }, + "description": "Scoped access for admin API client (organizations)" } }, { "request": { "method": "PUT", - "url": "AccessPolicy/smart-app-can-read-patient-api" + "url": "AccessPolicy/admin-api-client" }, "resource": { "resourceType": "AccessPolicy", - "id": "smart-app-can-read-patient-api", + "id": "admin-api-client", "engine": "matcho", "matcho": { - "jwt": { - "atv": 2, - "scope": "present?", - "context": { - "patient": "present?" - } - }, "client": { - "type": "smart-app", - "active": true + "id": "admin-api" + }, + "params": { + "resource/type": "Client" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "FhirDelete" + ] + } } - } + }, + "description": "Scoped access for admin API client (clients, incl. E2E teardown)" } }, { - "resource": { - "resourceType": "DocumentReference", - "id": "smartbox-tos", - "status": "current", - "type": { - "text": "Terms of Service" - }, - "category": [ - { - "text": "legal" - } - ], - "content": [ - { - "attachment": { - "contentType": "text/html" - } - } - ] - }, "request": { "method": "PUT", - "url": "DocumentReference/smartbox-tos" - } - }, - { + "url": "AccessPolicy/admin-api-user" + }, "resource": { - "resourceType": "DocumentReference", - "id": "smartbox-privacy", - "status": "current", - "type": { - "text": "Privacy Policy" - }, - "category": [ - { - "text": "legal" - } - ], - "content": [ - { - "attachment": { - "contentType": "text/html" + "resourceType": "AccessPolicy", + "id": "admin-api-user", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "params": { + "resource/type": "User" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "FhirCreate", + "FhirUpdate", + "FhirPatch", + "FhirDelete", + "Search", + "Read", + "Create", + "Update", + "Patch", + "Delete" + ] } } - ] - }, - "request": { - "method": "PUT", - "url": "DocumentReference/smartbox-privacy" + }, + "description": "Full CRUD access to User for admin API client (FHIR and native Aidbox API)" } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-document-reference" + }, "resource": { - "resourceType": "FHIRSchema", - "url": "http://smartbox.hs/StructureDefinition/AwsAccount", - "id": "AwsAccount", - "name": "AwsAccount", - "type": "AwsAccount", - "kind": "resource", - "derivation": "specialization", - "elements": { - "region": { - "type": "string" - }, - "access-key-id": { - "type": "string" - }, - "secret-access-key": { - "type": "string" - }, - "host": { - "type": "string" + "resourceType": "AccessPolicy", + "id": "admin-api-document-reference", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" }, - "path-style": { - "type": "boolean" + "params": { + "resource/id": { + "$one-of": [ + "smartbox-tos", + "smartbox-privacy", + "smartbox-theme", + "smartbox-enrollment-message", + "smartbox-app-name", + "smartbox-app-logo", + "mpf-export-scope" + ] + }, + "resource/type": "DocumentReference" }, - "use-ssl": { - "type": "boolean" + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirUpdate", + "FhirCreate" + ] + } } - } - }, - "request": { - "method": "PUT", - "url": "FHIRSchema/AwsAccount" + }, + "description": "Scoped access for admin-api client to DocumentReference resources (tos, privacy, theme, enrollment message)" } }, { - "resource": { - "resourceType": "AwsAccount", - "id": "minio", - "region": "us-east-1", - "access-key-id": "minioadmin", - "secret-access-key": "minioadmin", - "host": "minio:9000", - "path-style": true, - "use-ssl": false - }, "request": { "method": "PUT", - "url": "AwsAccount/minio" - } - }, - { + "url": "AccessPolicy/admin-api-footer-config" + }, "resource": { - "resourceType": "FHIRSchema", - "url": "http://smartbox.hs/StructureDefinition/GcpServiceAccount", - "id": "GcpServiceAccount", - "name": "GcpServiceAccount", - "type": "GcpServiceAccount", - "kind": "resource", - "derivation": "specialization", - "elements": { - "private-key": { - "type": "string" + "resourceType": "AccessPolicy", + "id": "admin-api-footer-config", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" }, - "service-account-email": { - "type": "string" + "params": { + "resource/id": "#^footer-config-.*", + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirUpdate", + "FhirCreate" + ] + } } - } - }, - "request": { - "method": "PUT", - "url": "FHIRSchema/GcpServiceAccount" + }, + "description": "Allow admin-api client to read/write footer config DocumentReference (id prefix footer-config-*)" } }, { "resource": { - "resourceType": "AuthConfig", - "id": "smartbox", - "theme": { - "styleUrl": "http://localhost:3001/auth.css" + "resourceType": "AccessPolicy", + "id": "allow-read-settings", + "engine": "matcho", + "description": "Allow admin-api client to read Aidbox settings", + "matcho": { + "client": { + "id": "admin-api" + }, + "uri": { + "$one-of": [ + "/api/v1/settings/introspect", + "^/api/v1/settings/.*" + ] + } } }, "request": { "method": "PUT", - "url": "AuthConfig/smartbox" + "url": "AccessPolicy/allow-read-settings" } }, { "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-sql", "engine": "matcho", - "description": "Admin access to Client resources", + "description": "Allow admin-api client to execute SQL queries for patient enrollment lookup", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] + "client": { + "id": "admin-api" }, - "params": { - "resource/type": "Client" - } - }, - "id": "admin-role-client", - "resourceType": "AccessPolicy" + "uri": "/$sql", + "request-method": "post" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-client" + "url": "AccessPolicy/admin-api-sql" } }, { "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-audit-event", "engine": "matcho", - "description": "Admin search and read Session resources", + "description": "Allow admin-api client to create and read AuditEvent resources for enrollment audit logging", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] + "client": { + "id": "admin-api" }, "params": { - "resource/type": "Session" + "resource/type": "AuditEvent" }, "operation": { "id": { "$one-of": [ + "FhirCreate", "FhirSearch", "FhirRead" ] } } - }, - "id": "admin-role-session", - "resourceType": "AccessPolicy" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-session" + "url": "AccessPolicy/admin-api-audit-event" } }, { "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-notification", "engine": "matcho", - "description": "Admin access to Organization resources", + "description": "Allow admin-api client to create, send, and delete Notification resources for email notifications", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } + "client": { + "id": "admin-api" + }, + "request-method": { + "$one-of": [ + "put", + "post", + "delete" ] }, - "params": { - "resource/type": "Organization" + "uri": { + "$one-of": [ + "#^/Notification.*" + ] } - }, - "id": "admin-role-organization", - "resourceType": "AccessPolicy" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-organization" + "url": "AccessPolicy/admin-api-notification" } }, { "resource": { - "engine": "matcho", - "description": "Admin read Patient with ORGBAC", - "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] - }, - "params": { + "resourceType": "SearchParameter", + "id": "Communication.about", + "url": "http://smartbox.hs/sp/Communication-about", + "name": "communication-about", + "status": "active", + "code": "about", + "base": [ + "Communication" + ], + "type": "reference", + "description": "Search Communication by Communication.about (any reference, incl. Aidbox system resources)", + "expression": "Communication.about" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Communication.about" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Communication.identifier", + "url": "http://smartbox.hs/sp/Communication-identifier", + "name": "communication-identifier", + "status": "active", + "code": "identifier", + "base": [ + "Communication" + ], + "type": "token", + "description": "Search Communication by identifier (system|value)", + "expression": "Communication.identifier" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Communication.identifier" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Session.client", + "url": "http://smartbox.hs/sp/Session-client", + "name": "session-client", + "status": "active", + "code": "client", + "base": [ + "Session" + ], + "type": "reference", + "description": "Search Session by client reference", + "expression": "Session.client", + "target": [ + "Client" + ] + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Session.client" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Session.refresh-token-exp", + "url": "http://smartbox.hs/sp/Session-refresh-token-exp", + "name": "session-refresh-token-exp", + "status": "active", + "code": "refresh_token_exp", + "base": [ + "Session" + ], + "type": "number", + "description": "Search Session by refresh token expiration time (unix epoch seconds)", + "expression": "Session.refresh_token_exp" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Session.refresh-token-exp" + } + }, + { + "resource": { + "roles": [ + { + "type": "admin" + } + ] + }, + "request": { + "method": "PATCH", + "url": "User/admin" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/patient-can-get-launch-uri" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "patient-can-get-launch-uri", + "type": "rpc", + "engine": "matcho-rpc", + "rpc": { + "aidbox.smart/get-launch-uri": { + "user": { + "fhirUser": { + "resourceType": "Patient" + } + } + } + } + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/patient-can-get-smart-apps" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "patient-can-get-smart-apps", + "engine": "matcho", + "matcho": { + "user": { + "fhirUser": { + "resourceType": "Patient" + } + }, + "params": { + "status": "active", + ".type": "smart-app", + "resource/type": "Client" + }, + "operation": { + "id": "FhirSearch" + } + } + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/patient-can-create-communication" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "patient-can-create-communication", + "engine": "matcho", + "matcho": { + "user": { + "fhirUser": { + "resourceType": "Patient" + } + }, + "params": { + "resource/type": "Communication" + }, + "operation": { + "id": "FhirCreate" + } + } + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/smart-app-can-read-patient-api" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "smart-app-can-read-patient-api", + "engine": "matcho", + "matcho": { + "jwt": { + "atv": 2, + "scope": "present?", + "context": { + "patient": "present?" + } + }, + "client": { + "type": "smart-app", + "active": true + } + } + } + }, + { + "request": { + "method": "PUT", + "url": "DocumentReference/smartbox-tos" + }, + "resource": { + "resourceType": "DocumentReference", + "id": "smartbox-tos", + "status": "current", + "type": { + "text": "Terms of Service" + }, + "category": [ + { + "text": "legal" + } + ], + "content": [ + { + "attachment": { + "url": "http://localhost:8095/change-me-smartbox-tos.pdf", + "contentType": "application/pdf" + } + } + ] + } + }, + { + "request": { + "method": "PUT", + "url": "DocumentReference/smartbox-privacy" + }, + "resource": { + "resourceType": "DocumentReference", + "id": "smartbox-privacy", + "status": "current", + "type": { + "text": "Privacy Policy" + }, + "category": [ + { + "text": "legal" + } + ], + "content": [ + { + "attachment": { + "contentType": "text/html" + } + } + ] + } + }, + { + "resource": { + "resourceType": "AuthConfig", + "id": "smartbox", + "theme": { + "styleUrl": "http://localhost:8095/auth.css" + } + }, + "request": { + "method": "PUT", + "url": "AuthConfig/smartbox" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin access to Client resources", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "Client" + } + }, + "id": "admin-role-client", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-client" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin search and read Session resources", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "Session" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead" + ] + } + } + }, + "id": "admin-role-session", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-session" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin access to Organization resources", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "Organization" + } + }, + "id": "admin-role-organization", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-organization" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin read Patient with ORGBAC", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { "resource/type": "Patient" }, "operation": { @@ -652,24 +1021,125 @@ "$one-of": [ "FhirSearch", "FhirRead", - "orgbac-fhir-search", - "orgbac-fhir-read" + "orgbac-fhir-search", + "orgbac-fhir-read" + ] + } + } + }, + "id": "admin-role-patient", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-patient" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin read User with ORGBAC", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "User" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "orgbac-fhir-search", + "orgbac-fhir-read" + ] + } + } + }, + "id": "admin-role-user", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-user" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin read Group with ORGBAC", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "Group" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "orgbac-fhir-search", + "orgbac-fhir-read" + ] + } + } + }, + "id": "admin-role-group", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-group" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin manage DocumentReference", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "FhirUpdate" ] } } }, - "id": "admin-role-patient", + "id": "admin-role-document-reference", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-patient" + "url": "AccessPolicy/admin-role-document-reference" } }, { "resource": { "engine": "matcho", - "description": "Admin read User with ORGBAC", + "description": "Admin access to settings endpoints", "matcho": { "user": { "roles": [ @@ -678,32 +1148,36 @@ } ] }, - "params": { - "resource/type": "User" + "request": { + "uri": { + "$one-of": [ + "/api/v1/settings/introspect", + "^/api/v1/settings/.*" + ] + } }, "operation": { "id": { "$one-of": [ "FhirSearch", "FhirRead", - "orgbac-fhir-search", - "orgbac-fhir-read" + "FhirUpdate" ] } } }, - "id": "admin-role-user", + "id": "admin-role-settings-introspect", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-user" + "url": "AccessPolicy/admin-role-settings-introspect" } }, { "resource": { "engine": "matcho", - "description": "Admin read Group with ORGBAC", + "description": "Admin access to AwsAccount resources", "matcho": { "user": { "roles": [ @@ -713,31 +1187,77 @@ ] }, "params": { - "resource/type": "Group" + "resource/type": "AwsAccount" + } + }, + "id": "admin-role-aws-account", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-aws-account" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin access to GcpServiceAccount resources", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "GcpServiceAccount" + } + }, + "id": "admin-role-gcp-service-account", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-gcp-service-account" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin search and read AuditEvent resources", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "AuditEvent" }, "operation": { "id": { "$one-of": [ "FhirSearch", - "FhirRead", - "orgbac-fhir-search", - "orgbac-fhir-read" + "FhirRead" ] } } }, - "id": "admin-role-group", + "id": "admin-role-audit-event", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-group" + "url": "AccessPolicy/admin-role-audit-event" } }, { "resource": { "engine": "matcho", - "description": "Admin manage DocumentReference", + "description": "Admin search and read Communication resources", "matcho": { "user": { "roles": [ @@ -747,142 +1267,447 @@ ] }, "params": { - "resource/type": "DocumentReference" + "resource/type": "Communication" }, "operation": { "id": { "$one-of": [ "FhirSearch", - "FhirRead", - "FhirUpdate" + "FhirRead" ] } } }, - "id": "admin-role-document-reference", + "id": "admin-role-communication", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-document-reference" + "url": "AccessPolicy/admin-role-communication" + } + }, + { + "resource": { + "url": "http://aidbox.app/StructureDefinition/AuditEvent/client", + "id": "AuditEvent.client", + "base": [ + "AuditEvent" + ], + "expression": "AuditEvent.agent.who.identifier.value", + "name": "client", + "status": "active", + "type": "token", + "resourceType": "SearchParameter", + "code": "client", + "description": "Filter AuditEvent by client identifier (agent.who.identifier.value)" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/AuditEvent.client" + } + }, + { + "resource": { + "resourceType": "StructureDefinition", + "id": "FaqPage", + "url": "http://aidbox.app/StructureDefinition/FaqPage", + "name": "FaqPage", + "status": "active", + "kind": "resource", + "abstract": false, + "type": "FaqPage", + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/DomainResource", + "derivation": "specialization", + "differential": { + "element": [ + { + "id": "FaqPage", + "path": "FaqPage", + "min": 0, + "max": "*" + }, + { + "id": "FaqPage.items", + "path": "FaqPage.items", + "min": 0, + "max": "*", + "type": [ + { + "code": "BackboneElement" + } + ] + }, + { + "id": "FaqPage.items.id", + "path": "FaqPage.items.id", + "min": 0, + "max": "1", + "type": [ + { + "code": "string" + } + ] + }, + { + "id": "FaqPage.items.question", + "path": "FaqPage.items.question", + "min": 0, + "max": "1", + "type": [ + { + "code": "string" + } + ] + }, + { + "id": "FaqPage.items.answer", + "path": "FaqPage.items.answer", + "min": 0, + "max": "1", + "type": [ + { + "code": "markdown" + } + ] + } + ] + } + }, + "request": { + "method": "PUT", + "url": "StructureDefinition/FaqPage" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-faqpage" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-faqpage", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "params": { + "resource/type": "FaqPage" + }, + "operation": { + "id": "Read" + } + }, + "description": "Scoped access for admin API client (FAQ pages - read only)" + } + }, + { + "request": { + "method": "PUT", + "url": "NotificationTemplate/auth-signup-email" + }, + "resource": { + "resourceType": "NotificationTemplate", + "subject": "Confirm your Member Account", + "template": "\n

Confirm your email address

\n

Hello {{params.data.name}}{{params.email}}{{params.username}}!

\n

We just need to verify that {{params.email}} {{params.username}} is your email address.

\n

Confirm Email Address

\nDidn't request this email?\n

No worries! Your address may have been entered by mistake. If you ignore or delete this email, nothing further will happen.

\n

If you're having problems, please feel free to write to us at FHIRsupport@villagecare.org. We'll be glad to help.

" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/box-ui-faqpage" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "box-ui-faqpage", + "engine": "matcho", + "matcho": { + "client": { + "id": "box-ui" + }, + "params": { + "resource/type": "FaqPage" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirSearch" + ] + } + } + }, + "description": "Allow Aidbox UI to read FAQ pages" + } + }, + { + "resource": { + "resourceType": "Patient", + "id": "test-e2e-patient", + "name": [ + { + "given": [ + "E2E" + ], + "family": "TestPatient" + } + ], + "birthDate": "1990-01-01", + "gender": "unknown" + }, + "request": { + "method": "PUT", + "url": "Patient/test-e2e-patient" + } + }, + { + "resource": { + "resourceType": "User", + "id": "test-e2e-smartbox-patient", + "email": "test-e2e-patient@smartbox.dev", + "password": "Test123!@#", + "fhirUser": { + "id": "test-e2e-patient", + "resourceType": "Patient" + }, + "data": { + "firstName": "E2E", + "lastName": "TestPatient" + }, + "roles": [ + { + "type": "patient" + } + ] + }, + "request": { + "method": "PUT", + "url": "User/test-e2e-smartbox-patient" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "provider-directory-public-read", + "engine": "matcho", + "description": "Allow admin-api client to read provider directory resources", + "matcho": { + "uri": { + "$one-of": [ + "#^/fhir/PractitionerRole($|/|\\?)", + "#^/fhir/Practitioner($|/|\\?)", + "#^/fhir/Location($|/|\\?)", + "#^/fhir/Organization($|/|\\?)", + "#^/fhir/HealthcareService($|/|\\?)" + ] + }, + "request-method": "get", + "client": { + "id": "admin-api" + } + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/provider-directory-public-read" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-patient-write", + "engine": "matcho", + "description": "Allow admin-api client to write Patient resources for enrollment telecom updates", + "matcho": { + "client": { + "id": "admin-api" + }, + "request-method": { + "$one-of": [ + "patch", + "put" + ] + }, + "uri": "#^/fhir/Patient($|/|\\?)" + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-patient-write" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-registration-read", + "engine": "matcho", + "description": "Allow admin-api client to read Registration resources for enrollment status lookup", + "matcho": { + "client": { + "id": "admin-api" + }, + "request-method": "get", + "uri": "#^/fhir/Registration($|/|\\?)" + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-registration-read" } }, { "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-access-policy", "engine": "matcho", - "description": "Admin access to settings endpoints", + "description": "Allow admin-api client to manage per-backend-service AccessPolicies (bs-policy-*) created/removed on app approval/deactivation (#478)", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] + "client": { + "id": "admin-api" }, - "request": { - "uri": { - "$one-of": [ - "/api/v1/settings/introspect", - "^/api/v1/settings/.*" - ] - } + "request-method": { + "$one-of": [ + "get", + "put", + "post", + "delete" + ] }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead", - "FhirUpdate" - ] - } + "uri": { + "$one-of": [ + "#^/AccessPolicy/bs-policy-.*", + "#^/fhir/AccessPolicy/bs-policy-.*" + ] } - }, - "id": "admin-role-settings-introspect", - "resourceType": "AccessPolicy" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-settings-introspect" + "url": "AccessPolicy/admin-api-access-policy" } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-force-reset-password" + }, "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-force-reset-password", "engine": "matcho", - "description": "Admin access to AwsAccount resources", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] + "client": { + "id": "admin-api" }, - "params": { - "resource/type": "AwsAccount" - } + "request-method": "post", + "uri": "#^/auth/force-reset-password.*" }, - "id": "admin-role-aws-account", - "resourceType": "AccessPolicy" + "description": "Allow admin API client to issue password reset links via /auth/force-reset-password" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "User.role", + "url": "http://smartbox.hs/sp/User-role", + "name": "user-role", + "status": "active", + "code": "role", + "base": [ + "User" + ], + "type": "token", + "description": "Search User by role type (User.roles[].type), e.g. /User?role=admin. FHIRPath traverses the roles array, so a role at any index matches.", + "expression": "User.roles.type" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-aws-account" + "url": "SearchParameter/User.role" } }, { "resource": { - "engine": "matcho", - "description": "Admin access to GcpServiceAccount resources", - "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] - }, - "params": { - "resource/type": "GcpServiceAccount" - } - }, - "id": "admin-role-gcp-service-account", - "resourceType": "AccessPolicy" + "resourceType": "SearchParameter", + "id": "User.patient", + "url": "http://smartbox.hs/sp/User-patient", + "name": "user-patient", + "status": "active", + "code": "patient", + "base": [ + "User" + ], + "type": "reference", + "target": [ + "Patient" + ], + "description": "Linked Patient for an enrolled member. Covers both link shapes: the enrollment flow writes User.fhirUser ({id,resourceType}) and legacy/imported members link via User.data.patient. Powers the enrolled-members list, which pages enrolled Users with /fhir/User?patient:missing=false (matches both shapes) and then fetches that page's Patients. NOTE: avoid reverse chaining (Patient?_has:User:patient:...) — it is too slow on large datasets; and Aidbox value-matches only Aidbox-format references, so :missing is the reliable modifier here. Index for scale: GIN on the User resource (see aidbox.index/suggest-index).", + "expression": "User.fhirUser | User.data.patient" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-gcp-service-account" + "url": "SearchParameter/User.patient" + } + }, + { + "resource": { + "source": "https://storage.googleapis.com/aidbox-public/smartbox/all_data.ndjson.gz" + }, + "request": { + "method": "POST", + "url": "/$load" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "plannet-practitionerrole-network", + "url": "http://hl7.org/fhir/us/davinci-pdex-plan-net/SearchParameter/practitionerrole-network", + "version": "1.2.0-aidbox-fixed", + "name": "Plannet_sp_practitionerrole_network", + "status": "active", + "description": "Select roles where the practitioner is a member of the specified health insurance provider network. NOTE: the IG 1.2.0 expression is missing the trailing .value (selects the Extension, not the Reference) and Aidbox cannot compile it - fixed here.", + "code": "network", + "base": [ + "PractitionerRole" + ], + "type": "reference", + "expression": "PractitionerRole.extension.where(url='http://hl7.org/fhir/us/davinci-pdex-plan-net/StructureDefinition/network-reference').value" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/plannet-practitionerrole-network" + } + }, + { + "request": { + "method": "PUT", + "url": "AidboxConfig/smartbox" + }, + "resource": { + "id": "smartbox", + "resourceType": "AidboxConfig", + "smartbox": { + "logoUrl": "https://storage.googleapis.com/aidbox-public/smartbox/health-system-logo.png" + } } }, { "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-client-patch", "engine": "matcho", - "description": "Admin search and read AuditEvent resources", + "description": "Allow the admin-api client to PATCH a single Client resource by id in the admin (PHI) box. The backend uses this to propagate developer-portal changes to approved clients into the production box. Single-resource PATCH only; collection/conditional PATCH, full-resource replace, and other write methods are denied.", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] - }, - "params": { - "resource/type": "AuditEvent" + "client": { + "id": "admin-api" }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead" - ] - } - } - }, - "id": "admin-role-audit-event", - "resourceType": "AccessPolicy" + "request-method": "patch", + "uri": "#^/fhir/Client/[^/?]+$" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-audit-event" + "url": "AccessPolicy/admin-api-client-patch" } }, { @@ -903,65 +1728,76 @@ }, { "resource": { - "url": "http://aidbox.app/StructureDefinition/AuditEvent/client", - "id": "AuditEvent.client", - "base": [ - "AuditEvent" - ], - "expression": "AuditEvent.agent.who.identifier.value", - "name": "client", - "status": "active", - "type": "token", - "resourceType": "SearchParameter", - "code": "client", - "description": "Filter AuditEvent by client identifier (agent.who.identifier.value)" + "resourceType": "FHIRSchema", + "url": "http://smartbox.hs/StructureDefinition/AwsAccount", + "id": "AwsAccount", + "name": "AwsAccount", + "type": "AwsAccount", + "kind": "resource", + "derivation": "specialization", + "elements": { + "region": { + "type": "string" + }, + "access-key-id": { + "type": "string" + }, + "secret-access-key": { + "type": "string" + }, + "host": { + "type": "string" + }, + "path-style": { + "type": "boolean" + }, + "use-ssl": { + "type": "boolean" + } + } }, "request": { "method": "PUT", - "url": "SearchParameter/AuditEvent.client" + "url": "FHIRSchema/AwsAccount" } }, { - "request": { - "method": "POST", - "url": "/$fhir-package-install" + "resource": { + "resourceType": "AwsAccount", + "id": "minio", + "region": "us-east-1", + "access-key-id": "minioadmin", + "secret-access-key": "minioadmin", + "host": "minio:9000", + "path-style": true, + "use-ssl": false }, + "request": { + "method": "PUT", + "url": "AwsAccount/minio" + } + }, + { "resource": { - "resourceType": "Parameters", - "parameter": [ - { - "name": "package", - "valueString": "hl7.fhir.us.core@6.1.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.carin-bb@2.0.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-pdex@2.0.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-drug-formulary@2.0.1" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-pdex-plan-net@1.1.0" - }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-pas%402.0.1.tar.gz" - }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-dtr%402.0.1.tar.gz" + "resourceType": "FHIRSchema", + "url": "http://smartbox.hs/StructureDefinition/GcpServiceAccount", + "id": "GcpServiceAccount", + "name": "GcpServiceAccount", + "type": "GcpServiceAccount", + "kind": "resource", + "derivation": "specialization", + "elements": { + "private-key": { + "type": "string" }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-crd%402.0.1.tar.gz" + "service-account-email": { + "type": "string" } - ] + } + }, + "request": { + "method": "PUT", + "url": "FHIRSchema/GcpServiceAccount" } }, { diff --git a/assets/get-started/quickstart/init-bundle-developer.json b/assets/get-started/quickstart/init-bundle-developer.json index ae52323..6621d9a 100644 --- a/assets/get-started/quickstart/init-bundle-developer.json +++ b/assets/get-started/quickstart/init-bundle-developer.json @@ -4,36 +4,60 @@ "entry": [ { "resource": { - "resourceType": "FHIRSchema", - "url": "http://aidbox.app/StructureDefinition/Client/created-by", + "resourceType": "StructureDefinition", "id": "client-created-by", - "base": "Extension", + "url": "http://aidbox.app/StructureDefinition/Client/created-by", "name": "client-created-by", + "status": "active", "kind": "complex-type", + "abstract": false, "type": "Extension", - "version": "0.0.1", - "elements": { - "url": { - "fixed": "http://aidbox.app/StructureDefinition/Client/created-by" - }, - "value": { - "choices": [ - "valueReference" - ] - }, - "valueReference": { - "type": "Reference", - "refers": [ - "User" - ], - "choiceOf": "value" + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension", + "derivation": "constraint", + "context": [ + { + "type": "element", + "expression": "Client" } - }, - "derivation": "constraint" + ], + "differential": { + "element": [ + { + "id": "Extension", + "path": "Extension", + "min": 0, + "max": "1" + }, + { + "id": "Extension.extension", + "path": "Extension.extension", + "max": "0" + }, + { + "id": "Extension.url", + "path": "Extension.url", + "fixedUri": "http://aidbox.app/StructureDefinition/Client/created-by" + }, + { + "id": "Extension.value[x]", + "path": "Extension.value[x]", + "min": 1, + "max": "1", + "type": [ + { + "code": "Reference", + "targetProfile": [ + "http://health-samurai.io/fhir/core/StructureDefinition/User" + ] + } + ] + } + ] + } }, "request": { "method": "PUT", - "url": "FHIRSchema/client-created-by" + "url": "StructureDefinition/client-created-by" } }, { @@ -58,39 +82,65 @@ }, { "resource": { - "resourceType": "FHIRSchema", - "url": "http://aidbox.app/StructureDefinition/Client/status", + "resourceType": "StructureDefinition", "id": "client-status", - "base": "Extension", + "url": "http://aidbox.app/StructureDefinition/Client/status", "name": "client-status", + "status": "active", "kind": "complex-type", + "abstract": false, "type": "Extension", - "version": "0.0.2", - "elements": { - "url": { - "fixed": "http://aidbox.app/StructureDefinition/Client/status" - }, - "value": { - "choices": [ - "valueCode" - ] - }, - "valueCode": { - "type": "code", - "choiceOf": "value", - "constraints": { - "enum-client-status": { - "severity": "error", - "expression": "%context.subsetOf('draft' | 'review' | 'active' | 'rejected')" - } - } + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension", + "derivation": "constraint", + "context": [ + { + "type": "element", + "expression": "Client" } - }, - "derivation": "constraint" + ], + "differential": { + "element": [ + { + "id": "Extension", + "path": "Extension", + "min": 0, + "max": "1" + }, + { + "id": "Extension.extension", + "path": "Extension.extension", + "max": "0" + }, + { + "id": "Extension.url", + "path": "Extension.url", + "fixedUri": "http://aidbox.app/StructureDefinition/Client/status" + }, + { + "id": "Extension.value[x]", + "path": "Extension.value[x]", + "min": 1, + "max": "1", + "type": [ + { + "code": "code" + } + ], + "constraint": [ + { + "key": "enum-client-status", + "severity": "error", + "human": "status must be one of draft | review | active | rejected", + "expression": "$this.subsetOf('draft' | 'review' | 'active' | 'rejected')" + } + ] + } + ] + } }, "request": { "method": "PUT", - "url": "FHIRSchema/client-status" + "url": "StructureDefinition/client-status" } }, { @@ -151,6 +201,20 @@ "url": "Client/smartbox-developer-portal" } }, + { + "resource": { + "resourceType": "Client", + "id": "developer-api", + "secret": "developer-api-secret-change-in-production", + "grant_types": [ + "client_credentials" + ] + }, + "request": { + "method": "PUT", + "url": "Client/developer-api" + } + }, { "resource": { "fhirUser": { @@ -230,73 +294,180 @@ } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-session" + }, "resource": { - "resourceType": "Client", - "id": "developer-api", - "secret": "developer-api-secret-change-in-production", - "grant_types": [ - "client_credentials" - ] + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "Session" + }, + "operation": { + "id": { + "$one-of": [ + "FhirCreate", + "FhirSearch", + "FhirRead", + "FhirUpdate", + "FhirPatch" + ] + } + } + }, + "description": "Scoped access for developer API client (sessions)", + "id": "developer-api-session", + "resourceType": "AccessPolicy" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-organization" + }, + "resource": { + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "Organization" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead" + ] + } + } + }, + "description": "Scoped access for developer API client (organizations)", + "id": "developer-api-organization", + "resourceType": "AccessPolicy" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-user" }, + "resource": { + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "User" + }, + "operation": { + "id": "FhirRead" + } + }, + "description": "Scoped access for developer API client (users)", + "id": "developer-api-user", + "resourceType": "AccessPolicy" + } + }, + { "request": { "method": "PUT", - "url": "Client/developer-api" + "url": "AccessPolicy/developer-api-client" + }, + "resource": { + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "Client" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "FhirDelete" + ] + } + } + }, + "description": "Scoped access for developer API client (clients, incl. E2E teardown)", + "id": "developer-api-client", + "resourceType": "AccessPolicy" } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-footer-config" + }, "resource": { "resourceType": "AccessPolicy", - "id": "developer-api", + "id": "developer-api-footer-config", "engine": "matcho", - "description": "Scoped access for developer API client (sessions, oauth state, orgs, users)", "matcho": { "client": { "id": "developer-api" }, - "$one-of": [ - { - "params": { - "resource/type": "Session" - }, - "operation": { - "id": { - "$one-of": [ - "FhirCreate", - "FhirSearch", - "FhirRead", - "FhirUpdate", - "FhirPatch" - ] - } - } - }, - { - "params": { - "resource/type": "Organization" - }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead" - ] - } - } - }, - { - "params": { - "resource/type": "User" - }, - "operation": { - "id": "FhirRead" - } + "params": { + "resource/id": "#^footer-config-.*", + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirUpdate", + "FhirCreate" + ] } - ] - } - }, + } + }, + "description": "Allow developer-api client to read/write footer config DocumentReference (id prefix footer-config-*)" + } + }, + { "request": { "method": "PUT", - "url": "AccessPolicy/developer-api" + "url": "AccessPolicy/developer-api-document-reference" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "developer-api-document-reference", + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/id": { + "$one-of": [ + "smartbox-tos", + "smartbox-privacy", + "smartbox-enrollment-message" + ] + }, + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirUpdate", + "FhirCreate" + ] + } + } + }, + "description": "Scoped access for developer-api client to DocumentReference resources (tos, privacy, enrollment message)" } }, { @@ -532,7 +703,8 @@ }, "resource": { "resourceType": "NotificationTemplate", - "template": "\n

Confirm your email address

\n

Hello {{params.data.name}}{{params.email}}{{params.username}}!

\n

We just need to verify that {{params.email}} {{params.username}} is your email address.

\n

Confirm Email Address

\nDidn't request this email?\n

No worries! Your address may have been entered by mistake. If you ignore or delete this email, nothing further will happen.

\n

If you're having problems, please feel free to write to us at hello@health-samurai.io. We'll be glad to help.

" + "template": "\n

Confirm your email address

\n

Hello {{params.data.name}}{{params.email}}{{params.username}}!

\n

We just need to verify that {{params.email}} {{params.username}} is your email address.

\n

Confirm Email Address

\nDidn't request this email?\n

No worries! Your address may have been entered by mistake. If you ignore or delete this email, nothing further will happen.

\n

If you're having problems, please feel free to write to us at hello@health-samurai.io. We'll be glad to help.

", + "subject": "Confirm your Developer Account" } }, { @@ -596,17 +768,49 @@ }, "params": { "resource/type": "Communication", - ".about.0.reference": "present?" + "about": "present?" }, "operation": { "id": "FhirSearch" } }, - "description": "Developers can search communication for sertain app", + "description": "Developers can search communication for certain app", "id": "dev-client-search-communication", "resourceType": "AccessPolicy" } }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/dev-read-compartment-definition" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "dev-read-compartment-definition", + "engine": "matcho", + "description": "Developers can read CompartmentDefinition (SMART scope picker enumerates patient compartment)", + "matcho": { + "user": { + "roles": { + "$contains": { + "type": "developer" + } + } + }, + "params": { + "resource/type": "CompartmentDefinition" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead" + ] + } + } + } + } + }, { "request": { "method": "PUT", @@ -631,6 +835,46 @@ } } }, + { + "request": { + "method": "PUT", + "url": "DocumentReference/smartbox-tos" + }, + "resource": { + "resourceType": "DocumentReference", + "id": "smartbox-tos", + "status": "current", + "type": { + "text": "Terms of Service" + }, + "category": [ + { + "text": "legal" + } + ], + "content": [ + { + "attachment": { + "contentType": "application/pdf", + "url": "http://localhost:8096/change-me-smartbox-tos.pdf" + } + } + ] + } + }, + { + "resource": { + "resourceType": "AuthConfig", + "id": "smartbox", + "theme": { + "styleUrl": "http://localhost:8096/auth.css" + } + }, + "request": { + "method": "PUT", + "url": "AuthConfig/smartbox" + } + }, { "resource": { "engine": "matcho", @@ -648,21 +892,221 @@ }, "description": "Admin access to Client resources", "id": "developer-role-client", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-role-client" + } + }, + { + "resource": { + "resourceType": "User", + "id": "test-e2e-smartbox-dev", + "email": "test-e2e@smartbox.dev", + "password": "Test123!@#", + "data": { + "firstName": "E2E", + "lastName": "Test", + "phone": "+1 555 0100", + "companyName": "E2E Health Systems", + "companyUrl": "https://e2e.example.com", + "role": "developer", + "emailVerified": true + }, + "roles": [ + { + "type": "developer" + } + ] + }, + "request": { + "method": "PUT", + "url": "User/test-e2e-smartbox-dev" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Communication.about", + "url": "http://hl7.org/fhir/SearchParameter/Communication-about", + "name": "about", + "status": "active", + "code": "about", + "base": [ + "Communication" + ], + "type": "reference", + "description": "Search Communication by about reference", + "expression": "Communication.about" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Communication.about" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-grant" + }, + "resource": { "resourceType": "AccessPolicy", - "meta": { - "lastUpdated": "2025-12-11T17:05:59.203507Z", - "versionId": "2895", - "extension": [ - { - "url": "https://aidbox.app/ex/createdAt", - "valueInstant": "2025-12-11T17:05:59.203507Z" + "id": "developer-api-grant", + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "request-method": { + "$one-of": [ + "get", + "post", + "put", + "patch", + "delete" + ] + }, + "uri": { + "$one-of": [ + "#^/fhir/Grant.*", + "#^/Grant.*" + ] + } + }, + "description": "Full CRUD access to Grant for developer API client" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "developer-api-sql", + "engine": "matcho", + "description": "Allow developer-api client to execute SQL queries for patient enrollment lookup", + "matcho": { + "client": { + "id": "developer-api" + }, + "uri": "/$sql", + "request-method": "post" + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-sql" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "developer-api-audit-event", + "engine": "matcho", + "description": "Allow developer-api client to create and read AuditEvent resources for enrollment audit logging", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "AuditEvent" + }, + "operation": { + "id": { + "$one-of": [ + "FhirCreate", + "FhirSearch", + "FhirRead" + ] } - ] + } } }, "request": { "method": "PUT", - "url": "AccessPolicy/developer-role-client" + "url": "AccessPolicy/developer-api-audit-event" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "dev-backend-service-read", + "engine": "matcho", + "description": "Sandbox: any backend service (bulk-api-client) may read/search the shared synthetic dataset before approval, mirroring dev-smart-app-read (#478)", + "matcho": { + "client": { + "type": "bulk-api-client" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirSearch" + ] + } + } + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/dev-backend-service-read" + } + }, + { + "request": { + "method": "PUT", + "url": "AidboxConfig/smartbox" + }, + "resource": { + "id": "smartbox", + "resourceType": "AidboxConfig", + "smartbox": { + "logoUrl": "https://storage.googleapis.com/aidbox-public/smartbox/health-system-logo.png" + } + } + }, + { + "request": { + "method": "PUT", + "url": "DocumentReference/smartbox-privacy" + }, + "resource": { + "resourceType": "DocumentReference", + "id": "smartbox-privacy", + "status": "current", + "type": { + "text": "Privacy Policy" + }, + "category": [ + { + "text": "legal" + } + ], + "content": [ + { + "attachment": { + "url": "http://localhost:8096/change-me-smartbox-privacy.html", + "contentType": "text/html" + } + } + ] + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-identity-provider" + }, + "resource": { + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "request-method": "get", + "uri": "#^/IdentityProvider.*" + }, + "description": "Read-only IdentityProvider access for developer API client (backend maps OIDC third-party initiated login iss to an IdP id)", + "id": "developer-api-identity-provider", + "resourceType": "AccessPolicy" } } ] From 06f0e488067a87d40d0ee5125f626636b7fe5b25 Mon Sep 17 00:00:00 2001 From: glebmark <87950237+glebmark@users.noreply.github.com> Date: Fri, 31 Jul 2026 10:31:07 +0400 Subject: [PATCH 2/2] [HealthSamurai/smartbox#631] removed excessive fhir-package-install --- .../quickstart/init-bundle-admin.json | 43 ------------------- 1 file changed, 43 deletions(-) diff --git a/assets/get-started/quickstart/init-bundle-admin.json b/assets/get-started/quickstart/init-bundle-admin.json index 7d81243..7d4771a 100644 --- a/assets/get-started/quickstart/init-bundle-admin.json +++ b/assets/get-started/quickstart/init-bundle-admin.json @@ -25,49 +25,6 @@ ] } }, - { - "request": { - "method": "POST", - "url": "/$fhir-package-install" - }, - "resource": { - "resourceType": "Parameters", - "parameter": [ - { - "name": "package", - "valueString": "hl7.fhir.us.core@6.1.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.carin-bb@2.0.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-pdex@2.0.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-drug-formulary@2.0.1" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-pdex-plan-net@1.1.0" - }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-pas%402.0.1.tar.gz" - }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-dtr%402.0.1.tar.gz" - }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-crd%402.0.1.tar.gz" - } - ] - } - }, { "resource": { "resourceType": "StructureDefinition",