honeymoose
/
hapi-fhir
mirror of https://github.com/hapifhir/hapi-fhir.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

handle queries on bare ids without explicit types

This commit is contained in:
Jason Roberts 2021-09-24 14:57:05 -04:00
parent 4a53d10c78
commit 626c6f855c
2 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/SearchNarrowingInterceptor.java
View File

@ -151,12 +151,19 @@ public class SearchNarrowingInterceptor {
* requested, and the values that the user is allowed to see * requested, and the values that the user is allowed to see
*/ */
String[] existingValues = newParameters.get(nextParamName); String[] existingValues = newParameters.get(nextParamName);
List<String> nextAllowedValueIds = nextAllowedValues
.stream()
.map(t -> t.lastIndexOf("/") > -1 ? t.substring(t.lastIndexOf("/") + 1) : t)
.collect(Collectors.toList());
boolean restrictedExistingList = false; boolean restrictedExistingList = false;
for (int i = 0; i < existingValues.length; i++) { for (int i = 0; i < existingValues.length; i++) {
String nextExistingValue = existingValues[i]; String nextExistingValue = existingValues[i];
List<String> nextRequestedValues = QualifiedParamList.splitQueryStringByCommasIgnoreEscape(null, nextExistingValue); List<String> nextRequestedValues = QualifiedParamList.splitQueryStringByCommasIgnoreEscape(null, nextExistingValue);
List<String> nextPermittedValues = ListUtils.intersection(nextRequestedValues, nextAllowedValues); List<String> nextPermittedValues = ListUtils.union(
ListUtils.intersection(nextRequestedValues, nextAllowedValues),
ListUtils.intersection(nextRequestedValues, nextAllowedValueIds)
);
if (nextPermittedValues.size() > 0) { if (nextPermittedValues.size() > 0) {
restrictedExistingList = true; restrictedExistingList = true;
existingValues[i] = ParameterUtil.escapeAndJoinOrList(nextPermittedValues); existingValues[i] = ParameterUtil.escapeAndJoinOrList(nextPermittedValues);

20
hapi-fhir-structures-r4/src/test/java/ca/uhn/fhir/rest/server/interceptor/auth/SearchNarrowingInterceptorTest.java
View File

@ -224,6 +224,26 @@ public class SearchNarrowingInterceptorTest {
assertThat(toStrings(ourLastPatientParam), Matchers.contains("Patient/456", "Patient/456")); assertThat(toStrings(ourLastPatientParam), Matchers.contains("Patient/456", "Patient/456"));
} }
@Test
public void testNarrowObservationsByPatientContext_ClientRequestedSomeOverlap_ShortIds() {
ourNextCompartmentList = new AuthorizedList().addCompartments("Patient/123", "Patient/456");
ourClient
.search()
.forResource("Observation")
.where(Observation.PATIENT.hasAnyOfIds("456", "777"))
.and(Observation.PATIENT.hasAnyOfIds("456", "888"))
.execute();
assertEquals("Observation.search", ourLastHitMethod);
assertNull(ourLastIdParam);
assertNull(ourLastCodeParam);
assertNull(ourLastSubjectParam);
assertNull(ourLastPerformerParam);
assertThat(toStrings(ourLastPatientParam), Matchers.contains("456", "456"));
}
@Test @Test
public void testNarrowObservationsByPatientContext_ClientRequestedSomeOverlap_UseSynonym() { public void testNarrowObservationsByPatientContext_ClientRequestedSomeOverlap_UseSynonym() {