diff --git a/hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/5_6_0/3018-search-narrowing-interceptor-forbidden-scope.yaml b/hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/5_6_0/3018-search-narrowing-interceptor-forbidden-scope.yaml index 7dd2f146001..376fdeac523 100644 --- a/hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/5_6_0/3018-search-narrowing-interceptor-forbidden-scope.yaml +++ b/hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/5_6_0/3018-search-narrowing-interceptor-forbidden-scope.yaml @@ -2,7 +2,7 @@ type: add issue: 3018 jira: SMILE-782 -title: "Previously, when a search query explicitly included a search parameter that was for the same resource type but a -different resource instance from the one specified in the token, the search narrowing interceptor would include both search -parameters in the final query, resulting in an empty bundle being returned to the caller. Now, such a call will result in -a 403 Forbidden error, making it more clear why no resources were returned." +title: "Previously, when a search query explicitly includes a search parameter that is for the same resource type but a +different resource instance from the one(s) specified on the authorized list, the search narrowing interceptor would include +both search parameters in the final query, resulting in an empty bundle being returned to the caller. Now, such a call +will result in a 403 Forbidden error, making it more clear why no resources were returned." diff --git a/hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/SearchNarrowingInterceptor.java b/hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/SearchNarrowingInterceptor.java index 64867a7be70..7295f483f72 100644 --- a/hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/SearchNarrowingInterceptor.java +++ b/hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/SearchNarrowingInterceptor.java @@ -285,21 +285,20 @@ public class SearchNarrowingInterceptor { searchParamName = primarySearchParamName; } else { // If the primary search parameter itself isn't in use, check to see whether any of its synonyms are. - List synonyms = findSynonyms(searchParams, primarySearchParam.get()); - Optional synonymInUse = synonyms + Optional synonymInUse = findSynonyms(searchParams, primarySearchParam.get()) .stream() .filter(t -> queryParameters.contains(t.getName())) .findFirst(); if (synonymInUse.isPresent()) { - // if so, use one of those + // if a synonym is in use, use it searchParamName = synonymInUse.get().getName(); } else { - // if not, i.e., the original query is not filtering on this field at all, use the primary + // if not, i.e., the original query is not filtering on this field at all, use the primary search param searchParamName = primarySearchParamName; } } } else { - // Otherwise, fall back to whatever is available + // Otherwise, fall back to whatever search parameter is available searchParamName = searchParams.get(0).getName(); }