bluehalo / node-fhir-server-core

An Open Source secure REST implementation for the HL7 FHIR Specification. For API documentation, please see https://github.com/Asymmetrik/node-fhir-server-core/wiki.

Asymmetrik FHIR API Server

A Secure Rest implementation for the HL7 FHIR Specification. For API documentation, please see our documents.

The Asymmetrik Extensible Server Framework for Healthcare allows organizations to build secure, interoperable solutions that can aggregate and expose healthcare resources via a common HL7® FHIR®-compatible REST API. This server framework currently supports DSTU2 (1.0.2), STU3 (3.0.1), and R4 (4.0.0) simultaneously. You can decide to support all three or just one by editing the configuration.

The framework defines a core server, node-fhir-server-core, a simple, secure Node.js module built according to the FHIR specification and compliant with the US Core implementation.

For an example implementation using MongoDB, please refer to our Github repository that we used for the ONC FHIR Secure API Server Showdown Challenge: https://github.com/Asymmetrik/node-fhir-server-mongo.

[email protected]

Please view the Migration Guide for version 2.0.0. We will absolutely continue supporting previous versions but will prioritize new features going to 2.0.0 unless we receive requests to retrofit them to older versions.

Prerequisites

Node.js version later than >7.6 is required, but you should NOT use 8.5 (see Attention). A basic understanding of promises and a familiarity of the FHIR specification is not required, but will be very helpful.

Getting Started

Please see our Getting Started guide for a walkthrough of how to set up our FHIR server.

Frequently Asked Questions

• What configurations does FHIRServer.initialize() accept?
• How do I configure a "profile"?
• Can I add more loggers or customize how the logger works?
• How do I customize the capability statement?
• How do I add custom operations?
• How do I enable/disable/customize access control (authentication)?

Philosophy

Our project vision is to build an easy to use FHIR server that supports all resource profiles defined in the US Core implementation guide and is built with security in mind from the ground up. We decided to use a plugin style architecture so implementors could focus on writing queries and not worry about all the other technical difficulties of securing the server. As this project matures, we plan to support more resources, custom extensions, versions, write capabilities, etc.

We believe in establishing a robust security, especially when it comes to health information. Part of the ONC Secure API Server Challenge was to stand up a server and let penetration testers have a go at it (you can see their results here). We are committed to continuing this practice and we will continue fixing any vulnerabilities discovered so we can do our best to make this server as secure as possible. For authentication, we are actively working on methods for simplifying integration with SMART on FHIR.

Contributing

Please see CONTRIBUTING.md for more details regarding contributing issues or code.

Questions

If you are experiencing a bug, please feel free to file an issue. For general questions, please post them to StackOverflow with the tag node-fhir-server-core or javascript-fhir.

Attention

This library makes use of node's path module. This is potentially exploitable in node version 8.5, see here. When deploying this, you need to deploy with a node version later than >7.6 but NOT 8.5.

License

@asymmetrik/node-fhir-server-core is MIT licensed.

node-fhir-server-core's Issues

Extend structure definition in patient profile

I need to add custom data field to patient FHIR object, There are any way to Extend structure definition in FHIR patient object in Asymmetrik/node-fhir-server-core

Observation controller does not return links for search operation

Are you reporting a bug?

Yes.

What is the current behavior?

When a search is performed on the Observation resource, the result does not contain the link property which contains urls for related resources.

Upon further investigation I noted that the search method in the observation controller was the only resource controller where the response utility was not being used to process the result (the metadata controller does this too but no additional processing is done in this instance). Was this intentional or did you guys just miss this when updating the resource controllers?

What is the expected behavior?

When a search is performed on the Observation resource, the result should contain the link property which contains the url for the search results:

GET /3_0_1/Observation

{
  "resourceType": "Bundle",
  "type": "searchset",
  "link": [
    {
      "relation": "self",
      "url": "http://localhost:3000/3_0_1/Observation"
    }
  ],
  "total": 0,
  "entry": []
}

What are the steps to reproduce?

GET /3_0_1/Observation

{
  "resourceType": "Bundle",
  "type": "searchset",
  "total": 0,
  "entry": []
}

What OS are you using and what version of node.js and @asymmetrik/fhir-server-core are you running?

OS: Mac OS 10.14 (Mojave)
Node: 10.14.2
@asymmetrik/fhir-server-core: 1.2.0

Missing search params: _count is undefined

Hello, I'm trying to get the _count value from the search params however after some search on the source code, I found that only part of the following params are implemented

let { _INCLUDE, _REVINCLUDE, _SORT, _COUNT, _SUMMARY, _ELEMENTS, _CONTAINED, _CONTAINEDTYPED } = args;

According to your file common.arguments.js, only some of them are implemented and I want to use the _count. how should I do without changing the source code?

'part' attribute missing from Parameters object

The 'part' attribute is missing from the v3.0.1 Parameters object (see reference here: http://www.hl7.org/fhir/parameters.html).

bump nodemon to remove malicious package

Do you want to request a feature, improve documentation, or ask a question?

No.

Are you reporting a bug?

Yes.

What is the current behavior?

A critical issue on npm install: malicious package flatmap-stream.

What is the expected behavior?

No critical issues.

What are the steps to reproduce?

npm install (against the current package.json on master).

What OS are you using and what version of node.js and @asymmetrik/fhir-server-core are you running?

MacOS, node 10.5.0, dev branch of the project.

An adequate fix, bumping nodemon to 1.18.6, is documented here: reactioncommerce/reaction#4828

The current version is 1.12.1.

Improved config validation and messaging.

Do you want to request a feature, improve documentation, or ask a question?

Feature - Improved config validation and messaging.

For version 2.0.0, we want better error handling on the initial setup. In the getting started section, we have to pass in empty objects as part of the initial config or else it throws errors. If those configs are indeed required, which not all are, we should throw a more appropriate error with details on how to fix it. If it is not required, then we should not be throwing errors attempting to validate it.

Generating StatusCode 404

Question about generating a 404

What is the current behavior?
Let's say I have a Medication Resource and I have this function to get a medication by ID

module.exports.searchById = (args, context, logger) => {
	logger.info(`Getting medication with ID: ${args.id}`)
	return new Promise(async (resolve, reject) => {
		try {
			let data = await getDrug(args.id)
			const resp = JSON.parse(data.body) // WHAT DO I DO WHEN RESOURCE NOT FOUND
			resolve(resp)
		} catch (err) {
			reject(err)
		}
	})
}

What is the best way to return a 404 to the user when getDrug returns nothing? I would like to generate an OperationOutcome, but I don't have access to set the statusCode, do I? Is this something I need to make a pull request for? Or do you handle it a different way
@jonterrylee

Missing patient-specific scopes and validation in resource controller

Do you want to request a feature, improve documentation, or ask a question?

I would like to request the implementation of patient-specific scopes in accordance with the SMART on FHIR authorization specification. patient/:resourceType.(read|write|*)
As well as the associated validation in the resource controller.

If i am not mistaken, this is currently only implemented for patients who are only allowed to view their own patient resource (patient.controller.js#L44, common.scopes.js#L14 (if profile == patient)), but not for the rest of the resources. Or am i missing something here?

Make npm package module

Do you want to request a feature, improve documentation, or ask a question?

Feature

Are you reporting a bug?

No
What is the current behavior?
Have to reference github in package.json
What is the expected behavior?
Have npm package with versions
What are the steps to reproduce?

Are there plans to make this an npm package you all are going to maintain? I am using a fork for our staging server implementation because I can't have changes going to master all willy nilly. Do you want me to make one and have y'all be co-owners? Do you have other thoughts?

Add $expand by ValueSet Id

Do you want to request a feature, improve documentation, or ask a question?

Feature to add $expand to value-sets. See #95

R4 Timeline

What is the expected R4 release timeline?

"resourceType" always undefined when trying to POST a patient

I am trying to POST a patient's object:

{
        "resourceType": "Patient",
        "id": "2a269655-ca89-49f6-893d-baf301382c11",
        ...
}

But I always get the error, "resourceType expected 'Patient' but got undefined". I ran this in test mode (bypassing authentication). Is there a sample format or example of POST body?

Thanks.

The deprecated __resourceType still referenced in controllers.js

Do you want to request a feature, improve documentation, or ask a question?

No

Are you reporting a bug?

Yes

What is the current behavior?
When PUTing a new Patient resource following a fresh install and the instructions at https://github.com/Asymmetrik/node-fhir-server-mongo, I get an error:
'resourceType' expected to have value of 'undefined', received 'Patient'

What is the expected behavior?
A new Patient resource to be added.

What are the steps to reproduce?
PUT a new Patient resource following a fresh install and the instructions at https://github.com/Asymmetrik/node-fhir-server-mongo

What OS are you using and what version of node.js and @asymmetrik/fhir-server-core are you running?
$ node -v
v10.15.3
fhir-server-core: 1.4.0

Note: See #157 (comment) for comment about same issue during last PR#157. I tracked down issue to https://github.com/Asymmetrik/node-fhir-server-core/blob/master/src/server/profiles/patient/patient.controller.js#L137. Of course, the rest of the profile controllers have this same issue from a quick grep.

Server will not start on Ubuntu 16.04 when trying to grab capitalized argument file.

Are you reporting a bug?

Yes
What is the current behavior?
Trying to start server on an ubuntu 16.04 does not work because filenames are case sensitive but the /server/utils/params.utils.js:23 uses a lowercase profilekey.
What is the expected behavior?
Grab the allowed arguments for the profiles specified.
What are the steps to reproduce?
Try to start a server on ubuntu 16.04
What OS are you using and what version of node.js and @asymmetrik/fhir-server-core are you running?
ubuntu 16.04 / node 8.11.2 / node-fhir-server-core master

2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR Error: Cannot find module '../standards/3_0_1/arguments/allergyintolerance.arguments'
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     ^
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     at configureResourceRoutes (/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/route-setter.js:151:20)
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     at Object.setter [as setRoutes] (/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/route-setter.js:278:2)
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     at getSearchParamaters (/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/utils/params.utils.js:23:33)
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     at Function.Module._resolveFilename (module.js:547:15)
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     at Function.Module._load (module.js:474:25)
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     at require (internal/module.js:11:18)
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     at Array.forEach (<anonymous>)
2018-10-11T14:16:08.74-0400 [APP/PROC/WEB/0] ERR     at profile.versions.forEach.version (/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/route-setter.js:152:30)
2018-10-11T14:16:08.75-0400 [APP/PROC/WEB/0] ERR npm ERR! code ELIFECYCLE
2018-10-11T14:16:08.75-0400 [APP/PROC/WEB/0] ERR npm ERR! Exit status 1
2018-10-11T14:16:08.75-0400 [APP/PROC/WEB/0] ERR npm ERR! [email protected] start: `node server.js`
2018-10-11T14:16:08.75-0400 [APP/PROC/WEB/0] ERR npm ERR! This is probably not a problem with npm. There is likely additional logging output above.
2018-10-11T14:16:08.75-0400 [APP/PROC/WEB/0] ERR npm ERR! Failed at the [email protected] start script.
2018-10-11T14:16:08.83-0400 [APP/PROC/WEB/0] ERR npm ERR!     /home/vcap/app/.npm/_logs/2018-10-11T18_16_08_760Z-debug.log
2018-10-11T14:16:08.83-0400 [APP/PROC/WEB/0] ERR npm ERR! A complete log of this run can be found in:

Potential Fix is #90

Define a custom search parameter?

Is it possible to define a custom search parameter for a particular profile? In my case, I would like to add an endDateTime as a parameter when searching for Slots. However, this parameter is getting removed by the arg sanitizer because it is not listed in the FHIR spec. Is there a way to specify that I would like to allow this custom parameter through? Thank you!

resolve.utils breaks on case sensitive operating systems

Are you reporting a bug?

Yes

What is the current behavior?

Trying to start server on an ubuntu 16.04 does not work because filenames are case sensitive but the /server/utils/resolve.utils.js:6 uses a lowercase relative_path with key.

What is the expected behavior?

Grab the allowed arguments for the relative_path specified.

What are the steps to reproduce?

Try to start a server on ubuntu 16.04

What OS are you using and what version of node.js and @asymmetrik/fhir-server-core are you running?

ubuntu 16.04 / node 8.11.2 / node-fhir-server-core master

info: Metadata.generateCapabilityStatement
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR 2018-10-12T13:52:46.270Z - error: 500 message=Cannot find module '/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/standards/3_0_1/medication', stack=Error: Cannot find module '/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/standards/3_0_1/medication'
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at Function.Module._resolveFilename (module.js:547:15)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at Function.Module._load (module.js:474:25)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at Module.require (module.js:596:17)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at require (internal/module.js:11:18)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at Object.resource [as makeResource] (/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/metadata/capability.template.js:11:18)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at server_statement.resource.active_profiles.map (/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/metadata/metadata.service.js:69:12)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at Array.map (<anonymous>)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at Promise (/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/metadata/metadata.service.js:66:46)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at new Promise (<anonymous>)
2018-10-12T09:52:46.27-0400 [APP/PROC/WEB/0] ERR     at Object.generateCapabilityStatement (/home/vcap/deps/0/node_modules/@asymmetrik/node-fhir-server-core/src/server/metadata/metadata.service.js:24:61), code=MODULE_NOT_FOUND

Potential Fix is #92

Integration and Route tests

Do you want to request a feature, improve documentation, or ask a question?

We need more comprehensive unit tests and would also like to add integration testing as well. Too many issues are getting resolved without test cases being updated to check for them, so let's add some more.

For route testing, we should start the server and issue requests to each potential route that an endpoint could have and make sure cors options are correctly handled, route paths and methods are correctly set, and error handling is properly done.

For integration testing, let's start the server and validate all routes to make sure they are reachable and the controllers are returning the expected defaults. We can also test the conformance statements are returned at the proper location.

ResourceList Resource missing

Multiple resources reference the ResourceList.js resource/file in src\server\standards\stu3\base but it is not present in the repo.

How to add custom route ?

Not able to call custom route

I have registered auth route like shown in image but i am not able to view or call this route

it is giving 404 not found

please tell me how to do this ?

Rethink Authentication

Do you want to request a feature, improve documentation, or ask a question?

Feature - Change how to integrate authentication.

There is still some discussion on this issue. Currently our authentication allows for one of two things easily. Smart on FHIR authentication and authorization, or authentication via a passport strategy (but no authorization). Users can use the advanced way of building, but this requires a universal middleware (versus one that can be applied directly to a route) that would also cover non authenticated routes, and a universal strategy. Plus the user has to invoke all the correct server methods to get back to the same result as using Smart or Passportjs.

One solution is to not include auth, most user's ask us how to disable it anyway, and allow for them to provide a middleware and a strategy. The middleware would only apply to routes that should have authentication and would get some extra parameters at setup time to help with building it. The strategy would work much the same way it does now except we would not need to maintain and document Smart on FHIR specific things.

If we choose this solution, we could then include examples of each option in our docs with walkthroughs and have a much more flexible mechanism for user role validation.

Creating custom profile

Do you want to request a feature, improve documentation, or ask a question?
Asking a question

Hello, I am new to NodeJS and am having trouble creating a custom profile.
Could anyone tell me how to create a profile and when creating new resources how can I check validation with my profile?

ONC FHIR Challenge Vulnerability: Invalid access to a patient record

Are you reporting a bug?

Yes

This was an issue discovered during the ONC FHIR challenge competition during stage 2. The user was able to ask for a patient's records other than the one their token allowed them to access due to an invalid check. For example, if the patient had the following context in their jwt token.

context: {
  patient: "1"
},

and they requested <server>/dstu2/patient/2. They could retrieve patient records for the patient with ID 2 when the intended behavior is a 401 Unauthorized with the following message You are not allowed to access patient 2.

doseSimpleQuantity should be doseQuantity in stu3?

I was following the FHIR 3.0.1 documentation here to implement dosage in medicationStatement and noticed that my doseRanges were working but my doseQuantities were disappearing. This seems to be because the server uses doseSimpleQuantity instead of doseQuantity, e.g., here:

https://github.com/Asymmetrik/node-fhir-server-core/blob/e05e59a736f6572439c0515f12f60bc44cf99758/src/server/standards/stu3/base/Dosage.js#L124

I don't know whether the name changed at some point, but doseSimpleQuantity seems to be incorrect now.

base_version missing from Observation controller search method

Do you want to request a feature, improve documentation, or ask a question?

Suggest a change/correction

Are you reporting a bug?

Yes

What is the current behavior?
Observation service search method is not supplied with base_version because the parameter is missing when calling from the controller.
https://github.com/Asymmetrik/node-fhir-server-core/blob/master/src/server/profiles/observation/observation.controller.js#L164
currently reads
let args = { id, resource: observation };

Line 164 should read
let args = { id, base_version, resource: observation };

What is the expected behavior?
Observation service search method should be passed base_version from Observation controller (like all other controllers do)

What are the steps to reproduce?
Try to do a search and you will not get the 3_0_1 which is the base_version filled in

What OS are you using and what version of node.js and @asymmetrik/fhir-server-core are you running?
node 8.11.2 and fhir 1.3.0

Integrate Phoenix Tools

Do you want to request a feature, improve documentation, or ask a question?

Integrate recently published phoenix-tools to npm into this project. Be careful not to remove any functionality in this current project.

Use deprecated utility

Do you want to request a feature, improve documentation, or ask a question?

Feature - Mark future breaking changes as deprecated

In version 2.0.0, we will have some breaking changes, but also some things will be marked as deprecated and we will encourage users to not use them with the deprecation notice utility.

Document authentication changes

Do you want to request a feature, improve documentation, or ask a question?

Improve documentation.

What is the current behavior?

Authentication has changed to use PassportJS and is no longer documented. Nor is it clear from the existing documentation that it no longer applies.

A particular issue with the change in setup is that there is no Passport strategy example given, and authentication does not turn on without one. (There was some discussion of this at the end of issue #58.)

An example would also be helpful, as PassportJS is cryptic about authentication failures.

ONC FHIR Challenge Vulnerability: Modify Token Properties

Given a valid access token, client id, and client secret. The valid token is able to be decoded, modified, and resigned. Once it is resigned, it can be sent back into the server and the server still thinks the token is valid.

This was used to modify scopes and extend the expiration time of a token.

Practitioner communication bug

Hello,

I think there is a bug in the Practitioner entity, with the "communication" entry. I'm using as it's said on v3 FHIR specifications (https://www.hl7.org/fhir/practitioner-definitions.html#Practitioner.communication), and it loads nothing when casting to Practitioner class. I'm using exactly in the same way as in Patient's entity, and there it works well.

This is what I have just before casting:
"communication":[{"language":{"coding":[{"system":"http://hl7.org/fhir/ValueSet/languages","code":"es"}],"text":"es"},"preferred":true}]

And, after casting, I got a simple "communication":[{}]

It's not important, as it's not a mandatory field, but maybe it can be taken into account for the future.

Thank you very much.

BundleEntry.js - Resource does not inherit from ("./Resource") and cannot call toJSON

Are you reporting a bug?

Yes.

What is the current behavior?
I am hitting http://localhost:3001/3_0_1/Medication?_content=ritalin. Here is the data I pass into my resolve().

[{"resourceType":"Medication","id":"13424","meta":{"lastUpdated":"stuff"},"code":{"text":"8 HR Metadate 20 MG Extended Release Oral Tablet","coding":[{"system":"http://www.nlm.nih.gov/research/umls/rxnorm","code":"1091488","display":"8 HR Metadate 20 MG Extended Release Oral Tablet","userSelected":false}]},"isBrand":true,"isOverTheCounter":false,"form":"tablet"},{"resourceType":"Medication","id":"13424","meta":{"lastUpdated":"stuff"},"code":{"text":"Ritalin 5 MG Oral Tablet","coding":[{"system":"http://www.nlm.nih.gov/research/umls/rxnorm","code":"1091500","display":"Ritalin 5 MG Oral Tablet","userSelected":false}]},"isBrand":true,"isOverTheCounter":false,"form":"tablet"}]

The response from the server

{ message: 'this.__resource.toJSON is not a function',
  stack: 'TypeError: this.__resource.toJSON is not a function\n    at BundleEntry.toJSON 

(/Users/nhall/common-clinical/fdb-proxy/node_modules/@asymmetrik/node-fhir-server-core/src/server/standards/3_0_1/BundleEntry.js:72:49)\n    
at Object.assign.entry.__entry.__entry.map.v (/Users/nhall/common-clinical/fdb-proxy/node_modules/@asymmetrik/node-fhir-server-core/src/server/standards/3_0_1/Bundle.js:96:51)\n    
at Array.map (<anonymous>)\n    at Bundle.toJSON (/Users/nhall/common-clinical/fdb-proxy/node_modules/@asymmetrik/node-fhir-server-core/src/server/standards/3_0_1/Bundle.js:96:40)\n    
at JSON.stringify (<anonymous>)\n   
at stringify (/Users/nhall/common-clinical/fdb-proxy/node_modules/express/lib/response.js:1119:12)\n 
   at ServerResponse.json (/Users/nhall/common-clinical/fdb-proxy/node_modules/express/lib/response.js:260:14)\n    
at Object.handleBundleReadResponse (/Users/nhall/common-clinical/fdb-proxy/node_modules/@asymmetrik/node-fhir-server-core/src/server/utils/response.utils.js:103:18)\n  
at service.search.then (/Users/nhall/common-clinical/fdb-proxy/node_modules/@asymmetrik/node-fhir-server-core/src/server/profiles/medication/medication.controller.js:48:19)\n   
 at <anonymous>' }

The issue I think is in src/server/standards/3_0_1/BundleEntry.js. If you look at the setters, it is not requiring ./Resource to instantiate a new object, and not inheriting toJSON. The options are

1. require('./Resource') on line 36 and instantiate a new resource object
2. remove toJSON on line 73.

In my pull request, I went with option 2 because it works for my use case. It now returns

{
  resourceType: "Bundle",
  type: "searchset",
  total: 2,
  link: [
    {
      relation: "self",
      url: "http://localhost:3001/3_0_1/Medication?_content=ritalin"
    }
  ],
  entry: [
    {
      fullUrl: "undefined/3_0_1/Medication/13424",
      resource: {
        resourceType: "Medication",
        id: "13424",
        meta: {
          lastUpdated: "stuff"
        },
        code: {
          text: "8 HR Metadate 20 MG Extended Release Oral Tablet",
          coding: [
            {
              system: "http://www.nlm.nih.gov/research/umls/rxnorm",
              code: "1091488",
              display: "8 HR Metadate 20 MG Extended Release Oral Tablet",
              userSelected: false
            }
          ]
        },
        isBrand: true,
        isOverTheCounter: false,
        form: "tablet"
      },
      search: {
        mode: "match"
      }
    },
    {
      ...truncated other object
    }
  ]
}

I'll submit the pull request as well. Test and lint all pass. Please let me know if I'm in error. Thanks again for this great project.

Asymmetrik/node-fhir-server-core with Microsoft SQL Server

Currently i am trying use your Asymmetrik/node-fhir-server-core with Microsoft SQL Server is there any possibility to do that

Resource search parameters not implemented?

Do you want to request a feature, improve documentation, or ask a question?

No...

Are you reporting a bug?

Yes.

What is the current behavior?

Resource searches fail with an invalid parameter error because the "resource" type is not found in sanitize.utils.js.

What is the expected behavior?

I think resource searches should restrict to the resource; for example, restrict a Condition search to a particular patient, as works here (but is not working for me on my server):
https://r3.smarthealthit.org/Condition?patient=7b1b9efd-50a4-4b8b-a772-a24aafe01f7f

What are the steps to reproduce?

Pass in a search query of resource type from the argument list for a particular service. You don't need a sensible value to see the error.

What OS are you using and what version of node.js and @asymmetrik/fhir-server-core are you running?

MacOS 10.12.6, Node 10.5.0, and a branch of fhir-server-core off of develop commit 1e933be, but master and develop don't seem to have changed any w.r.t. sanitize.utils.js.

Practitioner search by language doesn't work

Hi,

Only to notify... If you query a practitioner by language (communication), it simply ignores that filter. In version v3. An example:

https://localhost:10000/3_0_1/Practitioner?given=dr&language=en

While "given" filter works fine, "language" is simply ignored.

Regards.

Cleanup of old code

Do you want to request a feature, improve documentation, or ask a question?

Feature - When migrating to 2.0 and incorporating new resources and utilities, a lot of code will no longer be needed. We are not reducing functionality, just removing boilerplate.

Separating header Last-Modified from meta lastUpdated

Hi.

I'm not sure if it's a bug, or not. I have a FHIR server with some entities. They returns a field named "Last-Modified" when the corresponding meta "lastUpdated" is defined in the service. Others are trying to access to my endpoint, but we are encountering different problems related to date formats. If I define meta lastUpdated in a correct format, Last-Modified header is automatically defined in the same way. But, for the third-party client from Microsoft, this is not correct, as one must be defined in an xs:dateTime format, but the other must be ISO with timezone. If I remove meta, header is also removed. They are linked in response.utils file:

res.set('Last-Modified', ${resource_json.meta.lastUpdated});

Is there any chance to get both dates separately, or both of them must be necessarily together?

Thanks in advance.

Add changelog generator

Do you want to request a feature, improve documentation, or ask a question?

Feature - Add changelog generator which works on conventional commit standard. We can use this to generate release notes automatically for us as long as all commits merged to master follow the conventional commit standard (angular type)

Update/Improve Documentation in Wiki

Do you want to request a feature, improve documentation, or ask a question?

Improve Documentation. We have merged many PR's that have added new features, changed configurations, etc. We should update the wiki to include all these additions.

TODO:

• Review merged PR's and add items to the list below.

Things to add to the wiki:

• #108 Improve auth documentation, provide examples
• #118 Give example of adding errorHandler and requestHandler middleware
• #111 Document custom operations and how to use them, provide an example
• Update documentation for "Getting Started" section, including example request to a resource
• Update contributors guide
• Update Metadata documentation since we support custom metadata hooks

If there are other things we are missing documentation on, please comment below and we will add those as soon as we can.

ONC FHIR Challenge Vulnerability: Token creation and validation

Two separate issues here but can be fixed with a similar patch. The oauth server used in this repo as an example was not a fully implemented oauth server. Replacing our mock oauth server with a fully secured oauth server should remediate both the following issues, but they need to be verified independently.

First issue is that with a client id and client secret, tokens can be self generated without going to an oauth server, and then used to access resources.

Second issue is that a client secret is not required to request an auth token when the client is "trusted".

Operation support

Hi,
I have a couple of quick questions.

1. Is there a means to support FHIR operations? It looks like there is all of the basic CRUD and searching type stuff but I do not see how one would go about implementing operations within the framework. This would be for spec defined operations such as Patient $everything as well as custom site defined operations.

2. Is there something along the lines of a google group for asking questions or interacting with other users of the framework? Github issues are good for somethings, groups are better for others, IMO anyway.

Thanks

Add invariant class

Do you want to request a feature, improve documentation, or ask a question?

Feature - Invariant class

Create an invariant class we can use to make assertions and throw errors in the dev environment

ONC FHIR Challenge Vulnerability: NoSQL Injection

This issue affects an implementation that used this repo. The issue was that someone was able to inject a NoSQL injection attack as a field name and trick the server into retrieving all client ids. This was a mongo specific issue which node-fhir-server-core does not typically care about. However, it was exploited because our sanitization utils were not used on the oauth related endpoints. Adding those utils to oauth will fix the issue by sanitizing all values and not passing fields in, rather, creating a new object with a valid field name provided by a config.

Updating profile controllers

Do you want to request a feature, improve documentation, or ask a question?

Ask a question. Hey guys, I want to make a change to how the profile controllers process search results to support paging. Do you guys use some sort of code generator to update all controller files or would I need to update them manually or use another approach?

Handling response

I'm having troubles managing response in every operation I do. I know it's my fault, but I can't get a correct response, specially relevant when creating (for example, an appointment). I've been told by other people that this kind of entities should return back a Patient object when creating an object, not only the new ID for that patient. However, I get a blank "data" property, and instead I have a "data" property inside config sub-object. This is a problem, but it's bigger yet when I create an appointment. I have this response:

{"data":"","status":201,"config":{"method":"POST","transformRequest":[null],"transformResponse":[null],"jsonpCallbackParam":"callback","url":"https://localhost:10000/3_0_1/Appointment","headers":{"Content-Type":"application/json+fhir;charset=UTF-8","Cache-Control":"no-cache","Accept":"application/json, text/plain, /"},"data":{"objApp":{"resourceType":"Appointment","status":"pending","participant":[{"actor":{"reference":"Patient/295","display":"Prueba Prueba"},"required":"required","status":"accepted"},{"type":[{"coding":[{"system":"http://terminology.hl7.org/CodeSystem/v3-ParticipationType","code":"ATND"}]}],"actor":{"reference":"Practitioner/19","display":"Prueba Prueba"},"required":"required","status":"accepted"}],"slot":[{"reference":"Slot/1610146","display":"1610146"}],"start":"2019-02-11T12:10:00Z","end":"2019-02-11T12:20:00Z"}}},"statusText":"Created"}

As you see, data is still blank. transformRequest and transformResponse are both null, and my object "objApp" is inside data, but at a time inside config. And, what is worst, I haven't got my new ID anywhere. I'm finishing my service back to the controller with:

return resolve({ id: request.parameters.nuevaCita.value });

which I checked that got the correct value (an integer). I don't know what I'm doing bad...

Thank you very much in advance.

Feature request to add $everything operation on Patient and Encounter resources

https://www.hl7.org/fhir/patient-operation-everything.html
https://www.hl7.org/fhir/operation-encounter-everything.html

Querying by entity references (v3)

Hello,

I'm unable to get a query from my FHIR server: I simply want to get all appointments for a single day, for a single patient. As date filtering is simple, because I need only to query by a string...

https://server:port/3_0_1/Appointment?date=2018-10-29&status=booked

...I can't get the patient filter, because it's a reference. If I'm not wrong, watching official documentation (http://hl7.org/fhir/search.html), it should be something like...

https://server:port/3_0_1/Appointment?date=2018-10-29&status=booked&patient:Patient=295

But I get a "Invalid parameter: patient". My appointment "search" service is defined:

...
let patient = args['patient'];
...
if (patient) {
query += " and p.idpaciente = " + patient;
};

Am I doing anything wrong? I get similar errors even when referencing a complex object from the same entity...

Thank you very much.

Integrate new resources

Do you want to request a feature, improve documentation, or ask a question?

Feature - Integrate new phoenix resources

The internal generator is getting an overhaul and will fix many issues and offer lots of area's for reduction in boilerplate. The newly generated resources also will use a plugin system where they can be dropped in and the server will automatically pick them up and register them as endpoints.

This will be a breaking change and will need to come with an upgrade guide and new documentation.

usage of _include and _revinclude search params

Any update on how to use Search params with _include and _revinclude params...??

Getting Started URL is no longer valid

Love this project. Thanks for your work.

http://localhost:3000/stu3/metadata no longer works. I had to use
http://localhost:3000/3_0_1/metadata. Not sure the best way to fork your wiki.

Getting Started doesn't get started

Do you want to request a feature, improve documentation, or ask a question?

This is regarding the Getting Started page of the wiki documentation.

Are you reporting a bug?

What is the current behavior?

The Getting Started page (https://github.com/Asymmetrik/node-fhir-server-core/wiki/Getting-Started) says to create a couple of files (without saying where to put them), and then look at the results on localhost:3000, but there is no instruction that actually starts a server on localhost.

What is the expected behavior?

Apparently, a startup step for the server should be included in the instructions.

What are the steps to reproduce?

Follow the instructions on the wiki page as of the 6th revision.

What OS are you using and what version of node.js and @asymmetrik/fhir-server-core are you running?

MacOS 10.12.6
Node v.10.5.0
Yarn v.1.7.0
@asymmetrik/fhir-server-core - presumably the yarn command provided installed master

Support Managing Return Content (Prefer: )

Do you want to request a feature, report a bug, or improve documentation?

This is a new feature, based on https://www.hl7.org/fhir/http.html#return

Would like to be able to specify:

Prefer: return=minimal
Prefer: return=representation
Prefer: return=OperationOutcome

In request headers in order to determine what to return on create and update returns.