feat: Add support for GetSearchFilterBasedOnIdentity

src/smartHandler.test.ts

@@ -16,6 +16,7 @@ import {
     AllowedResourceTypesForOperationRequest,
     BASE_R4_RESOURCES,
     AuthorizationBundleRequest,
+    GetSearchFilterBasedOnIdentity,
 } from 'fhir-works-on-aws-interface';
 import { decode } from 'jsonwebtoken';
 import { SMARTHandler } from './smartHandler';
@@ -1002,3 +1003,39 @@ describe('getAllowedResourceTypesForOperation', () => {
         );
     });
 });
+
+describe('getSearchFilterBasedOnIdentity', () => {
+    const authZHandler: SMARTHandler = new SMARTHandler(authZConfig, apiUrl, '4.0.1');
+    test('Patient identity', async () => {
+        // BUILD
+        const userIdentity = clone(patientIdentityWithoutScopes);
+        const request: GetSearchFilterBasedOnIdentity = {
+            userIdentity,
+            operation: 'search-type',
+        };
+
+        // OPERATE, CHECK
+        const expectedFilter = [
+            {
+                key: '_reference',
+                logicalOperator: 'OR',
+                operator: '==',
+                value: [patientId, `${apiUrl}${patientId}`],
+            },
+        ];
+        await expect(authZHandler.getSearchFilterBasedOnIdentity(request)).resolves.toEqual(expectedFilter);
+    });
+
+    test('Practitioner identity', async () => {
+        // BUILD
+        const userIdentity = clone(practitionerIdentityWithoutScopes);
+        const request: GetSearchFilterBasedOnIdentity = {
+            userIdentity,
+            operation: 'search-type',
+        };
+
+        // OPERATE, CHECK
+        const expectedFilter: [] = [];
+        await expect(authZHandler.getSearchFilterBasedOnIdentity(request)).resolves.toEqual(expectedFilter);
+    });
+});

src/smartHandler.ts

@@ -21,6 +21,8 @@ import {
     FhirVersion,
     BASE_STU3_RESOURCES,
     BulkDataAuth,
+    GetSearchFilterBasedOnIdentity,
+    SearchFilter,
 } from 'fhir-works-on-aws-interface';
 import axios from 'axios';
 import {
@@ -143,6 +145,24 @@ export class SMARTHandler implements Authorization {
         }
     }
 
+    async getSearchFilterBasedOnIdentity(request: GetSearchFilterBasedOnIdentity): Promise<SearchFilter[]> {
+        const fhirUser = this.getFhirUser(request.userIdentity);
+        const { hostname, resourceType, id } = fhirUser;
+
+        if (resourceType !== 'Practitioner' && ['search-type', 'search-system'].includes(request.operation)) {
+            return [
+                {
+                    key: '_reference',
+                    value: [`${resourceType}/${id}`, `${hostname}${resourceType}/${id}`],
+                    operator: '==',
+                    logicalOperator: 'OR',
+                },
+            ];
+        }
+
+        return [];
+    }
+
     async isBundleRequestAuthorized(request: AuthorizationBundleRequest): Promise<void> {
         const { scopes } = request.userIdentity;
         request.requests.forEach((req: BatchReadWriteRequest) => {