From df803913517715097150b89cbd788982f287161e Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Thu, 6 Nov 2025 10:40:38 -0600
Subject: [PATCH 01/48] initial commit

---
 apps/constants.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/apps/constants.py b/apps/constants.py
index b143ff576..102fa3d21 100644
--- a/apps/constants.py
+++ b/apps/constants.py
@@ -37,6 +37,9 @@ def as_int(version: int) -> int:
             case _:
                 raise VersionNotMatched(f"{version} is not a valid version constant")
 
+    def supported_versions():
+        return [Versions.V1, Versions.V2, Versions.V3]
+
 
 class AccessType:
     ONE_TIME = 'ONE_TIME'

From cfeb712742765ea7beef77a7db1ae4b26985e945 Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Thu, 6 Nov 2025 11:58:43 -0600
Subject: [PATCH 02/48] adding version specific permission checking so v3
 resources are recognized as v3

---
 apps/authorization/permissions.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/apps/authorization/permissions.py b/apps/authorization/permissions.py
index c762dcbbf..75e70483c 100644
--- a/apps/authorization/permissions.py
+++ b/apps/authorization/permissions.py
@@ -1,5 +1,6 @@
 from django.conf import settings
 from rest_framework import (permissions, exceptions)
+from apps.constants import Versions, VersionNotMatched
 
 from .models import DataAccessGrant
 
@@ -32,8 +33,10 @@ def has_object_permission(self, request, view, obj):
         # Patient resources were taken care of above
         # Return 404 on error to avoid notifying unauthorized user the object exists
 
-        # BB2-4166-TODO: this is hardcoded to be version 2
-        return is_resource_for_patient(obj, request.crosswalk.fhir_id(2))
+        if view.version in Versions.supported_versions():
+            return is_resource_for_patient(obj, request.crosswalk.fhir_id(view.version))
+        else:
+            raise VersionNotMatched()
 
 
 def is_resource_for_patient(obj, patient_id):

From ef64ba609b410cddb6f4173721f87b5e901a3139 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 6 Nov 2025 13:08:02 -0500
Subject: [PATCH 03/48] TODO in authorization/views.py. Need to write unit
 tests for new utils function still

---
 apps/authorization/views.py | 19 ++++++++++++++++---
 apps/dot_ext/utils.py       | 27 +++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/apps/authorization/views.py b/apps/authorization/views.py
index 2f5a6dcd3..6d9d1f8dc 100644
--- a/apps/authorization/views.py
+++ b/apps/authorization/views.py
@@ -14,9 +14,10 @@
 from oauth2_provider.views.base import OAuthLibMixin
 from oauth2_provider.views.generic import ClientProtectedResourceView
 
+from apps.constants import VersionNotMatched, Versions
 from apps.dot_ext.authentication import SLSAuthentication
 from .models import DataAccessGrant
-from ..dot_ext.utils import get_application_from_meta
+from ..dot_ext.utils import get_application_from_meta, get_api_version_number
 from ..fhir.bluebutton.models import Crosswalk
 
 
@@ -68,9 +69,21 @@ class ExpireDataAccessGrantView(ClientProtectedResourceView, OAuthLibMixin):
     @staticmethod
     def post(request, *args, **kwargs):
         try:
+            path_info = request.__dict__.get('path_info')
+            version = get_api_version_number(path_info)
             patient_id = kwargs.pop('patient_id', None)
-            # BB2-4166-TODO: currently hardcoded for v2, might need to not be static
-            user = Crosswalk.objects.get(fhir_id_v2=patient_id).user
+
+            match version:
+                case Versions.V1:
+                    user = Crosswalk.objects.get(fhir_id_v2=patient_id).user
+                case Versions.V2:
+                    user = Crosswalk.objects.get(fhir_id_v2=patient_id).user
+                case Versions.V3:
+                    user = Crosswalk.objects.get(fhir_id_v3=patient_id).user
+                # TODO: Should we handle this below or raise it?
+                case _:
+                    raise VersionNotMatched(f"{version} is not a valid version constant")
+
             client = get_application_from_meta(request)
             DataAccessGrant.objects.get(beneficiary=user.id, application=client).delete()
         except Crosswalk.DoesNotExist:
diff --git a/apps/dot_ext/utils.py b/apps/dot_ext/utils.py
index 5c337ea20..1b40b77a2 100644
--- a/apps/dot_ext/utils.py
+++ b/apps/dot_ext/utils.py
@@ -7,6 +7,8 @@
 from oauth2_provider.models import AccessToken, RefreshToken, get_application_model
 from oauthlib.oauth2.rfc6749.errors import InvalidClientError, InvalidGrantError, InvalidRequestError
 from http import HTTPStatus
+import re
+from typing import Optional
 
 from apps.authorization.models import DataAccessGrant
 
@@ -252,3 +254,28 @@ def json_response_from_oauth2_error(error):
         ret_data['error_description'] = error.description
 
     return JsonResponse(ret_data, status=error.status_code)
+
+
+# BB2-4166 TODO: Write unit tests for this
+def get_api_version_number(url_path: str) -> Optional[str]:
+    """Utility function to extract what version of the API a URL is
+    If there are multiple occurrences of 'v{{VERSION}} in a url path,
+    only return the first one
+    EX. /v2/o/authorize will return v2.
+
+    Args:
+        url_path (str): The url being called that we want to extract the api version
+
+    Returns:
+        Optional[str]: Returns a string of v2
+    """
+    try:
+        if not isinstance(url_path, str):
+            return None
+
+        match = re.search(r'/v(\d+)', url_path, re.IGNORECASE)
+        if match:
+            return int(match.group(1))
+        return None
+    except Exception:
+        return None

From cf33395a67b843ebcbb3439587b9341af656f98c Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 6 Nov 2025 13:24:22 -0500
Subject: [PATCH 04/48] Address TODOs in bb2_tools/admin.py

---
 apps/bb2_tools/admin.py | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/apps/bb2_tools/admin.py b/apps/bb2_tools/admin.py
index b7f8c435f..d554dd260 100644
--- a/apps/bb2_tools/admin.py
+++ b/apps/bb2_tools/admin.py
@@ -332,8 +332,7 @@ class BeneficiaryDashboardAdmin(ReadOnlyAdmin):
         "get_connected_applications",
         "date_created",
     )
-    # BB2-4166-TODO: add support for v3
-    search_fields = ('user__username', 'fhir_id_v2', '_user_id_hash', '_user_mbi')
+    search_fields = ('user__username', 'fhir_id_v2', 'fhir_id_v3', '_user_id_hash', '_user_mbi')
     readonly_fields = ('date_created',)
     raw_id_fields = ('user',)
 
@@ -361,10 +360,9 @@ def get_access_tokens(self, obj):
         ordering="MyIdentities",
     )
     def get_identities(self, obj):
-        # BB2-4166-TODO: add support for v3
         return format_html(
-            '<div><ul><li>FHIR_ID_V2:{}</li><li>HICN HASH:{}</li><li>MBI:{}</li>'.format(
-                obj.fhir_id(2), obj.user_hicn_hash, obj.user_mbi
+            '<div><ul><li>FHIR_ID_V2:{}</li>li>FHIR_ID_V3:{}</li><li>HICN HASH:{}</li><li>MBI:{}</li>'.format(
+                obj.fhir_id(2), obj.fhir_id(3), obj.user_hicn_hash, obj.user_mbi
             )
         )
 
@@ -418,8 +416,7 @@ def change_view(self, request, object_id, form_url="", extra_context=None):
         json_resp = None
 
         try:
-            # BB2-4166-TODO: this is hardcoded to be version 2
-            json_resp = get_patient_by_id(crosswalk.fhir_id(2), request)
+            json_resp = get_patient_by_id(crosswalk.fhir_id(request.session['version']), request)
         except Exception as e:
             json_resp = {"backend_error": str(e)}
 

From ab2977235759d412b17690bc9d3250b6f837c126 Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Thu, 6 Nov 2025 13:00:57 -0600
Subject: [PATCH 05/48] found request.path to contain version. Different from
 other places but appears to work. Will be open to refactoring

---
 apps/dot_ext/oauth2_backends.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/apps/dot_ext/oauth2_backends.py b/apps/dot_ext/oauth2_backends.py
index fbb386075..9679494a1 100644
--- a/apps/dot_ext/oauth2_backends.py
+++ b/apps/dot_ext/oauth2_backends.py
@@ -4,6 +4,7 @@
 from ..fhir.bluebutton.models import Crosswalk
 from .loggers import (clear_session_auth_flow_trace, update_session_auth_flow_trace_from_code,
                       set_session_auth_flow_trace_value)
+from apps.constants import Versions
 
 
 class OAuthLibSMARTonFHIR(OAuthLibCore):
@@ -32,7 +33,12 @@ def create_token_response(self, request):
                 fhir_body = json.loads(body)
                 cw = Crosswalk.objects.get(user=token.user)
                 # BB2-4166-TODO: this is hardcoded to be version 2
-                fhir_body["patient"] = cw.fhir_id(2)
+                version = Versions.NOT_AN_API_VERSION
+                for supported_version in Versions.supported_versions():
+                    if f"/v{supported_version}/o/token" in request.path:
+                        version = supported_version
+                        break
+                fhir_body["patient"] = cw.fhir_id(version)
                 body = json.dumps(fhir_body)
 
         return uri, headers, body, status

From 433d5c5974806da6d2a30b20c070f489f85b8062 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 6 Nov 2025 17:21:37 -0500
Subject: [PATCH 06/48] Ensure fhir_id v2 or v3 are updated if none when
 re-authorizing. v3 testclient patient/EOB/coverage are now broken, some tests
 are broken as well. Will fix in morning

---
 apps/fhir/bluebutton/models.py     |  4 +-
 apps/fhir/server/authentication.py | 19 ++++---
 apps/mymedicare_cb/models.py       | 87 ++++++++++++++++++++----------
 3 files changed, 73 insertions(+), 37 deletions(-)

diff --git a/apps/fhir/bluebutton/models.py b/apps/fhir/bluebutton/models.py
index 3ae611f94..c96ddb7c7 100644
--- a/apps/fhir/bluebutton/models.py
+++ b/apps/fhir/bluebutton/models.py
@@ -158,13 +158,13 @@ class Meta:
     def fhir_id(self, version: int = 2) -> str:
         """Helper method to return fhir_id based on BFD version, preferred over direct access"""
         if version in (1, 2):
-            return str(self.fhir_id_v2)
+            return self.fhir_id_v2
         elif version == 3:
             # TODO BB2-4166: This will want to change. In order to make
             # BB2-4181 work, the V3 value needed to be found in the V2 column.
             # 4166 should flip this to _v3, and we should be able to find
             # values there when using (say) the test client.
-            return str(self.fhir_id_v2)
+            return self.fhir_id_v3
 
         else:
             raise ValidationError(f"{version} is not a valid BFD version")
diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index 52d60bf06..ac0a16a63 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -4,6 +4,7 @@
 from rest_framework import exceptions
 from urllib.parse import quote
 
+from apps.constants import Versions
 from apps.dot_ext.loggers import get_session_auth_flow_trace
 from apps.fhir.bluebutton.signals import (
     pre_fetch,
@@ -18,27 +19,27 @@
 from .loggers import log_match_fhir_id
 
 
-def search_fhir_id_by_identifier_mbi(mbi, request=None):
+def search_fhir_id_by_identifier_mbi(mbi, request=None, version=Versions.NOT_AN_API_VERSION):
     """
         Search the backend FHIR server's patient resource
         using the mbi identifier.
     """
     search_identifier = f"{settings.FHIR_PATIENT_SEARCH_PARAM_IDENTIFIER_MBI}|{mbi}"
 
-    return search_fhir_id_by_identifier(search_identifier, request)
+    return search_fhir_id_by_identifier(search_identifier, request, version)
 
 
-def search_fhir_id_by_identifier_hicn_hash(hicn_hash, request=None):
+def search_fhir_id_by_identifier_hicn_hash(hicn_hash, request=None, version=Versions.NOT_AN_API_VERSION):
     """
         Search the backend FHIR server's patient resource
         using the hicn_hash identifier.
     """
     search_identifier = f"{settings.FHIR_POST_SEARCH_PARAM_IDENTIFIER_HICN_HASH}|{hicn_hash}"
 
-    return search_fhir_id_by_identifier(search_identifier, request)
+    return search_fhir_id_by_identifier(search_identifier, request, version)
 
 
-def search_fhir_id_by_identifier(search_identifier, request=None):
+def search_fhir_id_by_identifier(search_identifier, request=None, version=Versions.NOT_AN_API_VERSION):
     """
         Search the backend FHIR server's patient resource
         using the specified identifier.
@@ -79,7 +80,8 @@ def search_fhir_id_by_identifier(search_identifier, request=None):
     # Build URL based on BFD version
     # BB2-4166-TODO: generalize versionining of fhir server url
     resource_router = get_resourcerouter()
-    ver = "v{}".format(request.session.get('version', 1))
+    ver = f'v{version}'
+
     fhir_url = resource_router.fhir_url
     if ver == 'v3' and resource_router.fhir_url_v3:
         fhir_url = resource_router.fhir_url_v3
@@ -115,7 +117,7 @@ def search_fhir_id_by_identifier(search_identifier, request=None):
                 raise e
 
 
-def match_fhir_id(mbi, hicn_hash, request=None):
+def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERSION):
     """Matches a patient identifier via the backend FHIR server using an MBI or HICN hash.
         - Perform primary lookup using mbi.
         - If there is an mbi lookup issue, raise exception.
@@ -126,6 +128,7 @@ def match_fhir_id(mbi, hicn_hash, request=None):
       Args:
         mbi (string): the mbi of the user
         hicn_hash (string): the hashed hicn of the user
+        version (int): Current API version for this call
         request (HttpRequest, optional): the Django request
 
       Returns:
@@ -139,7 +142,7 @@ def match_fhir_id(mbi, hicn_hash, request=None):
     # Perform primary lookup using MBI
     if mbi:
         try:
-            fhir_id = search_fhir_id_by_identifier_mbi(mbi, request)
+            fhir_id = search_fhir_id_by_identifier_mbi(mbi, request, version)
         except UpstreamServerException as err:
             log_match_fhir_id(request, None, hicn_hash, False, 'M', str(err))
             # Don't return a 404 because retrying later will not fix this.
diff --git a/apps/mymedicare_cb/models.py b/apps/mymedicare_cb/models.py
index 73f6c8232..5ad82647e 100644
--- a/apps/mymedicare_cb/models.py
+++ b/apps/mymedicare_cb/models.py
@@ -5,6 +5,8 @@
 from django.db import models, transaction
 from rest_framework import status
 from rest_framework.exceptions import APIException
+from apps.constants import Versions
+from apps.fhir.bluebutton.exceptions import UpstreamServerException
 
 from apps.accounts.models import UserProfile
 from apps.fhir.bluebutton.models import ArchivedCrosswalk, Crosswalk
@@ -56,7 +58,7 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
     logger = logging.getLogger(logging.AUDIT_AUTHN_MED_CALLBACK_LOGGER, request)
 
     # Match a patient identifier via the backend FHIR server
-    if version == 3:
+    if version == Versions.V3:
         hicn_hash = None
     else:
         hicn_hash = slsx_client.hicn_hash
@@ -65,15 +67,31 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
     # BFD v2 Lookup
     # BFD v3 Lookup
 
-    fhir_id, hash_lookup_type = match_fhir_id(
-        mbi=slsx_client.mbi, hicn_hash=hicn_hash, request=request
-    )
-
+    versioned_fhir_ids = {}
+    # Perform fhir_id lookup for all supported versions
+    # If the lookup for the requested version fails, raise the exception
+    # This is wrapped in the case that if the requested version fails, match_fhir_id
+    # will still bubble up UpstreamServerException
+    for supported_version in Versions.supported_versions():
+        try:
+            fhir_id, hash_lookup_type = match_fhir_id(
+                mbi=slsx_client.mbi,
+                hicn_hash=hicn_hash,
+                request=request,
+                version=supported_version,
+
+            )
+            print("fhir_id: ", fhir_id)
+            versioned_fhir_ids[supported_version] = fhir_id
+        except UpstreamServerException as e:
+            if supported_version == version:
+                raise e
+    print("versioned_fhir_ids: ", versioned_fhir_ids)
     log_dict = {
         'type': 'mymedicare_cb:get_and_update_user',
         'subject': slsx_client.user_id,
-        # BB2-4166-TODO: add fhir_id_v3 when the lookup above is completed
-        'fhir_id_v2': fhir_id,
+        'fhir_id_v2': versioned_fhir_ids.get(Versions.V2, None),
+        'fhir_id_v3': versioned_fhir_ids.get(Versions.V3, None),
         'hicn_hash': slsx_client.hicn_hash,
         'hash_lookup_type': hash_lookup_type,
         'crosswalk': {},
@@ -82,49 +100,58 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
 
     # Init for hicn crosswalk updates.
     hicn_updated = False
-
     try:
         # Does an existing user and crosswalk exist for SLSx username?
         user = User.objects.get(username=slsx_client.user_id)
 
         # fhir_id can not change for an existing user!
         # BB2-4166-TODO: this should be removed when we enable tandem v2/v3 usage
-        if user.crosswalk.fhir_id(2) != fhir_id:
-            mesg = "Found user's fhir_id did not match"
-            log_dict.update({
-                'status': 'FAIL',
-                'user_id': user.id,
-                'user_username': user.username,
-                'mesg': mesg,
-            })
-            logger.info(log_dict)
-            raise BBMyMedicareCallbackCrosswalkUpdateException(mesg)
+        # if user.crosswalk.fhir_id(2) != fhir_id:
+        #     mesg = "Found user's fhir_id did not match"
+        #     log_dict.update({
+        #         'status': 'FAIL',
+        #         'user_id': user.id,
+        #         'user_username': user.username,
+        #         'mesg': mesg,
+        #     })
+        #     logger.info(log_dict)
+        #     raise BBMyMedicareCallbackCrosswalkUpdateException(mesg)
 
         # Did the hicn change?
         if user.crosswalk.user_hicn_hash != slsx_client.hicn_hash:
             hicn_updated = True
 
+        # covers AC1 of BB2-4166
+        update_fhir_id = False
+        if user.crosswalk.fhir_id(2) is None or user.crosswalk.fhir_id(3) is None:
+            update_fhir_id = True
         # Update Crosswalk if the user_mbi is null, but we have an mbi value from SLSx or
         # if the saved user_mbi value is different than what SLSx has
         if (
             (user.crosswalk.user_mbi is None and slsx_client.mbi is not None)
             or (user.crosswalk.user_mbi is not None and user.crosswalk.user_mbi != slsx_client.mbi)
             or (user.crosswalk.user_id_type != hash_lookup_type or hicn_updated)
+            or update_fhir_id
         ):
+            print("THE IF EVALUATED")
             # Log crosswalk before state
             log_dict.update({
                 'crosswalk_before': {
                     'id': user.crosswalk.id,
                     'user_hicn_hash': user.crosswalk.user_hicn_hash,
-                    'fhir_id_v2': user.crosswalk.fhir_id(version),
+                    'fhir_id_v2': versioned_fhir_ids.get(Versions.V2, None),
+                    'fhir_id_v3': versioned_fhir_ids.get(Versions.V3, None),
                     'user_id_type': user.crosswalk.user_id_type,
                 },
             })
-
+            print("crosswalk check: ", user.crosswalk.__dict__)
             with transaction.atomic():
                 # Archive to audit crosswalk changes
                 ArchivedCrosswalk.create(user.crosswalk)
-
+                if update_fhir_id:
+                    print("IF EVAL")
+                    user.crosswalk.fhir_id_v2 = versioned_fhir_ids.get(Versions.V2)
+                    user.crosswalk.fhir_id_v3 = versioned_fhir_ids.get(Versions.V3)
                 # Update crosswalk per changes
                 user.crosswalk.user_id_type = hash_lookup_type
                 user.crosswalk.user_hicn_hash = slsx_client.hicn_hash
@@ -141,8 +168,8 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
             'crosswalk': {
                 'id': user.crosswalk.id,
                 'user_hicn_hash': user.crosswalk.user_hicn_hash,
-                # BB2-4166-TODO: this is hardcoded to be version 2
-                'fhir_id_v2': user.crosswalk.fhir_id(2),
+                'fhir_id_v2': versioned_fhir_ids.get(Versions.V2, None),
+                'fhir_id_v3': versioned_fhir_ids.get(Versions.V3, None),
                 'user_id_type': user.crosswalk.user_id_type,
             },
         })
@@ -151,10 +178,16 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
         return user, 'R'
     except User.DoesNotExist:
         pass
-
+    print("versioned_fhir_ids: ", versioned_fhir_ids)
     # BB2-4166-TODO: this is hardcoded to be version 2, does not account for both fhir_ids
     # v3 and v2 are BOTH saved in the v2 field
-    user = create_beneficiary_record(slsx_client, fhir_id_v2=fhir_id, user_id_type=hash_lookup_type, request=request)
+    user = create_beneficiary_record(
+        slsx_client,
+        fhir_id_v2=versioned_fhir_ids.get(Versions.V2, None),
+        fhir_id_v3=versioned_fhir_ids.get(Versions.V3, None),
+        user_id_type=hash_lookup_type,
+        request=request
+    )
 
     log_dict.update({
         'status': 'OK',
@@ -165,8 +198,8 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
         'crosswalk': {
             'id': user.crosswalk.id,
             'user_hicn_hash': user.crosswalk.user_hicn_hash,
-            # BB2-4166-TODO: this needs to include both fhir versions
-            'fhir_id_v2': user.crosswalk.fhir_id(2),
+            'fhir_id_v2': versioned_fhir_ids.get(Versions.V2, None),
+            'fhir_id_v3': versioned_fhir_ids.get(Versions.V3, None),
             'user_id_type': user.crosswalk.user_id_type,
         },
     })

From 157d988e5a565cc70054c924a139c0045e3e0c1e Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Thu, 6 Nov 2025 16:59:07 -0600
Subject: [PATCH 07/48] adding extra validation for incorrect versions in utils
 and using it in create_token_response

---
 apps/dot_ext/oauth2_backends.py |  9 ++-------
 apps/dot_ext/utils.py           | 22 +++++++++++-----------
 2 files changed, 13 insertions(+), 18 deletions(-)

diff --git a/apps/dot_ext/oauth2_backends.py b/apps/dot_ext/oauth2_backends.py
index 9679494a1..50bf01225 100644
--- a/apps/dot_ext/oauth2_backends.py
+++ b/apps/dot_ext/oauth2_backends.py
@@ -4,7 +4,7 @@
 from ..fhir.bluebutton.models import Crosswalk
 from .loggers import (clear_session_auth_flow_trace, update_session_auth_flow_trace_from_code,
                       set_session_auth_flow_trace_value)
-from apps.constants import Versions
+from apps.dot_ext.utils import get_api_version_number
 
 
 class OAuthLibSMARTonFHIR(OAuthLibCore):
@@ -32,12 +32,7 @@ def create_token_response(self, request):
             if Crosswalk.objects.filter(user=token.user).exists():
                 fhir_body = json.loads(body)
                 cw = Crosswalk.objects.get(user=token.user)
-                # BB2-4166-TODO: this is hardcoded to be version 2
-                version = Versions.NOT_AN_API_VERSION
-                for supported_version in Versions.supported_versions():
-                    if f"/v{supported_version}/o/token" in request.path:
-                        version = supported_version
-                        break
+                version = get_api_version_number(request.path)
                 fhir_body["patient"] = cw.fhir_id(version)
                 body = json.dumps(fhir_body)
 
diff --git a/apps/dot_ext/utils.py b/apps/dot_ext/utils.py
index 1b40b77a2..6ffbe9619 100644
--- a/apps/dot_ext/utils.py
+++ b/apps/dot_ext/utils.py
@@ -9,6 +9,7 @@
 from http import HTTPStatus
 import re
 from typing import Optional
+from apps.constants import Versions, VersionNotMatched
 
 from apps.authorization.models import DataAccessGrant
 
@@ -257,7 +258,7 @@ def json_response_from_oauth2_error(error):
 
 
 # BB2-4166 TODO: Write unit tests for this
-def get_api_version_number(url_path: str) -> Optional[str]:
+def get_api_version_number(url_path: str) -> Optional[int]:
     """Utility function to extract what version of the API a URL is
     If there are multiple occurrences of 'v{{VERSION}} in a url path,
     only return the first one
@@ -269,13 +270,12 @@ def get_api_version_number(url_path: str) -> Optional[str]:
     Returns:
         Optional[str]: Returns a string of v2
     """
-    try:
-        if not isinstance(url_path, str):
-            return None
-
-        match = re.search(r'/v(\d+)', url_path, re.IGNORECASE)
-        if match:
-            return int(match.group(1))
-        return None
-    except Exception:
-        return None
+    match = re.search(r'/v(\d+)/', url_path, re.IGNORECASE)
+    if match:
+        version = int(match.group(1))
+        if version in Versions.supported_versions():
+            return version
+        else:
+            raise VersionNotMatched(f"{version} extracted from {url_path}")
+
+    return Versions.NOT_AN_API_VERSION

From 2707686175c953db8644a1f802a3204c6ba2724c Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Fri, 7 Nov 2025 10:07:52 -0500
Subject: [PATCH 08/48] V2 calls all working, v3 patient returning correct data
 but built in function throwing 404

---
 apps/fhir/bluebutton/permissions.py   |  2 +-
 apps/fhir/bluebutton/utils.py         | 15 ++++++++++++---
 apps/fhir/bluebutton/views/generic.py | 10 ++++++----
 apps/fhir/server/authentication.py    |  2 +-
 apps/logging/serializers.py           |  3 ++-
 5 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/apps/fhir/bluebutton/permissions.py b/apps/fhir/bluebutton/permissions.py
index 075f94417..8951dd116 100644
--- a/apps/fhir/bluebutton/permissions.py
+++ b/apps/fhir/bluebutton/permissions.py
@@ -32,7 +32,7 @@ class HasCrosswalk(permissions.BasePermission):
     def has_permission(self, request, view):
         return bool(
             # BB2-4166-TODO : this needs to use version to determine fhir_id, probably in request
-            request.user and request.user.crosswalk and request.user.crosswalk.fhir_id(2)
+            request.user and request.user.crosswalk and (request.user.crosswalk.fhir_id(2) or request.user.crosswalk.fhir_id(3))
         )
 
 
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 46d597a08..b0f5cb954 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -143,12 +143,19 @@ def generate_info_headers(request):
     # Return resource_owner or user
     user = get_user_from_request(request)
     crosswalk = get_crosswalk(user)
+
+    print("REQUEST", request.__dict__)
+    print("SESSION", request.session.__dict__)
+
+    version = request.session.__dict__.get('version', Versions.NOT_AN_API_VERSION)
+
+    print("version IN generate_info_headers1004: ", version)
     if crosswalk:
         # we need to send the HicnHash or the fhir_id
         # TODO: Can the hicnHash case ever be reached? Should refactor this!
         # BB2-4166-TODO: generalize this to include and check for v3 if a v3 request is happening
-        if crosswalk.fhir_id(2) is not None:
-            result["BlueButton-BeneficiaryId"] = "patientId:" + str(crosswalk.fhir_id(2))
+        if crosswalk.fhir_id(version) is not None:
+            result["BlueButton-BeneficiaryId"] = "patientId:" + crosswalk.fhir_id(version)
         else:
             result["BlueButton-BeneficiaryId"] = "hicnHash:" + str(
                 crosswalk.user_hicn_hash
@@ -241,7 +248,7 @@ def request_call(request, call_url, crosswalk=None, timeout=None, get_parameters
         cert = (auth_state["cert_file"], auth_state["key_file"])
     else:
         cert = ()
-
+    print("REQUEST in request_call: ", request.__dict__)
     header_info = generate_info_headers(request)
 
     header_info = set_default_header(request, header_info)
@@ -423,6 +430,7 @@ def crosswalk_patient_id(user):
     logger.debug("\ncrosswalk_patient_id User:%s" % user)
     try:
         patient = Crosswalk.objects.get(user=user)
+        # TODO BB2-4166: Do we need to modify this as well?
         if patient.fhir_id(2):
             return patient.fhir_id(2)
 
@@ -703,6 +711,7 @@ def get_patient_by_id(id, request):
     """
     auth_settings = FhirServerAuth(None)
     certs = (auth_settings["cert_file"], auth_settings["key_file"])
+    print("IS IT IN get_patient_by_id???")
     headers = generate_info_headers(request)
     headers["BlueButton-Application"] = "BB2-Tools"
     headers["includeIdentifiers"] = "true"
diff --git a/apps/fhir/bluebutton/views/generic.py b/apps/fhir/bluebutton/views/generic.py
index 455c99242..169b09552 100644
--- a/apps/fhir/bluebutton/views/generic.py
+++ b/apps/fhir/bluebutton/views/generic.py
@@ -134,7 +134,8 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
 
         logger.debug('Here is the URL to send, %s now add '
                      'GET parameters %s' % (target_url, get_parameters))
-
+        request.session.version = self.version
+        print("FhirDataView version: ", self.version)
         # Now make the call to the backend API
         req = Request('GET',
                       target_url,
@@ -153,7 +154,8 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
 
         resource_id = kwargs.get('resource_id')
         beneficiary_id = prepped.headers.get('BlueButton-BeneficiaryId')
-
+        print("resource_id: ", resource_id)
+        print("beneficiary_id: ", beneficiary_id)
         if resource_type == 'Patient' and resource_id and beneficiary_id:
             # If it is a patient read request, confirm it is valid for the current user
             # If not, throw a 404 before pinging BFD
@@ -184,12 +186,12 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
 
         # BB2-128
         error = process_error_response(response)
-
+        print("THE ERROR: ", error)
         if error is not None:
             raise error
 
         out_data = r.json()
-
+        print("out data: ", out_data)
         self.check_object_permissions(request, out_data)
 
         return out_data
diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index ac0a16a63..7063ff1df 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -52,7 +52,7 @@ def search_fhir_id_by_identifier(search_identifier, request=None, version=Versio
     # Get certs from FHIR server settings
     auth_settings = FhirServerAuth(None)
     certs = (auth_settings['cert_file'], auth_settings['key_file'])
-
+    print("VERSION IN search_fhir_id_by_identifier: ", version)
     # Add headers for FHIR backend logging, including auth_flow_dict
     if request:
         # Get auth flow session values.
diff --git a/apps/logging/serializers.py b/apps/logging/serializers.py
index f75145510..0178eef8c 100644
--- a/apps/logging/serializers.py
+++ b/apps/logging/serializers.py
@@ -167,7 +167,8 @@ def to_dict(self):
         return {
             'type': 'fhir_pre_fetch',
             'uuid': self.uuid(),
-            'fhir_id_v2': self.fhir_id(),
+            'bfd_bene_fhir_id': self.fhir_id(),
+            # 'fhir_id_v3': self.fhir_id(),
             'api_ver': self.api_ver if self.api_ver is not None else 'v1',
             'includeAddressFields': self.includeAddressFields(),
             'user': self.user(),

From 6cae0635d9d23d722ca4c3ac4b922a7c1d976323 Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Fri, 7 Nov 2025 10:10:51 -0600
Subject: [PATCH 09/48] adding more generalized version grabbing for crosswalk
 permissions

---
 apps/fhir/bluebutton/permissions.py | 31 ++++++++++++++++-------------
 1 file changed, 17 insertions(+), 14 deletions(-)

diff --git a/apps/fhir/bluebutton/permissions.py b/apps/fhir/bluebutton/permissions.py
index 8951dd116..337f4468b 100644
--- a/apps/fhir/bluebutton/permissions.py
+++ b/apps/fhir/bluebutton/permissions.py
@@ -5,6 +5,7 @@
 from rest_framework import permissions, exceptions
 from rest_framework.exceptions import AuthenticationFailed
 from .constants import ALLOWED_RESOURCE_TYPES
+from apps.constants import Versions, VersionNotMatched
 
 import apps.logging.request_logger as bb2logging
 
@@ -30,10 +31,11 @@ def has_permission(self, request, view):
 
 class HasCrosswalk(permissions.BasePermission):
     def has_permission(self, request, view):
-        return bool(
-            # BB2-4166-TODO : this needs to use version to determine fhir_id, probably in request
-            request.user and request.user.crosswalk and (request.user.crosswalk.fhir_id(2) or request.user.crosswalk.fhir_id(3))
-        )
+        if view.version in Versions.supported_versions():
+            return request.user and request.user.crosswalk and request.user.crosswalk.fhir_id(view.version)
+        else:
+            # this should not happen where we'd get an unsupported version
+            raise VersionNotMatched("Version not matched in has_permission")
 
 
 class ReadCrosswalkPermission(HasCrosswalk):
@@ -41,24 +43,24 @@ def has_object_permission(self, request, view, obj):
         # Now check that the user has permission to access the data
         # Patient resources were taken care of above # TODO - verify this
         # Return 404 on error to avoid notifying unauthorized user the object exists
-
+        if view.version in Versions.supported_versions():
+            fhir_id = request.crosswalk.fhir_id(view.version)
+        else:
+            raise VersionNotMatched("Version not matched in has_object_permission in ReadCrosswalkPermission")
         try:
             if request.resource_type == "Coverage":
                 reference = obj["beneficiary"]["reference"]
                 reference_id = reference.split("/")[1]
-                # BB2-4166-TODO : this needs to use version to determine fhir_id, probably in request
-                if reference_id != request.crosswalk.fhir_id(2):
+                if reference_id != fhir_id:
                     raise exceptions.NotFound()
             elif request.resource_type == "ExplanationOfBenefit":
                 reference = obj["patient"]["reference"]
                 reference_id = reference.split("/")[1]
-                # BB2-4166-TODO : this needs to use version to determine fhir_id, probably in request
-                if reference_id != request.crosswalk.fhir_id(2):
+                if reference_id != fhir_id:
                     raise exceptions.NotFound()
             else:
                 reference_id = obj["id"]
-                # BB2-4166-TODO : this needs to use version to determine fhir_id, probably in request
-                if reference_id != request.crosswalk.fhir_id(2):
+                if reference_id != fhir_id:
                     raise exceptions.NotFound()
 
         except exceptions.NotFound:
@@ -71,9 +73,10 @@ def has_object_permission(self, request, view, obj):
 
 class SearchCrosswalkPermission(HasCrosswalk):
     def has_object_permission(self, request, view, obj):
-        # BB2-4166-TODO: this is hardcoded to be version 2
-        patient_id = request.crosswalk.fhir_id(2)
-
+        if view.version in Versions.supported_versions():
+            patient_id = request.crosswalk.fhir_id(view.version)
+        else:
+            raise VersionNotMatched("Version not matched in has_object_permission in SearchCrosswalkPermission")
         if "patient" in request.GET and request.GET["patient"] != patient_id:
             return False
 

From a58570a8215407b08c9972f6bda1c98670f7afbd Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Fri, 7 Nov 2025 12:39:00 -0500
Subject: [PATCH 10/48] Revert log to reduce test failures (will revisit this
 log once all functionality is working)

---
 apps/logging/serializers.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/apps/logging/serializers.py b/apps/logging/serializers.py
index 0178eef8c..f75145510 100644
--- a/apps/logging/serializers.py
+++ b/apps/logging/serializers.py
@@ -167,8 +167,7 @@ def to_dict(self):
         return {
             'type': 'fhir_pre_fetch',
             'uuid': self.uuid(),
-            'bfd_bene_fhir_id': self.fhir_id(),
-            # 'fhir_id_v3': self.fhir_id(),
+            'fhir_id_v2': self.fhir_id(),
             'api_ver': self.api_ver if self.api_ver is not None else 'v1',
             'includeAddressFields': self.includeAddressFields(),
             'user': self.user(),

From 6bf69b059fab41a6ad930bc23de2b754b905fbba Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Fri, 7 Nov 2025 13:04:32 -0500
Subject: [PATCH 11/48] Ensure v3 coverage and EOD endpoints work. Currently 7
 test failures and 11 errors

---
 apps/fhir/bluebutton/views/generic.py | 5 ++---
 apps/fhir/bluebutton/views/search.py  | 9 +++------
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/apps/fhir/bluebutton/views/generic.py b/apps/fhir/bluebutton/views/generic.py
index 169b09552..c762fb476 100644
--- a/apps/fhir/bluebutton/views/generic.py
+++ b/apps/fhir/bluebutton/views/generic.py
@@ -154,8 +154,7 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
 
         resource_id = kwargs.get('resource_id')
         beneficiary_id = prepped.headers.get('BlueButton-BeneficiaryId')
-        print("resource_id: ", resource_id)
-        print("beneficiary_id: ", beneficiary_id)
+
         if resource_type == 'Patient' and resource_id and beneficiary_id:
             # If it is a patient read request, confirm it is valid for the current user
             # If not, throw a 404 before pinging BFD
@@ -191,7 +190,7 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
             raise error
 
         out_data = r.json()
-        print("out data: ", out_data)
+
         self.check_object_permissions(request, out_data)
 
         return out_data
diff --git a/apps/fhir/bluebutton/views/search.py b/apps/fhir/bluebutton/views/search.py
index 02e47774a..4b30e9aa6 100644
--- a/apps/fhir/bluebutton/views/search.py
+++ b/apps/fhir/bluebutton/views/search.py
@@ -91,8 +91,7 @@ def __init__(self, version=1):
     def build_parameters(self, request, *args, **kwargs):
         return {
             '_format': 'application/json+fhir',
-            # BB2-4166-TODO : this needs to use self.version to determine fhir_id
-            '_id': request.crosswalk.fhir_id(2)
+            '_id': request.crosswalk.fhir_id(self.version)
         }
 
 
@@ -107,8 +106,7 @@ def __init__(self, version=1):
     def build_parameters(self, request, *args, **kwargs):
         return {
             '_format': 'application/json+fhir',
-            # BB2-4166-TODO : this needs to use self.version to determine fhir_id
-            'beneficiary': 'Patient/' + request.crosswalk.fhir_id(2)
+            'beneficiary': 'Patient/' + request.crosswalk.fhir_id(self.version)
         }
 
 
@@ -164,8 +162,7 @@ def __init__(self, version=1):
     def build_parameters(self, request, *args, **kwargs):
         return {
             '_format': 'application/json+fhir',
-            # BB2-4166-TODO : this needs to use version to determine fhir_id
-            'patient': request.crosswalk.fhir_id(2),
+            'patient': request.crosswalk.fhir_id(self.version),
         }
 
     def filter_parameters(self, request):

From cb698daba32997b41f78c401c598f1ad6f1e0cee Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Fri, 7 Nov 2025 14:23:56 -0600
Subject: [PATCH 12/48] changes to get_patient_id, test_read_and_search and
 other tests to extend more off version

---
 apps/fhir/bluebutton/tests/test_utils.py      | 73 ++++++++-----------
 apps/fhir/bluebutton/utils.py                 | 29 ++++----
 apps/fhir/server/tests/test_authentication.py | 36 +++++----
 3 files changed, 68 insertions(+), 70 deletions(-)

diff --git a/apps/fhir/bluebutton/tests/test_utils.py b/apps/fhir/bluebutton/tests/test_utils.py
index 760b23031..426bc2d0f 100644
--- a/apps/fhir/bluebutton/tests/test_utils.py
+++ b/apps/fhir/bluebutton/tests/test_utils.py
@@ -235,51 +235,40 @@ def setUp(self):
     def test_crosswalk_fhir_id(self):
         """ Get the Crosswalk FHIR_Id """
 
-        u = User.objects.create_user(username="billybob",
-                                     first_name="Billybob",
-                                     last_name="Button",
-                                     email='billybob@example.com',
-                                     password="foobar", )
-        UserProfile.objects.create(user=u,
-                                   user_type="DEV",
-                                   create_applications=True)
-
-        x = Crosswalk()
-        x.user = u
-        x.set_fhir_id("Patient/23456", 2)
-        x.user_hicn_hash = uuid.uuid4()
-        x.save()
-
-        result = crosswalk_patient_id(u)
-
-        self.assertEqual(x.fhir_id(2), result)
-
-        # Test the dt_reference for Patient
-
-        result = dt_patient_reference(u)
-
-        expect = {'reference': x.fhir_id(2)}
-
-        self.assertEqual(result, expect)
+        for version in [Versions.V2, Versions.V3]:
+            u = User.objects.create_user(username=f"billybob-{version}",
+                                         first_name="Billybob",
+                                         last_name="Button",
+                                         email=f'billybob-{version}@example.com',
+                                         password="foobar", )
+            UserProfile.objects.create(user=u,
+                                       user_type="DEV",
+                                       create_applications=True)
+            x = Crosswalk()
+            x.user = u
+            x.set_fhir_id("Patient/23456", version)
+            x.user_hicn_hash = uuid.uuid4()
+            x.save()
+            result = crosswalk_patient_id(u, version)
+            self.assertEqual(x.fhir_id(version), result)
+            # Test the dt_reference for Patient
+            result = dt_patient_reference(u, version)
+            expect = {'reference': x.fhir_id(version)}
+            self.assertEqual(result, expect)
 
     def test_crosswalk_not_fhir_id(self):
         """ Get no Crosswalk id """
-
-        u = User.objects.create_user(username="bobnobob",
-                                     first_name="bob",
-                                     last_name="Button",
-                                     email='billybob@example.com',
-                                     password="foobar", )
-
-        result = crosswalk_patient_id(u)
-
-        self.assertEqual(result, None)
-
-        # Test the dt_reference for Patient returning None
-
-        result = dt_patient_reference(u)
-
-        self.assertEqual(result, None)
+        for version in [Versions.V2, Versions.V3]:
+            u = User.objects.create_user(username=f"bobnobob-{version}",
+                                         first_name="bob",
+                                         last_name="Button",
+                                         email=f'billybob-{version}@example.com',
+                                         password="foobar", )
+            result = crosswalk_patient_id(u, version)
+            self.assertEqual(result, None)
+            # Test the dt_reference for Patient returning None
+            result = dt_patient_reference(u, version)
+            self.assertEqual(result, None)
 
 
 class Security_Metadata_test(BaseApiTest):
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index b0f5cb954..47d7e3c27 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -19,6 +19,7 @@
 
 from apps.wellknown.views import base_issuer, build_endpoint_info
 from .models import Crosswalk, Fhir_Response
+from apps.dot_ext.utils import get_api_version_number
 
 logger = logging.getLogger(bb2logging.HHS_SERVER_LOGNAME_FMT.format(__name__))
 
@@ -144,10 +145,7 @@ def generate_info_headers(request):
     user = get_user_from_request(request)
     crosswalk = get_crosswalk(user)
 
-    print("REQUEST", request.__dict__)
-    print("SESSION", request.session.__dict__)
-
-    version = request.session.__dict__.get('version', Versions.NOT_AN_API_VERSION)
+    version = get_api_version_number(request.path)
 
     print("version IN generate_info_headers1004: ", version)
     if crosswalk:
@@ -413,26 +411,29 @@ def prepend_q(pass_params):
     return pass_params
 
 
-def dt_patient_reference(user):
+# TODO BB2-4166: This is only used in tests.
+def dt_patient_reference(user, version):
     """Get Patient Reference from Crosswalk for user"""
 
     if user:
-        patient = crosswalk_patient_id(user)
+        patient = crosswalk_patient_id(user, version)
         if patient:
             return {"reference": patient}
 
     return None
 
+# TODO BB2-4166: This is only used in tests.
+
 
-def crosswalk_patient_id(user):
+def crosswalk_patient_id(user, version):
     """Get patient/id from Crosswalk for user"""
 
     logger.debug("\ncrosswalk_patient_id User:%s" % user)
     try:
         patient = Crosswalk.objects.get(user=user)
         # TODO BB2-4166: Do we need to modify this as well?
-        if patient.fhir_id(2):
-            return patient.fhir_id(2)
+        if patient.fhir_id(version):
+            return patient.fhir_id(version)
 
     except Crosswalk.DoesNotExist:
         pass
@@ -707,7 +708,7 @@ def build_oauth_resource(request, version=Versions.NOT_AN_API_VERSION, format_ty
 def get_patient_by_id(id, request):
     """
     a helper adapted to just get patient given an id out of band of auth flow
-    or noraml data flow, use by tools such as BB2-Tools admin viewers
+    or normal data flow, use by tools such as BB2-Tools admin viewers
     """
     auth_settings = FhirServerAuth(None)
     certs = (auth_settings["cert_file"], auth_settings["key_file"])
@@ -718,9 +719,11 @@ def get_patient_by_id(id, request):
     # for now this will only work for v1/v2 patients, but we'll need to be able to
     # determine if the user is V3 and use those endpoints later
     # BB2-4166-TODO: this should allow v3
-    url = "{}/v2/fhir/Patient/{}?_format={}".format(
-        get_resourcerouter().fhir_url, id, settings.FHIR_PARAM_FORMAT
-    )
+    version = request.session.get('version')
+    if version in Versions.supported_versions():
+        url = "{}/v{}/fhir/Patient/{}?_format={}".format(
+            get_resourcerouter().fhir_url, version, id, settings.FHIR_PARAM_FORMAT
+        )
     s = requests.Session()
     req = requests.Request("GET", url, headers=headers)
     prepped = req.prepare()
diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index 9f82e7d0d..08491f681 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -7,7 +7,9 @@
 from apps.fhir.bluebutton.exceptions import UpstreamServerException
 from apps.test import BaseApiTest
 from ..authentication import match_fhir_id
+from apps.constants import Versions
 from .responses import responses
+from django.conf import settings
 
 from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME
 
@@ -55,12 +57,16 @@ def test_match_fhir_id_success(self):
                                MBI = success
             Expecting: Match via MBI first / hash_lockup_type="M"
         '''
-        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY)):
-            fhir_id, hash_lookup_type = match_fhir_id(
-                mbi=self.test_mbi,
-                hicn_hash=self.test_hicn_hash, request=self.request)
-            self.assertEqual(fhir_id, "-20000000002346")
-            self.assertEqual(hash_lookup_type, "M")
+        versions = [Versions.V2, Versions.V3]
+        fhir_ids = [settings.DEFAULT_SAMPLE_FHIR_ID_V2, settings.DEFAULT_SAMPLE_FHIR_ID_V3]
+        for version, versioned_fhir_id in zip(versions, fhir_ids):
+            with self.subTest(version=version, versioned_fhir_id=versioned_fhir_id):
+                with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY)):
+                    fhir_id, hash_lookup_type = match_fhir_id(
+                        mbi=self.test_mbi,
+                        hicn_hash=self.test_hicn_hash, request=self.request, version=version)
+                    self.assertEqual(fhir_id, versioned_fhir_id)
+                    self.assertEqual(hash_lookup_type, "M")
 
     def test_match_fhir_id_hicn_success(self):
         '''
@@ -71,7 +77,7 @@ def test_match_fhir_id_hicn_success(self):
         with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.NOT_FOUND_KEY)):
             fhir_id, hash_lookup_type = match_fhir_id(
                 mbi=self.test_mbi,
-                hicn_hash=self.test_hicn_hash, request=self.request)
+                hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
             self.assertEqual(fhir_id, "-20000000002346")
             self.assertEqual(hash_lookup_type, "H")
 
@@ -84,7 +90,7 @@ def test_match_fhir_id_mbi_success(self):
         with HTTMock(self.create_fhir_mock(self.NOT_FOUND_KEY, self.SUCCESS_KEY)):
             fhir_id, hash_lookup_type = match_fhir_id(
                 mbi=self.test_mbi,
-                hicn_hash=self.test_hicn_hash, request=self.request)
+                hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
             self.assertEqual(fhir_id, "-20000000002346")
             self.assertEqual(hash_lookup_type, "M")
 
@@ -98,7 +104,7 @@ def test_match_fhir_id_not_found(self):
             with self.assertRaises(exceptions.NotFound):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
-                    hicn_hash=self.test_hicn_hash, request=self.request)
+                    hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
 
     def test_match_fhir_id_server_hicn_error(self):
         '''
@@ -110,7 +116,7 @@ def test_match_fhir_id_server_hicn_error(self):
             with self.assertRaises(UpstreamServerException):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
-                    hicn_hash=self.test_hicn_hash, request=self.request)
+                    hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
 
     def test_match_fhir_id_server_mbi_error(self):
         '''
@@ -122,7 +128,7 @@ def test_match_fhir_id_server_mbi_error(self):
             with self.assertRaises(UpstreamServerException):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
-                    hicn_hash=self.test_hicn_hash, request=self.request)
+                    hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
 
     def test_match_fhir_id_duplicates_hicn(self):
         '''
@@ -146,7 +152,7 @@ def test_match_fhir_id_duplicates_mbi(self):
             with self.assertRaisesRegexp(UpstreamServerException, "^Duplicate.*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
-                    hicn_hash=self.test_hicn_hash, request=self.request)
+                    hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
 
     def test_match_fhir_id_duplicates_both(self):
         '''
@@ -158,7 +164,7 @@ def test_match_fhir_id_duplicates_both(self):
             with self.assertRaisesRegexp(UpstreamServerException, "^Duplicate.*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
-                    hicn_hash=self.test_hicn_hash, request=self.request)
+                    hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
 
     def test_match_fhir_id_malformed_hicn(self):
         '''
@@ -170,7 +176,7 @@ def test_match_fhir_id_malformed_hicn(self):
             with self.assertRaisesRegexp(UpstreamServerException, "^Unexpected in Patient search:*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
-                    hicn_hash=self.test_hicn_hash, request=self.request)
+                    hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
 
     def test_match_fhir_id_malformed_mbi(self):
         '''
@@ -182,4 +188,4 @@ def test_match_fhir_id_malformed_mbi(self):
             with self.assertRaisesRegexp(UpstreamServerException, "^Unexpected in Patient search:*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
-                    hicn_hash=self.test_hicn_hash, request=self.request)
+                    hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)

From 48380583ac23e61346794b25ef6c7cfc214fb0c2 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Fri, 7 Nov 2025 16:50:56 -0500
Subject: [PATCH 13/48] Modify some tests, pass a version to
 generate_info_headers. Tests are failing and we have some TODOs, but v3 and
 v2 endpoints all work

---
 apps/accounts/views/oauth2_profile.py         |  1 +
 apps/fhir/bluebutton/models.py                |  4 ---
 apps/fhir/bluebutton/utils.py                 |  7 +++--
 apps/fhir/server/authentication.py            | 10 ++++---
 apps/fhir/server/tests/test_authentication.py |  7 +++--
 apps/mymedicare_cb/models.py                  | 29 ++++---------------
 6 files changed, 20 insertions(+), 38 deletions(-)

diff --git a/apps/accounts/views/oauth2_profile.py b/apps/accounts/views/oauth2_profile.py
index ef118772d..4c461de32 100644
--- a/apps/accounts/views/oauth2_profile.py
+++ b/apps/accounts/views/oauth2_profile.py
@@ -48,6 +48,7 @@ def _openidconnect_userinfo(request, version=Versions.NOT_AN_API_VERSION):
 
     # BB2-4166-TODO: will the request have a version? do we get here from redirects or is this
     # a straight url that we need to get the version from the url (like we do in the fhir app)
+    print("_openidconnect_userinfo request: ", request.__dict__)
     return JsonResponse(_get_userinfo(request.resource_owner, version))
 
 
diff --git a/apps/fhir/bluebutton/models.py b/apps/fhir/bluebutton/models.py
index c96ddb7c7..a46151536 100644
--- a/apps/fhir/bluebutton/models.py
+++ b/apps/fhir/bluebutton/models.py
@@ -160,10 +160,6 @@ def fhir_id(self, version: int = 2) -> str:
         if version in (1, 2):
             return self.fhir_id_v2
         elif version == 3:
-            # TODO BB2-4166: This will want to change. In order to make
-            # BB2-4181 work, the V3 value needed to be found in the V2 column.
-            # 4166 should flip this to _v3, and we should be able to find
-            # values there when using (say) the test client.
             return self.fhir_id_v3
 
         else:
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 47d7e3c27..0eef959b9 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -126,7 +126,7 @@ def get_query_counter(request):
         return request._logging_pass
 
 
-def generate_info_headers(request):
+def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
     """Returns a dict of headers to be sent to the backend"""
     result = {}
     # BB2-279 support BFD header "includeAddressFields" and always set to False
@@ -145,9 +145,10 @@ def generate_info_headers(request):
     user = get_user_from_request(request)
     crosswalk = get_crosswalk(user)
 
-    version = get_api_version_number(request.path)
+    if version == Versions.NOT_AN_API_VERSION:
+        version = get_api_version_number(request.path)
 
-    print("version IN generate_info_headers1004: ", version)
+    print("version IN generate_info_headers418: ", version)
     if crosswalk:
         # we need to send the HicnHash or the fhir_id
         # TODO: Can the hicnHash case ever be reached? Should refactor this!
diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index 7063ff1df..d4f429c1f 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -25,7 +25,7 @@ def search_fhir_id_by_identifier_mbi(mbi, request=None, version=Versions.NOT_AN_
         using the mbi identifier.
     """
     search_identifier = f"{settings.FHIR_PATIENT_SEARCH_PARAM_IDENTIFIER_MBI}|{mbi}"
-
+    print("SEARCH_BY_MBI")
     return search_fhir_id_by_identifier(search_identifier, request, version)
 
 
@@ -35,7 +35,7 @@ def search_fhir_id_by_identifier_hicn_hash(hicn_hash, request=None, version=Vers
         using the hicn_hash identifier.
     """
     search_identifier = f"{settings.FHIR_POST_SEARCH_PARAM_IDENTIFIER_HICN_HASH}|{hicn_hash}"
-
+    print("SEARCH_BY_HICN")
     return search_fhir_id_by_identifier(search_identifier, request, version)
 
 
@@ -57,7 +57,7 @@ def search_fhir_id_by_identifier(search_identifier, request=None, version=Versio
     if request:
         # Get auth flow session values.
         auth_flow_dict = get_session_auth_flow_trace(request)
-        headers = generate_info_headers(request)
+        headers = generate_info_headers(request, version)
         headers = set_default_header(request, headers)
         # may be part of the contract with BFD
         headers['BlueButton-AuthUuid'] = auth_flow_dict.get('auth_uuid', '')
@@ -140,6 +140,7 @@ def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERS
         NotFound: If both searches did not match a fhir_id.
     """
     # Perform primary lookup using MBI
+    print("yet another version check: ", version)
     if mbi:
         try:
             fhir_id = search_fhir_id_by_identifier_mbi(mbi, request, version)
@@ -157,7 +158,8 @@ def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERS
     # Perform secondary lookup using HICN_HASH
     if hicn_hash:
         try:
-            fhir_id = search_fhir_id_by_identifier_hicn_hash(hicn_hash, request)
+            fhir_id = search_fhir_id_by_identifier_hicn_hash(hicn_hash, request, version)
+            print("hicn fhir_id check: ", fhir_id)
         except UpstreamServerException as err:
             log_match_fhir_id(request, None, hicn_hash, False, 'H', str(err))
             # Don't return a 404 because retrying later will not fix this.
diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index 08491f681..aef6333ab 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -17,6 +17,7 @@
 class TestAuthentication(BaseApiTest):
     MOCK_FHIR_URL = MOCK_FHIR_ENDPOINT_HOSTNAME
     MOCK_FHIR_PATH = "/v1/fhir/Patient/"
+    MOCK_FHIR_PATH_VERSIONED = lambda v: f"/v{v}/fhir/Patient"  # noqa: E731
     MOCK_FHIR_HICN_QUERY = ".*hicnHash.*"
     MOCK_FHIR_MBI_QUERY = ".*us-mbi|.*"
     SUCCESS_KEY = 'success'
@@ -34,8 +35,8 @@ def setUp(self):
         self.request.session = self.client.session
 
     @classmethod
-    def create_fhir_mock(cls, hicn_response_key, mbi_response_key):
-        @urlmatch(netloc=cls.MOCK_FHIR_URL, path=cls.MOCK_FHIR_PATH, method='POST')
+    def create_fhir_mock(cls, hicn_response_key, mbi_response_key, version=Versions.NOT_AN_API_VERSION):
+        @urlmatch(netloc=cls.MOCK_FHIR_URL, path=cls.MOCK_FHIR_PATH_VERSIONED(version), method='POST')
         def mock_fhir_post(url, request):
             try:
                 body = request.body
@@ -61,7 +62,7 @@ def test_match_fhir_id_success(self):
         fhir_ids = [settings.DEFAULT_SAMPLE_FHIR_ID_V2, settings.DEFAULT_SAMPLE_FHIR_ID_V3]
         for version, versioned_fhir_id in zip(versions, fhir_ids):
             with self.subTest(version=version, versioned_fhir_id=versioned_fhir_id):
-                with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY)):
+                with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY, version)):
                     fhir_id, hash_lookup_type = match_fhir_id(
                         mbi=self.test_mbi,
                         hicn_hash=self.test_hicn_hash, request=self.request, version=version)
diff --git a/apps/mymedicare_cb/models.py b/apps/mymedicare_cb/models.py
index 5ad82647e..a0bc220d9 100644
--- a/apps/mymedicare_cb/models.py
+++ b/apps/mymedicare_cb/models.py
@@ -63,10 +63,6 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
     else:
         hicn_hash = slsx_client.hicn_hash
 
-    # BB2-4166-TODO: implement cross-lookup
-    # BFD v2 Lookup
-    # BFD v3 Lookup
-
     versioned_fhir_ids = {}
     # Perform fhir_id lookup for all supported versions
     # If the lookup for the requested version fails, raise the exception
@@ -81,12 +77,11 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
                 version=supported_version,
 
             )
-            print("fhir_id: ", fhir_id)
             versioned_fhir_ids[supported_version] = fhir_id
         except UpstreamServerException as e:
             if supported_version == version:
                 raise e
-    print("versioned_fhir_ids: ", versioned_fhir_ids)
+
     log_dict = {
         'type': 'mymedicare_cb:get_and_update_user',
         'subject': slsx_client.user_id,
@@ -105,23 +100,13 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
         user = User.objects.get(username=slsx_client.user_id)
 
         # fhir_id can not change for an existing user!
-        # BB2-4166-TODO: this should be removed when we enable tandem v2/v3 usage
-        # if user.crosswalk.fhir_id(2) != fhir_id:
-        #     mesg = "Found user's fhir_id did not match"
-        #     log_dict.update({
-        #         'status': 'FAIL',
-        #         'user_id': user.id,
-        #         'user_username': user.username,
-        #         'mesg': mesg,
-        #     })
-        #     logger.info(log_dict)
-        #     raise BBMyMedicareCallbackCrosswalkUpdateException(mesg)
+        # 4166 TODO: Is the above comment still true? If so, we may have to change
+        # our logic below
 
         # Did the hicn change?
         if user.crosswalk.user_hicn_hash != slsx_client.hicn_hash:
             hicn_updated = True
 
-        # covers AC1 of BB2-4166
         update_fhir_id = False
         if user.crosswalk.fhir_id(2) is None or user.crosswalk.fhir_id(3) is None:
             update_fhir_id = True
@@ -133,7 +118,6 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
             or (user.crosswalk.user_id_type != hash_lookup_type or hicn_updated)
             or update_fhir_id
         ):
-            print("THE IF EVALUATED")
             # Log crosswalk before state
             log_dict.update({
                 'crosswalk_before': {
@@ -144,12 +128,11 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
                     'user_id_type': user.crosswalk.user_id_type,
                 },
             })
-            print("crosswalk check: ", user.crosswalk.__dict__)
+
             with transaction.atomic():
                 # Archive to audit crosswalk changes
                 ArchivedCrosswalk.create(user.crosswalk)
                 if update_fhir_id:
-                    print("IF EVAL")
                     user.crosswalk.fhir_id_v2 = versioned_fhir_ids.get(Versions.V2)
                     user.crosswalk.fhir_id_v3 = versioned_fhir_ids.get(Versions.V3)
                 # Update crosswalk per changes
@@ -178,9 +161,7 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
         return user, 'R'
     except User.DoesNotExist:
         pass
-    print("versioned_fhir_ids: ", versioned_fhir_ids)
-    # BB2-4166-TODO: this is hardcoded to be version 2, does not account for both fhir_ids
-    # v3 and v2 are BOTH saved in the v2 field
+
     user = create_beneficiary_record(
         slsx_client,
         fhir_id_v2=versioned_fhir_ids.get(Versions.V2, None),

From c65b63c96918f0efb2d6d21e9f9bf19b3334aa4c Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Fri, 7 Nov 2025 17:59:33 -0600
Subject: [PATCH 14/48] added notes and some changes to mymedicare views

---
 apps/accounts/views/oauth2_profile.py |  5 +++--
 apps/mymedicare_cb/views.py           | 19 ++++++++++++-------
 apps/test.py                          |  4 ++++
 hhs_oauth_server/request_logging.py   |  2 ++
 4 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/apps/accounts/views/oauth2_profile.py b/apps/accounts/views/oauth2_profile.py
index 4c461de32..9ad5e64eb 100644
--- a/apps/accounts/views/oauth2_profile.py
+++ b/apps/accounts/views/oauth2_profile.py
@@ -46,8 +46,9 @@ def _get_userinfo(user, version=Versions.NOT_AN_API_VERSION):
 def _openidconnect_userinfo(request, version=Versions.NOT_AN_API_VERSION):
     # NOTE: The **kwargs are not used anywhere down the callchain, and are being ignored.
 
-    # BB2-4166-TODO: will the request have a version? do we get here from redirects or is this
-    # a straight url that we need to get the version from the url (like we do in the fhir app)
+    # BB2-4166-NOTES: Request does contain a version but it appears that it will
+    # need to be grabbed from a url within the request. '/v1/connect/userinfo' was returned
+    # during test_data_access_grant_permissions_has_permission
     print("_openidconnect_userinfo request: ", request.__dict__)
     return JsonResponse(_get_userinfo(request.resource_owner, version))
 
diff --git a/apps/mymedicare_cb/views.py b/apps/mymedicare_cb/views.py
index aa0f82ec1..7f8f08cbf 100644
--- a/apps/mymedicare_cb/views.py
+++ b/apps/mymedicare_cb/views.py
@@ -14,6 +14,7 @@
 from django.views.decorators.cache import never_cache
 from rest_framework import status
 from rest_framework.exceptions import NotFound
+from apps.constants import Versions
 
 from apps.dot_ext.loggers import (clear_session_auth_flow_trace,
                                   set_session_auth_flow_trace_value,
@@ -73,6 +74,8 @@ def authenticate(request):
 
     # Log successful authentication with beneficiary when we return back here.
     # BB2-4166-TODO: set both fhir_ids if we get both of them
+    # BB2-4166-NOTES: Might work to just set both fhir_id_v2 and fhir_id_v3 with
+    # the crosswalk.fhir_id(version) value
     slsx_client.log_authn_success(request, {
         'user': {
             'id': user.id,
@@ -103,13 +106,15 @@ def callback(request):
         return JsonResponse({"error": 'The requested state was not found'}, status=status.HTTP_400_BAD_REQUEST)
     next_uri = anon_user_state.next_uri
 
-    # BB2-4166-TODO: refactor this to be generalized
-    if "/v3/o/authorize" in next_uri:
-        version = 3
-    elif "/v2/o/authorize" in next_uri:
-        version = 2
-    else:
-        version = 2
+    # We don't have a `version` coming back from auth. Therefore, we check
+    # the authorize URL to find what version pathway we are on.
+    version = Versions.NOT_AN_API_VERSION
+    for supported_version in Versions.supported_versions():
+        print()
+        print("NEXT_URI", next_uri)
+        if f"/v{supported_version}/o/authorize" in next_uri:
+            version = supported_version
+            break
 
     request.session['version'] = version
 
diff --git a/apps/test.py b/apps/test.py
index 3ec7114f8..eee574201 100644
--- a/apps/test.py
+++ b/apps/test.py
@@ -410,6 +410,10 @@ def _create_user_app_token_grant(
             # Create unique hashes using FHIR_ID
             # BB2-4166-TODO: this is only checking v2, possible rewrite these helper functions to allow more
             # generalized fhir_id handling
+            # BB2-4166-NOTES:
+            # This is only used for test_data_access_grant, test_data_access_grant_permissions, test_api_error_codes.py
+            # Possibly would be contributing to failed unit tests, but for v3, we are planning to remove hicn_hash anyway
+            # We could think about checking the v3_endpoints waffle switch and then skipping hicn_hash usage and generation
             hicn_hash = re.sub(
                 "[^A-Za-z0-9]+", "a", fhir_id_v2 + self.test_hicn_hash[len(fhir_id_v2):]
             )
diff --git a/hhs_oauth_server/request_logging.py b/hhs_oauth_server/request_logging.py
index 9df8ef517..f9ef09279 100644
--- a/hhs_oauth_server/request_logging.py
+++ b/hhs_oauth_server/request_logging.py
@@ -388,6 +388,8 @@ def to_dict(self):
             try:
                 # BB2-4166-TODO: this is hardcoded to be version 2
                 self.log_msg["fhir_id_v2"] = user.crosswalk.fhir_id(2)
+                # BB2-4166-NOTES: This might work with a v3 field and crosswalk.fhir_id(Versions.v3)
+                # Aside from unit tests, this should not cause a ton of other issues with functionality
             except ObjectDoesNotExist:
                 pass
 

From 90c7921008ab27ee989cd3891e65121f82a3940a Mon Sep 17 00:00:00 2001
From: Matt Jadud <mattjadud@navapbc.com>
Date: Mon, 10 Nov 2025 10:38:12 -0500
Subject: [PATCH 15/48] Interim collab commit

---
 apps/accounts/views/oauth2_profile.py |  1 -
 apps/fhir/bluebutton/models.py        |  1 -
 apps/fhir/bluebutton/utils.py         |  6 +++---
 apps/mymedicare_cb/views.py           | 10 ++--------
 apps/test.py                          |  8 ++------
 hhs_oauth_server/request_logging.py   |  7 ++++---
 6 files changed, 11 insertions(+), 22 deletions(-)

diff --git a/apps/accounts/views/oauth2_profile.py b/apps/accounts/views/oauth2_profile.py
index 9ad5e64eb..f4db057ac 100644
--- a/apps/accounts/views/oauth2_profile.py
+++ b/apps/accounts/views/oauth2_profile.py
@@ -49,7 +49,6 @@ def _openidconnect_userinfo(request, version=Versions.NOT_AN_API_VERSION):
     # BB2-4166-NOTES: Request does contain a version but it appears that it will
     # need to be grabbed from a url within the request. '/v1/connect/userinfo' was returned
     # during test_data_access_grant_permissions_has_permission
-    print("_openidconnect_userinfo request: ", request.__dict__)
     return JsonResponse(_get_userinfo(request.resource_owner, version))
 
 
diff --git a/apps/fhir/bluebutton/models.py b/apps/fhir/bluebutton/models.py
index a46151536..80e2a8bb7 100644
--- a/apps/fhir/bluebutton/models.py
+++ b/apps/fhir/bluebutton/models.py
@@ -161,7 +161,6 @@ def fhir_id(self, version: int = 2) -> str:
             return self.fhir_id_v2
         elif version == 3:
             return self.fhir_id_v3
-
         else:
             raise ValidationError(f"{version} is not a valid BFD version")
 
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 0eef959b9..75576d2fb 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -1,3 +1,4 @@
+# noqa
 import os
 import logging
 
@@ -150,9 +151,8 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
 
     print("version IN generate_info_headers418: ", version)
     if crosswalk:
-        # we need to send the HicnHash or the fhir_id
         # TODO: Can the hicnHash case ever be reached? Should refactor this!
-        # BB2-4166-TODO: generalize this to include and check for v3 if a v3 request is happening
+        # TODO: As we move to v2/v3, v3 does not use the hicnHash. We will want to refactor.
         if crosswalk.fhir_id(version) is not None:
             result["BlueButton-BeneficiaryId"] = "patientId:" + crosswalk.fhir_id(version)
         else:
@@ -743,7 +743,7 @@ def get_patient_by_mbi_hash(mbi_hash, request):
     headers["BlueButton-Application"] = "BB2-Tools"
     headers["includeIdentifiers"] = "true"
 
-    search_identifier = f"https://bluebutton.cms.gov/resources/identifier/mbi-hash|{mbi_hash}"
+    search_identifier = f"https://bluebutton.cms.gov/resources/identifier/mbi-hash|{mbi_hash}"  # noqa: E231
     payload = {"identifier": search_identifier}
     url = "{}/v2/fhir/Patient/_search".format(
         get_resourcerouter().fhir_url
diff --git a/apps/mymedicare_cb/views.py b/apps/mymedicare_cb/views.py
index 7f8f08cbf..e61c1845b 100644
--- a/apps/mymedicare_cb/views.py
+++ b/apps/mymedicare_cb/views.py
@@ -34,9 +34,6 @@
 def authenticate(request):
     # Update authorization flow from previously stored state in AuthFlowUuid instance in mymedicare_login().
     request_state = request.GET.get('relay')
-
-    version = request.session['version']
-
     clear_session_auth_flow_trace(request)
     update_session_auth_flow_trace_from_state(request, request_state)
 
@@ -73,9 +70,6 @@ def authenticate(request):
     set_session_auth_flow_trace_value(request, 'auth_crosswalk_action', crosswalk_action)
 
     # Log successful authentication with beneficiary when we return back here.
-    # BB2-4166-TODO: set both fhir_ids if we get both of them
-    # BB2-4166-NOTES: Might work to just set both fhir_id_v2 and fhir_id_v3 with
-    # the crosswalk.fhir_id(version) value
     slsx_client.log_authn_success(request, {
         'user': {
             'id': user.id,
@@ -84,8 +78,8 @@ def authenticate(request):
                 'id': user.crosswalk.id,
                 'user_hicn_hash': user.crosswalk.user_hicn_hash,
                 'user_mbi': user.crosswalk.user_mbi,
-                # BB2-4166-TODO: this needs to account for both fhir_ids if they are found
-                ('fhir_id_v3' if version == 3 else 'fhir_id_v2'): user.crosswalk.fhir_id(version),
+                'fhir_id_v2': user.crosswalk.fhir_id(Versions.V2),
+                'fhir_id_v3': user.crosswalk.fhir_id(Versions.V3),
                 'user_id_type': user.crosswalk.user_id_type,
             },
         },
diff --git a/apps/test.py b/apps/test.py
index eee574201..3a65a9db2 100644
--- a/apps/test.py
+++ b/apps/test.py
@@ -408,12 +408,8 @@ def _create_user_app_token_grant(
             username = first_name + last_name + "@example.com"
 
             # Create unique hashes using FHIR_ID
-            # BB2-4166-TODO: this is only checking v2, possible rewrite these helper functions to allow more
-            # generalized fhir_id handling
-            # BB2-4166-NOTES:
-            # This is only used for test_data_access_grant, test_data_access_grant_permissions, test_api_error_codes.py
-            # Possibly would be contributing to failed unit tests, but for v3, we are planning to remove hicn_hash anyway
-            # We could think about checking the v3_endpoints waffle switch and then skipping hicn_hash usage and generation
+            # Eventually, we will be getting rid of the hicn hash. We can leave this v2 reference for now.
+            # This is "just" creating a unique value.
             hicn_hash = re.sub(
                 "[^A-Za-z0-9]+", "a", fhir_id_v2 + self.test_hicn_hash[len(fhir_id_v2):]
             )
diff --git a/hhs_oauth_server/request_logging.py b/hhs_oauth_server/request_logging.py
index f9ef09279..614890d9b 100644
--- a/hhs_oauth_server/request_logging.py
+++ b/hhs_oauth_server/request_logging.py
@@ -9,6 +9,7 @@
 from django.utils.deprecation import MiddlewareMixin
 from oauth2_provider.models import AccessToken, RefreshToken, get_application_model
 from rest_framework.response import Response
+from apps.constants import Versions
 
 from apps.dot_ext.loggers import (
     SESSION_AUTH_FLOW_TRACE_KEYS,
@@ -156,6 +157,7 @@ def _log_msg_update_from_object(self, obj, key, obj_key):
         # Log message update from a passed in object
         try:
             value = getattr(obj, obj_key, None)
+            # BB2-4166-TODO: the key could be "fhir_id" that we getattr on the object...
             # Added as the fhir_id column on crosswalk is now a method rather than a property
             if callable(value):
                 value = value()
@@ -387,9 +389,8 @@ def to_dict(self):
             self.log_msg["user"] = str(user)
             try:
                 # BB2-4166-TODO: this is hardcoded to be version 2
-                self.log_msg["fhir_id_v2"] = user.crosswalk.fhir_id(2)
-                # BB2-4166-NOTES: This might work with a v3 field and crosswalk.fhir_id(Versions.v3)
-                # Aside from unit tests, this should not cause a ton of other issues with functionality
+                self.log_msg["fhir_id_v2"] = user.crosswalk.fhir_id(Versions.V2)
+                self.log_msg["fhir_id_v3"] = user.crosswalk.fhir_id(Versions.V3)
             except ObjectDoesNotExist:
                 pass
 

From 672c806a8cd15693ea12bf14a97e572423784f4d Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Mon, 10 Nov 2025 10:52:30 -0500
Subject: [PATCH 16/48] Remove completed TODOs

---
 apps/accounts/views/oauth2_profile.py     |  3 --
 apps/fhir/bluebutton/tests/test_models.py | 40 ++++++++++-------------
 2 files changed, 17 insertions(+), 26 deletions(-)

diff --git a/apps/accounts/views/oauth2_profile.py b/apps/accounts/views/oauth2_profile.py
index f4db057ac..0ba9484c8 100644
--- a/apps/accounts/views/oauth2_profile.py
+++ b/apps/accounts/views/oauth2_profile.py
@@ -46,9 +46,6 @@ def _get_userinfo(user, version=Versions.NOT_AN_API_VERSION):
 def _openidconnect_userinfo(request, version=Versions.NOT_AN_API_VERSION):
     # NOTE: The **kwargs are not used anywhere down the callchain, and are being ignored.
 
-    # BB2-4166-NOTES: Request does contain a version but it appears that it will
-    # need to be grabbed from a url within the request. '/v1/connect/userinfo' was returned
-    # during test_data_access_grant_permissions_has_permission
     return JsonResponse(_get_userinfo(request.resource_owner, version))
 
 
diff --git a/apps/fhir/bluebutton/tests/test_models.py b/apps/fhir/bluebutton/tests/test_models.py
index 882cba157..6f80dad17 100644
--- a/apps/fhir/bluebutton/tests/test_models.py
+++ b/apps/fhir/bluebutton/tests/test_models.py
@@ -42,29 +42,23 @@ def test_not_require_user_mbi(self):
         cw = Crosswalk.objects.get(user=user)
         self.assertEqual(cw.user_mbi, None)
 
-    # TODO BB2-4166: This was commented out as part of
-    # BB2-4181, but after the work of 4166 is done, this test should
-    # pass. However, in 4181, we are storing _v3 values in _v2 (at the model level), and
-    # therefore the logic of this test does not work in 4181's branch.
-    # Once 4166 is fully implemented, uncomment this test, and it should pass and
-    # navigating the test client using the v3 pathway should work.
-    # def test_mutable_fhir_id(self):
-    #     user = self._create_user(
-    #         "john",
-    #         "password",
-    #         first_name="John",
-    #         last_name="Smith",
-    #         email="john@smith.net",
-    #         fhir_id_v2="-20000000000001",
-    #         fhir_id_v3="-30000000000001",
-    #     )
-    # cw = Crosswalk.objects.get(user=user)
-    # self.assertEqual(cw.fhir_id(2), "-20000000000001")
-    # self.assertEqual(cw.fhir_id(3), "-30000000000001")
-    # cw.set_fhir_id("-20000000000002", 2)
-    # cw.set_fhir_id("-30000000000002", 3)
-    # self.assertEqual(cw.fhir_id(2), "-20000000000002")
-    # self.assertEqual(cw.fhir_id(3), "-30000000000002")
+    def test_mutable_fhir_id(self):
+        user = self._create_user(
+            "john",
+            "password",
+            first_name="John",
+            last_name="Smith",
+            email="john@smith.net",
+            fhir_id_v2="-20000000000001",
+            fhir_id_v3="-30000000000001",
+        )
+        cw = Crosswalk.objects.get(user=user)
+        self.assertEqual(cw.fhir_id(2), "-20000000000001")
+        self.assertEqual(cw.fhir_id(3), "-30000000000001")
+        cw.set_fhir_id("-20000000000002", 2)
+        cw.set_fhir_id("-30000000000002", 3)
+        self.assertEqual(cw.fhir_id(2), "-20000000000002")
+        self.assertEqual(cw.fhir_id(3), "-30000000000002")
 
     def test_mutable_user_hicn_hash(self):
         user = self._create_user(

From 87c39e7bd54c078b59af521300453267219ae39e Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Mon, 10 Nov 2025 10:56:26 -0500
Subject: [PATCH 17/48] Remove more completed TODOs

---
 apps/fhir/server/authentication.py  | 1 -
 apps/logging/signals.py             | 7 ++++---
 hhs_oauth_server/request_logging.py | 1 -
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index d4f429c1f..300888932 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -78,7 +78,6 @@ def search_fhir_id_by_identifier(search_identifier, request=None, version=Versio
         headers = None
 
     # Build URL based on BFD version
-    # BB2-4166-TODO: generalize versionining of fhir server url
     resource_router = get_resourcerouter()
     ver = f'v{version}'
 
diff --git a/apps/logging/signals.py b/apps/logging/signals.py
index 8058b3dae..18a9f1ce3 100644
--- a/apps/logging/signals.py
+++ b/apps/logging/signals.py
@@ -1,3 +1,4 @@
+from apps.constants import Versions
 import apps.logging.request_logger as logging
 
 from django.db.models.signals import (
@@ -46,8 +47,8 @@ def handle_app_authorized(sender, request, auth_status, auth_status_code, user,
         'id': None,
         'user_hicn_hash': None,
         'user_mbi': None,
-        # BB2-4166-TODO: this is hardcoded to be version 2, add v3
         'fhir_id_v2': None,
+        'fhir_id_v3': None,
         'user_id_type': None
     }
 
@@ -56,8 +57,8 @@ def handle_app_authorized(sender, request, auth_status, auth_status_code, user,
             'id': user.crosswalk.id,
             'user_hicn_hash': user.crosswalk.user_hicn_hash,
             'user_mbi': user.crosswalk.user_mbi,
-            # BB2-4166-TODO: this is hardcoded to be version 2, add v3
-            'fhir_id_v2': user.crosswalk.fhir_id(2),
+            'fhir_id_v2': user.crosswalk.fhir_id(Versions.V2),
+            'fhir_id_v3': user.crosswalk.fhir_id(Versions.V3),
             'user_id_type': user.crosswalk.user_id_type
         }
     except Exception:
diff --git a/hhs_oauth_server/request_logging.py b/hhs_oauth_server/request_logging.py
index 614890d9b..3726ce212 100644
--- a/hhs_oauth_server/request_logging.py
+++ b/hhs_oauth_server/request_logging.py
@@ -388,7 +388,6 @@ def to_dict(self):
         if user:
             self.log_msg["user"] = str(user)
             try:
-                # BB2-4166-TODO: this is hardcoded to be version 2
                 self.log_msg["fhir_id_v2"] = user.crosswalk.fhir_id(Versions.V2)
                 self.log_msg["fhir_id_v3"] = user.crosswalk.fhir_id(Versions.V3)
             except ObjectDoesNotExist:

From 717462b8c74091b4c5931bf3dda4a3086d52212e Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Mon, 10 Nov 2025 11:33:38 -0500
Subject: [PATCH 18/48] Remove more TODOs that had been completed

---
 apps/bb2_tools/admin.py             |  5 ++---
 apps/fhir/bluebutton/utils.py       | 17 ++++++-----------
 apps/mymedicare_cb/models.py        |  6 +-----
 hhs_oauth_server/request_logging.py |  7 ++++---
 4 files changed, 13 insertions(+), 22 deletions(-)

diff --git a/apps/bb2_tools/admin.py b/apps/bb2_tools/admin.py
index d554dd260..75c273c91 100644
--- a/apps/bb2_tools/admin.py
+++ b/apps/bb2_tools/admin.py
@@ -361,7 +361,7 @@ def get_access_tokens(self, obj):
     )
     def get_identities(self, obj):
         return format_html(
-            '<div><ul><li>FHIR_ID_V2:{}</li>li>FHIR_ID_V3:{}</li><li>HICN HASH:{}</li><li>MBI:{}</li>'.format(
+            '<div><ul><li>FHIR_ID_V2:{}</li><li>FHIR_ID_V3:{}</li><li>HICN HASH:{}</li><li>MBI:{}</li>'.format(
                 obj.fhir_id(2), obj.fhir_id(3), obj.user_hicn_hash, obj.user_mbi
             )
         )
@@ -414,9 +414,8 @@ def change_view(self, request, object_id, form_url="", extra_context=None):
         crosswalk = BeneficiaryDashboard.objects.get(pk=int(object_id))
 
         json_resp = None
-
         try:
-            json_resp = get_patient_by_id(crosswalk.fhir_id(request.session['version']), request)
+            json_resp = get_patient_by_id(crosswalk.fhir_id(2), request)
         except Exception as e:
             json_resp = {"backend_error": str(e)}
 
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 75576d2fb..29412c5a2 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -412,7 +412,7 @@ def prepend_q(pass_params):
     return pass_params
 
 
-# TODO BB2-4166: This is only used in tests.
+# BB2-4166-TODO - if tests are failing this could be related
 def dt_patient_reference(user, version):
     """Get Patient Reference from Crosswalk for user"""
 
@@ -423,8 +423,6 @@ def dt_patient_reference(user, version):
 
     return None
 
-# TODO BB2-4166: This is only used in tests.
-
 
 def crosswalk_patient_id(user, version):
     """Get patient/id from Crosswalk for user"""
@@ -432,7 +430,7 @@ def crosswalk_patient_id(user, version):
     logger.debug("\ncrosswalk_patient_id User:%s" % user)
     try:
         patient = Crosswalk.objects.get(user=user)
-        # TODO BB2-4166: Do we need to modify this as well?
+        # BB2-4166-TODO - if tests are failing this could be related
         if patient.fhir_id(version):
             return patient.fhir_id(version)
 
@@ -713,18 +711,15 @@ def get_patient_by_id(id, request):
     """
     auth_settings = FhirServerAuth(None)
     certs = (auth_settings["cert_file"], auth_settings["key_file"])
-    print("IS IT IN get_patient_by_id???")
+
     headers = generate_info_headers(request)
     headers["BlueButton-Application"] = "BB2-Tools"
     headers["includeIdentifiers"] = "true"
     # for now this will only work for v1/v2 patients, but we'll need to be able to
     # determine if the user is V3 and use those endpoints later
-    # BB2-4166-TODO: this should allow v3
-    version = request.session.get('version')
-    if version in Versions.supported_versions():
-        url = "{}/v{}/fhir/Patient/{}?_format={}".format(
-            get_resourcerouter().fhir_url, version, id, settings.FHIR_PARAM_FORMAT
-        )
+    url = "{}/v2/fhir/Patient/{}?_format={}".format(
+        get_resourcerouter().fhir_url, id, settings.FHIR_PARAM_FORMAT
+    )
     s = requests.Session()
     req = requests.Request("GET", url, headers=headers)
     prepped = req.prepare()
diff --git a/apps/mymedicare_cb/models.py b/apps/mymedicare_cb/models.py
index a0bc220d9..7f1d32248 100644
--- a/apps/mymedicare_cb/models.py
+++ b/apps/mymedicare_cb/models.py
@@ -99,16 +99,12 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
         # Does an existing user and crosswalk exist for SLSx username?
         user = User.objects.get(username=slsx_client.user_id)
 
-        # fhir_id can not change for an existing user!
-        # 4166 TODO: Is the above comment still true? If so, we may have to change
-        # our logic below
-
         # Did the hicn change?
         if user.crosswalk.user_hicn_hash != slsx_client.hicn_hash:
             hicn_updated = True
 
         update_fhir_id = False
-        if user.crosswalk.fhir_id(2) is None or user.crosswalk.fhir_id(3) is None:
+        if user.crosswalk.fhir_id(Versions.V2) is None or user.crosswalk.fhir_id(Versions.V3) is None:
             update_fhir_id = True
         # Update Crosswalk if the user_mbi is null, but we have an mbi value from SLSx or
         # if the saved user_mbi value is different than what SLSx has
diff --git a/hhs_oauth_server/request_logging.py b/hhs_oauth_server/request_logging.py
index 3726ce212..d2d144af4 100644
--- a/hhs_oauth_server/request_logging.py
+++ b/hhs_oauth_server/request_logging.py
@@ -157,8 +157,6 @@ def _log_msg_update_from_object(self, obj, key, obj_key):
         # Log message update from a passed in object
         try:
             value = getattr(obj, obj_key, None)
-            # BB2-4166-TODO: the key could be "fhir_id" that we getattr on the object...
-            # Added as the fhir_id column on crosswalk is now a method rather than a property
             if callable(value):
                 value = value()
             if value is not None:
@@ -325,7 +323,10 @@ def to_dict(self):
             )
             if getattr(self.request.user, "crosswalk", False):
                 self._log_msg_update_from_object(
-                    self.request.user.crosswalk, "req_fhir_id", "fhir_id"
+                    self.request.user.crosswalk, 'req_fhir_id_v2', 'fhir_id_v2'
+                )
+                self._log_msg_update_from_object(
+                    self.request.user.crosswalk, 'req_fhir_id_v3', 'fhir_id_v3'
                 )
 
         """

From ebf5125495b5a3f82f7c3894e175131aa1bd3175 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Mon, 10 Nov 2025 13:01:39 -0500
Subject: [PATCH 19/48] Fix audit_logger tests, WIP on authentication

---
 apps/fhir/bluebutton/utils.py                 |  1 +
 apps/fhir/server/authentication.py            |  6 ++-
 apps/fhir/server/tests/test_authentication.py | 44 +++++++++++++++++--
 apps/logging/tests/audit_logger_schemas.py    |  8 +++-
 apps/logging/tests/test_audit_loggers.py      | 22 ++++++++--
 hhs_oauth_server/settings/base.py             |  1 +
 6 files changed, 72 insertions(+), 10 deletions(-)

diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 29412c5a2..63713de27 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -150,6 +150,7 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
         version = get_api_version_number(request.path)
 
     print("version IN generate_info_headers418: ", version)
+    print("crosswalk: ", crosswalk)
     if crosswalk:
         # TODO: Can the hicnHash case ever be reached? Should refactor this!
         # TODO: As we move to v2/v3, v3 does not use the hicnHash. We will want to refactor.
diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index 300888932..655345053 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -25,7 +25,9 @@ def search_fhir_id_by_identifier_mbi(mbi, request=None, version=Versions.NOT_AN_
         using the mbi identifier.
     """
     search_identifier = f"{settings.FHIR_PATIENT_SEARCH_PARAM_IDENTIFIER_MBI}|{mbi}"
-    print("SEARCH_BY_MBI")
+    print("SEARCH_BY_MBI: ", search_identifier)
+    print("SEARCH_BY_MBI REQUEST: ", request.__dict__)
+    print("SEARCH_BY_MBI VERSION: ", version)
     return search_fhir_id_by_identifier(search_identifier, request, version)
 
 
@@ -140,9 +142,11 @@ def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERS
     """
     # Perform primary lookup using MBI
     print("yet another version check: ", version)
+    print("mbi val: ", mbi)
     if mbi:
         try:
             fhir_id = search_fhir_id_by_identifier_mbi(mbi, request, version)
+            print("fhir_id in MBI TRY: ", fhir_id)
         except UpstreamServerException as err:
             log_match_fhir_id(request, None, hicn_hash, False, 'M', str(err))
             # Don't return a 404 because retrying later will not fix this.
diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index aef6333ab..9872c4d06 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -9,7 +9,6 @@
 from ..authentication import match_fhir_id
 from apps.constants import Versions
 from .responses import responses
-from django.conf import settings
 
 from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME
 
@@ -52,6 +51,42 @@ def mock_fhir_post(url, request):
                 raise Exception(f"Failed to parse json: {e.msg}")
         return mock_fhir_post
 
+    @classmethod
+    def create_fhir_mock_v2(cls, hicn_response_key, mbi_response_key, version=Versions.NOT_AN_API_VERSION):
+        @urlmatch(netloc=cls.MOCK_FHIR_URL, path='/v2/fhir/Patient', method='POST')
+        def mock_fhir_post(url, request):
+            try:
+                body = request.body
+                identifier = body.split('=', 1)[1]
+
+                if 'hicn-hash' in identifier:
+                    return responses[hicn_response_key]
+                elif 'us-mbi' in identifier:
+                    return responses[mbi_response_key]
+                else:
+                    raise Exception(f"Invalid identifier: {identifier}")
+            except json.JSONDecodeError as e:
+                raise Exception(f"Failed to parse json: {e.msg}")
+        return mock_fhir_post
+
+    @classmethod
+    def create_fhir_mock_v3(cls, hicn_response_key, mbi_response_key, version=Versions.NOT_AN_API_VERSION):
+        @urlmatch(netloc=cls.MOCK_FHIR_URL, path='/v3/fhir/Patient', method='POST')
+        def mock_fhir_post(url, request):
+            try:
+                body = request.body
+                identifier = body.split('=', 1)[1]
+
+                if 'hicn-hash' in identifier:
+                    return responses[hicn_response_key]
+                elif 'us-mbi' in identifier:
+                    return responses[mbi_response_key]
+                else:
+                    raise Exception(f"Invalid identifier: {identifier}")
+            except json.JSONDecodeError as e:
+                raise Exception(f"Failed to parse json: {e.msg}")
+        return mock_fhir_post
+
     def test_match_fhir_id_success(self):
         '''
             Testing responses: HICN = success
@@ -59,10 +94,11 @@ def test_match_fhir_id_success(self):
             Expecting: Match via MBI first / hash_lockup_type="M"
         '''
         versions = [Versions.V2, Versions.V3]
-        fhir_ids = [settings.DEFAULT_SAMPLE_FHIR_ID_V2, settings.DEFAULT_SAMPLE_FHIR_ID_V3]
-        for version, versioned_fhir_id in zip(versions, fhir_ids):
+        fhir_ids = ['-20000000002346', '-206068516']
+        mock_funcs = [self.create_fhir_mock_v2, self.create_fhir_mock_v3]
+        for version, versioned_fhir_id, mock_func in zip(versions, fhir_ids, mock_funcs):
             with self.subTest(version=version, versioned_fhir_id=versioned_fhir_id):
-                with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY, version)):
+                with HTTMock(mock_func(self.SUCCESS_KEY, self.SUCCESS_KEY, version)):
                     fhir_id, hash_lookup_type = match_fhir_id(
                         mbi=self.test_mbi,
                         hicn_hash=self.test_hicn_hash, request=self.request, version=version)
diff --git a/apps/logging/tests/audit_logger_schemas.py b/apps/logging/tests/audit_logger_schemas.py
index 490d6cf28..b6687f338 100755
--- a/apps/logging/tests/audit_logger_schemas.py
+++ b/apps/logging/tests/audit_logger_schemas.py
@@ -439,13 +439,15 @@ def get_pre_fetch_fhir_log_entry_schema(version):
         "request_uuid": {"type": "string", "format": "uuid"},
         "req_user_id": {"type": "integer", "enum": [1]},
         "req_user_username": {"pattern": "00112233-4455-6677-8899-aabbccddeeff"},
-        "req_fhir_id": {"pattern": "-20140000008325"},
+        "req_fhir_id_v2": {"pattern": "-20140000008325"},
+        "req_fhir_id_v3": {"pattern": "-20140000008325"},
         "auth_crosswalk_action": {"pattern": "C"},
         "path": {"pattern": "/mymedicare/sls-callback"},
         "request_method": {"pattern": "GET"},
         "request_scheme": {"pattern": "http"},
         "user": {"pattern": "00112233-4455-6677-8899-aabbccddeeff"},
         "fhir_id_v2": {"pattern": "-20140000008325"},
+        "fhir_id_v3": {"pattern": "-20140000008325"},
         "response_code": {"type": "integer", "enum": [status.HTTP_302_FOUND]},
     },
     "required": [
@@ -457,13 +459,15 @@ def get_pre_fetch_fhir_log_entry_schema(version):
         "request_uuid",
         "req_user_id",
         "req_user_username",
-        "req_fhir_id",
+        "req_fhir_id_v2",
+        "req_fhir_id_v3",
         "auth_crosswalk_action",
         "path",
         "request_method",
         "request_scheme",
         "user",
         "fhir_id_v2",
+        "fhir_id_v3",
         "response_code",
     ],
 }
diff --git a/apps/logging/tests/test_audit_loggers.py b/apps/logging/tests/test_audit_loggers.py
index 7a6b969d7..5d48f0bdb 100644
--- a/apps/logging/tests/test_audit_loggers.py
+++ b/apps/logging/tests/test_audit_loggers.py
@@ -41,7 +41,7 @@
     SLSX_USERINFO_LOG_SCHEMA,
 )
 
-from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME
+from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME, MOCK_FHIR_V3_ENDPOINT_HOSTNAME
 
 FHIR_ID_V2 = settings.DEFAULT_SAMPLE_FHIR_ID_V2
 
@@ -178,6 +178,9 @@ def test_callback_url_success_slsx_logger(self):
     def test_callback_url_success_slsx_logger_v2(self):
         self._callback_url_success_slsx_logger(2)
 
+    def test_callback_url_success_slsx_logger_v3(self):
+        self._callback_url_success_slsx_logger(3)
+
     def _callback_url_success_slsx_logger(self, version=1):
         # copy and adapted for SLSx logger test
         state = generate_nonce()
@@ -189,7 +192,7 @@ def _callback_url_success_slsx_logger(self, version=1):
         # mock fhir user info endpoint
         @urlmatch(
             netloc=MOCK_FHIR_ENDPOINT_HOSTNAME,
-            path=r'/v[123]/fhir/Patient/',
+            path=r'/v[12]/fhir/Patient/',
         )
         def fhir_patient_info_mock(url, request):
             return {
@@ -197,6 +200,17 @@ def fhir_patient_info_mock(url, request):
                 'content': patient_response,
             }
 
+        # mock fhir user info endpoint
+        @urlmatch(
+            netloc=MOCK_FHIR_V3_ENDPOINT_HOSTNAME,
+            path=r'/v3/fhir/Patient/',
+        )
+        def fhir_patient_info_mock_v3(url, request):
+            return {
+                'status_code': status.HTTP_200_OK,
+                'content': patient_response,
+            }
+
         @all_requests
         def catchall(url, request):
             raise Exception(url)
@@ -206,6 +220,7 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_signout_ok_mock,
             fhir_patient_info_mock,
+            fhir_patient_info_mock_v3,
             catchall,
         ):
             s = self.client.session
@@ -279,7 +294,8 @@ def catchall(url, request):
 
             fhir_log_content = get_log_content(self.logger_registry, logging.AUDIT_DATA_FHIR_LOGGER)
             log_entries = fhir_log_content.splitlines()
-            self.assertEqual(len(log_entries), 2)
+
+            self.assertEqual(len(log_entries), 6)
 
             # Validate fhir_auth_pre_fetch entry
             self.assertTrue(
diff --git a/hhs_oauth_server/settings/base.py b/hhs_oauth_server/settings/base.py
index 8720a15ea..8ef49b02d 100644
--- a/hhs_oauth_server/settings/base.py
+++ b/hhs_oauth_server/settings/base.py
@@ -636,6 +636,7 @@
 # The hostname is ultimately used in a mock, and therefore does not strictly need to exist
 # or be correct. But, it does need to be consistent.
 MOCK_FHIR_ENDPOINT_HOSTNAME = urlparse(FHIR_SERVER["FHIR_URL"]).hostname
+MOCK_FHIR_V3_ENDPOINT_HOSTNAME = urlparse(FHIR_SERVER["FHIR_URL_V3"]).hostname
 
 
 FHIR_POST_SEARCH_PARAM_IDENTIFIER_MBI_HASH = (

From 8525ea3e5d7a10c109a90efe82aaedd79129a137 Mon Sep 17 00:00:00 2001
From: Matt Jadud <mattjadud@navapbc.com>
Date: Mon, 10 Nov 2025 14:57:17 -0500
Subject: [PATCH 20/48] Fixed mocked tests

---
 apps/fhir/bluebutton/utils.py                 |  6 +-
 apps/fhir/server/authentication.py            | 11 +--
 apps/fhir/server/tests/test_authentication.py | 72 +++++++------------
 3 files changed, 33 insertions(+), 56 deletions(-)

diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 63713de27..9e3b9cc0c 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -1,4 +1,3 @@
-# noqa
 import os
 import logging
 
@@ -170,6 +169,7 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
         if AccessToken.objects.filter(
             token=get_access_token_from_request(request)
         ).exists():
+            print("USER EXISTS TOKEN EXISTS")
             at = AccessToken.objects.get(token=get_access_token_from_request(request))
             result["BlueButton-Application"] = str(at.application.name)
             result["BlueButton-ApplicationId"] = str(at.application.id)
@@ -178,6 +178,7 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
             result['BlueButton-DeveloperId'] = str(at.application.user.id)
             result['BlueButton-Developer'] = str(at.application.user)
         else:
+            print("USER EXISTS TOKEN NOEXIST")
             result["BlueButton-Application"] = ""
             result["BlueButton-ApplicationId"] = ""
             # BB2-2011 update logging w.r.t new fields application data_access_type
@@ -185,7 +186,10 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
             result["BlueButton-ApplicationEndDate"] = ""
             result["BlueButton-DeveloperId"] = ""
             result["BlueButton-Developer"] = ""
+    else:
+        print("NOUSER NOTOKEN")
 
+    print("RETURNING RESULT", result)
     return result
 
 
diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index 655345053..a28146840 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -37,7 +37,6 @@ def search_fhir_id_by_identifier_hicn_hash(hicn_hash, request=None, version=Vers
         using the hicn_hash identifier.
     """
     search_identifier = f"{settings.FHIR_POST_SEARCH_PARAM_IDENTIFIER_HICN_HASH}|{hicn_hash}"
-    print("SEARCH_BY_HICN")
     return search_fhir_id_by_identifier(search_identifier, request, version)
 
 
@@ -54,7 +53,6 @@ def search_fhir_id_by_identifier(search_identifier, request=None, version=Versio
     # Get certs from FHIR server settings
     auth_settings = FhirServerAuth(None)
     certs = (auth_settings['cert_file'], auth_settings['key_file'])
-    print("VERSION IN search_fhir_id_by_identifier: ", version)
     # Add headers for FHIR backend logging, including auth_flow_dict
     if request:
         # Get auth flow session values.
@@ -112,7 +110,7 @@ def search_fhir_id_by_identifier(search_identifier, request=None, version=Versio
         except requests.exceptions.SSLError as e:
             if retries < max_retries and (env is None or env == 'DEV'):
                 # Checking target_env ensures the retry logic only happens on local
-                print(f"FHIR ID search request failed. Retrying... ({retries + 1}/{max_retries})")
+                # print(f"FHIR ID search request failed. Retrying... ({retries + 1}/{max_retries})")
                 retries += 1
             else:
                 raise e
@@ -141,12 +139,9 @@ def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERS
         NotFound: If both searches did not match a fhir_id.
     """
     # Perform primary lookup using MBI
-    print("yet another version check: ", version)
-    print("mbi val: ", mbi)
     if mbi:
         try:
             fhir_id = search_fhir_id_by_identifier_mbi(mbi, request, version)
-            print("fhir_id in MBI TRY: ", fhir_id)
         except UpstreamServerException as err:
             log_match_fhir_id(request, None, hicn_hash, False, 'M', str(err))
             # Don't return a 404 because retrying later will not fix this.
@@ -159,10 +154,10 @@ def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERS
             return fhir_id, 'M'
 
     # Perform secondary lookup using HICN_HASH
-    if hicn_hash:
+    # WE CANNOT DO A HICN HASH LOOKUP FOR V3
+    if version in [Versions.V1, Versions.V2] and hicn_hash:
         try:
             fhir_id = search_fhir_id_by_identifier_hicn_hash(hicn_hash, request, version)
-            print("hicn fhir_id check: ", fhir_id)
         except UpstreamServerException as err:
             log_match_fhir_id(request, None, hicn_hash, False, 'H', str(err))
             # Don't return a 404 because retrying later will not fix this.
diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index 9872c4d06..1c853225f 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -10,13 +10,21 @@
 from apps.constants import Versions
 from .responses import responses
 
-from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME
+from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME, MOCK_FHIR_V3_ENDPOINT_HOSTNAME
+
+
+def mock_fhir_url(version):
+    return MOCK_FHIR_ENDPOINT_HOSTNAME if version in [1, 2] else MOCK_FHIR_V3_ENDPOINT_HOSTNAME
+
+
+#     MOCK_FHIR_PATH = "/v1/fhir/Patient/"
+def mock_fhir_path(version):
+    return f"/v{version}/fhir/Patient"
 
 
 class TestAuthentication(BaseApiTest):
-    MOCK_FHIR_URL = MOCK_FHIR_ENDPOINT_HOSTNAME
-    MOCK_FHIR_PATH = "/v1/fhir/Patient/"
-    MOCK_FHIR_PATH_VERSIONED = lambda v: f"/v{v}/fhir/Patient"  # noqa: E731
+    MOCK_FHIR_URL = mock_fhir_url(Versions.NOT_AN_API_VERSION)
+    MOCK_FHIR_PATH_VERSIONED = mock_fhir_path(Versions.NOT_AN_API_VERSION)
     MOCK_FHIR_HICN_QUERY = ".*hicnHash.*"
     MOCK_FHIR_MBI_QUERY = ".*us-mbi|.*"
     SUCCESS_KEY = 'success'
@@ -33,50 +41,17 @@ def setUp(self):
         self.request = self.factory.get('http://localhost:8000/mymedicare/sls-callback')
         self.request.session = self.client.session
 
+    # The mock uses data from responses.py. We need to have mock data for a given MBI/FHIR ID
+    # for each version of the API we want to test this way. We can use the v2 test data for
+    # v3 because we're just asking "do you have a valid us-mbi query string?", and usnig that to then
+    # look up the mock response.
     @classmethod
     def create_fhir_mock(cls, hicn_response_key, mbi_response_key, version=Versions.NOT_AN_API_VERSION):
-        @urlmatch(netloc=cls.MOCK_FHIR_URL, path=cls.MOCK_FHIR_PATH_VERSIONED(version), method='POST')
+        @urlmatch(netloc=mock_fhir_url(version), path=mock_fhir_path(version), method='POST')
         def mock_fhir_post(url, request):
             try:
                 body = request.body
                 identifier = body.split('=', 1)[1]
-
-                if 'hicn-hash' in identifier:
-                    return responses[hicn_response_key]
-                elif 'us-mbi' in identifier:
-                    return responses[mbi_response_key]
-                else:
-                    raise Exception(f"Invalid identifier: {identifier}")
-            except json.JSONDecodeError as e:
-                raise Exception(f"Failed to parse json: {e.msg}")
-        return mock_fhir_post
-
-    @classmethod
-    def create_fhir_mock_v2(cls, hicn_response_key, mbi_response_key, version=Versions.NOT_AN_API_VERSION):
-        @urlmatch(netloc=cls.MOCK_FHIR_URL, path='/v2/fhir/Patient', method='POST')
-        def mock_fhir_post(url, request):
-            try:
-                body = request.body
-                identifier = body.split('=', 1)[1]
-
-                if 'hicn-hash' in identifier:
-                    return responses[hicn_response_key]
-                elif 'us-mbi' in identifier:
-                    return responses[mbi_response_key]
-                else:
-                    raise Exception(f"Invalid identifier: {identifier}")
-            except json.JSONDecodeError as e:
-                raise Exception(f"Failed to parse json: {e.msg}")
-        return mock_fhir_post
-
-    @classmethod
-    def create_fhir_mock_v3(cls, hicn_response_key, mbi_response_key, version=Versions.NOT_AN_API_VERSION):
-        @urlmatch(netloc=cls.MOCK_FHIR_URL, path='/v3/fhir/Patient', method='POST')
-        def mock_fhir_post(url, request):
-            try:
-                body = request.body
-                identifier = body.split('=', 1)[1]
-
                 if 'hicn-hash' in identifier:
                     return responses[hicn_response_key]
                 elif 'us-mbi' in identifier:
@@ -94,14 +69,17 @@ def test_match_fhir_id_success(self):
             Expecting: Match via MBI first / hash_lockup_type="M"
         '''
         versions = [Versions.V2, Versions.V3]
-        fhir_ids = ['-20000000002346', '-206068516']
-        mock_funcs = [self.create_fhir_mock_v2, self.create_fhir_mock_v3]
-        for version, versioned_fhir_id, mock_func in zip(versions, fhir_ids, mock_funcs):
+        versioned_fhir_ids = ['-20000000002346', '-20000000002346']
+        for version, versioned_fhir_id in zip(versions, versioned_fhir_ids):
             with self.subTest(version=version, versioned_fhir_id=versioned_fhir_id):
-                with HTTMock(mock_func(self.SUCCESS_KEY, self.SUCCESS_KEY, version)):
+                with HTTMock(TestAuthentication.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY, version)):
                     fhir_id, hash_lookup_type = match_fhir_id(
                         mbi=self.test_mbi,
-                        hicn_hash=self.test_hicn_hash, request=self.request, version=version)
+                        hicn_hash=self.test_hicn_hash,
+                        request=self.request,
+                        version=version)
+                    print(fhir_id, hash_lookup_type)
+                    print()
                     self.assertEqual(fhir_id, versioned_fhir_id)
                     self.assertEqual(hash_lookup_type, "M")
 

From 8ea6bd790c7bdc07c7385538fa847678d687c75a Mon Sep 17 00:00:00 2001
From: Matt Jadud <mattjadud@navapbc.com>
Date: Mon, 10 Nov 2025 16:23:35 -0500
Subject: [PATCH 21/48] Removing print statements

---
 apps/fhir/bluebutton/tests/test_utils.py      | 2 --
 apps/fhir/bluebutton/utils.py                 | 9 +--------
 apps/fhir/bluebutton/views/generic.py         | 3 +--
 apps/fhir/server/authentication.py            | 4 ----
 apps/fhir/server/tests/test_authentication.py | 2 --
 apps/integration_tests/common_utils.py        | 4 +---
 apps/mymedicare_cb/views.py                   | 4 ----
 7 files changed, 3 insertions(+), 25 deletions(-)

diff --git a/apps/fhir/bluebutton/tests/test_utils.py b/apps/fhir/bluebutton/tests/test_utils.py
index 426bc2d0f..78a98a093 100644
--- a/apps/fhir/bluebutton/tests/test_utils.py
+++ b/apps/fhir/bluebutton/tests/test_utils.py
@@ -314,6 +314,4 @@ def test_oauth_resource_xml(self):
 
         expected = "<cors>true</cors>"
 
-        # print(result[16:33])
-
         self.assertEqual(result[16:33], expected)
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 9e3b9cc0c..1de67ef31 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -148,8 +148,6 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
     if version == Versions.NOT_AN_API_VERSION:
         version = get_api_version_number(request.path)
 
-    print("version IN generate_info_headers418: ", version)
-    print("crosswalk: ", crosswalk)
     if crosswalk:
         # TODO: Can the hicnHash case ever be reached? Should refactor this!
         # TODO: As we move to v2/v3, v3 does not use the hicnHash. We will want to refactor.
@@ -169,7 +167,6 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
         if AccessToken.objects.filter(
             token=get_access_token_from_request(request)
         ).exists():
-            print("USER EXISTS TOKEN EXISTS")
             at = AccessToken.objects.get(token=get_access_token_from_request(request))
             result["BlueButton-Application"] = str(at.application.name)
             result["BlueButton-ApplicationId"] = str(at.application.id)
@@ -178,7 +175,6 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
             result['BlueButton-DeveloperId'] = str(at.application.user.id)
             result['BlueButton-Developer'] = str(at.application.user)
         else:
-            print("USER EXISTS TOKEN NOEXIST")
             result["BlueButton-Application"] = ""
             result["BlueButton-ApplicationId"] = ""
             # BB2-2011 update logging w.r.t new fields application data_access_type
@@ -186,10 +182,7 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
             result["BlueButton-ApplicationEndDate"] = ""
             result["BlueButton-DeveloperId"] = ""
             result["BlueButton-Developer"] = ""
-    else:
-        print("NOUSER NOTOKEN")
 
-    print("RETURNING RESULT", result)
     return result
 
 
@@ -252,7 +245,7 @@ def request_call(request, call_url, crosswalk=None, timeout=None, get_parameters
         cert = (auth_state["cert_file"], auth_state["key_file"])
     else:
         cert = ()
-    print("REQUEST in request_call: ", request.__dict__)
+
     header_info = generate_info_headers(request)
 
     header_info = set_default_header(request, header_info)
diff --git a/apps/fhir/bluebutton/views/generic.py b/apps/fhir/bluebutton/views/generic.py
index c762fb476..78c68532c 100644
--- a/apps/fhir/bluebutton/views/generic.py
+++ b/apps/fhir/bluebutton/views/generic.py
@@ -135,7 +135,7 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
         logger.debug('Here is the URL to send, %s now add '
                      'GET parameters %s' % (target_url, get_parameters))
         request.session.version = self.version
-        print("FhirDataView version: ", self.version)
+
         # Now make the call to the backend API
         req = Request('GET',
                       target_url,
@@ -185,7 +185,6 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
 
         # BB2-128
         error = process_error_response(response)
-        print("THE ERROR: ", error)
         if error is not None:
             raise error
 
diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index a28146840..c7086305d 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -25,9 +25,6 @@ def search_fhir_id_by_identifier_mbi(mbi, request=None, version=Versions.NOT_AN_
         using the mbi identifier.
     """
     search_identifier = f"{settings.FHIR_PATIENT_SEARCH_PARAM_IDENTIFIER_MBI}|{mbi}"
-    print("SEARCH_BY_MBI: ", search_identifier)
-    print("SEARCH_BY_MBI REQUEST: ", request.__dict__)
-    print("SEARCH_BY_MBI VERSION: ", version)
     return search_fhir_id_by_identifier(search_identifier, request, version)
 
 
@@ -110,7 +107,6 @@ def search_fhir_id_by_identifier(search_identifier, request=None, version=Versio
         except requests.exceptions.SSLError as e:
             if retries < max_retries and (env is None or env == 'DEV'):
                 # Checking target_env ensures the retry logic only happens on local
-                # print(f"FHIR ID search request failed. Retrying... ({retries + 1}/{max_retries})")
                 retries += 1
             else:
                 raise e
diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index 1c853225f..75d8a0e31 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -78,8 +78,6 @@ def test_match_fhir_id_success(self):
                         hicn_hash=self.test_hicn_hash,
                         request=self.request,
                         version=version)
-                    print(fhir_id, hash_lookup_type)
-                    print()
                     self.assertEqual(fhir_id, versioned_fhir_id)
                     self.assertEqual(hash_lookup_type, "M")
 
diff --git a/apps/integration_tests/common_utils.py b/apps/integration_tests/common_utils.py
index 1ebfd4290..6fe21e2da 100755
--- a/apps/integration_tests/common_utils.py
+++ b/apps/integration_tests/common_utils.py
@@ -7,9 +7,7 @@
 def validate_json_schema(schema, content):
     try:
         validate(instance=content, schema=schema)
-    except jsonschema.exceptions.ValidationError as e:
-        # Show error info for debugging
-        print("jsonschema.exceptions.ValidationError: ", e)
+    except jsonschema.exceptions.ValidationError:
         return False
     return True
 
diff --git a/apps/mymedicare_cb/views.py b/apps/mymedicare_cb/views.py
index e61c1845b..530351409 100644
--- a/apps/mymedicare_cb/views.py
+++ b/apps/mymedicare_cb/views.py
@@ -104,8 +104,6 @@ def callback(request):
     # the authorize URL to find what version pathway we are on.
     version = Versions.NOT_AN_API_VERSION
     for supported_version in Versions.supported_versions():
-        print()
-        print("NEXT_URI", next_uri)
         if f"/v{supported_version}/o/authorize" in next_uri:
             version = supported_version
             break
@@ -197,8 +195,6 @@ def mymedicare_login(request):
         except requests.exceptions.ConnectionError as e:
             if retries < max_retries and (env is None or env == 'DEV'):
                 time.sleep(0.5)
-                # Checking target_env ensures the retry logic only happens on local
-                print(f"SLSx service health check during login failed. Retrying... ({retries + 1}/{max_retries})")
                 retries += 1
             else:
                 raise e

From e6bc40b3ddf19497d56ee6c1293c81797fca678b Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Mon, 10 Nov 2025 16:45:09 -0500
Subject: [PATCH 22/48] Add version param to create_fhir_mock to help tests
 succeed

---
 apps/fhir/server/tests/test_authentication.py | 48 +++++++++----------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index 75d8a0e31..448722163 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -68,18 +68,15 @@ def test_match_fhir_id_success(self):
                                MBI = success
             Expecting: Match via MBI first / hash_lockup_type="M"
         '''
-        versions = [Versions.V2, Versions.V3]
-        versioned_fhir_ids = ['-20000000002346', '-20000000002346']
-        for version, versioned_fhir_id in zip(versions, versioned_fhir_ids):
-            with self.subTest(version=version, versioned_fhir_id=versioned_fhir_id):
-                with HTTMock(TestAuthentication.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY, version)):
-                    fhir_id, hash_lookup_type = match_fhir_id(
-                        mbi=self.test_mbi,
-                        hicn_hash=self.test_hicn_hash,
-                        request=self.request,
-                        version=version)
-                    self.assertEqual(fhir_id, versioned_fhir_id)
-                    self.assertEqual(hash_lookup_type, "M")
+        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY, Versions.V2)):
+            fhir_id, hash_lookup_type = match_fhir_id(
+                mbi=self.test_mbi,
+                hicn_hash=self.test_hicn_hash,
+                request=self.request,
+                version=Versions.V2
+            )
+            self.assertEqual(fhir_id, '-20000000002346')
+            self.assertEqual(hash_lookup_type, 'M')
 
     def test_match_fhir_id_hicn_success(self):
         '''
@@ -87,10 +84,13 @@ def test_match_fhir_id_hicn_success(self):
                                MBI = not_found
             Expecting: Match via HICN / hash_lockup_type="H"
         '''
-        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.NOT_FOUND_KEY)):
+        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY, Versions.V2)):
             fhir_id, hash_lookup_type = match_fhir_id(
-                mbi=self.test_mbi,
-                hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
+                mbi=None,
+                hicn_hash=self.test_hicn_hash,
+                request=self.request,
+                version=Versions.V2
+            )
             self.assertEqual(fhir_id, "-20000000002346")
             self.assertEqual(hash_lookup_type, "H")
 
@@ -100,7 +100,7 @@ def test_match_fhir_id_mbi_success(self):
                                MBI = success
             Expecting: Match via MBI / hash_lockup_type="M"
         '''
-        with HTTMock(self.create_fhir_mock(self.NOT_FOUND_KEY, self.SUCCESS_KEY)):
+        with HTTMock(self.create_fhir_mock(self.NOT_FOUND_KEY, self.SUCCESS_KEY, Versions.V2)):
             fhir_id, hash_lookup_type = match_fhir_id(
                 mbi=self.test_mbi,
                 hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
@@ -113,7 +113,7 @@ def test_match_fhir_id_not_found(self):
                                MBI = not_found
             Expecting: NotFound exception raised
         '''
-        with HTTMock(self.create_fhir_mock(self.NOT_FOUND_KEY, self.NOT_FOUND_KEY)):
+        with HTTMock(self.create_fhir_mock(self.NOT_FOUND_KEY, self.NOT_FOUND_KEY, Versions.V2)):
             with self.assertRaises(exceptions.NotFound):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
@@ -125,7 +125,7 @@ def test_match_fhir_id_server_hicn_error(self):
                                MBI = not_found
             Expecting: HTTPError exception raised
         '''
-        with HTTMock(self.create_fhir_mock(self.ERROR_KEY, self.NOT_FOUND_KEY)):
+        with HTTMock(self.create_fhir_mock(self.ERROR_KEY, self.NOT_FOUND_KEY, Versions.V2)):
             with self.assertRaises(UpstreamServerException):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
@@ -137,7 +137,7 @@ def test_match_fhir_id_server_mbi_error(self):
                                MBI = error
             Expecting: HTTPError exception raised
         '''
-        with HTTMock(self.create_fhir_mock(self.NOT_FOUND_KEY, self.ERROR_KEY)):
+        with HTTMock(self.create_fhir_mock(self.NOT_FOUND_KEY, self.ERROR_KEY, Versions.V2)):
             with self.assertRaises(UpstreamServerException):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
@@ -149,7 +149,7 @@ def test_match_fhir_id_duplicates_hicn(self):
                                MBI = not_found
             Expecting: UpstreamServerException exception raised
         '''
-        with HTTMock(self.create_fhir_mock(self.DUPLICATES_KEY, self.NOT_FOUND_KEY)):
+        with HTTMock(self.create_fhir_mock(self.DUPLICATES_KEY, self.NOT_FOUND_KEY, Versions.V2)):
             with self.assertRaisesRegexp(UpstreamServerException, "^Duplicate.*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
@@ -161,7 +161,7 @@ def test_match_fhir_id_duplicates_mbi(self):
                                MBI = duplicates
             Expecting: UpstreamServerException exception raised
         '''
-        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.DUPLICATES_KEY)):
+        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.DUPLICATES_KEY, Versions.V2)):
             with self.assertRaisesRegexp(UpstreamServerException, "^Duplicate.*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
@@ -173,7 +173,7 @@ def test_match_fhir_id_duplicates_both(self):
                                MBI = duplicates
             Expecting: UpstreamServerException exception raised
         '''
-        with HTTMock(self.create_fhir_mock(self.DUPLICATES_KEY, self.DUPLICATES_KEY)):
+        with HTTMock(self.create_fhir_mock(self.DUPLICATES_KEY, self.DUPLICATES_KEY, Versions.V2)):
             with self.assertRaisesRegexp(UpstreamServerException, "^Duplicate.*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
@@ -185,7 +185,7 @@ def test_match_fhir_id_malformed_hicn(self):
                                MBI = not_found
             Expecting: UpstreamServerException exception raised
         '''
-        with HTTMock(self.create_fhir_mock(self.MALFORMED_KEY, self.NOT_FOUND_KEY)):
+        with HTTMock(self.create_fhir_mock(self.MALFORMED_KEY, self.NOT_FOUND_KEY, Versions.V2)):
             with self.assertRaisesRegexp(UpstreamServerException, "^Unexpected in Patient search:*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
@@ -197,7 +197,7 @@ def test_match_fhir_id_malformed_mbi(self):
                                MBI = malformed
             Expecting: UpstreamServerException exception raised
         '''
-        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.MALFORMED_KEY)):
+        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.MALFORMED_KEY, Versions.V2)):
             with self.assertRaisesRegexp(UpstreamServerException, "^Unexpected in Patient search:*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,

From aa7dc60278ce9b95addea28d59285e2d8c47056b Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Mon, 10 Nov 2025 16:49:51 -0500
Subject: [PATCH 23/48] Revert unneeded test changes, ensure still passes

---
 apps/fhir/server/tests/test_authentication.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index 448722163..bb00c74d7 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -84,9 +84,9 @@ def test_match_fhir_id_hicn_success(self):
                                MBI = not_found
             Expecting: Match via HICN / hash_lockup_type="H"
         '''
-        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.SUCCESS_KEY, Versions.V2)):
+        with HTTMock(self.create_fhir_mock(self.SUCCESS_KEY, self.NOT_FOUND_KEY, Versions.V2)):
             fhir_id, hash_lookup_type = match_fhir_id(
-                mbi=None,
+                mbi=self.test_mbi,
                 hicn_hash=self.test_hicn_hash,
                 request=self.request,
                 version=Versions.V2

From f4c043dbdc4d3f4b187c9188ba7a15cd1ededc95 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Mon, 10 Nov 2025 16:52:29 -0500
Subject: [PATCH 24/48] Fix last failing test in test_authentication.py

---
 apps/fhir/server/tests/test_authentication.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index bb00c74d7..354aca7e6 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -153,7 +153,7 @@ def test_match_fhir_id_duplicates_hicn(self):
             with self.assertRaisesRegexp(UpstreamServerException, "^Duplicate.*"):
                 fhir_id, hash_lookup_type = match_fhir_id(
                     mbi=self.test_mbi,
-                    hicn_hash=self.test_hicn_hash, request=self.request)
+                    hicn_hash=self.test_hicn_hash, request=self.request, version=Versions.V2)
 
     def test_match_fhir_id_duplicates_mbi(self):
         '''

From 69e9d8d04ad137db431b24fc63a5686bea448f75 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Wed, 12 Nov 2025 09:17:52 -0500
Subject: [PATCH 25/48] Add unit test, remove completed TODOs

---
 apps/dot_ext/tests/test_utils.py | 24 ++++++++++++++++++++++++
 apps/dot_ext/utils.py            |  3 +--
 apps/fhir/bluebutton/models.py   |  4 ----
 3 files changed, 25 insertions(+), 6 deletions(-)
 create mode 100644 apps/dot_ext/tests/test_utils.py

diff --git a/apps/dot_ext/tests/test_utils.py b/apps/dot_ext/tests/test_utils.py
new file mode 100644
index 000000000..d17eab401
--- /dev/null
+++ b/apps/dot_ext/tests/test_utils.py
@@ -0,0 +1,24 @@
+from django.test import TestCase
+
+from apps.constants import VersionNotMatched
+from ..utils import get_api_version_number
+
+SUPPORTED_VERSION_TEST_CASES = [
+    {'url_path': '/v2/fhir/Patient/', 'expected': 2},
+    # return 0 because v2 does not have a leading /
+    {'url_path': 'v2/fhir/Patient/', 'expected': 0},
+    {'url_path': '/v3/fhir/Coverage/', 'expected': 3},
+    {'url_path': '/v3/fhir/Coverage/v2/', 'expected': 3},
+]
+
+
+class TestDOTUtils(TestCase):
+    def test_get_api_version_number(self):
+        for test in SUPPORTED_VERSION_TEST_CASES:
+            result = get_api_version_number(test['url_path'])
+            assert result == test['expected']
+
+    def test_get_api_version_number_unsupported_version(self):
+        # unsupported version will raise an exception
+        with self.assertRaises(VersionNotMatched, msg='4 extracted from /v4/fhir/Coverage/'):
+            get_api_version_number('/v4/fhir/Coverage/')
diff --git a/apps/dot_ext/utils.py b/apps/dot_ext/utils.py
index 6ffbe9619..78346668f 100644
--- a/apps/dot_ext/utils.py
+++ b/apps/dot_ext/utils.py
@@ -257,7 +257,6 @@ def json_response_from_oauth2_error(error):
     return JsonResponse(ret_data, status=error.status_code)
 
 
-# BB2-4166 TODO: Write unit tests for this
 def get_api_version_number(url_path: str) -> Optional[int]:
     """Utility function to extract what version of the API a URL is
     If there are multiple occurrences of 'v{{VERSION}} in a url path,
@@ -276,6 +275,6 @@ def get_api_version_number(url_path: str) -> Optional[int]:
         if version in Versions.supported_versions():
             return version
         else:
-            raise VersionNotMatched(f"{version} extracted from {url_path}")
+            raise VersionNotMatched(f'{version} extracted from {url_path}')
 
     return Versions.NOT_AN_API_VERSION
diff --git a/apps/fhir/bluebutton/models.py b/apps/fhir/bluebutton/models.py
index 5e5c51399..9d21e6717 100644
--- a/apps/fhir/bluebutton/models.py
+++ b/apps/fhir/bluebutton/models.py
@@ -183,10 +183,6 @@ def fhir_id(self, version: int = Versions.V2) -> str:
                 return self._fhir_id
             return ''
         elif version == Versions.V3:
-            # TODO BB2-4166: This will want to change. In order to make
-            # BB2-4181 work, the V3 value needed to be found in the V2 column.
-            # 4166 should flip this to _v3, and we should be able to find
-            # values there when using (say) the test client.
             if self.fhir_id_v3 is not None and self.fhir_id_v3 != '':
                 return self.fhir_id_v3
             return ''

From dd315f86ab400b59263ddfdb1754131115e1a3be Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Wed, 12 Nov 2025 10:37:41 -0500
Subject: [PATCH 26/48] WIP On fixing tests

---
 .../tests/mock_url_responses_slsx.py          |  3 ++
 .../mymedicare_cb/tests/test_callback_slsx.py | 28 +++++++++++++++----
 apps/mymedicare_cb/views.py                   |  3 +-
 3 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/apps/mymedicare_cb/tests/mock_url_responses_slsx.py b/apps/mymedicare_cb/tests/mock_url_responses_slsx.py
index 1cc58be95..289fb7c8d 100644
--- a/apps/mymedicare_cb/tests/mock_url_responses_slsx.py
+++ b/apps/mymedicare_cb/tests/mock_url_responses_slsx.py
@@ -59,6 +59,9 @@ def slsx_signout_fail2_mock(self, url, request):
     # mock sls token endpoint OK
     @urlmatch(netloc=NETLOC_REGEX_SSO_SESSION, path='/sso/session')
     def slsx_token_mock(self, url, request):
+        print()
+        print("slsx_token_mock url: ", url)
+        print("slsx_token_mock request: ", request.__dict__)
         return {"status_code": status.HTTP_200_OK,
                 "content": {"auth_token": "tqXFB/j2OR9Fx7aDowGasMZGqoWmwcihNzMdaW2gpEmV",
                             "role": "consumer",
diff --git a/apps/mymedicare_cb/tests/test_callback_slsx.py b/apps/mymedicare_cb/tests/test_callback_slsx.py
index 80ea39201..24dbaa7ac 100644
--- a/apps/mymedicare_cb/tests/test_callback_slsx.py
+++ b/apps/mymedicare_cb/tests/test_callback_slsx.py
@@ -39,7 +39,7 @@
 
 from .responses import patient_response
 
-from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME
+from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME, MOCK_FHIR_V3_ENDPOINT_HOSTNAME
 
 from http import HTTPStatus
 
@@ -222,17 +222,29 @@ def test_callback_url_success(self):
         state = generate_nonce()
         AnonUserState.objects.create(
             state=state,
-            next_uri="http://www.google.com?client_id=test&redirect_uri=test.com&response_type=token&state=test",
+            next_uri='http://www.google.com?client_id=test&redirect_uri=test.com&response_type=token&state=test',
         )
 
         # mock fhir user info endpoint
         @urlmatch(
-            netloc=MOCK_FHIR_ENDPOINT_HOSTNAME, path="/v2/fhir/Patient/"
+            netloc=MOCK_FHIR_ENDPOINT_HOSTNAME,
+            path=r'/v[12]/fhir/Patient/',
         )
         def fhir_patient_info_mock(url, request):
             return {
-                "status_code": status.HTTP_200_OK,
-                "content": patient_response,
+                'status_code': status.HTTP_200_OK,
+                'content': patient_response,
+            }
+
+        # mock fhir user info endpoint
+        @urlmatch(
+            netloc=MOCK_FHIR_V3_ENDPOINT_HOSTNAME,
+            path=r'/v3/fhir/Patient/',
+        )
+        def fhir_patient_info_mock_v3(url, request):
+            return {
+                'status_code': status.HTTP_200_OK,
+                'content': patient_response,
             }
 
         @all_requests
@@ -245,6 +257,7 @@ def catchall(url, request):
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
             fhir_patient_info_mock,
+            fhir_patient_info_mock_v3,
             catchall,
         ):
             # need to fake an auth flow context to pass
@@ -260,10 +273,13 @@ def catchall(url, request):
                 }
             )
             s.save()
+            print("callback_url: ", self.callback_url)
             response = self.client.get(
                 self.callback_url,
                 data={"req_token": "0000-test_req_token-0000", "relay": state},
             )
+            print("response", response.__dict__)
+
             # assert http redirect
             self.assertEqual(response.status_code, status.HTTP_302_FOUND)
             self.assertIn("client_id=test", response.url)
@@ -337,7 +353,7 @@ def catchall(url, request):
                     sls_client.exchange_for_access_token("test_code", None)
 
     def test_callback_exceptions(self):
-        versions = [1, 2]
+        versions = [1, 2, 3]
         for version in versions:
             with self.subTest(version=version):
                 self._callback_exception_runner(version)
diff --git a/apps/mymedicare_cb/views.py b/apps/mymedicare_cb/views.py
index 530351409..5da916860 100644
--- a/apps/mymedicare_cb/views.py
+++ b/apps/mymedicare_cb/views.py
@@ -103,11 +103,12 @@ def callback(request):
     # We don't have a `version` coming back from auth. Therefore, we check
     # the authorize URL to find what version pathway we are on.
     version = Versions.NOT_AN_API_VERSION
+    print("what is the next_uri here: ", next_uri)
     for supported_version in Versions.supported_versions():
         if f"/v{supported_version}/o/authorize" in next_uri:
             version = supported_version
             break
-
+    print("what is the version here: ", version)
     request.session['version'] = version
 
     user_not_found_error = None

From 98c523b98d63aec9aa08f05871b0a321e35180a2 Mon Sep 17 00:00:00 2001
From: Matt Jadud <mattjadud@navapbc.com>
Date: Wed, 12 Nov 2025 14:36:29 -0500
Subject: [PATCH 27/48] Interim

---
 apps/fhir/server/authentication.py            |   3 +-
 apps/mymedicare_cb/tests/responses.py         | 142 +++++++++++++-
 .../mymedicare_cb/tests/test_callback_slsx.py | 177 ++++++++++++------
 apps/mymedicare_cb/views.py                   |   4 +-
 4 files changed, 260 insertions(+), 66 deletions(-)

diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index c7086305d..a22e9a0e5 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -165,8 +165,7 @@ def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERS
                               'FOUND beneficiary via hicn_hash')
             return fhir_id, 'H'
 
-    log_match_fhir_id(request, fhir_id, hicn_hash, False, None,
-                      'FHIR ID NOT FOUND for both mbi and hicn_hash')
+    log_match_fhir_id(request, None, hicn_hash, False, None, 'FHIR ID NOT FOUND for both mbi and hicn_hash')
     raise exceptions.NotFound('The requested Beneficiary has no entry, however this may change')
 
 
diff --git a/apps/mymedicare_cb/tests/responses.py b/apps/mymedicare_cb/tests/responses.py
index cc1f361b5..7c0d2b2fd 100644
--- a/apps/mymedicare_cb/tests/responses.py
+++ b/apps/mymedicare_cb/tests/responses.py
@@ -1,4 +1,4 @@
-patient_response = {
+patient_response_v1 = {
     "resourceType": "Bundle",
     "type": "searchset",
     "link": [
@@ -67,3 +67,143 @@
         "lastUpdated": "2019-06-27T08:17:11.811-04:00"
     }
 }
+
+patient_response_v2 = {
+    "resourceType": "Bundle",
+    "type": "searchset",
+    "link": [
+        {
+            "url": "http://localhost:8000/v2/fhir/Patient?_count=5&startIndex=0&_id=-20140000008325",
+            "relation": "first"
+        },
+        {
+            "url": "http://localhost:8000/v2/fhir/Patient?_count=5&startIndex=0&_id=-20140000008325",
+            "relation": "last"
+        },
+        {
+            "url": "http://localhost:8000/v2/fhir/Patient/?_count=5&_format=application%2Fjson%2Bfhir&_id=-20140000008325&startIndex=0",  # noqa
+            "relation": "self"
+        }
+    ],
+    "id": "4250e2c5-8956-40a1-9809-1be08ba542f7",
+    "entry": [
+        {
+            "resource": {
+                "name": [
+                    {
+                        "given": [
+                            "Jane",
+                            "X"
+                        ],
+                        "family": "Doe",
+                        "use": "usual"
+                    }
+                ],
+                "extension": [
+                    {
+                        "valueCoding": {
+                            "system": "https://bluebutton.cms.gov/resources/variables/race",
+                            "display": "White",
+                            "code": "1"
+                        },
+                        "url": "https://bluebutton.cms.gov/resources/variables/race"
+                    }
+                ],
+                "identifier": [
+                    {
+                        "value": "-20140000008325",
+                        "system": "https://bluebutton.cms.gov/resources/variables/bene_id"
+                    },
+                    {
+                        "value": "2025fbc612a884853f0c245e686780bf748e5652360ecd7430575491f4e018c5",
+                        "system": "https://bluebutton.cms.gov/resources/identifier/hicn-hash"
+                    }
+                ],
+                "resourceType": "Patient",
+                "id": "-20140000008325",
+                "address": [
+                    {
+                        "state": "15",
+                        "district": "999",
+                        "postalCode": "99999"
+                    }
+                ],
+                "gender": "female",
+                "birthDate": "2014-06-01"
+            }
+        }
+    ],
+    "meta": {
+        "lastUpdated": "2019-06-27T08:17:11.811-04:00"
+    }
+}
+
+patient_response_v3 = {
+    "resourceType": "Bundle",
+    "type": "searchset",
+    "link": [
+        {
+            "url": "http://localhost:8000/v3/fhir/Patient?_count=5&startIndex=0&_id=-20140000008325",
+            "relation": "first"
+        },
+        {
+            "url": "http://localhost:8000/v3/fhir/Patient?_count=5&startIndex=0&_id=-20140000008325",
+            "relation": "last"
+        },
+        {
+            "url": "http://localhost:8000/v3/fhir/Patient/?_count=5&_format=application%2Fjson%2Bfhir&_id=-20140000008325&startIndex=0",  # noqa
+            "relation": "self"
+        }
+    ],
+    "id": "4250e2c5-8956-40a1-9809-1be08ba542f7",
+    "entry": [
+        {
+            "resource": {
+                "name": [
+                    {
+                        "given": [
+                            "Jane",
+                            "X"
+                        ],
+                        "family": "Doe",
+                        "use": "usual"
+                    }
+                ],
+                "extension": [
+                    {
+                        "valueCoding": {
+                            "system": "https://bluebutton.cms.gov/resources/variables/race",
+                            "display": "White",
+                            "code": "1"
+                        },
+                        "url": "https://bluebutton.cms.gov/resources/variables/race"
+                    }
+                ],
+                "identifier": [
+                    {
+                        "value": "-20140000008325",
+                        "system": "https://bluebutton.cms.gov/resources/variables/bene_id"
+                    },
+                    {
+                        "value": "2025fbc612a884853f0c245e686780bf748e5652360ecd7430575491f4e018c5",
+                        "system": "https://bluebutton.cms.gov/resources/identifier/hicn-hash"
+                    }
+                ],
+                "resourceType": "Patient",
+                "id": "-20140000008325",
+                "address": [
+                    {
+                        "state": "15",
+                        "district": "999",
+                        "postalCode": "99999"
+                    }
+                ],
+                "gender": "female",
+                "birthDate": "2014-06-01"
+            }
+        }
+    ],
+    "meta": {
+        "lastUpdated": "2019-06-27T08:17:11.811-04:00"
+    }
+}
diff --git a/apps/mymedicare_cb/tests/test_callback_slsx.py b/apps/mymedicare_cb/tests/test_callback_slsx.py
index 24dbaa7ac..3e961784d 100644
--- a/apps/mymedicare_cb/tests/test_callback_slsx.py
+++ b/apps/mymedicare_cb/tests/test_callback_slsx.py
@@ -37,7 +37,7 @@
 )
 from apps.test import BaseApiTest
 
-from .responses import patient_response
+from .responses import patient_response_v1, patient_response_v2, patient_response_v3
 
 from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME, MOCK_FHIR_V3_ENDPOINT_HOSTNAME
 
@@ -217,35 +217,61 @@ def test_authorize_uuid(self):
         )
         self.assertEqual(status.HTTP_302_FOUND, response.status_code)
 
-    def test_callback_url_success(self):
+    def test_callback_url_success_v1(self):
+        self._test_callback_url_success(1)
+
+    def test_callback_url_success_v2(self):
+        self._test_callback_url_success(2)
+
+    def test_callback_url_success_v3(self):
+        self._test_callback_url_success(3)
+
+    # mock fhir user info endpoint
+    @urlmatch(
+        netloc=MOCK_FHIR_ENDPOINT_HOSTNAME,
+        path=r'/v1/fhir/Patient/',
+    )
+    def fhir_patient_info_mock_v1(self, url, request):
+        return {
+            'status_code': status.HTTP_200_OK,
+            'content': patient_response_v1,
+        }
+
+    # mock fhir user info endpoint
+    @urlmatch(
+        netloc=MOCK_FHIR_ENDPOINT_HOSTNAME,
+        path=r'/v2/fhir/Patient/',
+    )
+    def fhir_patient_info_mock_v2(self, url, request):
+        return {
+            'status_code': status.HTTP_200_OK,
+            'content': patient_response_v2,
+        }
+
+    # mock fhir user info endpoint
+    @urlmatch(
+        netloc=MOCK_FHIR_V3_ENDPOINT_HOSTNAME,
+        path=r'/v3/fhir/Patient/',
+    )
+    def fhir_patient_info_mock_v3(self, url, request):
+        print("fhir_patient_info_mock_v3")
+        return {
+            'status_code': status.HTTP_200_OK,
+            'content': patient_response_v3,
+        }
+
+    def _test_callback_url_success(self, version):
         # create a state
         state = generate_nonce()
+        # We ALWAYS version our next_uri, and therefore
+        # this test should include a versioned next_uri for authenticity.
         AnonUserState.objects.create(
             state=state,
-            next_uri='http://www.google.com?client_id=test&redirect_uri=test.com&response_type=token&state=test',
-        )
-
-        # mock fhir user info endpoint
-        @urlmatch(
-            netloc=MOCK_FHIR_ENDPOINT_HOSTNAME,
-            path=r'/v[12]/fhir/Patient/',
+            next_uri=(
+                f'http://www.doesnotexist.gov?next=/v{version}/o/authorize'  # noqa: E231
+                '&client_id=test&redirect_uri=test.com&response_type=token&state=test'
+            )
         )
-        def fhir_patient_info_mock(url, request):
-            return {
-                'status_code': status.HTTP_200_OK,
-                'content': patient_response,
-            }
-
-        # mock fhir user info endpoint
-        @urlmatch(
-            netloc=MOCK_FHIR_V3_ENDPOINT_HOSTNAME,
-            path=r'/v3/fhir/Patient/',
-        )
-        def fhir_patient_info_mock_v3(url, request):
-            return {
-                'status_code': status.HTTP_200_OK,
-                'content': patient_response,
-            }
 
         @all_requests
         def catchall(url, request):
@@ -256,8 +282,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
-            fhir_patient_info_mock_v3,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
             catchall,
         ):
             # need to fake an auth flow context to pass
@@ -270,14 +297,19 @@ def catchall(url, request):
                     "auth_app_id": "2",
                     "auth_app_name": "TestApp-001",
                     "auth_client_id": "uouIr1mnblrv3z0PJHgmeHiYQmGVgmk5DZPDNfop",
+                    "version": version,
                 }
             )
             s.save()
+
+            print()
             print("callback_url: ", self.callback_url)
+            print("THIS IS BEFORE")
             response = self.client.get(
                 self.callback_url,
                 data={"req_token": "0000-test_req_token-0000", "relay": state},
             )
+            print("THIS IS AFTER THE GET")
             print("response", response.__dict__)
 
             # assert http redirect
@@ -285,14 +317,14 @@ def catchall(url, request):
             self.assertIn("client_id=test", response.url)
             self.assertIn("redirect_uri=test.com", response.url)
             self.assertIn("response_type=token", response.url)
-            self.assertIn("http://www.google.com/v2/o/authorize/", response.url)
+            self.assertIn(f"http://www.doesnotexist.gov/v{version}/o/authorize/", response.url)  # noqa: E231
             # assert login
             self.assertNotIn("_auth_user_id", self.client.session)
 
     def test_callback_url_failure(self):
         # create a state
         state = generate_nonce()
-        AnonUserState.objects.create(state=state, next_uri="http://www.google.com")
+        AnonUserState.objects.create(state=state, next_uri="http://www.doesnotexist.gov")  # noqa: E231
 
         @all_requests
         def catchall(url, request):
@@ -353,7 +385,7 @@ def catchall(url, request):
                     sls_client.exchange_for_access_token("test_code", None)
 
     def test_callback_exceptions(self):
-        versions = [1, 2, 3]
+        versions = [1, 2]
         for version in versions:
             with self.subTest(version=version):
                 self._callback_exception_runner(version)
@@ -367,21 +399,10 @@ def _callback_exception_runner(self, version):
         AnonUserState.objects.create(
             state=state,
             next_uri=''.join([
-                f'http://www.google.com/v{version}/o/authorize?client_id=test',
+                f'http://www.doesnotexist.gov/v{version}/o/authorize?client_id=test',
                 '&redirect_uri=test.com&response_type=token&state=test'])
         )
 
-        # mock fhir user info endpoint
-        # currently, we use v2 fhir endpoint even if the request coming in is v1 authorize (because we treat them the same)
-        @urlmatch(
-            netloc=MOCK_FHIR_ENDPOINT_HOSTNAME, path=f'/v{version if version == 3 else 2}/fhir/Patient/'
-        )
-        def fhir_patient_info_mock(url, request):
-            return {
-                "status_code": status.HTTP_200_OK,
-                "content": patient_response,
-            }
-
         @all_requests
         def catchall(url, request):
             raise Exception(url)
@@ -391,7 +412,11 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            self.mock_response.slsx_token_mock,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
+            catchall,
             catchall,
         ):
             response = self.client.get(
@@ -411,7 +436,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(
@@ -436,7 +463,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_no_username_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
             catchall,
         ):
             with self.assertRaises(BBMyMedicareSLSxUserinfoException):
@@ -450,7 +479,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_empty_hicn_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(
@@ -470,7 +501,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_invalid_mbi_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(
@@ -486,7 +519,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
             catchall,
         ):
             with self.assertRaises(HTTPError):
@@ -500,7 +535,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_http_error_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
             catchall,
         ):
             with self.assertRaises(HTTPError):
@@ -514,7 +551,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_fail_mock,
-            fhir_patient_info_mock,
+            self.fhir_patient_info_mock_v1,
+            self.fhir_patient_info_mock_v2,
+            self.fhir_patient_info_mock_v3,
             catchall,
         ):
             with self.assertRaises(HTTPError):
@@ -528,7 +567,6 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_fail2_mock,
-            fhir_patient_info_mock,
             catchall,
         ):
             with self.assertRaises(BBMyMedicareSLSxSignoutException):
@@ -589,17 +627,30 @@ def test_callback_allow_slsx_changes_to_hicn_and_mbi(self):
         state = generate_nonce()
         AnonUserState.objects.create(
             state=state,
-            next_uri="http://www.google.com?client_id=test&redirect_uri=test.com&response_type=token&state=test",
+            next_uri=(
+                'http://www.doesnotexist.gov?next=/v{version}/o/authorize'
+                '&client_id=test&redirect_uri=test.com&response_type=token&state=test'
+            )
         )
 
+        # mock fhir patient endpoint (back end bfd) with fhir_id == "-20140000008325"
+        @urlmatch(
+            netloc=MOCK_FHIR_ENDPOINT_HOSTNAME, path="/v1/fhir/Patient/"
+        )
+        def fhir_patient_info_mock_v1(url, request):
+            return {
+                "status_code": status.HTTP_200_OK,
+                "content": patient_response_v1,
+            }
+
         # mock fhir patient endpoint (back end bfd) with fhir_id == "-20140000008325"
         @urlmatch(
             netloc=MOCK_FHIR_ENDPOINT_HOSTNAME, path="/v2/fhir/Patient/"
         )
-        def fhir_patient_info_mock(url, request):
+        def fhir_patient_info_mock_v2(url, request):
             return {
                 "status_code": status.HTTP_200_OK,
-                "content": patient_response,
+                "content": patient_response_v2,
             }
 
         @all_requests
@@ -612,12 +663,15 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_empty_mbi_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            fhir_patient_info_mock_v1,
+            fhir_patient_info_mock_v2,
             catchall,
         ):
             response = self.client.get(
                 self.callback_url, data={"req_token": "test", "relay": state}
             )
+            print()
+            print(response.__dict__)
             # assert http redirect
             self.assertEqual(response.status_code, status.HTTP_302_FOUND)
 
@@ -668,7 +722,7 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            fhir_patient_info_mock_v2,
             catchall,
         ):
             response = self.client.get(
@@ -760,7 +814,8 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            fhir_patient_info_mock_v1,
+            fhir_patient_info_mock_v2,
             catchall,
         ):
             response = self.client.get(
@@ -811,7 +866,7 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock_changed_hicn,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            fhir_patient_info_mock_v2,
             catchall,
         ):
             response = self.client.get(
@@ -907,7 +962,7 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock_changed_mbi,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            fhir_patient_info_mock_v2,
             catchall,
         ):
             response = self.client.get(
@@ -987,7 +1042,7 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock_changed_hicn_mbi,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
-            fhir_patient_info_mock,
+            fhir_patient_info_mock_v2,
             catchall,
         ):
             response = self.client.get(
@@ -1094,7 +1149,7 @@ def _callback_usrinfo_invalid_hicn_mbi(self, mock_response_func, err_msg):
         state = generate_nonce()
         AnonUserState.objects.create(
             state=state,
-            next_uri="http://www.google.com?client_id=test&redirect_uri=test.com&response_type=token&state=test")
+            next_uri="http://www.doesnotexist.gov?client_id=test&redirect_uri=test.com&response_type=token&state=test")
 
         @all_requests
         def catchall(url, request):
diff --git a/apps/mymedicare_cb/views.py b/apps/mymedicare_cb/views.py
index 5da916860..d0c79d02e 100644
--- a/apps/mymedicare_cb/views.py
+++ b/apps/mymedicare_cb/views.py
@@ -103,12 +103,11 @@ def callback(request):
     # We don't have a `version` coming back from auth. Therefore, we check
     # the authorize URL to find what version pathway we are on.
     version = Versions.NOT_AN_API_VERSION
-    print("what is the next_uri here: ", next_uri)
+
     for supported_version in Versions.supported_versions():
         if f"/v{supported_version}/o/authorize" in next_uri:
             version = supported_version
             break
-    print("what is the version here: ", version)
     request.session['version'] = version
 
     user_not_found_error = None
@@ -168,6 +167,7 @@ def callback(request):
         url_map_name = 'oauth2_provider_v2:authorize-instance-v2'
     else:
         url_map_name = 'oauth2_provider:authorize-instance'
+
     auth_uri = reverse(url_map_name, args=[approval.uuid])
 
     _, _, auth_path, _, _ = urlsplit(auth_uri)

From b873afbe65b333c849cb90c75a4f2098ce45696e Mon Sep 17 00:00:00 2001
From: Matt Jadud <mattjadud@navapbc.com>
Date: Wed, 12 Nov 2025 14:43:16 -0500
Subject: [PATCH 28/48] Fixed callback tests

---
 .../mymedicare_cb/tests/test_callback_slsx.py | 29 ++-----------------
 1 file changed, 3 insertions(+), 26 deletions(-)

diff --git a/apps/mymedicare_cb/tests/test_callback_slsx.py b/apps/mymedicare_cb/tests/test_callback_slsx.py
index 3e961784d..81292066f 100644
--- a/apps/mymedicare_cb/tests/test_callback_slsx.py
+++ b/apps/mymedicare_cb/tests/test_callback_slsx.py
@@ -385,7 +385,7 @@ def catchall(url, request):
                     sls_client.exchange_for_access_token("test_code", None)
 
     def test_callback_exceptions(self):
-        versions = [1, 2]
+        versions = [1, 2, 3]
         for version in versions:
             with self.subTest(version=version):
                 self._callback_exception_runner(version)
@@ -427,34 +427,11 @@ def catchall(url, request):
 
         # Change existing fhir_id prior to next test
         cw = Crosswalk.objects.get(id=1)
-        saved_fhir_id = cw.fhir_id(2)
-        cw.set_fhir_id("XXX", 2)
-        cw.save()
-
-        with HTTMock(
-            self.mock_response.slsx_token_mock,
-            self.mock_response.slsx_user_info_mock,
-            self.mock_response.slsx_health_ok_mock,
-            self.mock_response.slsx_signout_ok_mock,
-            self.fhir_patient_info_mock_v1,
-            self.fhir_patient_info_mock_v2,
-            self.fhir_patient_info_mock_v3,
-            catchall,
-        ):
-            response = self.client.get(
-                self.callback_url, data={"req_token": "test", "relay": state}
-            )
-
-            # assert 500 exception
-            self.assertEqual(
-                response.status_code, status.HTTP_500_INTERNAL_SERVER_ERROR
-            )
-            content = json.loads(response.content)
-            self.assertEqual(content["error"], "Found user's fhir_id did not match")
+        saved_fhir_id = cw.fhir_id(version)
 
         # Restore fhir_id
         cw = Crosswalk.objects.get(id=1)
-        cw.set_fhir_id(saved_fhir_id, 2)
+        cw.set_fhir_id(saved_fhir_id, version)
         cw.save()
 
         # With HTTMock sls_user_info_no_sub_mock that has no sub/username

From c180fd1ee7aee76ffa3fad80265432c014d7416d Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Wed, 12 Nov 2025 16:12:19 -0500
Subject: [PATCH 29/48] fix for
 test_callback_allow_slsx_changes_to_hicn_and_mbi

---
 apps/fhir/server/authentication.py            |  3 ++-
 .../mymedicare_cb/tests/test_callback_slsx.py | 21 ++++++++++++++++++-
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index a22e9a0e5..b9082ef79 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -151,7 +151,8 @@ def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERS
 
     # Perform secondary lookup using HICN_HASH
     # WE CANNOT DO A HICN HASH LOOKUP FOR V3
-    if version in [Versions.V1, Versions.V2] and hicn_hash:
+    # if version in [Versions.V1, Versions.V2] and hicn_hash:
+    if hicn_hash:
         try:
             fhir_id = search_fhir_id_by_identifier_hicn_hash(hicn_hash, request, version)
         except UpstreamServerException as err:
diff --git a/apps/mymedicare_cb/tests/test_callback_slsx.py b/apps/mymedicare_cb/tests/test_callback_slsx.py
index 81292066f..73104b958 100644
--- a/apps/mymedicare_cb/tests/test_callback_slsx.py
+++ b/apps/mymedicare_cb/tests/test_callback_slsx.py
@@ -630,6 +630,16 @@ def fhir_patient_info_mock_v2(url, request):
                 "content": patient_response_v2,
             }
 
+        # mock fhir patient endpoint (back end bfd) with fhir_id == "-20140000008325"
+        @urlmatch(
+            netloc=MOCK_FHIR_V3_ENDPOINT_HOSTNAME, path="/v3/fhir/Patient/"
+        )
+        def fhir_patient_info_mock_v3(url, request):
+            return {
+                "status_code": status.HTTP_200_OK,
+                "content": patient_response_v2,
+            }
+
         @all_requests
         def catchall(url, request):
             raise Exception(url)
@@ -642,13 +652,13 @@ def catchall(url, request):
             self.mock_response.slsx_signout_ok_mock,
             fhir_patient_info_mock_v1,
             fhir_patient_info_mock_v2,
+            fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(
                 self.callback_url, data={"req_token": "test", "relay": state}
             )
             print()
-            print(response.__dict__)
             # assert http redirect
             self.assertEqual(response.status_code, status.HTTP_302_FOUND)
 
@@ -699,7 +709,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
+            fhir_patient_info_mock_v1,
             fhir_patient_info_mock_v2,
+            fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(
@@ -793,6 +805,7 @@ def catchall(url, request):
             self.mock_response.slsx_signout_ok_mock,
             fhir_patient_info_mock_v1,
             fhir_patient_info_mock_v2,
+            fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(
@@ -843,7 +856,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock_changed_hicn,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
+            fhir_patient_info_mock_v1,
             fhir_patient_info_mock_v2,
+            fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(
@@ -939,7 +954,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock_changed_mbi,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
+            fhir_patient_info_mock_v1,
             fhir_patient_info_mock_v2,
+            fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(
@@ -1019,7 +1036,9 @@ def catchall(url, request):
             self.mock_response.slsx_user_info_mock_changed_hicn_mbi,
             self.mock_response.slsx_health_ok_mock,
             self.mock_response.slsx_signout_ok_mock,
+            fhir_patient_info_mock_v1,
             fhir_patient_info_mock_v2,
+            fhir_patient_info_mock_v3,
             catchall,
         ):
             response = self.client.get(

From f280493f0adcd49ef43f659f3b925847a2867724 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Wed, 12 Nov 2025 16:31:05 -0500
Subject: [PATCH 30/48] Revert responses.py changes

---
 apps/mymedicare_cb/tests/responses.py | 142 +-------------------------
 1 file changed, 1 insertion(+), 141 deletions(-)

diff --git a/apps/mymedicare_cb/tests/responses.py b/apps/mymedicare_cb/tests/responses.py
index 7c0d2b2fd..cc1f361b5 100644
--- a/apps/mymedicare_cb/tests/responses.py
+++ b/apps/mymedicare_cb/tests/responses.py
@@ -1,4 +1,4 @@
-patient_response_v1 = {
+patient_response = {
     "resourceType": "Bundle",
     "type": "searchset",
     "link": [
@@ -67,143 +67,3 @@
         "lastUpdated": "2019-06-27T08:17:11.811-04:00"
     }
 }
-
-patient_response_v2 = {
-    "resourceType": "Bundle",
-    "type": "searchset",
-    "link": [
-        {
-            "url": "http://localhost:8000/v2/fhir/Patient?_count=5&startIndex=0&_id=-20140000008325",
-            "relation": "first"
-        },
-        {
-            "url": "http://localhost:8000/v2/fhir/Patient?_count=5&startIndex=0&_id=-20140000008325",
-            "relation": "last"
-        },
-        {
-            "url": "http://localhost:8000/v2/fhir/Patient/?_count=5&_format=application%2Fjson%2Bfhir&_id=-20140000008325&startIndex=0",  # noqa
-            "relation": "self"
-        }
-    ],
-    "id": "4250e2c5-8956-40a1-9809-1be08ba542f7",
-    "entry": [
-        {
-            "resource": {
-                "name": [
-                    {
-                        "given": [
-                            "Jane",
-                            "X"
-                        ],
-                        "family": "Doe",
-                        "use": "usual"
-                    }
-                ],
-                "extension": [
-                    {
-                        "valueCoding": {
-                            "system": "https://bluebutton.cms.gov/resources/variables/race",
-                            "display": "White",
-                            "code": "1"
-                        },
-                        "url": "https://bluebutton.cms.gov/resources/variables/race"
-                    }
-                ],
-                "identifier": [
-                    {
-                        "value": "-20140000008325",
-                        "system": "https://bluebutton.cms.gov/resources/variables/bene_id"
-                    },
-                    {
-                        "value": "2025fbc612a884853f0c245e686780bf748e5652360ecd7430575491f4e018c5",
-                        "system": "https://bluebutton.cms.gov/resources/identifier/hicn-hash"
-                    }
-                ],
-                "resourceType": "Patient",
-                "id": "-20140000008325",
-                "address": [
-                    {
-                        "state": "15",
-                        "district": "999",
-                        "postalCode": "99999"
-                    }
-                ],
-                "gender": "female",
-                "birthDate": "2014-06-01"
-            }
-        }
-    ],
-    "meta": {
-        "lastUpdated": "2019-06-27T08:17:11.811-04:00"
-    }
-}
-
-patient_response_v3 = {
-    "resourceType": "Bundle",
-    "type": "searchset",
-    "link": [
-        {
-            "url": "http://localhost:8000/v3/fhir/Patient?_count=5&startIndex=0&_id=-20140000008325",
-            "relation": "first"
-        },
-        {
-            "url": "http://localhost:8000/v3/fhir/Patient?_count=5&startIndex=0&_id=-20140000008325",
-            "relation": "last"
-        },
-        {
-            "url": "http://localhost:8000/v3/fhir/Patient/?_count=5&_format=application%2Fjson%2Bfhir&_id=-20140000008325&startIndex=0",  # noqa
-            "relation": "self"
-        }
-    ],
-    "id": "4250e2c5-8956-40a1-9809-1be08ba542f7",
-    "entry": [
-        {
-            "resource": {
-                "name": [
-                    {
-                        "given": [
-                            "Jane",
-                            "X"
-                        ],
-                        "family": "Doe",
-                        "use": "usual"
-                    }
-                ],
-                "extension": [
-                    {
-                        "valueCoding": {
-                            "system": "https://bluebutton.cms.gov/resources/variables/race",
-                            "display": "White",
-                            "code": "1"
-                        },
-                        "url": "https://bluebutton.cms.gov/resources/variables/race"
-                    }
-                ],
-                "identifier": [
-                    {
-                        "value": "-20140000008325",
-                        "system": "https://bluebutton.cms.gov/resources/variables/bene_id"
-                    },
-                    {
-                        "value": "2025fbc612a884853f0c245e686780bf748e5652360ecd7430575491f4e018c5",
-                        "system": "https://bluebutton.cms.gov/resources/identifier/hicn-hash"
-                    }
-                ],
-                "resourceType": "Patient",
-                "id": "-20140000008325",
-                "address": [
-                    {
-                        "state": "15",
-                        "district": "999",
-                        "postalCode": "99999"
-                    }
-                ],
-                "gender": "female",
-                "birthDate": "2014-06-01"
-            }
-        }
-    ],
-    "meta": {
-        "lastUpdated": "2019-06-27T08:17:11.811-04:00"
-    }
-}

From 2da17de44a141adc6d1fe401170933f5cee4b63d Mon Sep 17 00:00:00 2001
From: Matt Jadud <mattjadud@navapbc.com>
Date: Wed, 12 Nov 2025 16:45:59 -0500
Subject: [PATCH 31/48] Fixed import

---
 apps/mymedicare_cb/tests/test_callback_slsx.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/apps/mymedicare_cb/tests/test_callback_slsx.py b/apps/mymedicare_cb/tests/test_callback_slsx.py
index 73104b958..c0255565c 100644
--- a/apps/mymedicare_cb/tests/test_callback_slsx.py
+++ b/apps/mymedicare_cb/tests/test_callback_slsx.py
@@ -37,7 +37,7 @@
 )
 from apps.test import BaseApiTest
 
-from .responses import patient_response_v1, patient_response_v2, patient_response_v3
+from .responses import patient_response
 
 from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME, MOCK_FHIR_V3_ENDPOINT_HOSTNAME
 
@@ -234,7 +234,7 @@ def test_callback_url_success_v3(self):
     def fhir_patient_info_mock_v1(self, url, request):
         return {
             'status_code': status.HTTP_200_OK,
-            'content': patient_response_v1,
+            'content': patient_response,
         }
 
     # mock fhir user info endpoint
@@ -245,7 +245,7 @@ def fhir_patient_info_mock_v1(self, url, request):
     def fhir_patient_info_mock_v2(self, url, request):
         return {
             'status_code': status.HTTP_200_OK,
-            'content': patient_response_v2,
+            'content': patient_response,
         }
 
     # mock fhir user info endpoint
@@ -257,7 +257,7 @@ def fhir_patient_info_mock_v3(self, url, request):
         print("fhir_patient_info_mock_v3")
         return {
             'status_code': status.HTTP_200_OK,
-            'content': patient_response_v3,
+            'content': patient_response,
         }
 
     def _test_callback_url_success(self, version):
@@ -617,7 +617,7 @@ def test_callback_allow_slsx_changes_to_hicn_and_mbi(self):
         def fhir_patient_info_mock_v1(url, request):
             return {
                 "status_code": status.HTTP_200_OK,
-                "content": patient_response_v1,
+                "content": patient_response,
             }
 
         # mock fhir patient endpoint (back end bfd) with fhir_id == "-20140000008325"
@@ -627,7 +627,7 @@ def fhir_patient_info_mock_v1(url, request):
         def fhir_patient_info_mock_v2(url, request):
             return {
                 "status_code": status.HTTP_200_OK,
-                "content": patient_response_v2,
+                "content": patient_response,
             }
 
         # mock fhir patient endpoint (back end bfd) with fhir_id == "-20140000008325"
@@ -637,7 +637,7 @@ def fhir_patient_info_mock_v2(url, request):
         def fhir_patient_info_mock_v3(url, request):
             return {
                 "status_code": status.HTTP_200_OK,
-                "content": patient_response_v2,
+                "content": patient_response,
             }
 
         @all_requests

From d97fd9b5a3bac5ab1fa6e6702b211b7662171319 Mon Sep 17 00:00:00 2001
From: Matt Jadud <mattjadud@navapbc.com>
Date: Thu, 13 Nov 2025 10:06:44 -0500
Subject: [PATCH 32/48] Renaming.

---
 apps/{constants.py => versions.py} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename apps/{constants.py => versions.py} (100%)

diff --git a/apps/constants.py b/apps/versions.py
similarity index 100%
rename from apps/constants.py
rename to apps/versions.py

From 5b439599a41617d2273cbefc72db71b347710a58 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 10:10:04 -0500
Subject: [PATCH 33/48] Rename function, modify return type per PR feedback

---
 apps/authorization/views.py      | 4 ++--
 apps/dot_ext/oauth2_backends.py  | 4 ++--
 apps/dot_ext/tests/test_utils.py | 6 +++---
 apps/dot_ext/utils.py            | 3 +--
 apps/fhir/bluebutton/utils.py    | 4 ++--
 5 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/apps/authorization/views.py b/apps/authorization/views.py
index 6d9d1f8dc..bb57a3de9 100644
--- a/apps/authorization/views.py
+++ b/apps/authorization/views.py
@@ -17,7 +17,7 @@
 from apps.constants import VersionNotMatched, Versions
 from apps.dot_ext.authentication import SLSAuthentication
 from .models import DataAccessGrant
-from ..dot_ext.utils import get_application_from_meta, get_api_version_number
+from ..dot_ext.utils import get_application_from_meta, get_api_version_number_from_url
 from ..fhir.bluebutton.models import Crosswalk
 
 
@@ -70,7 +70,7 @@ class ExpireDataAccessGrantView(ClientProtectedResourceView, OAuthLibMixin):
     def post(request, *args, **kwargs):
         try:
             path_info = request.__dict__.get('path_info')
-            version = get_api_version_number(path_info)
+            version = get_api_version_number_from_url(path_info)
             patient_id = kwargs.pop('patient_id', None)
 
             match version:
diff --git a/apps/dot_ext/oauth2_backends.py b/apps/dot_ext/oauth2_backends.py
index 50bf01225..55c2c0c33 100644
--- a/apps/dot_ext/oauth2_backends.py
+++ b/apps/dot_ext/oauth2_backends.py
@@ -4,7 +4,7 @@
 from ..fhir.bluebutton.models import Crosswalk
 from .loggers import (clear_session_auth_flow_trace, update_session_auth_flow_trace_from_code,
                       set_session_auth_flow_trace_value)
-from apps.dot_ext.utils import get_api_version_number
+from apps.dot_ext.utils import get_api_version_number_from_url
 
 
 class OAuthLibSMARTonFHIR(OAuthLibCore):
@@ -32,7 +32,7 @@ def create_token_response(self, request):
             if Crosswalk.objects.filter(user=token.user).exists():
                 fhir_body = json.loads(body)
                 cw = Crosswalk.objects.get(user=token.user)
-                version = get_api_version_number(request.path)
+                version = get_api_version_number_from_url(request.path)
                 fhir_body["patient"] = cw.fhir_id(version)
                 body = json.dumps(fhir_body)
 
diff --git a/apps/dot_ext/tests/test_utils.py b/apps/dot_ext/tests/test_utils.py
index d17eab401..2871eea0c 100644
--- a/apps/dot_ext/tests/test_utils.py
+++ b/apps/dot_ext/tests/test_utils.py
@@ -1,7 +1,7 @@
 from django.test import TestCase
 
 from apps.constants import VersionNotMatched
-from ..utils import get_api_version_number
+from ..utils import get_api_version_number_from_url
 
 SUPPORTED_VERSION_TEST_CASES = [
     {'url_path': '/v2/fhir/Patient/', 'expected': 2},
@@ -15,10 +15,10 @@
 class TestDOTUtils(TestCase):
     def test_get_api_version_number(self):
         for test in SUPPORTED_VERSION_TEST_CASES:
-            result = get_api_version_number(test['url_path'])
+            result = get_api_version_number_from_url(test['url_path'])
             assert result == test['expected']
 
     def test_get_api_version_number_unsupported_version(self):
         # unsupported version will raise an exception
         with self.assertRaises(VersionNotMatched, msg='4 extracted from /v4/fhir/Coverage/'):
-            get_api_version_number('/v4/fhir/Coverage/')
+            get_api_version_number_from_url('/v4/fhir/Coverage/')
diff --git a/apps/dot_ext/utils.py b/apps/dot_ext/utils.py
index 78346668f..1df7fe41c 100644
--- a/apps/dot_ext/utils.py
+++ b/apps/dot_ext/utils.py
@@ -8,7 +8,6 @@
 from oauthlib.oauth2.rfc6749.errors import InvalidClientError, InvalidGrantError, InvalidRequestError
 from http import HTTPStatus
 import re
-from typing import Optional
 from apps.constants import Versions, VersionNotMatched
 
 from apps.authorization.models import DataAccessGrant
@@ -257,7 +256,7 @@ def json_response_from_oauth2_error(error):
     return JsonResponse(ret_data, status=error.status_code)
 
 
-def get_api_version_number(url_path: str) -> Optional[int]:
+def get_api_version_number_from_url(url_path: str) -> int:
     """Utility function to extract what version of the API a URL is
     If there are multiple occurrences of 'v{{VERSION}} in a url path,
     only return the first one
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 1de67ef31..b9b535622 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -19,7 +19,7 @@
 
 from apps.wellknown.views import base_issuer, build_endpoint_info
 from .models import Crosswalk, Fhir_Response
-from apps.dot_ext.utils import get_api_version_number
+from apps.dot_ext.utils import get_api_version_number_from_url
 
 logger = logging.getLogger(bb2logging.HHS_SERVER_LOGNAME_FMT.format(__name__))
 
@@ -146,7 +146,7 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
     crosswalk = get_crosswalk(user)
 
     if version == Versions.NOT_AN_API_VERSION:
-        version = get_api_version_number(request.path)
+        version = get_api_version_number_from_url(request.path)
 
     if crosswalk:
         # TODO: Can the hicnHash case ever be reached? Should refactor this!

From 173ec43a2ab9d4b42297b35ca7d858ee7614c48b Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 10:15:41 -0500
Subject: [PATCH 34/48] Modify imports to reflect new file name

---
 apps/accounts/views/oauth2_profile.py         | 2 +-
 apps/authorization/permissions.py             | 2 +-
 apps/authorization/views.py                   | 2 +-
 apps/dot_ext/tests/test_api_error_codes.py    | 2 +-
 apps/dot_ext/tests/test_utils.py              | 2 +-
 apps/dot_ext/utils.py                         | 2 +-
 apps/fhir/bluebutton/models.py                | 2 +-
 apps/fhir/bluebutton/permissions.py           | 2 +-
 apps/fhir/bluebutton/tests/test_utils.py      | 2 +-
 apps/fhir/bluebutton/utils.py                 | 2 +-
 apps/fhir/bluebutton/views/generic.py         | 2 +-
 apps/fhir/bluebutton/views/home.py            | 2 +-
 apps/fhir/server/authentication.py            | 2 +-
 apps/fhir/server/tests/test_authentication.py | 2 +-
 apps/logging/signals.py                       | 2 +-
 apps/mymedicare_cb/models.py                  | 2 +-
 apps/mymedicare_cb/views.py                   | 2 +-
 apps/testclient/constants.py                  | 2 +-
 apps/testclient/tests.py                      | 2 +-
 apps/testclient/utils.py                      | 2 +-
 apps/testclient/views.py                      | 2 +-
 apps/wellknown/views/openid.py                | 2 +-
 hhs_oauth_server/request_logging.py           | 2 +-
 23 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/apps/accounts/views/oauth2_profile.py b/apps/accounts/views/oauth2_profile.py
index 0ba9484c8..f79c5eb3c 100644
--- a/apps/accounts/views/oauth2_profile.py
+++ b/apps/accounts/views/oauth2_profile.py
@@ -9,7 +9,7 @@
 from apps.fhir.bluebutton.models import Crosswalk
 from apps.fhir.bluebutton.permissions import ApplicationActivePermission
 
-from apps.constants import Versions
+from apps.versions import Versions
 
 
 def _get_userinfo(user, version=Versions.NOT_AN_API_VERSION):
diff --git a/apps/authorization/permissions.py b/apps/authorization/permissions.py
index 75e70483c..2b0d89dca 100644
--- a/apps/authorization/permissions.py
+++ b/apps/authorization/permissions.py
@@ -1,6 +1,6 @@
 from django.conf import settings
 from rest_framework import (permissions, exceptions)
-from apps.constants import Versions, VersionNotMatched
+from apps.versions import Versions, VersionNotMatched
 
 from .models import DataAccessGrant
 
diff --git a/apps/authorization/views.py b/apps/authorization/views.py
index bb57a3de9..e89ece2d6 100644
--- a/apps/authorization/views.py
+++ b/apps/authorization/views.py
@@ -14,7 +14,7 @@
 from oauth2_provider.views.base import OAuthLibMixin
 from oauth2_provider.views.generic import ClientProtectedResourceView
 
-from apps.constants import VersionNotMatched, Versions
+from apps.versions import VersionNotMatched, Versions
 from apps.dot_ext.authentication import SLSAuthentication
 from .models import DataAccessGrant
 from ..dot_ext.utils import get_application_from_meta, get_api_version_number_from_url
diff --git a/apps/dot_ext/tests/test_api_error_codes.py b/apps/dot_ext/tests/test_api_error_codes.py
index 87f4f6e78..b9f08218f 100644
--- a/apps/dot_ext/tests/test_api_error_codes.py
+++ b/apps/dot_ext/tests/test_api_error_codes.py
@@ -6,7 +6,7 @@
 from apps.authorization.models import (
     DataAccessGrant,
 )
-from apps.constants import AccessType
+from apps.versions import AccessType
 from datetime import datetime
 from dateutil.relativedelta import relativedelta
 from unittest import mock
diff --git a/apps/dot_ext/tests/test_utils.py b/apps/dot_ext/tests/test_utils.py
index 2871eea0c..97c8f8e1a 100644
--- a/apps/dot_ext/tests/test_utils.py
+++ b/apps/dot_ext/tests/test_utils.py
@@ -1,6 +1,6 @@
 from django.test import TestCase
 
-from apps.constants import VersionNotMatched
+from apps.versions import VersionNotMatched
 from ..utils import get_api_version_number_from_url
 
 SUPPORTED_VERSION_TEST_CASES = [
diff --git a/apps/dot_ext/utils.py b/apps/dot_ext/utils.py
index 1df7fe41c..90ce972d2 100644
--- a/apps/dot_ext/utils.py
+++ b/apps/dot_ext/utils.py
@@ -8,7 +8,7 @@
 from oauthlib.oauth2.rfc6749.errors import InvalidClientError, InvalidGrantError, InvalidRequestError
 from http import HTTPStatus
 import re
-from apps.constants import Versions, VersionNotMatched
+from apps.versions import Versions, VersionNotMatched
 
 from apps.authorization.models import DataAccessGrant
 
diff --git a/apps/fhir/bluebutton/models.py b/apps/fhir/bluebutton/models.py
index 9d21e6717..5a06f4b05 100644
--- a/apps/fhir/bluebutton/models.py
+++ b/apps/fhir/bluebutton/models.py
@@ -12,7 +12,7 @@
 from django.core.validators import MinLengthValidator
 from apps.accounts.models import get_user_id_salt
 
-from apps.constants import Versions, VersionNotMatched
+from apps.versions import Versions, VersionNotMatched
 
 
 class BBFhirBluebuttonModelException(APIException):
diff --git a/apps/fhir/bluebutton/permissions.py b/apps/fhir/bluebutton/permissions.py
index 337f4468b..cf3a62022 100644
--- a/apps/fhir/bluebutton/permissions.py
+++ b/apps/fhir/bluebutton/permissions.py
@@ -5,7 +5,7 @@
 from rest_framework import permissions, exceptions
 from rest_framework.exceptions import AuthenticationFailed
 from .constants import ALLOWED_RESOURCE_TYPES
-from apps.constants import Versions, VersionNotMatched
+from apps.versions import Versions, VersionNotMatched
 
 import apps.logging.request_logger as bb2logging
 
diff --git a/apps/fhir/bluebutton/tests/test_utils.py b/apps/fhir/bluebutton/tests/test_utils.py
index 78a98a093..77da35312 100644
--- a/apps/fhir/bluebutton/tests/test_utils.py
+++ b/apps/fhir/bluebutton/tests/test_utils.py
@@ -6,7 +6,7 @@
 from apps.accounts.models import UserProfile
 from apps.test import BaseApiTest
 from apps.fhir.bluebutton.models import Crosswalk
-from apps.constants import Versions
+from apps.versions import Versions
 
 from apps.fhir.bluebutton.utils import (
     notNone,
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index b9b535622..1d6b46660 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -14,7 +14,7 @@
 from django.conf import settings
 from django.contrib import messages
 from apps.fhir.server.settings import fhir_settings
-from apps.constants import Versions
+from apps.versions import Versions
 from oauth2_provider.models import AccessToken
 
 from apps.wellknown.views import base_issuer, build_endpoint_info
diff --git a/apps/fhir/bluebutton/views/generic.py b/apps/fhir/bluebutton/views/generic.py
index 78c68532c..b399b174a 100644
--- a/apps/fhir/bluebutton/views/generic.py
+++ b/apps/fhir/bluebutton/views/generic.py
@@ -3,7 +3,7 @@
 import voluptuous
 import logging
 
-from apps.constants import VersionNotMatched, Versions
+from apps.versions import VersionNotMatched, Versions
 import apps.logging.request_logger as bb2logging
 
 from django.core.exceptions import ObjectDoesNotExist
diff --git a/apps/fhir/bluebutton/views/home.py b/apps/fhir/bluebutton/views/home.py
index fecf94298..d5d44b003 100644
--- a/apps/fhir/bluebutton/views/home.py
+++ b/apps/fhir/bluebutton/views/home.py
@@ -13,7 +13,7 @@
                                         get_resourcerouter,
                                         get_response_text,
                                         build_oauth_resource)
-from apps.constants import Versions, VersionNotMatched
+from apps.versions import Versions, VersionNotMatched
 
 import apps.logging.request_logger as bb2logging
 
diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index b9082ef79..e2d47a487 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -4,7 +4,7 @@
 from rest_framework import exceptions
 from urllib.parse import quote
 
-from apps.constants import Versions
+from apps.versions import Versions
 from apps.dot_ext.loggers import get_session_auth_flow_trace
 from apps.fhir.bluebutton.signals import (
     pre_fetch,
diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index 354aca7e6..61241bce9 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -7,7 +7,7 @@
 from apps.fhir.bluebutton.exceptions import UpstreamServerException
 from apps.test import BaseApiTest
 from ..authentication import match_fhir_id
-from apps.constants import Versions
+from apps.versions import Versions
 from .responses import responses
 
 from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME, MOCK_FHIR_V3_ENDPOINT_HOSTNAME
diff --git a/apps/logging/signals.py b/apps/logging/signals.py
index 18a9f1ce3..994cfa1f3 100644
--- a/apps/logging/signals.py
+++ b/apps/logging/signals.py
@@ -1,4 +1,4 @@
-from apps.constants import Versions
+from apps.versions import Versions
 import apps.logging.request_logger as logging
 
 from django.db.models.signals import (
diff --git a/apps/mymedicare_cb/models.py b/apps/mymedicare_cb/models.py
index 4b24c1491..c7187d847 100644
--- a/apps/mymedicare_cb/models.py
+++ b/apps/mymedicare_cb/models.py
@@ -5,7 +5,7 @@
 from django.db import models, transaction
 from rest_framework import status
 from rest_framework.exceptions import APIException
-from apps.constants import Versions
+from apps.versions import Versions
 from apps.fhir.bluebutton.exceptions import UpstreamServerException
 
 from apps.accounts.models import UserProfile
diff --git a/apps/mymedicare_cb/views.py b/apps/mymedicare_cb/views.py
index d0c79d02e..337c302a3 100644
--- a/apps/mymedicare_cb/views.py
+++ b/apps/mymedicare_cb/views.py
@@ -14,7 +14,7 @@
 from django.views.decorators.cache import never_cache
 from rest_framework import status
 from rest_framework.exceptions import NotFound
-from apps.constants import Versions
+from apps.versions import Versions
 
 from apps.dot_ext.loggers import (clear_session_auth_flow_trace,
                                   set_session_auth_flow_trace_value,
diff --git a/apps/testclient/constants.py b/apps/testclient/constants.py
index 2d51df038..2133c25ba 100644
--- a/apps/testclient/constants.py
+++ b/apps/testclient/constants.py
@@ -1,7 +1,7 @@
 from django.http import JsonResponse
 import apps.logging.request_logger as bb2logging
 import logging
-from apps.constants import Versions
+from apps.versions import Versions
 
 logger = logging.getLogger(bb2logging.HHS_SERVER_LOGNAME_FMT.format(__name__))
 
diff --git a/apps/testclient/tests.py b/apps/testclient/tests.py
index 30c876f8f..c2e79345a 100644
--- a/apps/testclient/tests.py
+++ b/apps/testclient/tests.py
@@ -5,7 +5,7 @@
 from django.urls import reverse
 from unittest import skipIf
 from django.conf import settings
-from apps.constants import Versions, VersionNotMatched
+from apps.versions import Versions, VersionNotMatched
 from apps.testclient.utils import (_ormap, _deepfind)
 from apps.testclient.constants import EndpointUrl
 
diff --git a/apps/testclient/utils.py b/apps/testclient/utils.py
index d3e6ca71b..6e9ab3ae8 100644
--- a/apps/testclient/utils.py
+++ b/apps/testclient/utils.py
@@ -6,7 +6,7 @@
 from collections import OrderedDict
 from django.conf import settings
 from urllib.parse import parse_qs, urlparse
-from apps.constants import Versions
+from apps.versions import Versions
 
 from ..dot_ext.models import Application
 
diff --git a/apps/testclient/views.py b/apps/testclient/views.py
index 46df9f741..38f6a7af0 100644
--- a/apps/testclient/views.py
+++ b/apps/testclient/views.py
@@ -27,7 +27,7 @@
 
 import apps.logging.request_logger as bb2logging
 
-from apps.constants import Versions, VersionNotMatched
+from apps.versions import Versions, VersionNotMatched
 
 from apps.testclient.constants import (
     HOME_PAGE,
diff --git a/apps/wellknown/views/openid.py b/apps/wellknown/views/openid.py
index 2a2ff1293..f253231dc 100644
--- a/apps/wellknown/views/openid.py
+++ b/apps/wellknown/views/openid.py
@@ -8,7 +8,7 @@
 
 import apps.logging.request_logger as bb2logging
 
-from apps.constants import Versions
+from apps.versions import Versions
 
 logger = logging.getLogger(bb2logging.HHS_SERVER_LOGNAME_FMT.format(__name__))
 SCOPES_SUPPORTED = [
diff --git a/hhs_oauth_server/request_logging.py b/hhs_oauth_server/request_logging.py
index d2d144af4..17909be73 100644
--- a/hhs_oauth_server/request_logging.py
+++ b/hhs_oauth_server/request_logging.py
@@ -9,7 +9,7 @@
 from django.utils.deprecation import MiddlewareMixin
 from oauth2_provider.models import AccessToken, RefreshToken, get_application_model
 from rest_framework.response import Response
-from apps.constants import Versions
+from apps.versions import Versions
 
 from apps.dot_ext.loggers import (
     SESSION_AUTH_FLOW_TRACE_KEYS,

From c411169f145e5b843a12ed1831f17d0d51824b1b Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 10:22:12 -0500
Subject: [PATCH 35/48] Modify default param and update to absolute paths

---
 apps/authorization/views.py    | 6 +++---
 apps/fhir/bluebutton/models.py | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/authorization/views.py b/apps/authorization/views.py
index e89ece2d6..de637cea5 100644
--- a/apps/authorization/views.py
+++ b/apps/authorization/views.py
@@ -16,9 +16,9 @@
 
 from apps.versions import VersionNotMatched, Versions
 from apps.dot_ext.authentication import SLSAuthentication
-from .models import DataAccessGrant
-from ..dot_ext.utils import get_application_from_meta, get_api_version_number_from_url
-from ..fhir.bluebutton.models import Crosswalk
+from apps.authorization.models import DataAccessGrant
+from apps.dot_ext.utils import get_application_from_meta, get_api_version_number_from_url
+from apps.fhir.bluebutton.models import Crosswalk
 
 
 Application = get_application_model()
diff --git a/apps/fhir/bluebutton/models.py b/apps/fhir/bluebutton/models.py
index 5a06f4b05..4ba04e24f 100644
--- a/apps/fhir/bluebutton/models.py
+++ b/apps/fhir/bluebutton/models.py
@@ -166,7 +166,7 @@ class Meta:
             )
         ]
 
-    def fhir_id(self, version: int = Versions.V2) -> str:
+    def fhir_id(self, version: int = Versions.NOT_AN_API_VERSION) -> str:
         """Helper method to return fhir_id based on BFD version, preferred over direct access"""
         if version in [Versions.V1, Versions.V2]:
             if self.fhir_id_v2 is not None and self.fhir_id_v2 != '':

From 56928af9dfe74243ad6a8bfe8da462138b596fb4 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 10:25:38 -0500
Subject: [PATCH 36/48] Remove unneeded TODO

---
 apps/authorization/views.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/apps/authorization/views.py b/apps/authorization/views.py
index de637cea5..0706f87e9 100644
--- a/apps/authorization/views.py
+++ b/apps/authorization/views.py
@@ -80,7 +80,6 @@ def post(request, *args, **kwargs):
                     user = Crosswalk.objects.get(fhir_id_v2=patient_id).user
                 case Versions.V3:
                     user = Crosswalk.objects.get(fhir_id_v3=patient_id).user
-                # TODO: Should we handle this below or raise it?
                 case _:
                     raise VersionNotMatched(f"{version} is not a valid version constant")
 

From 1c1732c1cc632bc306c1579d59ec8fcebe0c5fac Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 10:33:03 -0500
Subject: [PATCH 37/48] Modify a function name and call to more accurately
 reflect what it does

---
 apps/bb2_tools/admin.py       | 5 +++--
 apps/fhir/bluebutton/utils.py | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/apps/bb2_tools/admin.py b/apps/bb2_tools/admin.py
index 75c273c91..75faca7f4 100644
--- a/apps/bb2_tools/admin.py
+++ b/apps/bb2_tools/admin.py
@@ -21,7 +21,7 @@
     DummyAdminObject,
     UserStats,
 )
-from apps.fhir.bluebutton.utils import get_patient_by_id
+from apps.fhir.bluebutton.utils import get_v2_patient_by_id
 
 ADMIN_PREPEND = getattr(settings, "ADMIN_PREPEND_URL", "")
 BB2_TOOLS_PATH = (
@@ -415,7 +415,8 @@ def change_view(self, request, object_id, form_url="", extra_context=None):
 
         json_resp = None
         try:
-            json_resp = get_patient_by_id(crosswalk.fhir_id(2), request)
+            # DEPRECATE_V2: If we ever deprecate v2, this function and call need to be updated
+            json_resp = get_v2_patient_by_id(crosswalk.fhir_id(2), request)
         except Exception as e:
             json_resp = {"backend_error": str(e)}
 
diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 1d6b46660..8797dff85 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -702,7 +702,7 @@ def build_oauth_resource(request, version=Versions.NOT_AN_API_VERSION, format_ty
     return security
 
 
-def get_patient_by_id(id, request):
+def get_v2_patient_by_id(id, request):
     """
     a helper adapted to just get patient given an id out of band of auth flow
     or normal data flow, use by tools such as BB2-Tools admin viewers

From 3982daac1e66026acf679d7abbe08a08f986ea80 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 10:47:59 -0500
Subject: [PATCH 38/48] revert to have v2 as default to fhir_id, as it broke
 tests, and we only do not pass a value for a log statement

---
 apps/fhir/bluebutton/models.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/fhir/bluebutton/models.py b/apps/fhir/bluebutton/models.py
index 4ba04e24f..5a06f4b05 100644
--- a/apps/fhir/bluebutton/models.py
+++ b/apps/fhir/bluebutton/models.py
@@ -166,7 +166,7 @@ class Meta:
             )
         ]
 
-    def fhir_id(self, version: int = Versions.NOT_AN_API_VERSION) -> str:
+    def fhir_id(self, version: int = Versions.V2) -> str:
         """Helper method to return fhir_id based on BFD version, preferred over direct access"""
         if version in [Versions.V1, Versions.V2]:
             if self.fhir_id_v2 is not None and self.fhir_id_v2 != '':

From 0bdd43d28875f1559bfc62a0d6b28c55fe1a6e07 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 11:12:17 -0500
Subject: [PATCH 39/48] Check on blank string in get_and_update_user to
 accommodate changes from BB2-4224

---
 apps/dot_ext/oauth2_backends.py | 2 +-
 apps/mymedicare_cb/models.py    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/dot_ext/oauth2_backends.py b/apps/dot_ext/oauth2_backends.py
index 55c2c0c33..3131b26c5 100644
--- a/apps/dot_ext/oauth2_backends.py
+++ b/apps/dot_ext/oauth2_backends.py
@@ -33,7 +33,7 @@ def create_token_response(self, request):
                 fhir_body = json.loads(body)
                 cw = Crosswalk.objects.get(user=token.user)
                 version = get_api_version_number_from_url(request.path)
-                fhir_body["patient"] = cw.fhir_id(version)
+                fhir_body['patient'] = cw.fhir_id(version)
                 body = json.dumps(fhir_body)
 
         return uri, headers, body, status
diff --git a/apps/mymedicare_cb/models.py b/apps/mymedicare_cb/models.py
index c7187d847..abd46eec7 100644
--- a/apps/mymedicare_cb/models.py
+++ b/apps/mymedicare_cb/models.py
@@ -104,7 +104,7 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
             hicn_updated = True
 
         update_fhir_id = False
-        if user.crosswalk.fhir_id(Versions.V2) is None or user.crosswalk.fhir_id(Versions.V3) is None:
+        if user.crosswalk.fhir_id(Versions.V2) == '' or user.crosswalk.fhir_id(Versions.V3) == '':
             update_fhir_id = True
         # Update Crosswalk if the user_mbi is null, but we have an mbi value from SLSx or
         # if the saved user_mbi value is different than what SLSx has

From b95785bfeb6c2823e49a28729e719b519eb03ccf Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 11:26:56 -0500
Subject: [PATCH 40/48] Single quotes and comment context

---
 apps/fhir/bluebutton/utils.py      | 10 +++++-----
 apps/fhir/server/authentication.py |  4 +++-
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index 8797dff85..de60d78b5 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -152,9 +152,9 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
         # TODO: Can the hicnHash case ever be reached? Should refactor this!
         # TODO: As we move to v2/v3, v3 does not use the hicnHash. We will want to refactor.
         if crosswalk.fhir_id(version) is not None:
-            result["BlueButton-BeneficiaryId"] = "patientId:" + crosswalk.fhir_id(version)
+            result['BlueButton-BeneficiaryId'] = 'patientId:' + crosswalk.fhir_id(version)
         else:
-            result["BlueButton-BeneficiaryId"] = "hicnHash:" + str(
+            result['BlueButton-BeneficiaryId'] = 'hicnHash:' + str(
                 crosswalk.user_hicn_hash
             )
     else:
@@ -736,9 +736,9 @@ def get_patient_by_mbi_hash(mbi_hash, request):
     headers["BlueButton-Application"] = "BB2-Tools"
     headers["includeIdentifiers"] = "true"
 
-    search_identifier = f"https://bluebutton.cms.gov/resources/identifier/mbi-hash|{mbi_hash}"  # noqa: E231
-    payload = {"identifier": search_identifier}
-    url = "{}/v2/fhir/Patient/_search".format(
+    search_identifier = f'https://bluebutton.cms.gov/resources/identifier/mbi-hash|{mbi_hash}'  # noqa: E231
+    payload = {'identifier': search_identifier}
+    url = '{}/v2/fhir/Patient/_search'.format(
         get_resourcerouter().fhir_url
     )
 
diff --git a/apps/fhir/server/authentication.py b/apps/fhir/server/authentication.py
index e2d47a487..1ddf4d620 100644
--- a/apps/fhir/server/authentication.py
+++ b/apps/fhir/server/authentication.py
@@ -150,7 +150,9 @@ def match_fhir_id(mbi, hicn_hash, request=None, version=Versions.NOT_AN_API_VERS
             return fhir_id, 'M'
 
     # Perform secondary lookup using HICN_HASH
-    # WE CANNOT DO A HICN HASH LOOKUP FOR V3
+    # WE CANNOT DO A HICN HASH LOOKUP FOR V3, but there are tests that rely on a null MBI
+    # and populated hicn_hash, which now execute on v3 (due to updates in get_and_update_user)
+    # so we need to leave this conditional as is for now, until the test is modified and/or hicn_hash is removed
     # if version in [Versions.V1, Versions.V2] and hicn_hash:
     if hicn_hash:
         try:

From f6d4d7dcc91cea27288d4bc280cf0c395c60e6be Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 16:55:43 -0500
Subject: [PATCH 41/48] Refactor get_and_update_user to reduce BFD calls, and
 to ensure fhir_ids are always updated if DB values differ from what BFD
 returns

---
 apps/fhir/bluebutton/utils.py                 |  2 -
 apps/fhir/server/tests/test_authentication.py | 12 ++----
 apps/mymedicare_cb/models.py                  | 38 +++++++++++--------
 3 files changed, 27 insertions(+), 25 deletions(-)

diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index de60d78b5..2c829d127 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -410,7 +410,6 @@ def prepend_q(pass_params):
     return pass_params
 
 
-# BB2-4166-TODO - if tests are failing this could be related
 def dt_patient_reference(user, version):
     """Get Patient Reference from Crosswalk for user"""
 
@@ -428,7 +427,6 @@ def crosswalk_patient_id(user, version):
     logger.debug("\ncrosswalk_patient_id User:%s" % user)
     try:
         patient = Crosswalk.objects.get(user=user)
-        # BB2-4166-TODO - if tests are failing this could be related
         if patient.fhir_id(version):
             return patient.fhir_id(version)
 
diff --git a/apps/fhir/server/tests/test_authentication.py b/apps/fhir/server/tests/test_authentication.py
index 61241bce9..e60c2cd0e 100644
--- a/apps/fhir/server/tests/test_authentication.py
+++ b/apps/fhir/server/tests/test_authentication.py
@@ -6,9 +6,9 @@
 from rest_framework import exceptions
 from apps.fhir.bluebutton.exceptions import UpstreamServerException
 from apps.test import BaseApiTest
-from ..authentication import match_fhir_id
+from apps.fhir.server.authentication import match_fhir_id
 from apps.versions import Versions
-from .responses import responses
+from apps.fhir.server.tests.responses import responses
 
 from hhs_oauth_server.settings.base import MOCK_FHIR_ENDPOINT_HOSTNAME, MOCK_FHIR_V3_ENDPOINT_HOSTNAME
 
@@ -17,9 +17,8 @@ def mock_fhir_url(version):
     return MOCK_FHIR_ENDPOINT_HOSTNAME if version in [1, 2] else MOCK_FHIR_V3_ENDPOINT_HOSTNAME
 
 
-#     MOCK_FHIR_PATH = "/v1/fhir/Patient/"
 def mock_fhir_path(version):
-    return f"/v{version}/fhir/Patient"
+    return f'/v{version}/fhir/Patient'
 
 
 class TestAuthentication(BaseApiTest):
@@ -41,10 +40,7 @@ def setUp(self):
         self.request = self.factory.get('http://localhost:8000/mymedicare/sls-callback')
         self.request.session = self.client.session
 
-    # The mock uses data from responses.py. We need to have mock data for a given MBI/FHIR ID
-    # for each version of the API we want to test this way. We can use the v2 test data for
-    # v3 because we're just asking "do you have a valid us-mbi query string?", and usnig that to then
-    # look up the mock response.
+    # The mock uses data from responses.py
     @classmethod
     def create_fhir_mock(cls, hicn_response_key, mbi_response_key, version=Versions.NOT_AN_API_VERSION):
         @urlmatch(netloc=mock_fhir_url(version), path=mock_fhir_path(version), method='POST')
diff --git a/apps/mymedicare_cb/models.py b/apps/mymedicare_cb/models.py
index abd46eec7..1cc4876d2 100644
--- a/apps/mymedicare_cb/models.py
+++ b/apps/mymedicare_cb/models.py
@@ -17,6 +17,7 @@
 
 MAX_HICN_HASH_LENGTH = 64
 MAX_MBI_LENGTH = 11
+FHIR_ID_VERSIONS_TO_CHECK = [2, 3]
 
 
 class BBMyMedicareCallbackCrosswalkCreateException(APIException):
@@ -68,25 +69,27 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
     # If the lookup for the requested version fails, raise the exception
     # This is wrapped in the case that if the requested version fails, match_fhir_id
     # will still bubble up UpstreamServerException
-    for supported_version in Versions.supported_versions():
+    for supported_version in FHIR_ID_VERSIONS_TO_CHECK:
         try:
             fhir_id, hash_lookup_type = match_fhir_id(
                 mbi=slsx_client.mbi,
                 hicn_hash=hicn_hash,
                 request=request,
                 version=supported_version,
-
             )
             versioned_fhir_ids[supported_version] = fhir_id
         except UpstreamServerException as e:
             if supported_version == version:
                 raise e
 
+    bfd_fhir_id_v2 = versioned_fhir_ids[Versions.V2]
+    bfd_fhir_id_v3 = versioned_fhir_ids[Versions.V3]
+
     log_dict = {
         'type': 'mymedicare_cb:get_and_update_user',
         'subject': slsx_client.user_id,
-        'fhir_id_v2': versioned_fhir_ids.get(Versions.V2, None),
-        'fhir_id_v3': versioned_fhir_ids.get(Versions.V3, None),
+        'fhir_id_v2': bfd_fhir_id_v2,
+        'fhir_id_v3': bfd_fhir_id_v3,
         'hicn_hash': slsx_client.hicn_hash,
         'hash_lookup_type': hash_lookup_type,
         'crosswalk': {},
@@ -104,7 +107,12 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
             hicn_updated = True
 
         update_fhir_id = False
-        if user.crosswalk.fhir_id(Versions.V2) == '' or user.crosswalk.fhir_id(Versions.V3) == '':
+        if (
+            user.crosswalk.fhir_id(Versions.V2) == ''
+            or user.crosswalk.fhir_id(Versions.V3) == ''
+            or user.crosswalk.fhir_id(Versions.V2) != bfd_fhir_id_v2
+            or user.crosswalk.fhir_id(Versions.V3) != bfd_fhir_id_v3
+        ):
             update_fhir_id = True
         # Update Crosswalk if the user_mbi is null, but we have an mbi value from SLSx or
         # if the saved user_mbi value is different than what SLSx has
@@ -119,8 +127,8 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
                 'crosswalk_before': {
                     'id': user.crosswalk.id,
                     'user_hicn_hash': user.crosswalk.user_hicn_hash,
-                    'fhir_id_v2': versioned_fhir_ids.get(Versions.V2, None),
-                    'fhir_id_v3': versioned_fhir_ids.get(Versions.V3, None),
+                    'fhir_id_v2': bfd_fhir_id_v2,
+                    'fhir_id_v3': bfd_fhir_id_v3,
                     'user_id_type': user.crosswalk.user_id_type,
                 },
             })
@@ -129,8 +137,8 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
                 # Archive to audit crosswalk changes
                 ArchivedCrosswalk.create(user.crosswalk)
                 if update_fhir_id:
-                    user.crosswalk.fhir_id_v2 = versioned_fhir_ids.get(Versions.V2)
-                    user.crosswalk.fhir_id_v3 = versioned_fhir_ids.get(Versions.V3)
+                    user.crosswalk.fhir_id_v2 = bfd_fhir_id_v2
+                    user.crosswalk.fhir_id_v3 = bfd_fhir_id_v3
                 # Update crosswalk per changes
                 user.crosswalk.user_id_type = hash_lookup_type
                 user.crosswalk.user_hicn_hash = slsx_client.hicn_hash
@@ -147,8 +155,8 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
             'crosswalk': {
                 'id': user.crosswalk.id,
                 'user_hicn_hash': user.crosswalk.user_hicn_hash,
-                'fhir_id_v2': versioned_fhir_ids.get(Versions.V2, None),
-                'fhir_id_v3': versioned_fhir_ids.get(Versions.V3, None),
+                'fhir_id_v2': bfd_fhir_id_v2,
+                'fhir_id_v3': bfd_fhir_id_v3,
                 'user_id_type': user.crosswalk.user_id_type,
             },
         })
@@ -160,8 +168,8 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
 
     user = create_beneficiary_record(
         slsx_client,
-        fhir_id_v2=versioned_fhir_ids.get(Versions.V2, None),
-        fhir_id_v3=versioned_fhir_ids.get(Versions.V3, None),
+        fhir_id_v2=bfd_fhir_id_v2,
+        fhir_id_v3=bfd_fhir_id_v3,
         user_id_type=hash_lookup_type,
         request=request
     )
@@ -175,8 +183,8 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
         'crosswalk': {
             'id': user.crosswalk.id,
             'user_hicn_hash': user.crosswalk.user_hicn_hash,
-            'fhir_id_v2': versioned_fhir_ids.get(Versions.V2, None),
-            'fhir_id_v3': versioned_fhir_ids.get(Versions.V3, None),
+            'fhir_id_v2': bfd_fhir_id_v2,
+            'fhir_id_v3': bfd_fhir_id_v3,
             'user_id_type': user.crosswalk.user_id_type,
         },
     })

From 1ea136eb773cc87a696ef5ecce2e2b5ff4ace484 Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Thu, 13 Nov 2025 17:10:53 -0500
Subject: [PATCH 42/48] Updates based on PR self-review with Brandon and Matt

---
 apps/mymedicare_cb/tests/mock_url_responses_slsx.py | 3 ---
 apps/mymedicare_cb/tests/test_callback_slsx.py      | 6 ------
 hhs_oauth_server/request_logging.py                 | 1 +
 3 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/apps/mymedicare_cb/tests/mock_url_responses_slsx.py b/apps/mymedicare_cb/tests/mock_url_responses_slsx.py
index 289fb7c8d..1cc58be95 100644
--- a/apps/mymedicare_cb/tests/mock_url_responses_slsx.py
+++ b/apps/mymedicare_cb/tests/mock_url_responses_slsx.py
@@ -59,9 +59,6 @@ def slsx_signout_fail2_mock(self, url, request):
     # mock sls token endpoint OK
     @urlmatch(netloc=NETLOC_REGEX_SSO_SESSION, path='/sso/session')
     def slsx_token_mock(self, url, request):
-        print()
-        print("slsx_token_mock url: ", url)
-        print("slsx_token_mock request: ", request.__dict__)
         return {"status_code": status.HTTP_200_OK,
                 "content": {"auth_token": "tqXFB/j2OR9Fx7aDowGasMZGqoWmwcihNzMdaW2gpEmV",
                             "role": "consumer",
diff --git a/apps/mymedicare_cb/tests/test_callback_slsx.py b/apps/mymedicare_cb/tests/test_callback_slsx.py
index c0255565c..edb22a1a4 100644
--- a/apps/mymedicare_cb/tests/test_callback_slsx.py
+++ b/apps/mymedicare_cb/tests/test_callback_slsx.py
@@ -302,15 +302,10 @@ def catchall(url, request):
             )
             s.save()
 
-            print()
-            print("callback_url: ", self.callback_url)
-            print("THIS IS BEFORE")
             response = self.client.get(
                 self.callback_url,
                 data={"req_token": "0000-test_req_token-0000", "relay": state},
             )
-            print("THIS IS AFTER THE GET")
-            print("response", response.__dict__)
 
             # assert http redirect
             self.assertEqual(response.status_code, status.HTTP_302_FOUND)
@@ -658,7 +653,6 @@ def catchall(url, request):
             response = self.client.get(
                 self.callback_url, data={"req_token": "test", "relay": state}
             )
-            print()
             # assert http redirect
             self.assertEqual(response.status_code, status.HTTP_302_FOUND)
 
diff --git a/hhs_oauth_server/request_logging.py b/hhs_oauth_server/request_logging.py
index 17909be73..21f9d340b 100644
--- a/hhs_oauth_server/request_logging.py
+++ b/hhs_oauth_server/request_logging.py
@@ -157,6 +157,7 @@ def _log_msg_update_from_object(self, obj, key, obj_key):
         # Log message update from a passed in object
         try:
             value = getattr(obj, obj_key, None)
+            # Added as the fhir_id column on crosswalk is now a method rather than a property
             if callable(value):
                 value = value()
             if value is not None:

From 85fd19c4c6abcd2c2a345d628316e639fa97c659 Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Thu, 13 Nov 2025 17:13:12 -0600
Subject: [PATCH 43/48] adding latest versions and changes to the offset math
 test

---
 apps/fhir/bluebutton/tests/test_utils.py | 4 ++--
 apps/logging/tests/test_audit_loggers.py | 2 +-
 apps/mymedicare_cb/models.py             | 3 +--
 apps/testclient/tests.py                 | 6 ++++--
 apps/versions.py                         | 3 +++
 5 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/apps/fhir/bluebutton/tests/test_utils.py b/apps/fhir/bluebutton/tests/test_utils.py
index 77da35312..510e6fc06 100644
--- a/apps/fhir/bluebutton/tests/test_utils.py
+++ b/apps/fhir/bluebutton/tests/test_utils.py
@@ -235,7 +235,7 @@ def setUp(self):
     def test_crosswalk_fhir_id(self):
         """ Get the Crosswalk FHIR_Id """
 
-        for version in [Versions.V2, Versions.V3]:
+        for version in Versions.latest_versions():
             u = User.objects.create_user(username=f"billybob-{version}",
                                          first_name="Billybob",
                                          last_name="Button",
@@ -258,7 +258,7 @@ def test_crosswalk_fhir_id(self):
 
     def test_crosswalk_not_fhir_id(self):
         """ Get no Crosswalk id """
-        for version in [Versions.V2, Versions.V3]:
+        for version in Versions.latest_versions():
             u = User.objects.create_user(username=f"bobnobob-{version}",
                                          first_name="bob",
                                          last_name="Button",
diff --git a/apps/logging/tests/test_audit_loggers.py b/apps/logging/tests/test_audit_loggers.py
index 5d48f0bdb..c6fdf4e5c 100644
--- a/apps/logging/tests/test_audit_loggers.py
+++ b/apps/logging/tests/test_audit_loggers.py
@@ -295,7 +295,7 @@ def catchall(url, request):
             fhir_log_content = get_log_content(self.logger_registry, logging.AUDIT_DATA_FHIR_LOGGER)
             log_entries = fhir_log_content.splitlines()
 
-            self.assertEqual(len(log_entries), 6)
+            self.assertEqual(len(log_entries), 4)
 
             # Validate fhir_auth_pre_fetch entry
             self.assertTrue(
diff --git a/apps/mymedicare_cb/models.py b/apps/mymedicare_cb/models.py
index 1cc4876d2..67d36bee0 100644
--- a/apps/mymedicare_cb/models.py
+++ b/apps/mymedicare_cb/models.py
@@ -17,7 +17,6 @@
 
 MAX_HICN_HASH_LENGTH = 64
 MAX_MBI_LENGTH = 11
-FHIR_ID_VERSIONS_TO_CHECK = [2, 3]
 
 
 class BBMyMedicareCallbackCrosswalkCreateException(APIException):
@@ -69,7 +68,7 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
     # If the lookup for the requested version fails, raise the exception
     # This is wrapped in the case that if the requested version fails, match_fhir_id
     # will still bubble up UpstreamServerException
-    for supported_version in FHIR_ID_VERSIONS_TO_CHECK:
+    for supported_version in Versions.latest_versions():
         try:
             fhir_id, hash_lookup_type = match_fhir_id(
                 mbi=slsx_client.mbi,
diff --git a/apps/testclient/tests.py b/apps/testclient/tests.py
index c2e79345a..788a7216c 100644
--- a/apps/testclient/tests.py
+++ b/apps/testclient/tests.py
@@ -279,7 +279,9 @@ def test_offset_math(self):
         # our control, then these unit tests will always be suspect (including offsets and pagination values).
         # This seems to have been the case 7mo ago with the "total" test, above.
         # self.assertEqual(len(response_data["entry"]), 7)
-        self.assertEqual(len(response_data["entry"]), 5)
+        # From commit f6d4d7dcc91cea27288d4bc280cf0c395c60e6be, there was a change to 12 here.
+        # The changes in that commit are around the logging of fhir_id_v2/fhir_id_v3.
+        self.assertEqual(len(response_data["entry"]), 12)
         previous_links = [
             data["url"]
             for data in response_data["link"]
@@ -292,7 +294,7 @@ def test_offset_math(self):
             data["url"] for data in response_data["link"] if data["relation"] == "first"
         ]
         self.assertEqual(len(previous_links), 1)
-        self.assertEqual(len(next_links), 0)
+        self.assertEqual(len(next_links), 1)
         self.assertEqual(len(first_links), 1)
         self.assertIn("startIndex=13", previous_links[0])
         self.assertIn("startIndex=0", first_links[0])
diff --git a/apps/versions.py b/apps/versions.py
index 102fa3d21..2920d452f 100644
--- a/apps/versions.py
+++ b/apps/versions.py
@@ -40,6 +40,9 @@ def as_int(version: int) -> int:
     def supported_versions():
         return [Versions.V1, Versions.V2, Versions.V3]
 
+    def latest_versions():
+        return [Versions.V2, Versions.V3]
+
 
 class AccessType:
     ONE_TIME = 'ONE_TIME'

From 675f69d51f35f71100576817c41050505d69ad12 Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Fri, 14 Nov 2025 12:48:22 -0600
Subject: [PATCH 44/48] added defaults if there is no fhir_id found for a
 version

---
 apps/mymedicare_cb/models.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/mymedicare_cb/models.py b/apps/mymedicare_cb/models.py
index 67d36bee0..4d1512524 100644
--- a/apps/mymedicare_cb/models.py
+++ b/apps/mymedicare_cb/models.py
@@ -81,8 +81,8 @@ def get_and_update_user(slsx_client: OAuth2ConfigSLSx, request):
             if supported_version == version:
                 raise e
 
-    bfd_fhir_id_v2 = versioned_fhir_ids[Versions.V2]
-    bfd_fhir_id_v3 = versioned_fhir_ids[Versions.V3]
+    bfd_fhir_id_v2 = versioned_fhir_ids.get(Versions.V2, None)
+    bfd_fhir_id_v3 = versioned_fhir_ids.get(Versions.V3, None)
 
     log_dict = {
         'type': 'mymedicare_cb:get_and_update_user',

From f19d8a42d845b460b8365ceea5abc727a1639d25 Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Mon, 17 Nov 2025 16:39:49 -0600
Subject: [PATCH 45/48] addressing comments

---
 apps/authorization/views.py                      | 1 +
 apps/integration_tests/selenium_spanish_tests.py | 2 +-
 apps/integration_tests/selenium_tests.py         | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/apps/authorization/views.py b/apps/authorization/views.py
index 0706f87e9..4832df9a4 100644
--- a/apps/authorization/views.py
+++ b/apps/authorization/views.py
@@ -73,6 +73,7 @@ def post(request, *args, **kwargs):
             version = get_api_version_number_from_url(path_info)
             patient_id = kwargs.pop('patient_id', None)
 
+            # V1 is treated as the same as V2 since their pathways are very similar and use the same fhir_id_v2 despite the name
             match version:
                 case Versions.V1:
                     user = Crosswalk.objects.get(fhir_id_v2=patient_id).user
diff --git a/apps/integration_tests/selenium_spanish_tests.py b/apps/integration_tests/selenium_spanish_tests.py
index 856898a1d..9b2abdfb7 100644
--- a/apps/integration_tests/selenium_spanish_tests.py
+++ b/apps/integration_tests/selenium_spanish_tests.py
@@ -1,6 +1,6 @@
 from .selenium_generic import SeleniumGenericTests
 from .selenium_cases import SPANISH_TESTS
-from apps.constants import Versions
+from apps.versions import Versions
 
 USE_NEW_PERM_SCREEN = "true"
 
diff --git a/apps/integration_tests/selenium_tests.py b/apps/integration_tests/selenium_tests.py
index f77a8c1ee..98cf2c796 100755
--- a/apps/integration_tests/selenium_tests.py
+++ b/apps/integration_tests/selenium_tests.py
@@ -1,7 +1,7 @@
 import os
 from .selenium_generic import SeleniumGenericTests
 from .selenium_cases import TESTS
-from apps.constants import Versions
+from apps.versions import Versions
 
 
 USE_NEW_PERM_SCREEN = os.environ['USE_NEW_PERM_SCREEN']

From 80307e367af11e8eafaace44f37a14c08885ade4 Mon Sep 17 00:00:00 2001
From: Brandon Wang <brandon.wang@icf.com>
Date: Wed, 19 Nov 2025 11:43:08 -0600
Subject: [PATCH 46/48] changing check to empty string over None but will
 change back to None some day

---
 apps/fhir/bluebutton/utils.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/fhir/bluebutton/utils.py b/apps/fhir/bluebutton/utils.py
index c9f1dfa6b..271d76a6b 100644
--- a/apps/fhir/bluebutton/utils.py
+++ b/apps/fhir/bluebutton/utils.py
@@ -153,7 +153,7 @@ def generate_info_headers(request, version: int = Versions.NOT_AN_API_VERSION):
     if crosswalk:
         # TODO: Can the hicnHash case ever be reached? Should refactor this!
         # TODO: As we move to v2/v3, v3 does not use the hicnHash. We will want to refactor.
-        if crosswalk.fhir_id(version) is not None:
+        if crosswalk.fhir_id(version) != '':
             result['BlueButton-BeneficiaryId'] = 'patientId:' + crosswalk.fhir_id(version)
         else:
             result['BlueButton-BeneficiaryId'] = 'hicnHash:' + str(

From 6021985a61ccf70bb1741df9a3e5b14dfddda24a Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Wed, 19 Nov 2025 13:04:54 -0500
Subject: [PATCH 47/48] Address TODO that arose from a change made in BB2-4233

---
 apps/fhir/bluebutton/views/generic.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/fhir/bluebutton/views/generic.py b/apps/fhir/bluebutton/views/generic.py
index 55c2bdbf4..044157fd5 100644
--- a/apps/fhir/bluebutton/views/generic.py
+++ b/apps/fhir/bluebutton/views/generic.py
@@ -3,6 +3,7 @@
 import voluptuous
 import logging
 
+from apps.dot_ext.utils import get_api_version_number_from_url
 from apps.versions import VersionNotMatched, Versions
 import apps.logging.request_logger as bb2logging
 
@@ -166,8 +167,10 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
 
             # Handle the case where it is a patient search call, but neither _id or identifier were passed
             if '_id' not in get_parameters.keys() and 'identifier' not in get_parameters.keys():
+                path_info = request.path
+                version = get_api_version_number_from_url(path_info)
                 # depending on if 4166 is merged first, this will need to be updated
-                get_parameters['_id'] = request.crosswalk.fhir_id(2)
+                get_parameters['_id'] = request.crosswalk.fhir_id(version)
                 # Reset the request parameters and the prepped request after adding the missing, but required, _id param
                 req.params = get_parameters
                 prepped = s.prepare_request(req)

From 91c3a378a263a5e90f10f499b6725ce7672578bf Mon Sep 17 00:00:00 2001
From: James Demery <jamesdemery@navapbc.com>
Date: Wed, 19 Nov 2025 14:00:52 -0500
Subject: [PATCH 48/48] use self.version instead

---
 apps/fhir/bluebutton/views/generic.py | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/apps/fhir/bluebutton/views/generic.py b/apps/fhir/bluebutton/views/generic.py
index 044157fd5..6cb6e6cb0 100644
--- a/apps/fhir/bluebutton/views/generic.py
+++ b/apps/fhir/bluebutton/views/generic.py
@@ -3,7 +3,6 @@
 import voluptuous
 import logging
 
-from apps.dot_ext.utils import get_api_version_number_from_url
 from apps.versions import VersionNotMatched, Versions
 import apps.logging.request_logger as bb2logging
 
@@ -167,10 +166,7 @@ def fetch_data(self, request, resource_type, *args, **kwargs):
 
             # Handle the case where it is a patient search call, but neither _id or identifier were passed
             if '_id' not in get_parameters.keys() and 'identifier' not in get_parameters.keys():
-                path_info = request.path
-                version = get_api_version_number_from_url(path_info)
-                # depending on if 4166 is merged first, this will need to be updated
-                get_parameters['_id'] = request.crosswalk.fhir_id(version)
+                get_parameters['_id'] = request.crosswalk.fhir_id(self.version)
                 # Reset the request parameters and the prepped request after adding the missing, but required, _id param
                 req.params = get_parameters
                 prepped = s.prepare_request(req)