Case-sensitivity in Conditional Update based on tokens (#7125)

* [7124] fix conditional update case sensitivity

* [7124] add changelog and more test

Author: YalingPeiS

hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/8_4_0/7125-case-sensitivity-in-conditional-update-by-token.yaml

@@ -0,0 +1,7 @@
+---
+type: fix
+issue: 7125
+jira: SMILE-10427
+title: "Previously, conditional updates based on tokens were case-insensitive. As a result, a new resource would be 
+created if the token value in the URL used a different case than the one in the request body, leading to incorrect 
+search results when using token-based search parameters. This issue has now been resolved."

hapi-fhir-jpaserver-model/src/main/java/ca/uhn/fhir/jpa/model/entity/ResourceIndexedSearchParamToken.java

@@ -350,15 +350,15 @@ public boolean matches(IQueryParameterType theParam) {
 
 		// Only match on system if it wasn't specified
 		if (token.getSystem() == null || token.getSystem().isEmpty()) {
-			if (valueString.equalsIgnoreCase(tokenValueString)) {
+			if (valueString.equals(tokenValueString)) {
 				retVal = true;
 			}
 		} else if (tokenValueString == null || tokenValueString.isEmpty()) {
-			if (token.getSystem().equalsIgnoreCase(getSystem())) {
+			if (token.getSystem().equals(getSystem())) {
 				retVal = true;
 			}
 		} else {
-			if (token.getSystem().equalsIgnoreCase(getSystem()) && valueString.equalsIgnoreCase(tokenValueString)) {
+			if (token.getSystem().equals(getSystem()) && valueString.equals(tokenValueString)) {
 				retVal = true;
 			}
 		}

hapi-fhir-jpaserver-model/src/test/java/ca/uhn/fhir/jpa/model/entity/ResourceIndexedSearchParamTokenTest.java

@@ -1,12 +1,15 @@
 package ca.uhn.fhir.jpa.model.entity;
 
 import ca.uhn.fhir.jpa.model.config.PartitionSettings;
+import ca.uhn.fhir.rest.param.TokenParam;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.CsvSource;
 
+import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 public class ResourceIndexedSearchParamTokenTest {
 
@@ -94,4 +97,23 @@ public void testEqualsAndHashCode_withDifferentParams_equalsIsFalseAndHashCodeIs
 		assertNotEquals(param2, param, theMessage);
 		assertNotEquals(param.hashCode(), param2.hashCode(), theMessage);
 	}
+
+	@ParameterizedTest
+	@CsvSource({
+		"system, value, true",
+		",       value, true",
+		"system, ,      true",
+		"SYSTEM, value, false",
+		"system, VALUE, false",
+		",       VALUE, false",
+		"SYSTEM, ,      false",
+		"diffS,  diffV, false",
+	})
+	public void testMatches(String theSystem, String theValue, boolean theExpected) {
+		ResourceIndexedSearchParamToken param = new ResourceIndexedSearchParamToken(
+			new PartitionSettings(), "Patient", "name", "system", "value");
+
+		TokenParam tokenParam = new TokenParam(theSystem, theValue);
+		assertThat(param.matches(tokenParam)).isEqualTo(theExpected);
+	}
 }

hapi-fhir-jpaserver-test-r4/src/test/java/ca/uhn/fhir/jpa/dao/r4/FhirResourceDaoR4CreateTest.java

@@ -456,6 +456,16 @@ public void testConditionalCreateFailsIfMatchUrlDoesntMatch_InTransaction() {
 		}
 	}
 
+	@Test
+	public void testConditionalCreateFailsIfMatchUrlCaseIsDifferent() {
+		Observation obs = new Observation();
+		obs.addIdentifier().setValue("XXX");
+		assertThatThrownBy(() -> myObservationDao.create(obs, "identifier=xxx", newSrd()))
+			.isInstanceOf(InvalidRequestException.class)
+			.hasMessage(Msg.code(929) +
+				"Failed to process conditional create. The supplied resource did not satisfy the conditional URL.");
+	}
+
 	@Test
 	public void testCreateResource_withConditionalCreate_willAddSearchUrlEntity(){
 		// given