7385 fix 401 unauthorized response does not include operation outcome (#7389)

* Inferno test parsing failure when 401 rejection does not contain OperationOutcome - failing test

* Inferno test parsing failure when 401 rejection does not contain OperationOutcome - implementation

* Inferno test parsing failure when 401 rejection does not contain OperationOutcome - changelog

Author: volodymyr-korzh

hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/8_8_0/7385-fix-401-unauthorized-response-does-not-include-operation-outcome.yaml

@@ -0,0 +1,6 @@
+---
+type: fix
+issue: 7385
+jira: SMILE-11170
+title: "The HTTP 401 Unauthorized response now returns a FHIR OperationOutcome resource instead of a plain text message. 
+This ensures compliance with Inferno ONC Certification expectations by resolving response body parsing failures."

hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/RestfulServer.java

@@ -45,10 +45,8 @@
 import ca.uhn.fhir.rest.api.server.IRestfulServer;
 import ca.uhn.fhir.rest.api.server.RequestDetails;
 import ca.uhn.fhir.rest.server.RestfulServerUtils.ResponseEncoding;
-import ca.uhn.fhir.rest.server.exceptions.AuthenticationException;
 import ca.uhn.fhir.rest.server.exceptions.BaseServerResponseException;
 import ca.uhn.fhir.rest.server.exceptions.InvalidRequestException;
-import ca.uhn.fhir.rest.server.exceptions.NotModifiedException;
 import ca.uhn.fhir.rest.server.exceptions.ResourceGoneException;
 import ca.uhn.fhir.rest.server.exceptions.ResourceNotFoundException;
 import ca.uhn.fhir.rest.server.interceptor.ExceptionHandlingInterceptor;
@@ -99,7 +97,6 @@
 import java.util.List;
 import java.util.ListIterator;
 import java.util.Map;
-import java.util.Map.Entry;
 import java.util.Set;
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReentrantLock;
@@ -1211,23 +1208,6 @@ && isNotBlank(contentType)
 			hookParams.add(ServletRequestDetails.class, requestDetails);
 			myInterceptorService.callHooks(Pointcut.SERVER_PROCESSING_COMPLETED_NORMALLY, hookParams);
 
-		} catch (NotModifiedException | AuthenticationException e) {
-
-			unhandledException = e;
-
-			HookParams handleExceptionParams = new HookParams();
-			handleExceptionParams.add(RequestDetails.class, requestDetails);
-			handleExceptionParams.add(ServletRequestDetails.class, requestDetails);
-			handleExceptionParams.add(HttpServletRequest.class, theRequest);
-			handleExceptionParams.add(HttpServletResponse.class, theResponse);
-			handleExceptionParams.add(BaseServerResponseException.class, e);
-			if (!myInterceptorService.callHooks(Pointcut.SERVER_HANDLE_EXCEPTION, handleExceptionParams)) {
-				return;
-			}
-
-			writeExceptionToResponse(theResponse, e);
-			unhandledException = null;
-
 		} catch (Throwable e) {
 
 			unhandledException = e;
@@ -2075,26 +2055,6 @@ private void unregisterAllProviders(List<?> theProviders) {
 		}
 	}
 
-	private void writeExceptionToResponse(HttpServletResponse theResponse, BaseServerResponseException theException)
-			throws IOException {
-		theResponse.setStatus(theException.getStatusCode());
-		addHeadersToResponse(theResponse);
-		if (theException.hasResponseHeaders()) {
-			for (Entry<String, List<String>> nextEntry :
-					theException.getResponseHeaders().entrySet()) {
-				for (String nextValue : nextEntry.getValue()) {
-					if (isNotBlank(nextValue)) {
-						theResponse.addHeader(nextEntry.getKey(), nextValue);
-					}
-				}
-			}
-		}
-		theResponse.setContentType("text/plain");
-		theResponse.setCharacterEncoding("UTF-8");
-		String message = UrlUtil.sanitizeUrlPart(theException.getMessage());
-		theResponse.getWriter().write(message);
-	}
-
 	/**
 	 * By default, server create/update/patch/transaction methods return a copy of the resource
 	 * as it was stored. This may be overridden by the client using the

hapi-fhir-structures-dstu3/src/test/java/ca/uhn/fhir/rest/server/ServerExceptionDstu3Test.java

@@ -40,6 +40,7 @@
 import java.util.List;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 
 public class ServerExceptionDstu3Test {
@@ -187,22 +188,43 @@ public void testPostWithNoBody() throws IOException {
 	}
 
 
+	/**
+	 * Ensures that when an {@link ca.uhn.fhir.rest.server.exceptions.AuthenticationException} is handled and
+	 * an <b>HTTP 401 Unauthorized</b> response is generated, the server returns a FHIR
+	 * {@code OperationOutcome} rather than plain text. This prevents JSON parse failures in
+	 * ONC Inferno’s SMART v2 tests.
+	 * <p>
+	 * These parse failures were observed in the <b>Granular Scopes 2</b> section, specifically in:
+	 * <ul>
+	 * <li>Server filters results for Condition reads based on granular scopes</li>
+	 * <li>Server filters results for Observation reads based on granular scopes</li>
+	 * </ul>
+	 * For details, see: <a href="https://github.com/hapifhir/hapi-fhir/issues/7385">#7385</a>
+	 */
 	@Test
 	public void testAuthorize() throws Exception {
-
+		// setup
 		OperationOutcome operationOutcome = new OperationOutcome();
 		operationOutcome.addIssue().setCode(IssueType.BUSINESSRULE);
-
 		ourException = new AuthenticationException().addAuthenticateHeaderForRealm("REALM");
 
+		// execute
 		HttpGet httpGet = new HttpGet(ourServer.getBaseUrl() + "/Patient");
 		try (CloseableHttpResponse status = ourClient.execute(httpGet)) {
 			String responseContent = IOUtils.toString(status.getEntity().getContent(), StandardCharsets.UTF_8);
 			ourLog.info(status.getStatusLine().toString());
 			ourLog.info(responseContent);
 
+			// validate
 			assertEquals(401, status.getStatusLine().getStatusCode());
 			assertEquals("Basic realm=\"REALM\"", status.getFirstHeader("WWW-Authenticate").getValue());
+			OperationOutcome outcome = assertDoesNotThrow(() ->
+				 ourCtx.newXmlParser().parseResource(OperationOutcome.class, responseContent));
+			assertThat(outcome.getIssue()).hasSize(1);
+			OperationOutcome.OperationOutcomeIssueComponent issue = outcome.getIssueFirstRep();
+			assertEquals(OperationOutcome.IssueSeverity.ERROR, issue.getSeverity());
+			assertEquals(OperationOutcome.IssueType.PROCESSING, issue.getCode());
+			assertEquals("Client unauthorized", issue.getDiagnostics());
 		}
 
 	}