Feature - Permit Bulk Export on Compartment by FHIR Query

hapi-fhir-docs/src/main/resources/ca/uhn/hapi/fhir/changelog/8_6_0/7342-enhance-rulebuilder-to-support-compartments-by-matchers.yaml

@@ -0,0 +1,4 @@
+---
+type: add
+issue: 7342
+title: "Enhanced the bulk export RuleBuilder code to support the identification of allowable Groups/Patients to export by a FHIR query matcher."

hapi-fhir-jpaserver-base/src/main/java/ca/uhn/fhir/jpa/config/JpaConfig.java

@@ -93,6 +93,7 @@
 import ca.uhn.fhir.jpa.entity.TermValueSet;
 import ca.uhn.fhir.jpa.esr.ExternallyStoredResourceServiceRegistry;
 import ca.uhn.fhir.jpa.graphql.DaoRegistryGraphQLStorageServices;
+import ca.uhn.fhir.jpa.interceptor.AuthResourceResolver;
 import ca.uhn.fhir.jpa.interceptor.CascadingDeleteInterceptor;
 import ca.uhn.fhir.jpa.interceptor.JpaConsentContextServices;
 import ca.uhn.fhir.jpa.interceptor.OverridePathBasedReferentialIntegrityForDeletesInterceptor;
@@ -205,6 +206,7 @@
 import ca.uhn.fhir.rest.api.server.storage.IResourcePersistentId;
 import ca.uhn.fhir.rest.server.interceptor.ResponseTerminologyTranslationInterceptor;
 import ca.uhn.fhir.rest.server.interceptor.ResponseTerminologyTranslationSvc;
+import ca.uhn.fhir.rest.server.interceptor.auth.IAuthResourceResolver;
 import ca.uhn.fhir.rest.server.interceptor.consent.IConsentContextServices;
 import ca.uhn.fhir.rest.server.interceptor.partition.RequestTenantPartitionInterceptor;
 import ca.uhn.fhir.rest.server.util.ISearchParamRegistry;
@@ -530,6 +532,11 @@ public IConsentContextServices consentContextServices() {
 		return new JpaConsentContextServices();
 	}
 
+	@Bean
+	public IAuthResourceResolver authResourceResolver(DaoRegistry theDaoRegistry) {
+		return new AuthResourceResolver(theDaoRegistry);
+	}
+
 	@Bean
 	@Lazy
 	public DiffProvider diffProvider() {

hapi-fhir-jpaserver-base/src/main/java/ca/uhn/fhir/jpa/interceptor/AuthResourceResolver.java

@@ -0,0 +1,59 @@
+/*-
+ * #%L
+ * HAPI FHIR JPA Server
+ * %%
+ * Copyright (C) 2014 - 2025 Smile CDR, Inc.
+ * %%
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * #L%
+ */
+package ca.uhn.fhir.jpa.interceptor;
+
+import ca.uhn.fhir.jpa.api.dao.DaoRegistry;
+import ca.uhn.fhir.jpa.searchparam.SearchParameterMap;
+import ca.uhn.fhir.rest.api.Constants;
+import ca.uhn.fhir.rest.api.server.SystemRequestDetails;
+import ca.uhn.fhir.rest.param.TokenOrListParam;
+import ca.uhn.fhir.rest.server.interceptor.auth.IAuthResourceResolver;
+import org.hl7.fhir.instance.model.api.IBaseResource;
+import org.hl7.fhir.instance.model.api.IIdType;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+/**
+ * Small service class to inject DB access into an interceptor
+ * For example, used in bulk export security to allow querying for resource to match against permission argument filters
+ */
+@Service
+public class AuthResourceResolver implements IAuthResourceResolver {
+	private final DaoRegistry myDaoRegistry;
+
+	public AuthResourceResolver(DaoRegistry myDaoRegistry) {
+		this.myDaoRegistry = myDaoRegistry;
+	}
+
+	public IBaseResource resolveCompartmentById(IIdType theResourceId) {
+		return myDaoRegistry
+				.getResourceDao(theResourceId.getResourceType())
+				.read(theResourceId, new SystemRequestDetails());
+	}
+
+	public List<IBaseResource> resolveCompartmentByIds(List<String> theResourceIds, String theResourceType) {
+		TokenOrListParam t = new TokenOrListParam(null, theResourceIds.toArray(String[]::new));
+
+		SearchParameterMap m = new SearchParameterMap();
+		m.add(Constants.PARAM_ID, t);
+		return myDaoRegistry.getResourceDao(theResourceType).searchForResources(m, new SystemRequestDetails());
+	}
+}

hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/BaseRule.java

@@ -93,6 +93,31 @@ private boolean applyTesters(
 		return retVal;
 	}
 
+	/**
+	 * Apply testers, and return true if at least 1 tester matches.
+	 * Returns false if all testers do not match.
+	 */
+	boolean applyTestersAtLeastOneMatch(
+			RestOperationTypeEnum theOperation,
+			RequestDetails theRequestDetails,
+			IBaseResource theInputResource,
+			IRuleApplier theRuleApplier) {
+
+		boolean retVal = false;
+
+		IAuthRuleTester.RuleTestRequest inputRequest = new IAuthRuleTester.RuleTestRequest(
+				myMode, theOperation, theRequestDetails, null, theInputResource, theRuleApplier);
+
+		for (IAuthRuleTester next : getTesters()) {
+			if (next.matches(inputRequest)) {
+				retVal = true;
+				break;
+			}
+		}
+
+		return retVal;
+	}
+
 	PolicyEnum getMode() {
 		return myMode;
 	}

hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/IAuthResourceResolver.java

@@ -0,0 +1,41 @@
+/*-
+ * #%L
+ * HAPI FHIR - Server Framework
+ * %%
+ * Copyright (C) 2014 - 2025 Smile CDR, Inc.
+ * %%
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * #L%
+ */
+package ca.uhn.fhir.rest.server.interceptor.auth;
+
+import org.hl7.fhir.instance.model.api.IBaseResource;
+import org.hl7.fhir.instance.model.api.IIdType;
+
+import java.util.List;
+
+/**
+ * Small service class to inject DB access into an interceptor
+ * For example, used in bulk export security to allow querying for resource to match against permission argument filters
+ */
+public interface IAuthResourceResolver {
+	IBaseResource resolveCompartmentById(IIdType theResourceId);
+
+	/**
+	 * Resolve a list of resources by ID. All resources should be the same type.
+	 * @param theResourceIds the FHIR id of the resource(s)
+	 * @param theResourceType the type of resource
+	 * @return A list of resources resolved by ID
+	 */
+	List<IBaseResource> resolveCompartmentByIds(List<String> theResourceIds, String theResourceType);
+}

hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/IAuthRuleBuilderRule.java

@@ -127,6 +127,22 @@ public interface IAuthRuleBuilderRule {
 	 */
 	IAuthRuleBuilderRuleBulkExport bulkExport();
 
+	/**
+	 * This rule permits the user to initiate a FHIR bulk export
+	 * by providing a filter matcher on Group compartment(s).
+	 *
+	 * @since 8.6.0
+	 */
+	IAuthRuleBuilderRuleGroupMatcherBulkExport bulkExportGroupCompartmentMatcher();
+
+	/**
+	 * This rule permits the user to initiate a FHIR bulk export
+	 * by providing a filter matcher on Patient compartment(s).
+	 *
+	 * @since 8.6.0
+	 */
+	IAuthRuleBuilderRulePatientMatcherBulkExport bulkExportPatientCompartmentMatcher();
+
 	/**
 	 * This rule specifically allows a user to perform a FHIR update on the historical version of a resource
 	 *

hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/IAuthRuleBuilderRuleGroupMatcherBulkExport.java

@@ -0,0 +1,34 @@
+/*-
+ * #%L
+ * HAPI FHIR - Server Framework
+ * %%
+ * Copyright (C) 2014 - 2025 Smile CDR, Inc.
+ * %%
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * #L%
+ */
+package ca.uhn.fhir.rest.server.interceptor.auth;
+
+import jakarta.annotation.Nonnull;
+
+/**
+ * @since 8.6.0
+ */
+public interface IAuthRuleBuilderRuleGroupMatcherBulkExport {
+	/**
+	 * Allow/deny <b>group-level</b> export rule applies to the Group with the given resource ID, e.g. <code>Group/123</code>
+	 *
+	 * @since 8.6.0
+	 */
+	IAuthRuleBuilderRuleBulkExportWithTarget groupExportOnGroup(@Nonnull String theCompartmentFilterMatcher);
+}

hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/IAuthRuleBuilderRulePatientMatcherBulkExport.java

@@ -0,0 +1,34 @@
+/*-
+ * #%L
+ * HAPI FHIR - Server Framework
+ * %%
+ * Copyright (C) 2014 - 2025 Smile CDR, Inc.
+ * %%
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * #L%
+ */
+package ca.uhn.fhir.rest.server.interceptor.auth;
+
+import jakarta.annotation.Nonnull;
+
+/**
+ * @since 8.6.0
+ */
+public interface IAuthRuleBuilderRulePatientMatcherBulkExport {
+	/**
+	 * Allow/deny <b>group-level</b> export rule applies to the Group with the given resource ID, e.g. <code>Group/123</code>
+	 *
+	 * @since 8.6.0
+	 */
+	IAuthRuleBuilderRuleBulkExportWithTarget patientExportOnPatient(@Nonnull String theCompartmentFilterMatcher);
+}

hapi-fhir-server/src/main/java/ca/uhn/fhir/rest/server/interceptor/auth/IRuleApplier.java

@@ -50,5 +50,15 @@ Verdict applyRulesAndReturnDecision(
 	default IAuthorizationSearchParamMatcher getSearchParamMatcher() {
 		return null;
 	}
-	;
+
+	/**
+	 * The auth resource resolve is a service that allows you to query the DB for a resource, given a resource ID
+	 * WARNING: This is slow, and should have limited use in authorization.
+	 *
+	 * It is currently used for bulk-export, to support permissible Group/Patient exports by matching a FHIR query
+	 * This is ok, since bulk-export is a slow and (relatively) rare operation
+	 */
+	default IAuthResourceResolver getAuthResourceResolver() {
+		return null;
+	}
 }