Added consentConfig to healthcare FHIR store. (#15039) (#10666)

[upstream:a8d5fd7c57df6a395624bf7895e104796edac202]

Signed-off-by: Modular Magician <[email protected]>

Author: modular-magician

.changelog/15039.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+healthcare: added `consentConfig` field to `healthcare_fhir_store` resource (beta)
+```

google-beta/services/healthcare/resource_healthcare_fhir_store.go

@@ -80,6 +80,69 @@ func ResourceHealthcareFhirStore() *schema.Resource {
 				ValidateFunc: verify.ValidateEnum([]string{"COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED", "DISABLED", "ENABLED", ""}),
 				Description:  `Enable parsing of references within complex FHIR data types such as Extensions. If this value is set to ENABLED, then features like referential integrity and Bundle reference rewriting apply to all references. If this flag has not been specified the behavior of the FHIR store will not change, references in complex data types will not be parsed. New stores will have this value set to ENABLED by default after a notification period. Warning: turning on this flag causes processing existing resources to fail if they contain references to non-existent resources. Possible values: ["COMPLEX_DATA_TYPE_REFERENCE_PARSING_UNSPECIFIED", "DISABLED", "ENABLED"]`,
 			},
+			"consent_config": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Description: `Specifies whether this store has consent enforcement. Not available for DSTU2 FHIR version due to absence of Consent resources. Not supported for R5 FHIR version.`,
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"version": {
+							Type:         schema.TypeString,
+							Required:     true,
+							ValidateFunc: verify.ValidateEnum([]string{"CONSENT_ENFORCEMENT_VERSION_UNSPECIFIED", "V1"}),
+							Description:  `Specifies which consent enforcement version is being used for this FHIR store. This field can only be set once by either [fhirStores.create][] or [fhirStores.patch][]. After that, you must call [fhirStores.applyConsents][] to change the version. Possible values: ["CONSENT_ENFORCEMENT_VERSION_UNSPECIFIED", "V1"]`,
+						},
+						"access_determination_log_config": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							Description: `Specifies how the server logs the consent-aware requests. If not specified, the AccessDeterminationLogConfig.LogLevel.MINIMUM option is used.`,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"log_level": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										ValidateFunc: verify.ValidateEnum([]string{"LOG_LEVEL_UNSPECIFIED", "DISABLED", "MINIMUM", "VERBOSE", ""}),
+										Description:  `Controls the amount of detail to include as part of the audit logs. Default value: "MINIMUM" Possible values: ["LOG_LEVEL_UNSPECIFIED", "DISABLED", "MINIMUM", "VERBOSE"]`,
+										Default:      "MINIMUM",
+									},
+								},
+							},
+						},
+						"access_enforced": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Description: `The default value is false. If set to true, when accessing FHIR resources, the consent headers will be verified against consents given by patients. See the ConsentEnforcementVersion for the supported consent headers.`,
+						},
+						"consent_header_handling": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							Description: `Different options to configure the behaviour of the server when handling the X-Consent-Scope header.`,
+							MaxItems:    1,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"profile": {
+										Type:         schema.TypeString,
+										Optional:     true,
+										ValidateFunc: verify.ValidateEnum([]string{"SCOPE_PROFILE_UNSPECIFIED", "PERMIT_EMPTY_SCOPE", "REQUIRED_ON_READ", ""}),
+										Description:  `Specifies the default server behavior when the header is empty. If not specified, the ScopeProfile.PERMIT_EMPTY_SCOPE option is used. Default value: "PERMIT_EMPTY_SCOPE" Possible values: ["SCOPE_PROFILE_UNSPECIFIED", "PERMIT_EMPTY_SCOPE", "REQUIRED_ON_READ"]`,
+										Default:      "PERMIT_EMPTY_SCOPE",
+									},
+								},
+							},
+						},
+						"enforced_admin_consents": {
+							Type:        schema.TypeList,
+							Computed:    true,
+							Description: `The versioned names of the enforced admin Consent resource(s), in the format projects/{projectId}/locations/{location}/datasets/{datasetId}/fhirStores/{fhirStoreId}/fhir/Consent/{resourceId}/_history/{version_id}. For FHIR stores with disableResourceVersioning=true, the format is projects/{projectId}/locations/{location}/datasets/{datasetId}/fhirStores/{fhirStoreId}/fhir/Consent/{resourceId}. This field can only be updated using [fhirStores.applyAdminConsents][].`,
+							Elem: &schema.Schema{
+								Type: schema.TypeString,
+							},
+						},
+					},
+				},
+			},
 			"default_search_handling_strict": {
 				Type:     schema.TypeBool,
 				Optional: true,
@@ -363,6 +426,12 @@ func resourceHealthcareFhirStoreCreate(d *schema.ResourceData, meta interface{})
 	} else if v, ok := d.GetOkExists("version"); !tpgresource.IsEmptyValue(reflect.ValueOf(versionProp)) && (ok || !reflect.DeepEqual(v, versionProp)) {
 		obj["version"] = versionProp
 	}
+	consentConfigProp, err := expandHealthcareFhirStoreConsentConfig(d.Get("consent_config"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("consent_config"); !tpgresource.IsEmptyValue(reflect.ValueOf(consentConfigProp)) && (ok || !reflect.DeepEqual(v, consentConfigProp)) {
+		obj["consentConfig"] = consentConfigProp
+	}
 	complexDataTypeReferenceParsingProp, err := expandHealthcareFhirStoreComplexDataTypeReferenceParsing(d.Get("complex_data_type_reference_parsing"), d, config)
 	if err != nil {
 		return err
@@ -520,6 +589,9 @@ func resourceHealthcareFhirStoreRead(d *schema.ResourceData, meta interface{}) e
 	if err := d.Set("version", flattenHealthcareFhirStoreVersion(res["version"], d, config)); err != nil {
 		return fmt.Errorf("Error reading FhirStore: %s", err)
 	}
+	if err := d.Set("consent_config", flattenHealthcareFhirStoreConsentConfig(res["consentConfig"], d, config)); err != nil {
+		return fmt.Errorf("Error reading FhirStore: %s", err)
+	}
 	if err := d.Set("complex_data_type_reference_parsing", flattenHealthcareFhirStoreComplexDataTypeReferenceParsing(res["complexDataTypeReferenceParsing"], d, config)); err != nil {
 		return fmt.Errorf("Error reading FhirStore: %s", err)
 	}
@@ -573,6 +645,12 @@ func resourceHealthcareFhirStoreUpdate(d *schema.ResourceData, meta interface{})
 	billingProject := ""
 
 	obj := make(map[string]interface{})
+	consentConfigProp, err := expandHealthcareFhirStoreConsentConfig(d.Get("consent_config"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("consent_config"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, consentConfigProp)) {
+		obj["consentConfig"] = consentConfigProp
+	}
 	complexDataTypeReferenceParsingProp, err := expandHealthcareFhirStoreComplexDataTypeReferenceParsing(d.Get("complex_data_type_reference_parsing"), d, config)
 	if err != nil {
 		return err
@@ -631,6 +709,10 @@ func resourceHealthcareFhirStoreUpdate(d *schema.ResourceData, meta interface{})
 	headers := make(http.Header)
 	updateMask := []string{}
 
+	if d.HasChange("consent_config") {
+		updateMask = append(updateMask, "consentConfig")
+	}
+
 	if d.HasChange("complex_data_type_reference_parsing") {
 		updateMask = append(updateMask, "complexDataTypeReferenceParsing")
 	}
@@ -767,6 +849,73 @@ func flattenHealthcareFhirStoreVersion(v interface{}, d *schema.ResourceData, co
 	return v
 }
 
+func flattenHealthcareFhirStoreConsentConfig(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return nil
+	}
+	original := v.(map[string]interface{})
+	if len(original) == 0 {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+	transformed["version"] =
+		flattenHealthcareFhirStoreConsentConfigVersion(original["version"], d, config)
+	transformed["access_enforced"] =
+		flattenHealthcareFhirStoreConsentConfigAccessEnforced(original["accessEnforced"], d, config)
+	transformed["consent_header_handling"] =
+		flattenHealthcareFhirStoreConsentConfigConsentHeaderHandling(original["consentHeaderHandling"], d, config)
+	transformed["access_determination_log_config"] =
+		flattenHealthcareFhirStoreConsentConfigAccessDeterminationLogConfig(original["accessDeterminationLogConfig"], d, config)
+	transformed["enforced_admin_consents"] =
+		flattenHealthcareFhirStoreConsentConfigEnforcedAdminConsents(original["enforcedAdminConsents"], d, config)
+	return []interface{}{transformed}
+}
+func flattenHealthcareFhirStoreConsentConfigVersion(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenHealthcareFhirStoreConsentConfigAccessEnforced(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenHealthcareFhirStoreConsentConfigConsentHeaderHandling(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return nil
+	}
+	original := v.(map[string]interface{})
+	if len(original) == 0 {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+	transformed["profile"] =
+		flattenHealthcareFhirStoreConsentConfigConsentHeaderHandlingProfile(original["profile"], d, config)
+	return []interface{}{transformed}
+}
+func flattenHealthcareFhirStoreConsentConfigConsentHeaderHandlingProfile(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenHealthcareFhirStoreConsentConfigAccessDeterminationLogConfig(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return nil
+	}
+	original := v.(map[string]interface{})
+	if len(original) == 0 {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+	transformed["log_level"] =
+		flattenHealthcareFhirStoreConsentConfigAccessDeterminationLogConfigLogLevel(original["logLevel"], d, config)
+	return []interface{}{transformed}
+}
+func flattenHealthcareFhirStoreConsentConfigAccessDeterminationLogConfigLogLevel(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenHealthcareFhirStoreConsentConfigEnforcedAdminConsents(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
 func flattenHealthcareFhirStoreComplexDataTypeReferenceParsing(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
 	return v
 }
@@ -989,6 +1138,111 @@ func expandHealthcareFhirStoreVersion(v interface{}, d tpgresource.TerraformReso
 	return v, nil
 }
 
+func expandHealthcareFhirStoreConsentConfig(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	l := v.([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil, nil
+	}
+	raw := l[0]
+	original := raw.(map[string]interface{})
+	transformed := make(map[string]interface{})
+
+	transformedVersion, err := expandHealthcareFhirStoreConsentConfigVersion(original["version"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedVersion); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["version"] = transformedVersion
+	}
+
+	transformedAccessEnforced, err := expandHealthcareFhirStoreConsentConfigAccessEnforced(original["access_enforced"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedAccessEnforced); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["accessEnforced"] = transformedAccessEnforced
+	}
+
+	transformedConsentHeaderHandling, err := expandHealthcareFhirStoreConsentConfigConsentHeaderHandling(original["consent_header_handling"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedConsentHeaderHandling); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["consentHeaderHandling"] = transformedConsentHeaderHandling
+	}
+
+	transformedAccessDeterminationLogConfig, err := expandHealthcareFhirStoreConsentConfigAccessDeterminationLogConfig(original["access_determination_log_config"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedAccessDeterminationLogConfig); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["accessDeterminationLogConfig"] = transformedAccessDeterminationLogConfig
+	}
+
+	transformedEnforcedAdminConsents, err := expandHealthcareFhirStoreConsentConfigEnforcedAdminConsents(original["enforced_admin_consents"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedEnforcedAdminConsents); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["enforcedAdminConsents"] = transformedEnforcedAdminConsents
+	}
+
+	return transformed, nil
+}
+
+func expandHealthcareFhirStoreConsentConfigVersion(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandHealthcareFhirStoreConsentConfigAccessEnforced(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandHealthcareFhirStoreConsentConfigConsentHeaderHandling(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	l := v.([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil, nil
+	}
+	raw := l[0]
+	original := raw.(map[string]interface{})
+	transformed := make(map[string]interface{})
+
+	transformedProfile, err := expandHealthcareFhirStoreConsentConfigConsentHeaderHandlingProfile(original["profile"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedProfile); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["profile"] = transformedProfile
+	}
+
+	return transformed, nil
+}
+
+func expandHealthcareFhirStoreConsentConfigConsentHeaderHandlingProfile(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandHealthcareFhirStoreConsentConfigAccessDeterminationLogConfig(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	l := v.([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil, nil
+	}
+	raw := l[0]
+	original := raw.(map[string]interface{})
+	transformed := make(map[string]interface{})
+
+	transformedLogLevel, err := expandHealthcareFhirStoreConsentConfigAccessDeterminationLogConfigLogLevel(original["log_level"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedLogLevel); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["logLevel"] = transformedLogLevel
+	}
+
+	return transformed, nil
+}
+
+func expandHealthcareFhirStoreConsentConfigAccessDeterminationLogConfigLogLevel(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandHealthcareFhirStoreConsentConfigEnforcedAdminConsents(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
 func expandHealthcareFhirStoreComplexDataTypeReferenceParsing(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
 	return v, nil
 }

google-beta/services/healthcare/resource_healthcare_fhir_store_generated_meta.yaml

@@ -6,6 +6,11 @@ api_version: 'v1beta1'
 api_resource_type_kind: 'FhirStore'
 fields:
   - field: 'complex_data_type_reference_parsing'
+  - field: 'consent_config.access_determination_log_config.log_level'
+  - field: 'consent_config.access_enforced'
+  - field: 'consent_config.consent_header_handling.profile'
+  - field: 'consent_config.enforced_admin_consents'
+  - field: 'consent_config.version'
   - field: 'dataset'
     provider_only: true
   - field: 'default_search_handling_strict'