Incorrect Visibility Error for Resource with Granular Scopes

[ahsancloudcode]

In test 9.14, an error occurs stating that a laboratory Observation (ID 2012afbe-c363-4844-8b94-9d53c670e851) is not visible when using granular scopes, even though it is visible when using resource-level scopes. This message seems incorrect, as the resource is accessible under resource-level scopes and the granular scopes restrictions are working as expected in other scenarios.

Steps to Reproduce:

Run the test with granular scopes, encountering the error about resource visibility.

Manually verify that the same resource is visible when using resource-level scopes.

Expected Behavior:
The resource should either be visible or correctly restricted according to the granular scopes configuration.

Actual Behavior:

The resource is incorrectly flagged as inaccessible under granular scopes.

[karlnaden]

Please include a read-only link to your test session demonstrating the error using the "share session" button in the top right of the Inferno UI so that the Inferno team can reproduce the issue and determine a fix. Without the session, we're not able to evaluate what might be causing Inferno to flag that resource are incorrectly blocked.

[ahsancloudcode]

https://inferno.healthit.gov/suites/g10_certification/63hrYp0WZES/#g10_certification-Group06-g10_smart_fine_grained_scopes-Group02

[karlnaden]

I wasn't able to find an error related to the Observation with id 2012afbe-c363-4844-8b94-9d53c670e851, so I looked closer at the failure for the Observation with id bmi-39156-5 on test 9.14.2.3.01. Inferno is failing because the query https://api-datamanager.carecloud.com:8081/api/fhir/R4/DCM/Observation?category=http://terminology.hl7.org/CodeSystem/observation-category%7Cvital-signs&patient=6392821898263 (11th query associated with the test is the original query made with resource-level scopes) includes in the query parameters a search for one of the extact categories included in the granular scope for Observation: category=http://terminology.hl7.org/CodeSystem/observation-category|vital-signs. That query made with the resource-level scope for Observation returned results, including bmi-39156-5 which has a category of http://terminology.hl7.org/CodeSystem/observation-category|vital-signs. Therefore, Inferno requires that the same query made with the granular scopes, including Observation.rs?category=http://terminology.hl7.org/CodeSystem/observation-category|vital-signs will return bmi-39156-5. However, when Inferno made this query (last request associated with the test), it got back a 403 error. That does not meet the requirements to return bmi-39156-5, so Inferno is failing the test.

Based on that, it looks like the test is failing due to an issue in your system. If there is a different failure that you think is incorrect, please point me to a specific test and pair of requests that you think Inferno isn't evaluating correctly.

[ahsancloudcode]

Please the this URL:

https://inferno.healthit.gov/suites/g10_certification/4S2BJaFFq2b/#9.14.1/view

[karlnaden]

I can't see anything wrong in the screenshot. Inferno tried to perform a read on a resource that it believes to be in the granular scope and did not receive the resource back. If there's something you think is a problem, please provide more detail.

When visiting the session, I do see some purple errors which do indicate a problem in Inferno

On investigation, this error is occurs when a resource-level scope is provided in the granular scopes tests. We will fix that bug. However, the condition under which it happens will always fail the "Required granular scopes were granted" test (e.g., 9.14.1.1.2.08), so this is not blocking your certification. We will plan to release a fix in the January release.

[ahsancloudcode]

We are inquiring about an issue related to section 9.14.1.2.03, as shown in the attached image. The server is returning a 403 error when attempting to fetch condition results based on granular scopes. Could you please review this and help us understand the cause of this error?
https://inferno.healthit.gov/suites/g10_certification/4S2BJaFFq2b/#9.14.1/view

[karlnaden]

Inferno believes that access to resource Condition/6309281895791 is granted by the granted granular scopes, so it is attempting a read of that resource that must succeed. Your system returns a failure on the read, so Inferno returns a failure.

Do you have any evidence that Condition/6309281895791 is not within the granted granular scopes?

[karlnaden]

The fix to the bug where Inferno was failing due to a parsing error when a non-granular scope was included (the purple failure on tests 9.14.1.2.01 and 02) has been deployed to inferno.healthit.gov.