RBAC routes configuration file

RBAC configuration file allows to manage access to Kodjin endpoints. Instead of listing HTTP methods and paths, access is now configured per FHIR interaction or operation. Current configuration file provides three levels of access:

access is allowed without token or scope
access is allowed with active and valid token but no scope is required
access is allowed only with proper scope and valid token

Example of the RBAC configuration file

{
    "restful": [
        {
            "interaction": "capabilities",
            "mode": "public"
        }
    ],
    "operation": [
        {
            "interaction": "apply-fhirpath",
            "mode": "token"
        },
        {
            "interaction": "versions",
            "mode": "public"
        },
        {
            "interaction": "base-url-read",
            "mode": "public"
        }
    ]
}

How to read and use file:

restful is an array of rules for RESTful interactions (CRUD, search, history, etc.).
operation is an array of rules for FHIR operations and Kodjin-specific endpoints.
interaction is a string with the name of the interaction or operation. Supported values are listed in the tables below. Interaction is required in each rule.
mode is a string, where only two variants could be used. Mode is required in each rule.

Mode variants are:

"public" - access without token or scope
"token" - access with active and valid token but no scope is required

Any interaction or operation that is not mentioned in this file requires proper scope and valid token for access.

Note

A rule applies to all endpoints covered by the interaction. For example, capabilities covers GET /metadata, and validate-code covers both GET and POST requests on CodeSystem and ValueSet, with or without resource id.

RESTful interactions

Interaction	Description
`create`	Create a new resource with a server assigned id
`read`	Read the current state of the resource
`vread`	Read the state of a specific version of the resource
`update`	Update an existing resource by its id (or create it if it is new)
`patch`	Update an existing resource by posting a set of changes to it
`delete`	Delete a resource
`history-instance`	Retrieve the change history for a particular resource
`history-system`	Retrieve the change history for all resources on a system
`history-type`	Retrieve the change history for all resources of a particular type
`search`	Search a resource type or all resources based on some filter criteria
`capabilities`	`GET /metadata` - get a Capability Statement for the system
`transaction`	Update, create or delete a set of resources as a single transaction
`batch`	Perform a set of separate interactions in a single HTTP operation
`websocket`	Perform a websocket connection
`job`	Get job

Operations

Interaction	Endpoints
`validate`	`POST /{resource_type}/$validate` `POST /{resource_type}/{id}/$validate`
`snapshot`	`POST /StructureDefinition/$snapshot` `POST /StructureDefinition/{id}/$snapshot`
`everything`	`GET /Patient/$everything` `GET /Patient/{id}/$everything`
`summary`	`GET /Patient/$summary` `GET /Patient/{id}/$summary`
`document`	`GET, POST /Composition/$document` `GET /Composition/{id}/$document`
`validate-code`	`GET, POST /CodeSystem/$validate-code` `GET, POST /CodeSystem/{id}/$validate-code` `GET, POST /ValueSet/$validate-code` `GET, POST /ValueSet/{id}/$validate-code`
`expand`	`GET, POST /ValueSet/$expand` `GET, POST /ValueSet/{id}/$expand`
`lookup`	`GET, POST /CodeSystem/$lookup` `GET, POST /CodeSystem/{id}/$lookup`
`translate`	`GET, POST /ConceptMap/$translate` `GET, POST /ConceptMap/{id}/$translate`
`find-matches`	`GET, POST /CodeSystem/$find-matches` `GET, POST /CodeSystem/{id}/$find-matches`
`subsumes`	`GET, POST /CodeSystem/$subsumes` `GET, POST /CodeSystem/{id}/$subsumes`
`export-read`	`GET /export/{id}`
`export-write`	`GET, POST /$export` `DELETE /export/{id}` `GET, POST /Group/{id}/$export` `GET, POST /Patient/$export`
`import-read`	`GET /import/{id}`
`import-write`	`POST /$import` `DELETE /import/{id}`
`graphql`	`GET /$graphql`
`convert-data`	Data conversion
`templates`	Templates
`versions`	`GET /$versions`
`subset`	`POST /CapabilityStatement/$subset` `POST /CapabilityStatement/{id}/$subset`
`purge`	`GET, POST /Patient/{id}/$purge`
`purge-read`	`GET /Patient-purge/{id}`
`bulk-purge`	`GET, POST /Patient/$bulk-purge`
`bulk-purge-read`	`GET /Patient-bulk-purge/{id}`
`system-stats`	`GET /$system-stats`
`reindex`	`GET /$reindex` `GET /reindex/{id}`
`base-url-read`	`GET /fhir-base-url`
`base-url-write`	`POST, PUT, DELETE /fhir-base-url`
`apply-fhirpath`	`POST /$apply-fhirpath`
`smart-style`	`GET /app/smart-style-url`

Migration from the previous format

The previous format (routes with method, path/regex and mode) is replaced. Rules map as follows:

Previous rule	New rule
`POST /$apply-fhirpath`, `token_only`	`operation` → `apply-fhirpath`, `token`
`GET /$versions`, `public`	`operation` → `versions`, `public`
`GET /metadata` (regex), `public`	`restful` → `capabilities`, `public`
`GET /fhir-base-url`, `public`	`operation` → `base-url-read`, `public`

Mode token_only is renamed to token.

The previous format documentation