hapifhir / hapi-fhir

🔥 HAPI FHIR - Java API for HL7 FHIR Clients and Servers
http://hapifhir.io
Apache License 2.0
2.04k stars 1.33k forks source link

SearchNarrowingInterceptor does not consider fully qualified ids #3249

Open nigtrifork opened 2 years ago

nigtrifork commented 2 years ago

Describe the bug Given a Patient resource https://my-server/fhir/Patient/1234 and compartment Patient/1234 When I search for RelatedPerson GET https://my-server/fhir/RelatedPerson?patient=https://my-server/fhir/Patient/1234 Then the server responds with 403 Unauthorized

(Note: URL encoding is omitted for readability)

However, When I search for RelatedPerson GET https://my-server/fhir/RelatedPerson?patient=Patient/1234 Then the server responds with all RelatedPersons with patient=https://my-server/fhir/Patient/1234

To Reproduce Steps to reproduce the behavior:

Expected behavior GET https://my-server/fhir/RelatedPerson?patient=https://my-server/fhir/Patient/1234 and GET https://my-server/fhir/RelatedPerson?patient=Patient/1234 should be equivalent,

Environment (please complete the following information):

Additional context Worked in 5.5.3

jvitrifork commented 2 years ago

@tadgh - any chance you will have a look at this?

tadgh commented 2 years ago

If I'm being honest I didn't even know you could do that search by absolute patient reference. Since this looks like a regression I'd be happy to fix it if we can find out what regressed it.

If you can get a failing unit test I'd be happy to git bisect the repository to find out what caused the change and why. Sadly I don't have the time to dedicate to writing one myself at the moment.