Bug with Referential Integrity on Write when Referencing Resources with Client Assigned IDs by PID

[jdar8]

Describe the bug If you POST/PUT a Resource with a reference to another Resource, using the res_id (PID) value of the target instead of the fhir_id (forced ID), the Resource is accepted.

Some additional context: The FHIR specification here defines a literal reference as a relative or absolute URL pointing to a resource. Based on my understanding, the relative or absolute URL should be following the same requirements as the URL used for a RESTful read request, which is defined here as [base]/[type]/[id] where [id] is the logical id that appears in the resource.

When we create a resource using a client-assigned ID, the client-assigned ID appears as the logical id in the resource and as such should be required when referencing the resource elsewhere. In other words, we should be able to use the reference to look up the referenced resource. This does not appear to always be the case. See my test findings below.

Additionally, the correct behaviour can be observed when JpaStorageSettings.ClientIdStrategyEnum = ANY

To Reproduce Steps to reproduce the behavior:

1. Ensure referential integrity on write is enabled
2. Create a resource using PUT with a client assigned ID
3. Query the database for the res_id (PID) of this resource
4. Try reading the resource by PID vs by client assigned ID. Note that we get 404 when referencing by PID, and 200 when referencing by client assigned ID
5. Create a second resource that references the first using it's PID --> This is successful (when it shouldn't be)

Expected behavior It should fail to create a resource with a PID reference to another resource created with a client assigned ID