onc-healthit / onc-certification-g10-test-kit

ONC Certification (g)(10) Standardized API Tests
Apache License 2.0
32 stars 10 forks source link

FI-2031: Integrate SMART App Launch Test Kit update #451

Closed Jammjammjamm closed 11 months ago

Jammjammjamm commented 11 months ago

This branch updates the g10 suite to accomodate the new inputs included in the SMART App Launch Test Kit 0.3.0 release.

Systems using the JSON API to run the g10 tests will need to update their API calls to include the new Client Auth Type & Encryption Method inputs if they using SMART App Launch 2. Presets should not need to be updated. The new inputs which need to be added are:


    {
      "name": "client_auth_type",
      "value": "confidential_symmetric",
    },
    {
      "name": "client_auth_encryption_method",
      "value": "ES384",
    },
    {
      "name": "public_client_auth_type",
      "value": "public",
    },
arscan commented 11 months ago

That locked input for the "Client Authentication Encryption Method" in smart v2 technically should be 'N/A', right? (I know we can't do it, but in a perfect world it wouldn't be shown at all or have n/a. I just wonder if people might read into that incorrectly, like they are missing something by not using ES384 for symmetric authentication.

Could you update the description for that input in that specific case to show below such that it says "Only applicable for Confidential Asymmetric client authentication"

Screenshot 2023-08-07 at 4 27 36 PM

arscan commented 11 months ago

Question 2: Is there a reason why Authorization Method is not locked in the limited access test in smart v2? The description implies that it should be locked. "All other inputs are locked to ensure the same app configuration as in the Standalone Patient App - Full Access test."