onc-healthit / onc-certification-g10-test-kit

ONC Certification (g)(10) Standardized API Tests
Apache License 2.0
34 stars 11 forks source link

Token exchange request warning when SMART scopes are not combined (Test 1.4.06) #538

Open Justin-Ramm opened 2 months ago

Justin-Ramm commented 2 months ago

Inferno currently gives a warning if SMART v2.0.0 scopes are returned separately instead of in a combined single scope string. For example, if the token endpoint returns a scope string that includes patient/AllergyIntolerance.r patient/AllergyIntolerance.s, Inferno will have a warning that says:

Token exchange response did not include all requested scopes. These may have been denied by user: patient/AllergyIntolerance.rs

The SMART spec does "recommend" combining scopes into the shortest string possible, but does not make it a strict requirement (in the Scope Equivalence section).

While this is only a warning, I am curious if Inferno should accept separate scope strings as valid without a warning. Perhaps the warning makes sense, but wanted to raise the issue in case this wasn't intended.