001package ca.uhn.fhir.rest.server.interceptor;
002
003/*-
004 * #%L
005 * HAPI FHIR - Server Framework
006 * %%
007 * Copyright (C) 2014 - 2022 Smile CDR, Inc.
008 * %%
009 * Licensed under the Apache License, Version 2.0 (the "License");
010 * you may not use this file except in compliance with the License.
011 * You may obtain a copy of the License at
012 *
013 *      http://www.apache.org/licenses/LICENSE-2.0
014 *
015 * Unless required by applicable law or agreed to in writing, software
016 * distributed under the License is distributed on an "AS IS" BASIS,
017 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
018 * See the License for the specific language governing permissions and
019 * limitations under the License.
020 * #L%
021 */
022
023import ca.uhn.fhir.interceptor.api.Hook;
024import ca.uhn.fhir.interceptor.api.Pointcut;
025import ca.uhn.fhir.rest.api.EncodingEnum;
026import ca.uhn.fhir.rest.api.server.RequestDetails;
027import ca.uhn.fhir.rest.server.RestfulServerUtils;
028import ca.uhn.fhir.rest.server.exceptions.AuthenticationException;
029import ca.uhn.fhir.rest.server.exceptions.UnprocessableEntityException;
030import ca.uhn.fhir.rest.server.method.ResourceParameter;
031import ca.uhn.fhir.validation.FhirValidator;
032import ca.uhn.fhir.validation.ResultSeverityEnum;
033import ca.uhn.fhir.validation.ValidationResult;
034
035import javax.servlet.http.HttpServletRequest;
036import javax.servlet.http.HttpServletResponse;
037import java.nio.charset.Charset;
038
039import static org.apache.commons.lang3.StringUtils.isBlank;
040
041/**
042 * This interceptor intercepts each incoming request and if it contains a FHIR resource, validates that resource. The
043 * interceptor may be configured to run any validator modules, and will then add headers to the response or fail the
044 * request with an {@link UnprocessableEntityException HTTP 422 Unprocessable Entity}.
045 */
046public class RequestValidatingInterceptor extends BaseValidatingInterceptor<String> {
047
048        /**
049         * X-HAPI-Request-Validation
050         */
051        public static final String DEFAULT_RESPONSE_HEADER_NAME = "X-FHIR-Request-Validation";
052        private static final org.slf4j.Logger ourLog = org.slf4j.LoggerFactory.getLogger(RequestValidatingInterceptor.class);
053        private boolean myAddValidationResultsToResponseOperationOutcome = true;
054
055        @Override
056        ValidationResult doValidate(FhirValidator theValidator, String theRequest) {
057                return theValidator.validateWithResult(theRequest);
058        }
059
060        @Hook(Pointcut.SERVER_INCOMING_REQUEST_POST_PROCESSED)
061        public boolean incomingRequestPostProcessed(RequestDetails theRequestDetails, HttpServletRequest theRequest, HttpServletResponse theResponse) throws AuthenticationException {
062                EncodingEnum encoding = RestfulServerUtils.determineRequestEncodingNoDefault(theRequestDetails);
063                if (encoding == null) {
064                        ourLog.trace("Incoming request does not appear to be FHIR, not going to validate");
065                        return true;
066                }
067
068                Charset charset = ResourceParameter.determineRequestCharset(theRequestDetails);
069                String requestText = new String(theRequestDetails.loadRequestContents(), charset);
070
071                if (isBlank(requestText)) {
072                        ourLog.trace("Incoming request does not have a body");
073                        return true;
074                }
075
076                ValidationResult validationResult = validate(requestText, theRequestDetails);
077
078                if (myAddValidationResultsToResponseOperationOutcome) {
079                        addValidationResultToRequestDetails(theRequestDetails, validationResult);
080                }
081
082                return true;
083        }
084
085        /**
086         * If set to {@literal true} (default is true), the validation results
087         * will be added to the OperationOutcome being returned to the client,
088         * unless the response being returned is not an OperationOutcome
089         * to begin with (e.g. if the client has requested
090         * <code>Return: prefer=representation</code>)
091         */
092        public boolean isAddValidationResultsToResponseOperationOutcome() {
093                return myAddValidationResultsToResponseOperationOutcome;
094        }
095
096        /**
097         * If set to {@literal true} (default is true), the validation results
098         * will be added to the OperationOutcome being returned to the client,
099         * unless the response being returned is not an OperationOutcome
100         * to begin with (e.g. if the client has requested
101         * <code>Return: prefer=representation</code>)
102         */
103        public void setAddValidationResultsToResponseOperationOutcome(boolean theAddValidationResultsToResponseOperationOutcome) {
104                myAddValidationResultsToResponseOperationOutcome = theAddValidationResultsToResponseOperationOutcome;
105        }
106
107        @Override
108        String provideDefaultResponseHeaderName() {
109                return DEFAULT_RESPONSE_HEADER_NAME;
110        }
111
112        /**
113         * Sets the name of the response header to add validation failures to
114         *
115         * @see #DEFAULT_RESPONSE_HEADER_NAME
116         * @see #setAddResponseHeaderOnSeverity(ResultSeverityEnum)
117         */
118        @Override
119        public void setResponseHeaderName(String theResponseHeaderName) {
120                super.setResponseHeaderName(theResponseHeaderName);
121        }
122
123}