001package ca.uhn.fhir.rest.server.interceptor.auth;
002
003/*
004 * #%L
005 * HAPI FHIR - Server Framework
006 * %%
007 * Copyright (C) 2014 - 2022 Smile CDR, Inc.
008 * %%
009 * Licensed under the Apache License, Version 2.0 (the "License");
010 * you may not use this file except in compliance with the License.
011 * You may obtain a copy of the License at
012 *
013 *      http://www.apache.org/licenses/LICENSE-2.0
014 *
015 * Unless required by applicable law or agreed to in writing, software
016 * distributed under the License is distributed on an "AS IS" BASIS,
017 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
018 * See the License for the specific language governing permissions and
019 * limitations under the License.
020 * #L%
021 */
022
023import java.util.Collection;
024import java.util.List;
025
026import org.hl7.fhir.instance.model.api.IIdType;
027
028import javax.annotation.Nonnull;
029
030public interface IAuthRuleBuilderRuleOpClassifier {
031
032        /**
033         * Rule applies to resources in the given compartment.
034         * <p>
035         * For example, to apply the rule to any observations in the patient compartment
036         * belonging to patient "123", you would invoke this with</br>
037         * <code>inCompartment("Patient", new IdType("Patient", "123"))</code>
038         * </p>
039         * <p>
040         * This call completes the rule and adds the rule to the chain. 
041         * </p>
042         * 
043         * @param theCompartmentName The name of the compartment (must not be null or blank)
044         * @param theOwner The owner of the compartment. Note that both the resource type and ID must be populated in this ID.
045         */
046        IAuthRuleBuilderRuleOpClassifierFinished inCompartment(String theCompartmentName, IIdType theOwner);
047
048        /**
049         * Rule applies to resources in the given compartment.
050         * <p>
051         * For example, to apply the rule to any observations in the patient compartment
052         * belonging to patient "123", you would invoke this with</br>
053         * <code>inCompartment("Patient", new IdType("Patient", "123"))</code>
054         *
055         * This call also allows you to pass additional search parameters that count as being included in the given compartment,
056         * passed in as a list of `resourceType:search-parameter-name`. For example, if you select a compartment name of "patient",
057         * you could pass in a singleton list consisting of the string "device:patient", which would cause any devices belonging
058         * to the patient to be permitted by the authorization rule.
059         *
060         * </p>
061         * <p>
062         * This call completes the rule and adds the rule to the chain.
063         * </p>
064         *
065         * @param theCompartmentName The name of the compartment (must not be null or blank)
066         * @param theOwner The owner of the compartment. Note that both the resource type and ID must be populated in this ID.
067         * @param theAdditionalTypeSearchParamNames A list of strings for additional resource types and search parameters which count as being in the compartment, in the form "resourcetype:search-parameter-name".
068         */
069        IAuthRuleBuilderRuleOpClassifierFinished inCompartmentWithAdditionalSearchParams(String theCompartmentName, IIdType theOwner, AdditionalCompartmentSearchParameters theAdditionalTypeSearchParamNames);
070
071
072        /**
073         * Rule applies to resources in the given compartment.
074         * <p>
075         * For example, to apply the rule to any observations in the patient compartment
076         * belonging to patient "123", you would invoke this with</br>
077         * <code>inCompartment("Patient", new IdType("Patient", "123"))</code>
078         * </p>
079         * <p>
080         * This call completes the rule and adds the rule to the chain. 
081         * </p>
082         * 
083         * @param theCompartmentName The name of the compartment (must not be null or blank)
084         * @param theOwners The owner of the compartment. Note that both the resource type and ID must be populated in this ID.
085         */
086        IAuthRuleBuilderRuleOpClassifierFinished inCompartment(String theCompartmentName, Collection<? extends IIdType> theOwners);
087
088
089        /**
090         * Rule applies to resources in the given compartment.
091         * <p>
092         * For example, to apply the rule to any observations in the patient compartment
093         * belonging to patient "123", you would invoke this with</br>
094         * <code>inCompartment("Patient", new IdType("Patient", "123"))</code>
095         *
096         * This call also allows you to pass additional search parameters that count as being included in the given compartment,
097         * passed in as a list of `resourceType:search-parameter-name`. For example, if you select a compartment name of "patient",
098         * you could pass in a singleton list consisting of the string "device:patient", which would cause any devices belonging
099         * to the patient to be permitted by the authorization rule.
100         *
101         * </p>
102         * <p>
103         * This call completes the rule and adds the rule to the chain.
104         * </p>
105         *
106         * @param theCompartmentName The name of the compartment (must not be null or blank)
107         * @param theOwners The owners of the compartment. Note that both the resource type and ID must be populated in these IDs.
108         * @param theAdditionalTypeSearchParamNames A {@link AdditionalCompartmentSearchParameters} which allows you to expand the search space for what is considered "in" the compartment.
109         *
110         **/
111        IAuthRuleBuilderRuleOpClassifierFinished inCompartmentWithAdditionalSearchParams(String theCompartmentName, Collection<? extends IIdType> theOwners, AdditionalCompartmentSearchParameters theAdditionalTypeSearchParamNames);
112
113
114        /**
115         * Rule applies to any resource instances
116         * <p>
117         * This call completes the rule and adds the rule to the chain. 
118         * </p>
119         */
120        IAuthRuleBuilderRuleOpClassifierFinished withAnyId();
121
122        /**
123         * Rule applies to resources where the given search parameter would be satisfied by a code in the given ValueSet
124         * @param theSearchParameterName The search parameter name, e.g. <code>"code"</code>
125         * @param theValueSetUrl The valueset URL, e.g. <code>"http://my-value-set"</code>
126         * @since 6.0.0
127         */
128        IAuthRuleBuilderRuleOpClassifierFinished withCodeInValueSet(@Nonnull String theSearchParameterName, @Nonnull String theValueSetUrl);
129
130        /**
131         * Rule applies to resources where the given search parameter would be satisfied by a code not in the given ValueSet
132         * @param theSearchParameterName The search parameter name, e.g. <code>"code"</code>
133         * @param theValueSetUrl The valueset URL, e.g. <code>"http://my-value-set"</code>
134         * @since 6.0.0
135         */
136        IAuthRuleFinished withCodeNotInValueSet(@Nonnull String theSearchParameterName, @Nonnull String theValueSetUrl);
137}