001package ca.uhn.fhir.rest.server.interceptor.auth; 002 003/* 004 * #%L 005 * HAPI FHIR - Server Framework 006 * %% 007 * Copyright (C) 2014 - 2022 Smile CDR, Inc. 008 * %% 009 * Licensed under the Apache License, Version 2.0 (the "License"); 010 * you may not use this file except in compliance with the License. 011 * You may obtain a copy of the License at 012 * 013 * http://www.apache.org/licenses/LICENSE-2.0 014 * 015 * Unless required by applicable law or agreed to in writing, software 016 * distributed under the License is distributed on an "AS IS" BASIS, 017 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 018 * See the License for the specific language governing permissions and 019 * limitations under the License. 020 * #L% 021 */ 022 023import java.util.Collection; 024import java.util.List; 025 026import org.hl7.fhir.instance.model.api.IIdType; 027 028import javax.annotation.Nonnull; 029 030public interface IAuthRuleBuilderRuleOpClassifier { 031 032 /** 033 * Rule applies to resources in the given compartment. 034 * <p> 035 * For example, to apply the rule to any observations in the patient compartment 036 * belonging to patient "123", you would invoke this with</br> 037 * <code>inCompartment("Patient", new IdType("Patient", "123"))</code> 038 * </p> 039 * <p> 040 * This call completes the rule and adds the rule to the chain. 041 * </p> 042 * 043 * @param theCompartmentName The name of the compartment (must not be null or blank) 044 * @param theOwner The owner of the compartment. Note that both the resource type and ID must be populated in this ID. 045 */ 046 IAuthRuleBuilderRuleOpClassifierFinished inCompartment(String theCompartmentName, IIdType theOwner); 047 048 /** 049 * Rule applies to resources in the given compartment. 050 * <p> 051 * For example, to apply the rule to any observations in the patient compartment 052 * belonging to patient "123", you would invoke this with</br> 053 * <code>inCompartment("Patient", new IdType("Patient", "123"))</code> 054 * 055 * This call also allows you to pass additional search parameters that count as being included in the given compartment, 056 * passed in as a list of `resourceType:search-parameter-name`. For example, if you select a compartment name of "patient", 057 * you could pass in a singleton list consisting of the string "device:patient", which would cause any devices belonging 058 * to the patient to be permitted by the authorization rule. 059 * 060 * </p> 061 * <p> 062 * This call completes the rule and adds the rule to the chain. 063 * </p> 064 * 065 * @param theCompartmentName The name of the compartment (must not be null or blank) 066 * @param theOwner The owner of the compartment. Note that both the resource type and ID must be populated in this ID. 067 * @param theAdditionalTypeSearchParamNames A list of strings for additional resource types and search parameters which count as being in the compartment, in the form "resourcetype:search-parameter-name". 068 */ 069 IAuthRuleBuilderRuleOpClassifierFinished inCompartmentWithAdditionalSearchParams(String theCompartmentName, IIdType theOwner, AdditionalCompartmentSearchParameters theAdditionalTypeSearchParamNames); 070 071 072 /** 073 * Rule applies to resources in the given compartment. 074 * <p> 075 * For example, to apply the rule to any observations in the patient compartment 076 * belonging to patient "123", you would invoke this with</br> 077 * <code>inCompartment("Patient", new IdType("Patient", "123"))</code> 078 * </p> 079 * <p> 080 * This call completes the rule and adds the rule to the chain. 081 * </p> 082 * 083 * @param theCompartmentName The name of the compartment (must not be null or blank) 084 * @param theOwners The owner of the compartment. Note that both the resource type and ID must be populated in this ID. 085 */ 086 IAuthRuleBuilderRuleOpClassifierFinished inCompartment(String theCompartmentName, Collection<? extends IIdType> theOwners); 087 088 089 /** 090 * Rule applies to resources in the given compartment. 091 * <p> 092 * For example, to apply the rule to any observations in the patient compartment 093 * belonging to patient "123", you would invoke this with</br> 094 * <code>inCompartment("Patient", new IdType("Patient", "123"))</code> 095 * 096 * This call also allows you to pass additional search parameters that count as being included in the given compartment, 097 * passed in as a list of `resourceType:search-parameter-name`. For example, if you select a compartment name of "patient", 098 * you could pass in a singleton list consisting of the string "device:patient", which would cause any devices belonging 099 * to the patient to be permitted by the authorization rule. 100 * 101 * </p> 102 * <p> 103 * This call completes the rule and adds the rule to the chain. 104 * </p> 105 * 106 * @param theCompartmentName The name of the compartment (must not be null or blank) 107 * @param theOwners The owners of the compartment. Note that both the resource type and ID must be populated in these IDs. 108 * @param theAdditionalTypeSearchParamNames A {@link AdditionalCompartmentSearchParameters} which allows you to expand the search space for what is considered "in" the compartment. 109 * 110 **/ 111 IAuthRuleBuilderRuleOpClassifierFinished inCompartmentWithAdditionalSearchParams(String theCompartmentName, Collection<? extends IIdType> theOwners, AdditionalCompartmentSearchParameters theAdditionalTypeSearchParamNames); 112 113 114 /** 115 * Rule applies to any resource instances 116 * <p> 117 * This call completes the rule and adds the rule to the chain. 118 * </p> 119 */ 120 IAuthRuleBuilderRuleOpClassifierFinished withAnyId(); 121 122 /** 123 * Rule applies to resources where the given search parameter would be satisfied by a code in the given ValueSet 124 * @param theSearchParameterName The search parameter name, e.g. <code>"code"</code> 125 * @param theValueSetUrl The valueset URL, e.g. <code>"http://my-value-set"</code> 126 * @since 6.0.0 127 */ 128 IAuthRuleBuilderRuleOpClassifierFinished withCodeInValueSet(@Nonnull String theSearchParameterName, @Nonnull String theValueSetUrl); 129 130 /** 131 * Rule applies to resources where the given search parameter would be satisfied by a code not in the given ValueSet 132 * @param theSearchParameterName The search parameter name, e.g. <code>"code"</code> 133 * @param theValueSetUrl The valueset URL, e.g. <code>"http://my-value-set"</code> 134 * @since 6.0.0 135 */ 136 IAuthRuleFinished withCodeNotInValueSet(@Nonnull String theSearchParameterName, @Nonnull String theValueSetUrl); 137}