Package org.fhirfrog.frog.smart

Class FormLoginPkceProvider

java.lang.Object

org.fhirfrog.frog.smart.FormLoginPkceProvider

All Implemented Interfaces:

SmartAuthProvider

public final class FormLoginPkceProvider
extends Object
implements SmartAuthProvider

SmartAuthProvider strategy that drives the plain-HTTP PKCE authorization-code flow with Spring Security form login used by aehrc-quokka-hapi-smart's own test IdP: GET /oauth2/authorize → GET /login → scrape the CSRF token → POST /login → follow the redirect for the authorization code → POST /oauth2/token.

Directly ported from aehrc-quokka-hapi-smart's own StandaloneLaunchIT/SmartOAuthHelper test helper class. See design.md's "Decisions" for why this uses plain JDK HttpClient rather than a browser or an OAuth2 client library: the target's login page is a plain HTML form over HTTP, not a JS-heavy SPA, and the whole flow is six manually-sequenced HTTP calls against one known, tested target - pulling in a heavier dependency for that would be premature.

Coupling risk: this strategy is coupled to that target's specific login form field names (username/password/_csrf) and redirect-chain shape. If that project changes its login page, this strategy breaks - but it is one pluggable strategy behind the SmartAuthProvider interface, not the interface itself, so replacing it doesn't touch fhir-frog-library or other strategies.

The obtained token is cached for the lifetime of a provider instance: obtainAccessToken() only runs the login flow once, on first call, rather than re-authenticating on every outgoing FHIR request. Construct a new instance to force a fresh login.

Constructor Summary

Constructors

Constructor	Description
FormLoginPkceProvider(String baseUrl, String clientId, String redirectUri, String scopes, String username, String password)

Method Summary

Modifier and Type	Method	Description
String	obtainAccessToken()	Obtain an access token, running whatever flow this strategy implements.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.fhirfrog.frog.smart.SmartAuthProvider

asRequestInterceptor

Constructor Details

FormLoginPkceProvider

public FormLoginPkceProvider(String baseUrl,
 String clientId,
 String redirectUri,
 String scopes,
 String username,
 String password)

Parameters:

baseUrl - the SMART server's base URL, e.g. http://localhost:9090 (no trailing slash, no /fhir suffix - the authorize/login/ token endpoints hang directly off this base)

clientId - the OAuth2 public client id (e.g. standalone-client)

redirectUri - the redirect URI registered for that client

scopes - space-separated scope string (e.g. "openid launch/patient patient/*.read")

username - the login form username

password - the login form password

Method Details

obtainAccessToken

public String obtainAccessToken()

Description copied from interface: SmartAuthProvider

Obtain an access token, running whatever flow this strategy implements.

Specified by:

obtainAccessToken in interface SmartAuthProvider

Returns:

the raw access token string (e.g. a JWT), suitable for use as Authorization: Bearer <token>