Package org.fhirfrog.frog.smart

Interface SmartAuthProvider

All Known Implementing Classes:
ClientCredentialsProvider, EhrLaunchProvider, FormLoginPkceProvider, StaticTokenProvider
public interface SmartAuthProvider
A pluggable strategy for obtaining a SMART on FHIR access token.

Deliberately minimal and decoupled from fhir-frog-library's generic ClientRequestInterceptor hook: this interface only knows how to *get* a token, not how it gets attached to outgoing requests. asRequestInterceptor() is the one bit of glue between the two, for the common case of "attach this token as a Bearer header to every request."

Different targets need genuinely different strategies - a local test IdP with a test-user bypass (FormLoginPkceProvider), a pre-obtained token (StaticTokenProvider), and (not built here - see design.md's Non-Goals) a real external IdP needing headless-browser automation, or a system-to-system target using client-credentials. Implementations are swappable without touching this interface or each other.

  • Method Details

    • obtainAccessToken

      String obtainAccessToken()
      Obtain an access token, running whatever flow this strategy implements.
      Returns:
      the raw access token string (e.g. a JWT), suitable for use as Authorization: Bearer <token>
      Throws:
      SmartAuthException - if the flow fails at any step

    • asRequestInterceptor

      default ClientRequestInterceptor asRequestInterceptor()
      Adapt this provider into a fhir-frog-library ClientRequestInterceptor that attaches obtainAccessToken()'s result as an Authorization: Bearer <token> header on every outgoing request.

      Typical usage: 

      
 SmartAuthProvider auth = new FormLoginPkceProvider(...);
 TestScriptEngine engine = TestScriptEngine.builder()
     .serverUrl(baseUrl + "/fhir")
     .requestInterceptor(auth.asRequestInterceptor())
     .build();

      Calls obtainAccessToken() once per outgoing request; strategies that want to obtain the token once and reuse it (e.g. to avoid re-running a login flow for every request) should cache the result themselves.

      Returns:
      a request interceptor attaching this provider's token as a Bearer header

    • launchContext

      default Optional<LaunchContext> launchContext()
      The SMART launch context (patient/encounter/fhirContext/etc.) associated with the obtained token, for strategies that support SMART launch context - see EhrLaunchProvider, whose EHR-launch flow returns launch-context alongside the access token.

      A default method rather than an addition to the interface's required contract, so existing strategies that don't carry launch context (FormLoginPkceProvider, StaticTokenProvider) are unaffected and simply return Optional.empty().

      Returns:
      the launch context, or Optional.empty() if this strategy doesn't have one