Package org.fhirfrog.frog.smart

package org.fhirfrog.frog.smart
Pluggable SMART on FHIR App Launch 2.0 auth strategies.

This package defines SmartAuthProvider, a small strategy interface for obtaining a SMART access token, decoupled from fhir-frog-library's generic ClientRequestInterceptor hook that actually attaches the resulting token to outgoing FHIR requests. See SmartAuthProvider.asRequestInterceptor() for the glue between the two.

Strategies

  • StaticTokenProvider - wraps a pre-obtained token, for targets where the token is fetched out-of-band.
  • FormLoginPkceProvider - drives the plain-HTTP PKCE authorization-code flow with Spring Security form login used by aehrc-quokka-hapi-smart's test IdP (and any other SMART test server shaped the same way).

Deliberately not implemented here (see design.md's Non-Goals): a HeadlessBrowserProvider for real IdPs with no test-user bypass, and a ClientCredentialsProvider for system-to-system targets with no login step. Nothing in this org's current test suites needs them yet.

  • Class
    Description
    FormLoginPkceProvider
    SmartAuthProvider strategy that drives the plain-HTTP PKCE authorization-code flow with Spring Security form login used by aehrc-quokka-hapi-smart's own test IdP: GET /oauth2/authorize → GET /login → scrape the CSRF token → POST /login → follow the redirect for the authorization code → POST /oauth2/token.
    SmartAuthException
    Thrown when a SmartAuthProvider strategy fails to obtain an access token - e.g.
    SmartAuthProvider
    A pluggable strategy for obtaining a SMART on FHIR access token.
    StaticTokenProvider
    Trivial SmartAuthProvider wrapping a pre-obtained access token, for targets where the token is fetched out-of-band (e.g. a token pasted in from a manual browser login, or obtained by some other tool entirely outside fhir-frog).