package com.example.fhirexample;

import ca.uhn.fhir.context.FhirContext;
import ca.uhn.fhir.rest.server.RestfulServer;

import com.example.fhirexample.providors.ObservationProvidor;
import com.example.fhirexample.providors.PatientProvider;

import org.springframework.context.ApplicationContext;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import java.util.Arrays;

@WebServlet("/*")
public class FhirRestfulServer extends RestfulServer {

    private ApplicationContext applicationContext;

    FhirRestfulServer(ApplicationContext context) {

        this.applicationContext = context;
    }

    @Override
    protected void initialize() throws ServletException{
        super.initialize();
        setFhirContext(FhirContext.forR4());
    }
}

package com.example.fhirexample;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.web.servlet.ServletRegistrationBean;
import org.springframework.context.ApplicationContext;
import org.springframework.context.annotation.Bean;

@SpringBootApplication
public class FhirExampleApplication{

    @Autowired
    private ApplicationContext context;


    public static void main(String[] args) {

        SpringApplication.run(FhirExampleApplication.class, args);
    }

    @Bean
    public ServletRegistrationBean ServletRegistrationBean() {
        ServletRegistrationBean registration= new ServletRegistrationBean(new FhirRestfulServer(context),"/*");
        registration.setName("FhirServlet");
        return registration;
    }
}

package com.example.fhirexample;

import ca.uhn.fhir.context.FhirContext;
import ca.uhn.fhir.rest.annotation.*;
import ca.uhn.fhir.rest.api.MethodOutcome;
import ca.uhn.fhir.rest.param.DateRangeParam;
import ca.uhn.fhir.rest.param.StringParam;
import ca.uhn.fhir.rest.param.TokenParam;
import ca.uhn.fhir.rest.server.IResourceProvider;
import com.example.fhirexample.dao.patient.PatientDAO;
import org.hl7.fhir.instance.model.api.IBaseResource;
import org.hl7.fhir.r4.model.IdType;
import org.hl7.fhir.r4.model.OperationOutcome;
import org.hl7.fhir.r4.model.Patient;
import org.hl7.fhir.r4.model.Resource;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

import javax.servlet.http.HttpServletRequest;
import java.util.List;


@Component
public class PatientProvider implements IResourceProvider {

    @Autowired
    private FhirContext ctx;

    @Autowired
    private PatientDAO patientDao;
    
    @Override
    public Class<? extends IBaseResource> getResourceType() {
        return  Patient.class;
    }

    @Search
    public List<Resource> searchPatient(HttpServletRequest request,
                                        @OptionalParam(name= Patient.SP_BIRTHDATE) DateRangeParam birthDate,
                                        @OptionalParam(name = Patient.SP_FAMILY) StringParam familyName,
                                        @OptionalParam(name= Patient.SP_GENDER) StringParam gender,   
                                        @OptionalParam(name= Patient.SP_GIVEN) StringParam givenName,
                                        @OptionalParam(name = Patient.SP_IDENTIFIER) TokenParam identifier,
                                        @OptionalParam(name= Patient.SP_NAME) StringParam name,
                                        @OptionalParam(name = Patient.SP_RES_ID) TokenParam resid) {

        return patientDao.search(ctx, birthDate, familyName, gender, givenName, identifier, name);
    }

    @Read()
    public Patient read(@IdParam IdType theId) {

        return patientDao.read(ctx,theId);

    }

    @Create()
    public MethodOutcome createPatient(HttpServletRequest theRequest, @ResourceParam Patient patient) {

        MethodOutcome  method = new  MethodOutcome();
        method.setCreated(true);
        OperationOutcome  opOutcome = new  OperationOutcome();
        method.setOperationOutcome(opOutcome)
       
        return patientDao.create(ctx, patient);
    }

    @Search()
    public List<Resource> getAllPatients() {
        return patientDao.search(ctx);
    
    }

  

    @Delete()
    public void delete(@IdParam  IdType  theId) {
        
        patientDao.delete(ctx,theId);
    }
}

package com.example.fhirexample;

import ca.uhn.fhir.context.FhirContext;
import ca.uhn.fhir.rest.server.RestfulServer;

import ca.uhn.fhir.rest.server.interceptor.CorsInterceptor;
import com.example.fhirexample.providors.ObservationProvidor;
import com.example.fhirexample.providors.PatientProvidor;

import org.springframework.context.ApplicationContext;
import org.springframework.web.cors.CorsConfiguration;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import java.util.Arrays;

@WebServlet("/*")
public class FhirRestfulServer extends RestfulServer {
    
    private ApplicationContext applicationContext;

    FhirRestfulServer(ApplicationContext context) {
        this.applicationContext = context;
    }

    @Override
    protected void initialize() throws ServletException {   

        super.initialize();
        setFhirContext(FhirContext.forR4());
        setResourceProviders(Arrays.asList(
            applicationContext.getBean(PatientProvider.class)));
    }
}

package com.example.fhirexample;

import ca.uhn.fhir.rest.server.interceptor.CorsInterceptor;
import org.springframework.web.cors.CorsConfiguration;

@WebServlet(urlPatterns = {"/fhir/*"}, displayName = "FHIR Server")
public class RestfulServerWithCors extends RestfulServer {
    @Override
    protected  void  initialize() throws  ServletException {
    // ... define your resource providers here ...
    // Define your CORS configuration. This is an example
    // showing a typical setup. You should customize this
    // to your specific needs
    CorsConfiguration  config = new  CorsConfiguration();
    config.addAllowedHeader("x-fhir-starter");
    config.addAllowedHeader("Origin");
    config.addAllowedHeader("Accept");
    config.addAllowedHeader("X-Requested-With");
    config.addAllowedHeader("Content-Type");
    config.addAllowedOrigin("*");
    config.addExposedHeader("Location");
    config.addExposedHeader("Content-Location");
    config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"));
    // Create the interceptor and register it
    CorsInterceptor  interceptor = new  CorsInterceptor(config);
    registerInterceptor(interceptor);
    }
}

package com.example.fhirexample;

import ca.uhn.fhir.rest.api.server.RequestDetails;
import ca.uhn.fhir.rest.server.exceptions.AuthenticationException;
import ca.uhn.fhir.rest.server.interceptor.auth.AuthorizationInterceptor;
import ca.uhn.fhir.rest.server.interceptor.auth.IAuthRule;
import ca.uhn.fhir.rest.server.interceptor.auth.RuleBuilder;
import org.hl7.fhir.r4.model.IdType;

import java.util.List;

public class PatientAndAdminAuthorizationInterceptor extends AuthorizationInterceptor {

    @Override
    public List<IAuthRule> buildRuleList(RequestDetails theRequestDetails) {

        // Process authorization header - The following is a fake
        // implementation. Obviously we'd want something more real
        // for a production scenario.
        //
        // In this basic example we have two hardcoded bearer tokens,
        // one which is for a user that has access to one patient, and
        // another that has full access.
        IdType userIdPatientId = null;
        String authHeader = theRequestDetails.getHeader("Authorization");
        if (isNormalUser(authHeader)) {
            // This user has only access to the Patient resource with id 1.
            // If the user is a specific patient, we create the following rule chain:
            // Allow the user to read anything in their own patient compartment
            // Allow the user to write anything in their own patient compartment
            // If a client request doesn't pass either of the above, deny it
            userIdPatientId = new IdType("Patient", 1L);
            return new RuleBuilder()
                    .allow().read().allResources().inCompartment("Patient", userIdPatientId).andThen()
                    .allow().write().allResources().inCompartment("Patient", userIdPatientId).andThen()
                    .denyAll()
                    .build();
        } else if (isAdmin(authHeader)) {
            // If the user is an admin, allow everything
            return new RuleBuilder()
                    .allowAll()
                    .build();
        } else {
            // Throw an HTTP 401
            throw new AuthenticationException("Missing or invalid Authorization header value");
        }
    }

    private boolean isNormalUser(String authHeader){
        return "Bearer dfw98h38r".equals(authHeader);

    }
    private boolean isAdmin(String authHeader){
        return "Bearer 39ff939jgg".equals(authHeader);
    }

}