001/*
002 * #%L
003 * HAPI FHIR - Server Framework
004 * %%
005 * Copyright (C) 2014 - 2025 Smile CDR, Inc.
006 * %%
007 * Licensed under the Apache License, Version 2.0 (the "License");
008 * you may not use this file except in compliance with the License.
009 * You may obtain a copy of the License at
010 *
011 *      http://www.apache.org/licenses/LICENSE-2.0
012 *
013 * Unless required by applicable law or agreed to in writing, software
014 * distributed under the License is distributed on an "AS IS" BASIS,
015 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
016 * See the License for the specific language governing permissions and
017 * limitations under the License.
018 * #L%
019 */
020package ca.uhn.fhir.rest.server.interceptor;
021
022import ca.uhn.fhir.interceptor.api.Hook;
023import ca.uhn.fhir.interceptor.api.Pointcut;
024import ca.uhn.fhir.rest.api.RestOperationTypeEnum;
025import ca.uhn.fhir.rest.api.server.RequestDetails;
026import ca.uhn.fhir.rest.server.exceptions.UnprocessableEntityException;
027import ca.uhn.fhir.validation.FhirValidator;
028import ca.uhn.fhir.validation.ResultSeverityEnum;
029import ca.uhn.fhir.validation.ValidationOptions;
030import ca.uhn.fhir.validation.ValidationResult;
031import org.apache.commons.lang3.Validate;
032import org.hl7.fhir.instance.model.api.IBaseResource;
033
034import java.util.HashSet;
035import java.util.Set;
036
037/**
038 * This interceptor intercepts each outgoing response and if it contains a FHIR resource, validates that resource. The interceptor may be configured to run any validator modules, and will then add
039 * headers to the response or fail the request with an {@link UnprocessableEntityException HTTP 422 Unprocessable Entity}.
040 */
041public class ResponseValidatingInterceptor extends BaseValidatingInterceptor<IBaseResource> {
042
043        /**
044         * X-HAPI-Request-Validation
045         */
046        public static final String DEFAULT_RESPONSE_HEADER_NAME = "X-FHIR-Response-Validation";
047
048        private static final org.slf4j.Logger ourLog =
049                        org.slf4j.LoggerFactory.getLogger(ResponseValidatingInterceptor.class);
050
051        private Set<RestOperationTypeEnum> myExcludeOperationTypes;
052
053        /**
054         * Do not validate the following operations. A common use for this is to exclude {@link RestOperationTypeEnum#METADATA} so that this operation will execute as quickly as possible.
055         */
056        public void addExcludeOperationType(RestOperationTypeEnum theOperationType) {
057                Validate.notNull(theOperationType, "theOperationType must not be null");
058                if (myExcludeOperationTypes == null) {
059                        myExcludeOperationTypes = new HashSet<>();
060                }
061                myExcludeOperationTypes.add(theOperationType);
062        }
063
064        @Override
065        ValidationResult doValidate(FhirValidator theValidator, IBaseResource theRequest, ValidationOptions theOptions) {
066                return theValidator.validateWithResult(theRequest, theOptions);
067        }
068
069        @Hook(Pointcut.SERVER_OUTGOING_RESPONSE)
070        public boolean outgoingResponse(RequestDetails theRequestDetails, IBaseResource theResponseObject) {
071                RestOperationTypeEnum operationType = theRequestDetails.getRestOperationType();
072                if (operationType != null
073                                && myExcludeOperationTypes != null
074                                && myExcludeOperationTypes.contains(operationType)) {
075                        ourLog.trace("Operation type {} is excluded from validation", operationType);
076                        return true;
077                }
078
079                validate(theResponseObject, theRequestDetails);
080
081                return true;
082        }
083
084        @Override
085        String provideDefaultResponseHeaderName() {
086                return DEFAULT_RESPONSE_HEADER_NAME;
087        }
088
089        /**
090         * Sets the name of the response header to add validation failures to
091         *
092         * @see #DEFAULT_RESPONSE_HEADER_NAME
093         * @see #setAddResponseHeaderOnSeverity(ResultSeverityEnum)
094         */
095        @Override
096        public void setResponseHeaderName(String theResponseHeaderName) {
097                super.setResponseHeaderName(theResponseHeaderName);
098        }
099}