
001/* 002 * #%L 003 * HAPI FHIR - Server Framework 004 * %% 005 * Copyright (C) 2014 - 2025 Smile CDR, Inc. 006 * %% 007 * Licensed under the Apache License, Version 2.0 (the "License"); 008 * you may not use this file except in compliance with the License. 009 * You may obtain a copy of the License at 010 * 011 * http://www.apache.org/licenses/LICENSE-2.0 012 * 013 * Unless required by applicable law or agreed to in writing, software 014 * distributed under the License is distributed on an "AS IS" BASIS, 015 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 016 * See the License for the specific language governing permissions and 017 * limitations under the License. 018 * #L% 019 */ 020package ca.uhn.fhir.rest.server.interceptor; 021 022import ca.uhn.fhir.interceptor.api.Hook; 023import ca.uhn.fhir.interceptor.api.Pointcut; 024import ca.uhn.fhir.rest.api.RestOperationTypeEnum; 025import ca.uhn.fhir.rest.api.server.RequestDetails; 026import ca.uhn.fhir.rest.server.exceptions.UnprocessableEntityException; 027import ca.uhn.fhir.validation.FhirValidator; 028import ca.uhn.fhir.validation.ResultSeverityEnum; 029import ca.uhn.fhir.validation.ValidationOptions; 030import ca.uhn.fhir.validation.ValidationResult; 031import org.apache.commons.lang3.Validate; 032import org.hl7.fhir.instance.model.api.IBaseResource; 033 034import java.util.HashSet; 035import java.util.Set; 036 037/** 038 * This interceptor intercepts each outgoing response and if it contains a FHIR resource, validates that resource. The interceptor may be configured to run any validator modules, and will then add 039 * headers to the response or fail the request with an {@link UnprocessableEntityException HTTP 422 Unprocessable Entity}. 040 */ 041public class ResponseValidatingInterceptor extends BaseValidatingInterceptor<IBaseResource> { 042 043 /** 044 * X-HAPI-Request-Validation 045 */ 046 public static final String DEFAULT_RESPONSE_HEADER_NAME = "X-FHIR-Response-Validation"; 047 048 private static final org.slf4j.Logger ourLog = 049 org.slf4j.LoggerFactory.getLogger(ResponseValidatingInterceptor.class); 050 051 private Set<RestOperationTypeEnum> myExcludeOperationTypes; 052 053 /** 054 * Do not validate the following operations. A common use for this is to exclude {@link RestOperationTypeEnum#METADATA} so that this operation will execute as quickly as possible. 055 */ 056 public void addExcludeOperationType(RestOperationTypeEnum theOperationType) { 057 Validate.notNull(theOperationType, "theOperationType must not be null"); 058 if (myExcludeOperationTypes == null) { 059 myExcludeOperationTypes = new HashSet<>(); 060 } 061 myExcludeOperationTypes.add(theOperationType); 062 } 063 064 @Override 065 ValidationResult doValidate(FhirValidator theValidator, IBaseResource theRequest, ValidationOptions theOptions) { 066 return theValidator.validateWithResult(theRequest, theOptions); 067 } 068 069 @Hook(Pointcut.SERVER_OUTGOING_RESPONSE) 070 public boolean outgoingResponse(RequestDetails theRequestDetails, IBaseResource theResponseObject) { 071 RestOperationTypeEnum operationType = theRequestDetails.getRestOperationType(); 072 if (operationType != null 073 && myExcludeOperationTypes != null 074 && myExcludeOperationTypes.contains(operationType)) { 075 ourLog.trace("Operation type {} is excluded from validation", operationType); 076 return true; 077 } 078 079 validate(theResponseObject, theRequestDetails); 080 081 return true; 082 } 083 084 @Override 085 String provideDefaultResponseHeaderName() { 086 return DEFAULT_RESPONSE_HEADER_NAME; 087 } 088 089 /** 090 * Sets the name of the response header to add validation failures to 091 * 092 * @see #DEFAULT_RESPONSE_HEADER_NAME 093 * @see #setAddResponseHeaderOnSeverity(ResultSeverityEnum) 094 */ 095 @Override 096 public void setResponseHeaderName(String theResponseHeaderName) { 097 super.setResponseHeaderName(theResponseHeaderName); 098 } 099}