FHIR Search Validator

A package to validate FHIR search requests.

Quick Start

npm i @synanetics/fhir-search-validator

Purpose

There are plenty of packages that help validate FHIR request bodies against FHIR profiles and the core STU3 (etc.) schema, but none that validate incoming request parameters against FHIR schemas and servers' capability statements. This package addresses that shortcoming.

Limitations

• Currently, only STU3 is supported.
• Searching by multiple concurrent resource types (e.g. [base]?_type=Practitioner,Patient&name=Jekyll) is not currently supported.
• User-defined profiles, against which to validate searches, are not currently supported.
• Validating that _include:recurse (_include:iterate in R4 and beyond) and _revinclude:recurse refer to one of the possible returned types from another part of the query is not currently supported. All :recurse queries will pass validation.

Usage

The validate function expects at least two parameters, a "search" of the format shown in the example, below, and the HTTP verb or "method" with which the search was invoked:

import validate from '@synanetics/fhir-search-validator';

const search = 'Patient?nickname=Jonesy';
const method = 'GET';

const outcome = validate(search, method);
console.log(outcome.issue[0].details.display); // 'Parameter "nickname" not understood';

The validate function returns a FHIR OperationOutcome detailing the success/failure of validating the search.

The HTTP verb argument is a string. Any unsupported HTTP verb will result in an OperationOutcome. The supported HTTP verbs are:

• GET
• PUT
• POST
• PATCH
• DELETE
• HEAD

Note that in STU3, there is no "success" issue type for OperationOutcomes. As such, an empty "issue" array on the OperationOutcome indicates success.

Validation options

The validate function accepts an optional options argument, which is an object with the following properties:

| Property name | Description | Default | | --------------------- | ------------------------------------------------------------------------------- | -------- | | fhirVersion | The version of FHIR (e.g. STU3) against which this search should be validated. | 'STU3' | | capabilityStatement | A FHIR CapabilityStatement against which to validate incoming searches. | none, optional | | bypassParameters | An array of query parameter names that will be exempted from the FHIR-based validation. This has been included because there is no agreed-upon way of expressing "page" and "state" in the FHIR specification for paginated queries. | none, optional |

Example usage:

const outcome = validate('Encounter?patient.name=Spartacus&page=1', 'GET', {
  fhirVersion: 'STU3',
  capabilityStatement: {
    resourceType: 'CapabilityStatement',
    // and so on...
  },
  bypassParameters: ['page']
});

Capability Statements

Because CapabilityStatement resources can get quite large, it maybe of benefit to precompile a validate function, perhaps using the pattern below:

const compile = (
  capabilityStatement: CapabilityStatement,
) => (search: string, httpVerb: HttpVerb) => validate(search, httpVerb, capabilityStatement);

const compiledValidator = compile(myCapabilityStatement);
// the compiledValidator can now repeatedly use the supplied capabilityStatement without passing it in every time:
const outcome = compiledValidator('Patient?name=Inigo%20Montoya', 'GET');

Roadmap

• [x] STU3 support
• [x] CapabilityStatement support
• [ ] multiple concurrent type ([base]?_type=Type1,Type2) support
• [ ] _include:recurse and _revinclude:recurse validation support
• [ ] R4 support
• [ ] R4B support
• [ ] R5 support
• [ ] Ability to supply additional profiles against which to validate