ca.uhn.fhir.rest.server.interceptor.auth

Class SearchNarrowingInterceptor

java.lang.Object

ca.uhn.fhir.rest.server.interceptor.InterceptorAdapter

ca.uhn.fhir.rest.server.interceptor.auth.SearchNarrowingInterceptor

All Implemented Interfaces:

IServerInterceptor

public abstract class SearchNarrowingInterceptor
extends InterceptorAdapter

This interceptor can be used to automatically narrow the scope of searches in order to automatically restrict the searches to specific compartments.

For example, this interceptor could be used to restrict a user to only viewing data belonging to Patient/123 (i.e. data in the Patient/123 compartment). In this case, a user performing a search for
http://baseurl/Observation?category=laboratory
would receive results as though they had requested
http://baseurl/Observation?subject=Patient/123&category=laboratory

Note that this interceptor should be used in combination with AuthorizationInterceptor if you are restricting results because of a security restriction. This interceptor is not intended to be a failsafe way of preventing users from seeing the wrong data (that is the purpose of AuthorizationInterceptor). This interceptor is simply intended as a convenience to help users simplify their queries while not receiving security errors for to trying to access data they do not have access to see.

See Also:

AuthorizationInterceptor

Nested Class Summary

Nested classes/interfaces inherited from interface ca.uhn.fhir.rest.server.interceptor.IServerInterceptor

IServerInterceptor.ActionRequestDetails

Constructor Summary

Constructors

Constructor and Description
SearchNarrowingInterceptor()

Method Summary

Modifier and Type	Method and Description
protected AuthorizedList	buildAuthorizedList(RequestDetails theRequestDetails) Subclasses should override this method to supply the set of compartments that the user making the request should actually have access to.
boolean	incomingRequestPostProcessed(RequestDetails theRequestDetails, javax.servlet.http.HttpServletRequest theRequest, javax.servlet.http.HttpServletResponse theResponse) This method is called just before the actual implementing server method is invoked.

Methods inherited from class ca.uhn.fhir.rest.server.interceptor.InterceptorAdapter

handleException, incomingRequestPreHandled, incomingRequestPreProcessed, outgoingResponse, outgoingResponse, outgoingResponse, outgoingResponse, outgoingResponse, outgoingResponse, outgoingResponse, preProcessOutgoingException, processingCompletedNormally

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SearchNarrowingInterceptor

public SearchNarrowingInterceptor()

Method Detail

buildAuthorizedList

protected AuthorizedList buildAuthorizedList(RequestDetails theRequestDetails)

Subclasses should override this method to supply the set of compartments that the user making the request should actually have access to.

Typically this is done by examining theRequestDetails to find out who the current user is and then building a list of Strings.

Parameters:

theRequestDetails - The individual request currently being applied

Returns:

The list of allowed compartments and instances that should be used for search narrowing. If this method returns null, no narrowing will be performed

incomingRequestPostProcessed

public boolean incomingRequestPostProcessed(RequestDetails theRequestDetails,
                                            javax.servlet.http.HttpServletRequest theRequest,
                                            javax.servlet.http.HttpServletResponse theResponse)
                                     throws ca.uhn.fhir.rest.server.exceptions.AuthenticationException

Description copied from interface: IServerInterceptor

This method is called just before the actual implementing server method is invoked.

Specified by:

incomingRequestPostProcessed in interface IServerInterceptor

Overrides:

incomingRequestPostProcessed in class InterceptorAdapter

Parameters:

theRequestDetails - A bean containing details about the request that is about to be processed, including details such as the resource type and logical ID (if any) and other FHIR-specific aspects of the request which have been pulled out of the servlet request.

theRequest - The incoming request

theResponse - The response. Note that interceptors may choose to provide a response (i.e. by calling ServletResponse.getWriter()) but in that case it is important to return false to indicate that the server itself should not also provide a response.

Returns:

Return true if processing should continue normally. This is generally the right thing to do. If your interceptor is providing a response rather than letting HAPI handle the response normally, you must return false. In this case, no further processing will occur and no further interceptors will be called.

Throws:

ca.uhn.fhir.rest.server.exceptions.AuthenticationException - This exception may be thrown to indicate that the interceptor has detected an unauthorized access attempt. If thrown, processing will stop and an HTTP 401 will be returned to the client.