Reference source · 0.1.0-dev.11

demo.ts

scripts/demo.ts · Download original file

import assert from 'node:assert/strict';
import { fixture, PATIENT, lab } from '../src/reference/fixtures.ts';
import { SCOPES } from '../src/authorization.ts';
import { startDemoServer } from '../src/reference/https-server.ts';
import { httpsTransport } from '../src/sdk.ts';
import { delegate, webfinger, discover, DirectoryTrust } from '../src/discovery.ts';

const f = fixture();
const address = 'synthetic@patients.example';
const server = await startDemoServer(f.host, f.clock, (resource, endpoint) => {
  assert.equal(resource, `acct:${address}`);
  return webfinger(address, delegate(f.hostingAuthority, { address: `acct:${address}`, record_id: PATIENT, endpoint, host: f.hostIdentity.public.subject, credential: f.hostCredential, issued_at: f.clock(), expires_at: f.clock() + 300, generation: 1 }));
});
try {
  const directory = new DirectoryTrust({ [f.hostingAuthority.issuer]: { publicKey: f.hostingAuthority.publicKey, domains: ['patients.example'] } }, f.trust);
  const located = await discover(address, directory, f.clock(), { ca: server.ca, origin: new URL(server.endpoint).origin });
  f.client.hostCredential = located.credential; f.client.hostId = located.host;
  f.client.transport = httpsTransport(located.endpoint, server.ca);
  console.log('PASS: WebFinger address resolves to a post-quantum signed domain-to-Host delegation.');
  const automatic = await f.client.requestAccess({ patient: PATIENT, scopes: [SCOPES.demographicsRead], requested_duration_seconds: 86400, refresh_requested: true });
  assert.equal(automatic.status, 'granted');
  console.log('PASS: one-day preauthorized access issued over verified HTTPS without patient login.');
  const pending = await f.client.requestAccess({ patient: PATIENT, scopes: Object.values(SCOPES), requested_duration_seconds: 90 * 86400, refresh_requested: true });
  assert.equal(pending.status, 'pending');
  if (pending.status !== 'pending') throw new Error('Expected pending approval');
  assert.equal(f.host.authorization.approvalTasks().length, 1);
  // Simulates a Host's authenticated patient interaction; not a protocol login endpoint.
  f.host.authorization.approve(f.app, pending.request_id, PATIENT, f.clock());
  const approved = await f.client.approvalStatus(pending.request_id);
  assert.equal(approved.status, 'granted');
  const baseline = await f.client.syncSnapshot(PATIENT);
  const demographics = await f.client.readDemographics(PATIENT);
  await f.client.updateDemographics(PATIENT, 'Synthetic Updated Example', demographics.version);
  const created = await f.client.createLab(PATIENT, lab(), 'demo-lab-operation');
  const repeated = await f.client.createLab(PATIENT, lab(), 'demo-lab-operation');
  assert.equal(created.resource.id, repeated.resource.id);
  console.log('PASS: conditional approval, scoped reads/writes, and duplicate-safe lab insertion.');
  const firstPage = await f.client.changes(PATIENT, baseline.cursor, 1);
  const secondPage = await f.client.changes(PATIENT, firstPage.cursor, 1);
  assert.equal(firstPage.events.length, 1); assert.equal(firstPage.has_more, true);
  assert.equal(secondPage.events[0].resource.id, created.resource.id); assert.equal(secondPage.has_more, false);
  assert.deepEqual((await f.client.changes(PATIENT, secondPage.cursor)).events, []);
  console.log('PASS: snapshot plus paged change feed catches up accepted changes without duplicate write events.');
  const refreshGrant = await f.client.requestAccess({ patient: PATIENT, scopes: [SCOPES.demographicsRead], requested_duration_seconds: 86400, refresh_requested: true });
  assert.equal(refreshGrant.status, 'granted');
  f.advance(301);
  const network = f.client.transport;
  f.client.transport = async envelope => { await network(envelope); throw new Error('synthetic_lost_refresh_response'); };
  await assert.rejects(f.client.readDemographics(PATIENT), /synthetic_lost_refresh_response/);
  f.client.transport = network;
  await f.client.readDemographics(PATIENT);
  console.log('PASS: lost refresh response recovered without extending the approved access period.');
  assert(f.client.authorization);
  f.host.authorization.revoke(f.client.authorization.grant_id);
  await assert.rejects(f.client.readDemographics(PATIENT), /authorization_expired_or_revoked/);
  console.log('PASS: revocation stops an otherwise unexpired JWT.');
  console.log('Synthetic demonstration complete. Private keys, tokens, and patient contents were not logged.');
} finally { await server.close(); f.host.close(); }