feature: RBAC + Clinical Audit Logging

2026-06-21 15:46:55 +08:00
parent a43db52813
commit 5af6ab490e
83 changed files with 4281 additions and 70 deletions
@@ -0,0 +1,71 @@
+using System.Security.Claims;
+using Hl7.Fhir.Serialization;
+using Microsoft.Extensions.Options;
+using Task = System.Threading.Tasks.Task;
+
+public class FhirApiKeyOrJwtMiddleware
+{
+    public const string SchemeName = "FhirApiKey";
+
+    private readonly RequestDelegate _next;
+    private readonly FhirOptions _options;
+    private static readonly FhirJsonSerializer Serializer = new();
+
+    public FhirApiKeyOrJwtMiddleware(RequestDelegate next, IOptions<FhirOptions> options)
+    {
+        _next = next;
+        _options = options.Value;
+    }
+
+    public async Task InvokeAsync(HttpContext context)
+    {
+        if (!context.Request.Path.StartsWithSegments("/fhir"))
+        {
+            await _next(context);
+            return;
+        }
+
+        if (context.Request.Path.StartsWithSegments("/fhir/R4/metadata"))
+        {
+            await _next(context);
+            return;
+        }
+
+        if (context.User.Identity?.IsAuthenticated == true)
+        {
+            await _next(context);
+            return;
+        }
+
+        if (string.IsNullOrWhiteSpace(_options.ApiKey))
+        {
+            await _next(context);
+            return;
+        }
+
+        if (context.Request.Headers.TryGetValue("X-Api-Key", out var key) && key == _options.ApiKey)
+        {
+            var claims = new[]
+            {
+                new Claim(ClaimTypes.NameIdentifier, "44444444-4444-4444-4444-444444444444"),
+                new Claim(ClaimTypes.Name, "integration.mirth"),
+                new Claim("display_name", "Mirth Connect"),
+                new Claim("clinical_role", ClinicalRole.Integration.ToDbString()),
+            };
+            context.User = new ClaimsPrincipal(new ClaimsIdentity(claims, SchemeName));
+            await _next(context);
+            return;
+        }
+
+        if (context.Request.Headers.ContainsKey("X-Api-Key"))
+        {
+            context.Response.StatusCode = StatusCodes.Status401Unauthorized;
+            context.Response.ContentType = "application/fhir+json";
+            var outcome = FhirOperationOutcomeBuilder.Create(401, "login", "Invalid or missing API key.");
+            await context.Response.WriteAsync(Serializer.SerializeToString(outcome));
+            return;
+        }
+
+        await _next(context);
+    }
+}