Merge pull request #43 from medizininformatik-initiative/release-2-1-0

Dockerfile

@@ -6,7 +6,7 @@ WORKDIR /opt/codex-feasibility-backend
 COPY ./target/*.jar ./feasibility-gui-backend.jar
 COPY ontology ontology
 
-ARG VERSION=0.0.0
+ARG VERSION=2.1.0
 ENV APP_VERSION=${VERSION}
 ENV FEASIBILITY_DATABASE_HOST="feasibility-network"
 ENV FEASIBILITY_DATABASE_PORT=5432
@@ -19,12 +19,12 @@ ENTRYPOINT ["java","-jar","feasibility-gui-backend.jar"]
 
 ARG GIT_REF=""
 ARG BUILD_TIME=""
-LABEL maintainer="num-codex" \
+LABEL maintainer="medizininformatik-initiative" \
     org.opencontainers.image.created=${BUILD_TIME} \
-    org.opencontainers.image.authors="num-codex" \
-    org.opencontainers.image.source="https://github.com/num-codex/codex-feasibility-backend" \
+    org.opencontainers.image.authors="medizininformatik-initiative" \
+    org.opencontainers.image.source="https://github.com/medizininformatik-initiative/feasibility-backend" \
     org.opencontainers.image.version=${VERSION} \
     org.opencontainers.image.revision=${GIT_REF} \
-    org.opencontainers.image.vendor="num-codex" \
-    org.opencontainers.image.title="codex feasibility backend" \
+    org.opencontainers.image.vendor="medizininformatik-initiative" \
+    org.opencontainers.image.title="feasibility backend" \
     org.opencontainers.image.description="Provides backend functions for feasibility UI including query execution"

pom.xml

@@ -4,12 +4,12 @@
   <parent>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-parent</artifactId>
-    <version>2.7.3</version>
+    <version>2.7.6</version>
     <relativePath /> <!-- lookup parent from repository -->
   </parent>
   <groupId>de.medizininformatik-initiative</groupId>
   <artifactId>FeasibilityGuiBackend</artifactId>
-  <version>1.0.1</version>
+  <version>2.1.0</version>
   <name>FeasibilityGuiBackend</name>
   <description>Backend of the Feasibility GUI</description>
 
@@ -26,6 +26,7 @@
     <mockwebserver.version>4.9.3</mockwebserver.version>
     <okhttp3.version>4.9.1</okhttp3.version>
     <postgresql.version>42.4.1</postgresql.version>
+    <spring-security.version>5.8.0</spring-security.version>
   </properties>
 
   <dependencyManagement>
@@ -80,10 +81,10 @@
       <artifactId>keycloak-spring-boot-starter</artifactId>
       <version>18.0.0</version>
     </dependency>
+
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-security</artifactId>
-      <version>2.7.2</version>
     </dependency>
 
     <dependency>
@@ -144,28 +145,44 @@
       <version>1.3.2</version>
     </dependency>
 
+    <!--
+      This is for fixing an RCE vulnerability in commons-text <1.10.0. The dependency comes with the
+      dsf-fhir-webservice-client which cannot update the transitive dependency itself due to breaking
+      changes.
+    -->
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-text</artifactId>
+      <version>1.10.0</version>
+    </dependency>
     <dependency>
       <groupId>org.highmed.dsf</groupId>
       <artifactId>dsf-fhir-webservice-client</artifactId>
-      <version>0.7.0</version>
+      <version>0.9.0</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.commons</groupId>
+          <artifactId>commons-text</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
     <dependency>
       <groupId>org.highmed.dsf</groupId>
       <artifactId>dsf-fhir-websocket-client</artifactId>
-      <version>0.7.0</version>
+      <version>0.9.0</version>
     </dependency>
 
     <dependency>
       <groupId>org.highmed.dsf</groupId>
       <artifactId>dsf-fhir-rest-adapter</artifactId>
-      <version>0.7.0</version>
+      <version>0.9.0</version>
     </dependency>
 
     <dependency>
       <groupId>de.medizininformatik-initiative</groupId>
       <artifactId>sq2cql</artifactId>
-      <version>0.1.20</version>
+      <version>0.1.26</version>
     </dependency>
 
     <dependency>
@@ -216,6 +233,14 @@
       <scope>test</scope>
     </dependency>
 
+    <!-- This dependency is only added to address a vulnerability in  org.springframework.boot-->
+    <!-- Remove this once the vulnerability is adressed in the next version -->
+    <dependency>
+      <groupId>org.yaml</groupId>
+      <artifactId>snakeyaml</artifactId>
+      <version>1.32</version>
+    </dependency>
+
     <dependency>
       <groupId>io.projectreactor</groupId>
       <artifactId>reactor-test</artifactId>

src/main/java/de/numcodex/feasibility_gui_backend/query/broker/dsf/DSFQueryManager.java

@@ -28,7 +28,7 @@
  */
 class DSFQueryManager implements QueryManager {
 
-    private static final String INSTANTIATE_URI = "http://medizininformatik-initiative.de/bpe/Process/feasibilityRequest/0.3.0";
+    private static final String INSTANTIATE_URI = "http://medizininformatik-initiative.de/bpe/Process/feasibilityRequest/0.5.0";
     private static final String REQUEST_PROFILE = "http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-request";
     private static final String MEASURE_PROFILE = "http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-measure";
     private static final String LIBRARY_PROFILE = "http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-library";
@@ -42,6 +42,7 @@ class DSFQueryManager implements QueryManager {
     private static final String RECIPIENT_TYPE = "Organization";
 
     private static final String LIBRARY_NAME = "Retrieve";
+    private static final String LIBRARY_VERSION = "1.0.0";
 
     private static final String CODE_SYSTEM_FEASIBILITY = "http://medizininformatik-initiative.de/fhir/CodeSystem/feasibility";
     private static final String CODE_SYSTEM_FEASIBILITY_VALUE_MEASURE_REFERENCE = "measure-reference";
@@ -213,6 +214,7 @@ private Bundle addLibrary(Bundle queryBundle, Map<String, String> queryContents,
         Bundle bundle = queryBundle.copy();
         Library library = new Library()
                 .setName(LIBRARY_NAME)
+                .setVersion(LIBRARY_VERSION)
                 .setStatus(ACTIVE)
                 .setType(new CodeableConcept()
                         .addCoding(new Coding()

src/main/java/de/numcodex/feasibility_gui_backend/query/broker/dsf/DSFQueryResultHandler.java

@@ -13,7 +13,7 @@
 @Slf4j
 class DSFQueryResultHandler {
 
-    private static final String SINGLE_DIC_QUERY_RESULT_PROFILE = "http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-single-dic-result|0.3.0";
+    private static final String SINGLE_DIC_QUERY_RESULT_PROFILE = "http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-single-dic-result|0.5.0";
     private static final String CODE_SYSTEM_FEASIBILITY = "http://medizininformatik-initiative.de/fhir/CodeSystem/feasibility";
     private static final String CODE_SYSTEM_FEASIBILITY_VALUE_MEASURE_REPORT_REF = "measure-report-reference";
     private static final String CODE_SYSTEM_BPMN_MESSAGE = "http://highmed.org/fhir/CodeSystem/bpmn-message";

src/main/java/de/numcodex/feasibility_gui_backend/query/translation/CqlQueryTranslator.java

@@ -31,7 +31,7 @@ public String translate(StructuredQuery query) throws QueryTranslationException
         }
 
         try {
-            return translator.toCql(structuredQuery).print(PrintContext.ZERO);
+            return translator.toCql(structuredQuery).print();
         } catch (Exception e) {
             throw new QueryTranslationException("cannot translate structured query to CQL format", e);
         }

src/test/java/de/numcodex/feasibility_gui_backend/query/broker/dsf/DSFQueryManagerTest.java

@@ -145,7 +145,7 @@ public void testPublishQuery() throws UnsupportedMediaTypeException, QueryNotFou
 
         assertEquals(businessKey, queryId);
         assertNotNull(library.getName());
-        assertEquals("http://medizininformatik-initiative.de/bpe/Process/feasibilityRequest/0.3.0", task.getInstantiatesUri());
+        assertEquals("http://medizininformatik-initiative.de/bpe/Process/feasibilityRequest/0.5.0", task.getInstantiatesUri());
         assertEquals(1, task.getMeta().getProfile().stream().filter(p -> p.getValueAsString()
                         .equals("http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-request"))
                 .count());

src/test/java/de/numcodex/feasibility_gui_backend/query/broker/dsf/DSFQueryResultCollectorIT.java

@@ -31,7 +31,7 @@
 @SuppressWarnings("NewClassNamingConvention")
 public class DSFQueryResultCollectorIT {
 
-    private static final String SINGLE_DIC_RESULT_PROFILE = "http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-single-dic-result|0.3.0";
+    private static final String SINGLE_DIC_RESULT_PROFILE = "http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-single-dic-result|0.5.0";
 
     @Mock
     private DSFBrokerClient brokerClient;
@@ -60,7 +60,7 @@ private Task createTestTask(String brokerQueryId, String siteId, String measureR
                 .setStatus(COMPLETED)
                 .setIntent(ORDER)
                 .setAuthoredOn(new Date())
-                .setInstantiatesUri("http://highmed.org/bpe/Process/feasibilityRequest/0.3.0");
+                .setInstantiatesUri("http://highmed.org/bpe/Process/feasibilityRequest/0.5.0");
 
         task.getRequester()
                 .setType("Organization")

src/test/java/de/numcodex/feasibility_gui_backend/query/broker/dsf/DSFQueryResultHandlerTest.java

@@ -55,7 +55,7 @@ public void testOnResultButReferencedMeasureReportCanNotBeFetched() throws FhirW
                 .setIntent(ORDER)
                 .setRequester(dicOrganizationRef)
                 .setRestriction(new TaskRestrictionComponent().addRecipient(zarsOrganizationRef));
-        task.getMeta().addProfile("http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-single-dic-result|0.3.0");
+        task.getMeta().addProfile("http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-single-dic-result|0.5.0");
 
         task.addInput()
                 .setType(new CodeableConcept()
@@ -88,7 +88,7 @@ public void testOnResult() throws FhirWebClientProvisionException {
                 .setIntent(ORDER)
                 .setRequester(dicOrganizationRef)
                 .setRestriction(new TaskRestrictionComponent().addRecipient(zarsOrganizationRef));
-        task.getMeta().addProfile("http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-single-dic-result|0.3.0");
+        task.getMeta().addProfile("http://medizininformatik-initiative.de/fhir/StructureDefinition/feasibility-task-single-dic-result|0.5.0");
 
         task.addInput()
                 .setType(new CodeableConcept()

src/test/java/de/numcodex/feasibility_gui_backend/query/translation/CqlQueryTranslatorTest.java

@@ -103,11 +103,12 @@ public void testTranslate_EverythingSucceeds() throws QueryTranslationException
         testQuery.setVersion(URI.create("http://to_be_decided.com/draft-2/schema#"));
 
         var resultLibraryMock = mock(Library.class);
-        when(resultLibraryMock.print(any())).thenReturn("bar");
+        when(resultLibraryMock.print()).thenReturn("bar");
         when(translator.toCql(any(de.numcodex.sq2cql.model.structured_query.StructuredQuery.class)))
                 .thenReturn(resultLibraryMock);
 
         var translationResult = cqlQueryTranslator.translate(testQuery);
         assertEquals("bar", translationResult);
+
     }
 }