SMART Exposed Extension

Canonical	../StructureDefinition/smart-exposed
Status	draft · 1.26.0
Base	Extension (constraint)
Context	StructureDefinition (element)
Source	FSH · JSON

Declares that this profile's resource type is reachable by a SMART on FHIR app, and names the platform permission required for each operation. Exposure is an authorization decision recorded in the IG, deliberately separate from whether the resource happens to be profiled.

FSH

The authored source of truth: extensions/SmartExposed.fsh (edit on GitHub). One FSH file may define several related artifacts.

// SmartExposed.fsh
// Declares that a profile's resource type is reachable by a SMART on FHIR app, and names the
// platform permission a caller needs for each operation. Applied at the StructureDefinition level;
// authored terse via the `SmartExposed` RuleSet.
//
// WHY THIS EXISTS. Profiling a resource and exposing it to a third-party app are two different
// decisions. Profiling is modelling; exposure is authorization. Without this flag the two collapse
// into one: a SMART wildcard scope (`patient/*.rs`) expands over "every profiled resource", so
// adding a profile silently widens the security boundary, and removing one silently leaves a
// permission grantable. Carrying exposure explicitly makes it a reviewable decision in the IG
// rather than a side effect of `kind = resource`.
//
// ON THE PERMISSION TOKENS. These name the platform's own permissions (`observation:read`), which
// are already a public feature of the EMR: administrators see them when building a role, they are
// validated on role edit and persisted on role grants. The IG REFERENCES them so an app author
// reading a resource page learns what to ask for; it does not define or own them. The definition
// stays the `Permission` enum in Well.Security, and code generation fails if a token declared here
// does not exist there.
//
// SMART's own scope grammar (the `c` `r` `u` `d` `s` interaction letters, `.read`/`.write` folding,
// wildcard expansion) is deliberately NOT modelled here. That is the app-facing dialect, and
// translating it to these operations is Well.Security's job. This extension answers only "is it
// exposed, and what does each operation cost".

Extension: SmartExposed
Id: smart-exposed
Title: "SMART Exposed"
Description: "Declares that this profile's resource type is reachable by a SMART on FHIR app, and names the platform permission required for each operation. Exposure is an authorization decision recorded in the IG, deliberately separate from whether the resource happens to be profiled."
* ^url = "../StructureDefinition/smart-exposed"
* ^status = #draft
* ^context[0].type = #element
* ^context[0].expression = "StructureDefinition"
* extension contains
    read 1..1 MS and
    write 0..1 and
    delete 0..1
* extension[read].value[x] only string
* extension[read] ^short = "The permission required to read or search this resource"
* extension[read] ^definition = "Required. A resource that cannot be read cannot meaningfully be exposed over SMART, so the presence of this extension always implies at least read access."
* extension[write].value[x] only string
* extension[write] ^short = "The permission required to create or update this resource (omit for read-only exposure)"
* extension[delete].value[x] only string
* extension[delete] ^short = "The permission required to delete this resource (omit if deletion is not exposed)"
* url 1..1
* value[x] 0..0