cms-hte-ial2-reader

Reads IAL2 token, verifies digital signature and returns FHIR Patient resource

Accepts a signed JWT (ID Token) from a Credential Service Provider (CSP), verifies the signature via JWKS, extracts demographics per the CSP payload specification V7.1, and returns a FHIR R4 Patient resource.

Usage

from cmshteial2reader import IAL2Extractor, TokenVerifier

verifier = TokenVerifier(
    jwks_uri="https://idp.example.com/.well-known/jwks.json",
    audience="my-client-id",
)
extractor = IAL2Extractor(verifier=verifier)
patient = await extractor.extract(token_string)
# patient is a FHIR R4 Patient resource dict

To accept tokens from any issuer on an explicit allow list (rather than a single pinned issuer), use MultiIssuerTokenVerifier in place of TokenVerifier:

from cmshteial2reader import IAL2Extractor, MultiIssuerTokenVerifier

verifier = MultiIssuerTokenVerifier.from_env(audience="my-client-id")
extractor = IAL2Extractor(verifier=verifier)
patient = await extractor.extract(token_string)

MultiIssuerTokenVerifier.from_env reads its whitelist of trusted JWKS URLs from the IAL2_ALLOWED_JWKS_URLS environment variable (comma-separated).

Quickstart

• make init to set up the local dev environment.
• make up to start the Docker dev stack.
• make tests to run tests in the dev container.

Common Tasks

• make shell to open a shell in the dev container.
• make run-pre-commit to run linting and formatting hooks.
• make build to build the package artifacts.

Publishing

• Set a token: export TWINE_PASSWORD=pypi-xxx
• make package to publish to PyPI or make testpackage for TestPyPI.

Project Metadata

• Repo: https://github.com/icanbwell/cms-hte-ial2-reader
• Author: Imran Qureshi imran.qureshi@bwell.com