Skip to main content

token_provider

Builds the bearer-token source a FHIR R4 client authenticates with.

There is exactly one place that decides where an EHR bearer token comes from, so the FHIR R4 worker algorithms and the DAG-step EHRDataResource cannot drift apart on it — an earlier split between the two left one path raising on missing credentials while the other silently sent unauthenticated requests.

See docs/adr/0006-fhir-client-owns-its-authorization.md.

Module​

Functions​

build_fhir_token_source​

def build_fhir_token_source(    ehr_config: EHRConfig | None,    ehr_secrets: RefreshableJWT | None,) ‑> tuple[RefreshableJWTSession | None, collections.abc.Callable[[bool], tuple[str, datetime.datetime | None]] | None]:

Build the session and token callback for a FHIR R4 client.

The callback is handed to FHIRClient(token_provider=...), which pulls a token before every request rather than snapshotting one at construction. The session is returned alongside it because callers keep it for token introspection and connectivity checks.

Arguments

  • ehr_config: The pod's EHR config. SMARTBackendEHRConfig carries its own auth on the config object; every other FHIR R4 provider authenticates from ehr_secrets.
  • ehr_secrets: Externally-supplied JWT secrets, from the pod's secrets.

Returns (session, token_provider), or (None, None) for a genuinely unauthenticated server under allow_no_ehr_secrets — in which case the client sends no Authorization header.

Raises

  • ValueError: If no usable credentials are available and allow_no_ehr_secrets is not set. Failing here beats discovering it as an HTTP 401 once per patient at query time, which is the failure this module exists to prevent.