SMART scope audit examples¶

OpenMed includes an offline SMART-on-FHIR scope comparison example for local workflow planning. It compares the resource scopes a synthetic workflow says it needs with the scopes declared for that workflow and reports missing or excessive operations.

The example is deliberately local-only:

• it does not implement OAuth;
• it does not contact a FHIR server;
• it does not include endpoints, tokens, launch context values, or patient data;
• it uses synthetic resource names such as SyntheticObservation.

Run the example¶

python examples/smart_scope_audit.py

The report is deterministic JSON with patient, user, and system context cases:

• a passing read-only patient workflow;
• a patient workflow missing a read scope;
• a user write workflow that over-claims search operations;
• a system read workflow with both missing and excessive scopes.

Each audit lists:

• required_scopes: normalized workflow needs;
• declared_scopes: normalized declared scopes;
• missing_scopes: required operations absent from the declaration;
• excessive_scopes: declared operations not needed by the workflow.

Example shape¶

{
  "workflow_id": "patient-read-missing",
  "status": "missing",
  "missing_scopes": [
    {
      "scope": "patient/SyntheticCondition.r",
      "context": "patient",
      "resource_type": "SyntheticCondition",
      "operations": [
        {
          "code": "r",
          "name": "read"
        }
      ]
    }
  ]
}

This helper is for deterministic local comparison only. It is not a production permissions recommendation, an OAuth client, or a substitute for deployment review.