smart-on-fhir/bulk-import

bulk-import's Issues

Authorization for static imports

How should a data consumer authorize in case of static import? My first suggestion was that it should read the requiresAccessToken property of the manifest to detect if auth is required. However, requiresAccessToken may be true but the manifest itself may be stored on third party file server that has nothing to do with the FHIR server. In this case how could the data consumer know what server to authorize against?

For that reason I intend to require a provider_token_url input at registration time and store that in the client (along with a consumer_client_id). Do you think that makes sense?

BTW, this is probably true to some extend for dynamic exports as well. In that case the client (the consumer) knows the export URL and can try to compute the base url from that, then look up a CapabilityStatement or well-known json and ultimately detect where the token endpoint is..., but somehow that doesn't strike me as the most reliable way to do that.

Question: Is there no support for bulk $import if I want to upload files from my local machine?