fix(shl): derive the access document per manifest fetch, not once at mint

The completeness fix in 9c9b19b could not reach a single link already in
circulation, and this is why: encryptSHLFile runs at mint, the ciphertext is
stored on the session, and the manifest endpoint replays it verbatim
(`embedded: entry.jwe`). Whatever the document claimed on the day it was created,
it claims forever. A link minted before that fix still tells its recipient

  Complete summary — the patient shared their full health record

over a view where the proxy denies all but Patient, ImagingStudy and metadata.

Nothing required the snapshot: the session already holds studyInstanceUID,
shareScope, patientId, sessionToken, expiresAt and the SHL key, so the manifest
can state what is true when asked. It now rebuilds and re-encrypts the document
on each fetch, falling back to the stored blob only if encryption fails — a stale
claim still beats handing the recipient a link that will not open.

Mint and manifest share one buildSmartApiAccess so a fresh link and a later fetch
cannot disagree. `expires_in` is now counted from the request rather than from
mint, where it had been describing a lifetime that started days ago.

Existing links, including the one that prompted this, are corrected as soon as the
backend deploys. No re-share needed.

Author: quotentiroler

backend/src/routes/api/shl.ts

@@ -92,6 +92,37 @@ function isJsonContentType(contentType: string | null): boolean {
   return !!contentType && /json/i.test(contentType)
 }
 
+/**
+ * The smart-api-access document the recipient decrypts (SHL spec §3.2).
+ *
+ * Derived from the session on every manifest fetch rather than frozen at mint,
+ * because what it asserts — how long the token is good for, whether the share is
+ * complete — are properties of the share as it stands now. Freezing them meant a
+ * link kept telling recipients it carried the full record after the rule deciding
+ * that was corrected, since the claim sat inside ciphertext minted days earlier.
+ */
+export function buildSmartApiAccess(session: {
+  sessionToken: string
+  patientId: string
+  expiresAt: number
+  shareScope?: ShareScope
+  studyInstanceUID?: string
+}): string {
+  return JSON.stringify({
+    access_token: session.sessionToken,
+    token_type: 'Bearer',
+    expires_in: Math.max(0, Math.floor((session.expiresAt - Date.now()) / 1000)),
+    scope: 'patient/*.read',
+    patient: session.patientId,
+    // aud points to our FHIR proxy — the viewer never talks to the real FHIR server.
+    aud: `${config.baseUrl}/api/shl/fhir`,
+    complete: isCompleteShare({
+      selectiveScope: session.shareScope,
+      studyInstanceUID: session.studyInstanceUID,
+    }),
+  })
+}
+
 /** Build the pure SelectiveScope from a session's persisted shareScope (all-empty when absent). */
 function sessionSelectiveScope(session: { shareScope?: ShareScope }): SelectiveScope {
   return {
@@ -438,19 +469,15 @@ export const shlRoutes = new Elysia({ prefix: '/shl', tags: ['shl'] })
           ? { excludedTypes, excludedIds, excludedObservationCategories }
           : undefined
 
-      // Build the SMART API Access token response (per SHL spec)
-      // aud points to our FHIR proxy — the viewer never talks to the real FHIR server.
-      // `complete` is a non-standard hint for our own viewer: false when the patient
-      // de-selected records, so the recipient can be told the summary is partial
-      // (qualitative only — no counts leak). Only the key holder can read it (JWE).
-      const smartApiAccess = JSON.stringify({
-        access_token: sessionToken,
-        token_type: 'Bearer',
-        expires_in: ttlSeconds,
-        scope: 'patient/*.read',
-        patient: patientId,
-        aud: `${config.baseUrl}/api/shl/fhir`,
-        complete: isCompleteShare({ selectiveScope: shareScope, studyInstanceUID: body.studyInstanceUID }),
+      // The same document the manifest re-derives on every fetch — built once here
+      // so a freshly minted link and a later fetch cannot disagree. `complete` is a
+      // non-standard hint for our own viewer, readable only by the key holder (JWE).
+      const smartApiAccess = buildSmartApiAccess({
+        sessionToken,
+        patientId,
+        expiresAt,
+        shareScope,
+        studyInstanceUID: body.studyInstanceUID,
       })
 
       // Generate SHL using kill-the-clipboard
@@ -614,12 +641,29 @@ export const shlRoutes = new Elysia({ prefix: '/shl', tags: ['shl'] })
       recipient: body.recipient,
     })
 
+    // Re-derive the access document from the session so it describes the share as
+    // it is now. Falls back to the stored blob only if encryption fails, since a
+    // stale claim still beats handing the recipient an unopenable link.
+    let embedded = entry.jwe
+    try {
+      embedded = await encryptSHLFile({
+        content: buildSmartApiAccess(entry),
+        key: entry.shl.key,
+        contentType: SMART_API_ACCESS,
+      })
+    } catch (error) {
+      logger.auth.error('Could not rebuild the SHL access document — serving the one stored at mint', {
+        shlId: params.id,
+        error: error instanceof Error ? error.message : String(error),
+      })
+    }
+
     // Return spec-compliant SHL manifest
     // The JWE compact string goes directly in `embedded` (not wrapped in custom JSON)
     return {
       files: [{
         contentType: SMART_API_ACCESS as string,
-        embedded: entry.jwe,
+        embedded,
       }],
     }
   }, {

backend/test/shl-access-document.test.ts

@@ -0,0 +1,62 @@
+// SPDX-FileCopyrightText: Max Health Inc.
+// SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Commercial
+
+/**
+ * The smart-api-access document a recipient decrypts.
+ *
+ * It used to be built once at mint and stored as ciphertext, which the manifest
+ * replayed forever. So when `complete` was corrected to count study scoping, every
+ * link already in circulation kept telling recipients it carried the full record —
+ * over a view where the proxy answers all but three queries with 403.
+ *
+ * Deriving it from the session on each fetch is what makes a fix reach links that
+ * already exist. These tests pin that the document follows the session.
+ */
+import { describe, expect, it } from 'bun:test'
+import { buildSmartApiAccess } from '../src/routes/api/shl'
+
+const base = {
+  sessionToken: 'opaque-session-token',
+  patientId: 'max-nussbaumer',
+  expiresAt: Date.now() + 3600_000,
+}
+
+const parse = (json: string) => JSON.parse(json) as Record<string, unknown>
+
+describe('buildSmartApiAccess', () => {
+  it('reports a whole-patient share as complete', () => {
+    expect(parse(buildSmartApiAccess(base)).complete).toBe(true)
+  })
+
+  it('reports a study-scoped share as incomplete', () => {
+    const doc = parse(buildSmartApiAccess({ ...base, studyInstanceUID: '1.2.840.113619.2.55.3' }))
+    expect(doc.complete).toBe(false)
+  })
+
+  it('reports a de-selected share as incomplete', () => {
+    const doc = parse(buildSmartApiAccess({
+      ...base,
+      shareScope: { excludedTypes: ['Condition'], excludedIds: [], excludedObservationCategories: [] },
+    }))
+    expect(doc.complete).toBe(false)
+  })
+
+  it('carries the session token and patient the viewer needs', () => {
+    const doc = parse(buildSmartApiAccess(base))
+    expect(doc.access_token).toBe('opaque-session-token')
+    expect(doc.patient).toBe('max-nussbaumer')
+    expect(doc.token_type).toBe('Bearer')
+    expect(doc.scope).toBe('patient/*.read')
+  })
+
+  /** Frozen at mint, expires_in counted down from the wrong instant on every later fetch. */
+  it('counts expires_in from now, not from mint', () => {
+    const expiresIn = parse(buildSmartApiAccess({ ...base, expiresAt: Date.now() + 600_000 })).expires_in
+    expect(expiresIn).toBeGreaterThan(590)
+    expect(expiresIn).toBeLessThanOrEqual(600)
+  })
+
+  it('never reports a negative lifetime for an expired share', () => {
+    expect(parse(buildSmartApiAccess({ ...base, expiresAt: Date.now() - 60_000 })).expires_in).toBe(0)
+  })
+})