Validate patient id is a relative reference

src/lib/Microsoft.Health.Extensions.Fhir.R4/ModelExtensions.cs

@@ -4,11 +4,14 @@
 // -------------------------------------------------------------------------------------------------
 
 using System;
+using System.Text.RegularExpressions;
 
 namespace Microsoft.Health.Extensions.Fhir
 {
     public static class ModelExtensions
     {
+        private static Regex _idMatcherRegex = new Regex(@"^[A-Za-z0-9_.\-~#]+$", RegexOptions.Compiled);
+
         public static Hl7.Fhir.Model.ResourceReference ToReference<TResource>(this TResource resource)
             where TResource : Hl7.Fhir.Model.Resource
         {
@@ -39,9 +42,26 @@ public static Hl7.Fhir.Model.ResourceReference ToReference<TResource>(this strin
         /// <returns>The id for the specified resource type if it exists, null otherwise.</returns>
         public static string GetId<TResource>(this Hl7.Fhir.Model.ResourceReference reference)
         {
+            string id;
             var referenceType = $"{typeof(TResource).Name}/";
-            return reference?.Reference == null || !reference.Reference.StartsWith(referenceType, StringComparison.InvariantCultureIgnoreCase)
-                ? null : reference.Reference.Substring(referenceType.Length);
+
+            if (reference?.Reference == null || !reference.Reference.StartsWith(referenceType, StringComparison.InvariantCultureIgnoreCase))
+            {
+                return null;
+            }
+
+            // Reference should be in the form: ResourceType/Identifier
+            var relativeReferenceIdentifier = reference.Reference.Substring(referenceType.Length);
+            var matches = _idMatcherRegex.Match(relativeReferenceIdentifier);
+            if (matches?.Groups?.Count != 1)
+            {
+                return null;
+            }
+            else
+            {
+                id = matches?.Groups?[0].Value;
+                return id;
+            }
         }
     }
 }

test/Microsoft.Health.Extensions.Fhir.R4.UnitTests/ModelExtensionsTests.cs

@@ -0,0 +1,39 @@
+// -------------------------------------------------------------------------------------------------
+// Copyright (c) Microsoft Corporation. All rights reserved.
+// Licensed under the MIT License (MIT). See LICENSE in the repo root for license information.
+// -------------------------------------------------------------------------------------------------
+
+using Xunit;
+using Model = Hl7.Fhir.Model;
+
+namespace Microsoft.Health.Extensions.Fhir.R4.UnitTests
+{
+    public class ModelExtensionsTests
+    {
+        [Fact]
+        public void GivenDeviceWithValidPatientReference_GetId_ThenReferenceIdentifierIsReturned_Test()
+        {
+            var device = new Model.Device
+            {
+                Id = "1",
+                Patient = new Model.ResourceReference("Patient/123"),
+            };
+
+            var patientIdentifier = device.Patient?.GetId<Model.Patient>();
+            Assert.Equal("123", patientIdentifier);
+        }
+
+        [Fact]
+        public void GivenDeviceWithInvalidPatientReference_GetId_ThenNullIsReturned_Test()
+        {
+            var device = new Model.Device
+            {
+                Id = "1",
+                Patient = new Model.ResourceReference("Not a reference in the form of: ResourceName/Identifier"),
+            };
+
+            var patientReference = device.Patient?.GetId<Model.Patient>();
+            Assert.Null(patientReference);
+        }
+    }
+}

test/Microsoft.Health.Fhir.R4.Ingest.UnitTests/Service/R4DeviceAndPatientLookupIdentityServiceTests.cs

@@ -100,5 +100,31 @@ public async void GivenDeviceWithNotPatientReference_WhenResolveResourceIdentiti
 
             await resourceService.Received(1).GetResourceByIdentityAsync<Model.Device>(fhirClient, "deviceId", null);
         }
+
+        [Fact]
+        public async void GivenDeviceWithPatientReferenceUnsupportedCharacters_WhenResolveResourceIdentitiesAsync_ThenNotSupportedExceptionThrown_Test()
+        {
+            var fhirClient = Utilities.CreateMockFhirClient();
+            var resourceService = Substitute.For<ResourceManagementService>();
+            var device = new Model.Device
+            {
+                Id = "1",
+                Patient = new Model.ResourceReference("Not a reference in the form of: /ResourceName/Identifier"),
+            };
+
+            var mg = Substitute.For<IMeasurementGroup>();
+            mg.DeviceId.Returns("deviceId");
+
+            resourceService.GetResourceByIdentityAsync<Model.Device>(Arg.Any<FhirClient>(), Arg.Any<string>(), Arg.Any<string>())
+                .Returns(Task.FromResult(device));
+
+            using (var idSrv = new R4DeviceAndPatientLookupIdentityService(fhirClient, resourceService))
+            {
+                var ex = await Assert.ThrowsAsync<FhirResourceNotFoundException>(async () => await idSrv.ResolveResourceIdentitiesAsync(mg));
+                Assert.Equal(ResourceType.Patient, ex.FhirResourceType);
+            }
+
+            await resourceService.Received(1).GetResourceByIdentityAsync<Model.Device>(fhirClient, "deviceId", null);
+        }
     }
 }