Patient user getting 403 on CondingInput (gender, ...
# supporto
oscadev
07/19/2025, 8:40 PMLast I checked, a practitioner logging in works, but mabe its broken now too after massive changes. Either way, when I log in as a user (medplumProfile works, so it is authed), I get 403. Here is an example component
<CodingInput
binding="http://hl7.org/fhir/ValueSet/icd-10"
name="icd10"
path=""
placeholder="Search for ICD-10 codes..."
/>
I added this to the default patient access policy (per chatGpt's attempt to fix the 403)
{
"resourceType": "ValueSet"
}
oscadev
07/20/2025, 5:45 AMJust confirmed that it is something wrong with my access policy. As soon as I remove the access policy from the user, all the valueSets load in the CodinInputs. Here us the "resource" part of the policy
"resource": [
{
"resourceType": "Patient",
"criteria": "Patient?_compartment=%patient"
},
{
"resourceType": "Observation",
"criteria": "Observation?_compartment=%patient"
},
{
"resourceType": "DiagnosticReport",
"criteria": "DiagnosticReport?_compartment=%patient"
},
{
"resourceType": "MedicationRequest",
"criteria": "MedicationRequest?_compartment=%patient"
},
{
"resourceType": "Coverage",
"criteria": "Coverage?_compartment=%patient"
},
{
"resourceType": "PaymentNotice",
"criteria": "PaymentNotice?_compartment=%patient"
},
{
"resourceType": "CarePlan",
"criteria": "CarePlan?_compartment=%patient"
},
{
"resourceType": "Immunization",
"criteria": "Immunization?_compartment=%patient"
},
{
"resourceType": "Communication",
"criteria": "Communication?_compartment=%patient"
},
{
"resourceType": "Organization",
"readonly": true
},
{
"resourceType": "Practitioner",
"readonly": true
},
{
"resourceType": "Schedule",
"readonly": true
},
{
"resourceType": "Slot",
"readonly": true
},
{
"resourceType": "Binary"
},
{
"resourceType": "ValueSet",
"criteria": "ValueSet?url=*"
},
{
"resourceType": "CodeSystem",
"criteria": "CodeSystem?url=*"
}
],
i
Ian Plunkett
07/21/2025, 4:23 PMLet us know if you need any additional assistance
o
oscadev
07/22/2025, 1:09 AMTo clarify, I am still having the issue when using this policy i posted
i
Ian Plunkett
07/22/2025, 3:04 PMCan you share the full policy and a resource it applies to?
o
oscadev
07/22/2025, 10:12 PMHere is the full patient access policy (minus the "resource" since it exceeds the char limit of discord. I pasted the resource above previously.
{
"resourceType": "AccessPolicy",
"name": "Patient Access Policy Template",
"id": "0198059f-af2b-7753-a088-9b09a80209e2",
"compartment": {
"reference": "%patient"
},
"resource": []
"meta": {
"project": "019682e4-6764-77be-9f1b-142f86ab2b28",
"compartment": [
{
"reference": "Project/019682e4-6764-77be-9f1b-142f86ab2b28"
}
],
"versionId": "01982578-c93e-717a-87f2-385be0fba19e",
"lastUpdated": "2025-07-20T01:35:29.598Z",
"author": {
"reference": "Practitioner/01981e87-e192-73fb-88e8-03f891cb80bb",
"display": "dev"
}
}
}
oscadev
07/22/2025, 10:14 PMThen I try to use a codingInput like so
<CodingInput
binding="http://hl7.org/fhir/ValueSet/icd-10"
name="icd10"
path=""
placeholder="Search for ICD-10 codes..."
/>
This works when I disable the access policy on the user, but doesnt work with the access policy enabled
i
Ian Plunkett
07/23/2025, 7:05 PM@oscadev is there any reason you added
"criteria": "CodeSystem?url=""criteria": "ValueSet?url="o
oscadev
07/24/2025, 12:05 AMthat was from chatgpt. Thanks, that works
150 Views