Skip to content

Releases: Digital-Healthcare-OpenSource/FHIRBridge

Release list

FHIRBridge v0.2.0

FHIRBridge v0.2.0 Latest
Latest

Choose a tag to compare

View all tags
@tranhoangtu-it tranhoangtu-it released this 24 Jul 15:17
v0.2.0
710ca39
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FHIRBridge v0.2.0 — four-market readiness release: Global (EN), Việt Nam (VI), 日本 (JA), 한국 (KO).

Highlights

🇰🇷 Korea compliance (PIPA) — new

  • Korean locale (ko) across the web dashboard (5 namespaces) and AI summary language support; real Japanese translations shipped alongside (the previous ja bundle was placeholder text).
  • RRN (주민등록번호) protection: regex + mod-11 checksum detector; identifier-mapped RRN values are HMAC-hashed when a secret is configured or masked ######-******* otherwise; the de-identifier masks any leftover RRN before AI calls. Raw RRN never reaches output, logs, or audit rows.
  • PIPA Art. 28-8 cross-border consent: Korean-market consent grants must acknowledge all five disclosure items; the consent modal presents them in every locale.
  • Access log (접속기록): AUDIT_PROFILE=kr enriches audit rows with patientRefHash (HMAC, never raw) + sourceIp per the KR safeguard requirements.
  • Korea hospital CSV column-mapping example (examples/column-mappings/csv-korea-hospital.json).

🇻🇳 Vietnam

  • Data residency — Vietnam (PDPD) documentation: Nghị định 13/2023/NĐ-CP sensitive-data consent, Art. 24/25 impact-assessment dossiers for cross-border AI calls, Decree 53/2022 localization posture of the self-hosted zero-PHI design, and the PDPL (91/2025/QH15) supersession note.

Operations & security

  • Schema-migration runner (dependency-free): sequential NNN_name.sql, per-migration transactions, schema_migrations checksum drift detection, pg_advisory_lock for multi-replica; run via pnpm --filter @fhirbridge/api migrate.
  • Dormant CI suites revived: the security test suite (46 tests) and the full Playwright e2e/a11y suite (372 e2e + 66 a11y, 3 browsers × 2 viewports) now run for real.
  • Accessibility: skip-to-content link, WCAG AA contrast fixes, ARIA corrections (axe critical+serious = 0 on all pages incl. landing).
  • Dependency hardening: all Dependabot alerts closed; production pnpm audit (high+) = 0.

Fixed

  • CSV imports from Firefox/WebKit on Windows returned 500 (application/vnd.ms-excel MIME mapping routed CSV into the Excel connector).
  • Web dashboard: API keys were sent as Authorization: Bearer (server accepts keys only via x-api-key) — pasting an API key in Settings now works.
  • Export wizard sent connectorConfig.url where the API expects baseUrl — wizard exports work end-to-end; failed exports now stop polling.
  • Import page no longer dead-ends after upload — synchronous imports show "Import complete — N resources processed".
  • Vite dev/preview proxy pointed at the wrong port and stripped the /api prefix.

Verification

  • docker run smoke test: /api/v1/health → export a patient from the public HAPI R4 sandbox → NDJSON download.
  • Full gate: build, ~1100 unit tests, typecheck, lint, integration, CLI e2e, security, performance, 372/372 Playwright e2e, 66/66 a11y.
  • Image: multi-arch (amd64/arm64), Trivy-gated, SPDX SBOM + SLSA provenance attestations, keyless cosign-signed.
docker pull ghcr.io/digital-healthcare-opensource/fhirbridge-api:0.2.0
cosign verify ghcr.io/digital-healthcare-opensource/fhirbridge-api:0.2.0 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'github.com/Digital-Healthcare-OpenSource/FHIRBridge'

Notes

  • ko/ja translations and consent/BAA texts are machine-authored and pending native-speaker review — flag issues via GitHub.
  • This is engineering software, not legal advice; data-residency sections (APPI/PIPA/PDPD) summarize engineering posture only.
Assets 2
Loading