Merge remote-tracking branch 'origin/main' into personal/anilm/fhir-c…

…osmosdbinitialization-newassembly
microsoft · Jul 2, 2024 · 7a7650b · 7a7650b
2 parents 8a95303 + dbd7da7
commit 7a7650b
Show file tree

Hide file tree

Showing 81 changed files with 955 additions and 249 deletions.
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -6,7 +6,7 @@
   </PropertyGroup>
   <ItemGroup Label="CVE Mitigation">
     <!--Please include the CGA id if possible-->
-    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.0" />
+    <PackageVersion Include="System.Security.Cryptography.Xml" Version="8.0.1" />
     <!--CVE-2023-29331-->
     <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="8.0.0" />
     <!-- CVE-2021-26701 -->
@@ -30,15 +30,15 @@
     </Otherwise>
   </Choose>
   <ItemGroup>
-    <PackageVersion Include="AngleSharp" Version="1.0.4" />
-    <PackageVersion Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.2.2" />
-    <PackageVersion Include="Azure.Identity" Version="1.11.3" />
-    <PackageVersion Include="Azure.Monitor.OpenTelemetry.AspNetCore" Version="1.1.0" />
+    <PackageVersion Include="AngleSharp" Version="1.1.2" />
+    <PackageVersion Include="Azure.Identity" Version="1.12.0" />
+    <PackageVersion Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.3.1" />
+    <PackageVersion Include="Azure.Monitor.OpenTelemetry.AspNetCore" Version="1.2.0" />
     <PackageVersion Include="Azure.Storage.Blobs" Version="12.20.0" />
     <PackageVersion Include="coverlet.collector" Version="6.0.2" />
     <PackageVersion Include="DotNet.ReproducibleBuilds" Version="1.1.1" />
     <PackageVersion Include="Ensure.That" Version="10.1.0" />
-    <PackageVersion Include="FluentValidation" Version="11.9.0" />
+    <PackageVersion Include="FluentValidation" Version="11.9.2" />
     <PackageVersion Include="Hl7.Fhir.R4" Version="$(Hl7FhirVersion)" />
     <PackageVersion Include="Hl7.Fhir.R4B" Version="$(Hl7FhirVersion)" />
     <PackageVersion Include="Hl7.Fhir.R5" Version="$(Hl7FhirVersion)" />
@@ -51,7 +51,7 @@
     <PackageVersion Include="Hl7.Fhir.Support.Poco" Version="$(Hl7FhirVersion)" />
     <PackageVersion Include="Hl7.FhirPath" Version="$(Hl7FhirVersion)" />
     <PackageVersion Include="IdentityServer4" Version="4.1.2" />
-    <PackageVersion Include="MediatR" Version="12.2.0" />
+    <PackageVersion Include="MediatR" Version="12.3.0" />
     <PackageVersion Include="Microsoft.ApplicationInsights.AspNetCore" Version="2.22.0" />
     <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="$(AspNetPackageVersion)" />
     <PackageVersion Include="Microsoft.AspNetCore.JsonPatch" Version="$(AspNetPackageVersion)" />
@@ -60,23 +60,23 @@
     <PackageVersion Include="Microsoft.AspNetCore.Mvc.Testing" Version="$(AspNetPackageVersion)" />
     <PackageVersion Include="Microsoft.AspNetCore.TestHost" Version="$(AspNetPackageVersion)" />
     <PackageVersion Include="Microsoft.Azure.ContainerRegistry" Version="1.0.0-preview.2" />
-    <PackageVersion Include="Microsoft.Azure.Cosmos" Version="3.39.1" />
+    <PackageVersion Include="Microsoft.Azure.Cosmos" Version="3.41.0" />
     <PackageVersion Include="Microsoft.Azure.Storage.Blob" Version="11.2.3" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Binder" Version="8.0.1" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.CommandLine" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Configuration.Json" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Configuration" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.3" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions" Version="8.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.Diagnostics.HealthChecks" Version="8.0.6" />
+    <PackageVersion Include="Microsoft.Extensions.FileProviders.Embedded" Version="8.0.6" />
     <PackageVersion Include="Microsoft.Extensions.Hosting.Abstractions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Http.Polly" Version="8.0.6" />
     <PackageVersion Include="Microsoft.Extensions.Http" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.1" />
     <PackageVersion Include="Microsoft.Extensions.Logging.ApplicationInsights" Version="2.22.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="8.3.0" />
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="8.6.0" />
     <PackageVersion Include="Microsoft.Extensions.Options.ConfigurationExtensions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Health.Abstractions" Version="$(HealthcareSharedPackageVersion)" />
     <PackageVersion Include="Microsoft.Health.Api" Version="$(HealthcareSharedPackageVersion)" />
@@ -87,22 +87,22 @@
     <PackageVersion Include="Microsoft.Health.Extensions.DependencyInjection" Version="$(HealthcareSharedPackageVersion)" />
     <PackageVersion Include="Microsoft.Health.Fhir.Anonymizer.R4.Core" Version="3.1.0.62" />
     <PackageVersion Include="Microsoft.Health.Fhir.Anonymizer.Stu3.Core" Version="3.1.0.62" />
-    <PackageVersion Include="Microsoft.Health.Fhir.Liquid.Converter" Version="5.1.28" />
+    <PackageVersion Include="Microsoft.Health.Fhir.Liquid.Converter" Version="7.0.1" />
     <PackageVersion Include="Microsoft.Health.SqlServer.Api" Version="$(HealthcareSharedPackageVersion)" />
     <PackageVersion Include="Microsoft.Health.SqlServer" Version="$(HealthcareSharedPackageVersion)" />
     <PackageVersion Include="Microsoft.Health.Test.Utilities" Version="$(HealthcareSharedPackageVersion)" />
     <PackageVersion Include="Microsoft.Health.Tools.Sql.Tasks" Version="$(HealthcareSharedPackageVersion)" />
     <PackageVersion Include="Microsoft.Identity.Web" Version="2.13.3" />
     <PackageVersion Include="Microsoft.IO.RecyclableMemoryStream" Version="2.3.2" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.7.2" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
     <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />
     <PackageVersion Include="Microsoft.SqlServer.DACFx" Version="162.0.52" />
     <PackageVersion Include="Microsoft.SqlServer.SqlManagementObjects" Version="171.30.0" />
-    <PackageVersion Include="Newtonsoft.Json.Schema" Version="3.0.15" />
+    <PackageVersion Include="Newtonsoft.Json.Schema" Version="4.0.1" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageVersion Include="NSubstitute" Version="5.1.0" />
-    <PackageVersion Include="Polly" Version="8.3.1" />
-    <PackageVersion Include="prometheus-net.AspNetCore" Version="8.0.1" />
+    <PackageVersion Include="Polly" Version="8.4.1" />
+    <PackageVersion Include="prometheus-net.AspNetCore" Version="8.2.1" />
     <PackageVersion Include="prometheus-net.DotNetRuntime" Version="4.4.0" />
     <PackageVersion Include="prometheus-net.SystemMetrics" Version="3.1.0" />
     <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
@@ -112,15 +112,16 @@
     <PackageVersion Include="System.Configuration.ConfigurationManager" Version="8.0.0" />
     <PackageVersion Include="System.Data.SqlClient" Version="4.8.6" />
     <PackageVersion Include="System.Diagnostics.PerformanceCounter" Version="8.0.0" />
-    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="7.3.1" />
+    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="7.6.2" />
     <PackageVersion Include="System.IO.FileSystem.AccessControl" Version="5.0.0" />
     <PackageVersion Include="System.Net.Http" Version="4.3.4" />
     <PackageVersion Include="System.Private.ServiceModel" Version="4.10.3" />
-    <PackageVersion Include="xunit.extensibility.core" Version="2.5.0" />
-    <PackageVersion Include="xunit.runner.visualstudio" Version="2.5.7" />
+    <PackageVersion Include="xunit.extensibility.core" Version="2.8.1" />
+    <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.1" />
     <PackageVersion Include="Xunit.SkippableFact" Version="1.4.13" />
-    <PackageVersion Include="xunit" Version="2.5.0" />
-    <PackageVersion Include="xunit.assert" Version="2.7.0" />
-    <PackageVersion Include="System.Drawing.Common" Version="8.0.0" />
+    <PackageVersion Include="xunit" Version="2.8.1" />
+    <PackageVersion Include="xunit.assert" Version="2.8.1" />
+    <PackageVersion Include="System.Drawing.Common" Version="8.0.6" />
+    <PackageVersion Include="Moq" Version="4.20.69" />
   </ItemGroup>
 </Project>
diff --git a/build/docker/Dockerfile b/build/docker/Dockerfile
@@ -79,7 +79,7 @@ COPY . .
 RUN dotnet publish /repo/src/Microsoft.Health.Fhir.${FHIR_VERSION}.Web/Microsoft.Health.Fhir.${FHIR_VERSION}.Web.csproj -o "/build" --no-restore -p:AssemblyVersion="${ASSEMBLY_VER}" -p:FileVersion="${ASSEMBLY_VER}" -p:Version="${ASSEMBLY_VER}" -f net8.0 -a $TARGETARCH
 
 # Implicitly uses the target platform for the runtime image.
-FROM mcr.microsoft.com/dotnet/aspnet:8.0.4-cbl-mariner2.0 AS runtime
+FROM mcr.microsoft.com/dotnet/aspnet:8.0.6-cbl-mariner2.0 AS runtime
 
 ARG FHIR_VERSION
 

diff --git a/src/Microsoft.Health.Extensions.Xunit/CustomXunitTestFrameworkExecutor.cs b/src/Microsoft.Health.Extensions.Xunit/CustomXunitTestFrameworkExecutor.cs
@@ -194,7 +194,7 @@ protected override Task<RunSummary> RunTestMethodsAsync()
         /// the synthetic classes that we created of the form Namespace.Class(Arg1, Arg2). For these, we want to create a
         /// <see cref="TestClassWithFixtureArgumentsTypeInfo"/> with Arg1 and Arg2 as the fixture arguments
         /// </summary>
-        private sealed class CustomAssemblyInfo : IAssemblyInfo
+        private sealed class CustomAssemblyInfo : LongLivedMarshalByRefObject, IAssemblyInfo
         {
             private readonly IAssemblyInfo _assemblyInfoImplementation;
             private readonly Regex _argumentsRegex = new Regex(@"\((\s*(?<VALUE>[^, )]+)\s*,?)*\)");

diff --git a/src/Microsoft.Health.Extensions.Xunit/TestClassWithFixtureArgumentsTypeInfo.cs b/src/Microsoft.Health.Extensions.Xunit/TestClassWithFixtureArgumentsTypeInfo.cs
@@ -7,6 +7,7 @@
 using System.Collections.Generic;
 using System.Linq;
 using EnsureThat;
+using Xunit;
 using Xunit.Abstractions;
 using Xunit.Sdk;
 
@@ -16,7 +17,7 @@ namespace Microsoft.Health.Extensions.Xunit
     /// A special <see cref="ITypeInfo"/> for a test class that will use a fixture instantiated with with a single set of constructor arguments.
     /// The <see cref="Name"/> property is customized to be of the form Namespace.Class(Arg1, Arg2)
     /// </summary>
-    public class TestClassWithFixtureArgumentsTypeInfo : IReflectionTypeInfo
+    public class TestClassWithFixtureArgumentsTypeInfo : LongLivedMarshalByRefObject, IReflectionTypeInfo
     {
         private readonly ITypeInfo _typeInfoImplementation;
 

diff --git a/src/Microsoft.Health.Fhir.Api/Features/Binders/DictionaryExpansionConfigurationProvider.cs b/src/Microsoft.Health.Fhir.Api/Features/Binders/DictionaryExpansionConfigurationProvider.cs
@@ -48,7 +48,7 @@ public override void Load()
 
         var data = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
 
-        EnumerateKeys(keys, data);
+        EnumerateKeys((IReadOnlyCollection<string>)keys, data);
 
         Data = data;
     }
@@ -86,7 +86,7 @@ public static bool TryParseDictionaryJson(string value, out Dictionary<string, s
         }
     }
 
-    private void EnumerateKeys(IEnumerable<string> keys, Dictionary<string, string> data, string path = null)
+    private void EnumerateKeys(IReadOnlyCollection<string> keys, Dictionary<string, string> data, string path = null)
     {
         foreach (string keyName in keys.Distinct())
         {
@@ -103,7 +103,7 @@ private void EnumerateKeys(IEnumerable<string> keys, Dictionary<string, string>
                 }
             }
 
-            IEnumerable<string> innerKeys = _configurationProvider.GetChildKeys(Array.Empty<string>(), keyPath);
+            var innerKeys = (IReadOnlyCollection<string>)_configurationProvider.GetChildKeys(Array.Empty<string>(), keyPath);
             EnumerateKeys(innerKeys, data, keyPath);
         }
     }

diff --git a/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateAsyncRequestFilterAttribute.cs b/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateAsyncRequestFilterAttribute.cs
@@ -4,6 +4,7 @@
 // -------------------------------------------------------------------------------------------------
 
 using System;
+using System.Linq;
 using EnsureThat;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Health.Fhir.Core.Exceptions;
@@ -27,7 +28,7 @@ public override void OnActionExecuting(ActionExecutingContext context)
             if (!context.HttpContext.Request.Headers.TryGetValue(KnownHeaders.Prefer, out var preferHeaderValue) ||
                 !string.Equals(preferHeaderValue[0], PreferHeaderExpectedValue, StringComparison.OrdinalIgnoreCase))
             {
-                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, KnownHeaders.Prefer));
+                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, preferHeaderValue.FirstOrDefault(), KnownHeaders.Prefer));
             }
         }
     }

diff --git a/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateExportRequestFilterAttribute.cs b/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateExportRequestFilterAttribute.cs
@@ -5,6 +5,7 @@
 
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using EnsureThat;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc.Filters;
@@ -61,14 +62,14 @@ public override void OnActionExecuting(ActionExecutingContext context)
                 acceptHeaderValue.Count != 1 ||
                 !string.Equals(acceptHeaderValue[0], KnownContentTypes.JsonContentType, StringComparison.OrdinalIgnoreCase))
             {
-                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, HeaderNames.Accept));
+                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, acceptHeaderValue.FirstOrDefault(), HeaderNames.Accept));
             }
 
             if (!context.HttpContext.Request.Headers.TryGetValue(PreferHeaderName, out var preferHeaderValue) ||
                 preferHeaderValue.Count != 1 ||
                 !string.Equals(preferHeaderValue[0], PreferHeaderExpectedValue, StringComparison.OrdinalIgnoreCase))
             {
-                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, PreferHeaderName));
+                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, preferHeaderValue.FirstOrDefault(), PreferHeaderName));
             }
 
             // Validate that the request does not contain query parameters that are not supported.

diff --git a/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateFormatParametersAttribute.cs b/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateFormatParametersAttribute.cs
@@ -4,6 +4,7 @@
 // -------------------------------------------------------------------------------------------------
 
 using System;
+using System.Linq;
 using System.Net.Http;
 using EnsureThat;
 using Microsoft.AspNetCore.Http;
@@ -50,7 +51,7 @@ public override async Task OnActionExecutionAsync(ActionExecutingContext context
                 {
                     if (!await _parametersValidator.IsFormatSupportedAsync(headerValue[0]))
                     {
-                        throw new UnsupportedMediaTypeException(string.Format(Resources.UnsupportedHeaderValue, HeaderNames.ContentType));
+                        throw new UnsupportedMediaTypeException(string.Format(Resources.UnsupportedHeaderValue, headerValue.FirstOrDefault(), HeaderNames.ContentType));
                     }
                 }
                 else
@@ -65,7 +66,7 @@ public override async Task OnActionExecutionAsync(ActionExecutingContext context
                 {
                     if (!await _parametersValidator.IsPatchFormatSupportedAsync(headerValue[0]))
                     {
-                        throw new UnsupportedMediaTypeException(string.Format(Resources.UnsupportedHeaderValue, HeaderNames.ContentType));
+                        throw new UnsupportedMediaTypeException(string.Format(Resources.UnsupportedHeaderValue, headerValue.FirstOrDefault(), HeaderNames.ContentType));
                     }
                 }
             }

diff --git a/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateImportRequestFilterAttribute.cs b/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateImportRequestFilterAttribute.cs
@@ -4,6 +4,7 @@
 // -------------------------------------------------------------------------------------------------
 
 using System;
+using System.Linq;
 using EnsureThat;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Health.Fhir.Core.Exceptions;
@@ -34,7 +35,7 @@ public override void OnActionExecuting(ActionExecutingContext context)
                 preferHeaderValue.Count != 1 ||
                 !string.Equals(preferHeaderValue[0], PreferHeaderExpectedValue, StringComparison.OrdinalIgnoreCase))
             {
-                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, PreferHeaderName));
+                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, preferHeaderValue.FirstOrDefault(), PreferHeaderName));
             }
 
             if (string.Equals(context.HttpContext.Request.Method, "POST", StringComparison.OrdinalIgnoreCase))
@@ -43,7 +44,7 @@ public override void OnActionExecuting(ActionExecutingContext context)
                     contentTypeHeaderValue.Count != 1 ||
                     !contentTypeHeaderValue[0].Contains(ContentTypeHeaderExpectedValue, StringComparison.OrdinalIgnoreCase))
                 {
-                    throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, HeaderNames.ContentType));
+                    throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, contentTypeHeaderValue.FirstOrDefault(), HeaderNames.ContentType));
                 }
             }
         }

diff --git a/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateReindexRequestFilterAttribute.cs b/src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateReindexRequestFilterAttribute.cs
@@ -4,6 +4,7 @@
 // -------------------------------------------------------------------------------------------------
 
 using System;
+using System.Linq;
 using EnsureThat;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Health.Fhir.Core.Exceptions;
@@ -27,7 +28,7 @@ public override void OnActionExecuting(ActionExecutingContext context)
             if (context.HttpContext.Request.Headers.TryGetValue(PreferHeaderName, out var preferHeaderValue) &&
                 !string.Equals(preferHeaderValue[0], PreferHeaderExpectedValue, StringComparison.OrdinalIgnoreCase))
             {
-                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, PreferHeaderName));
+                throw new RequestNotValidException(string.Format(Resources.UnsupportedHeaderValue, preferHeaderValue.FirstOrDefault(), PreferHeaderName));
             }
         }
     }

diff --git a/src/Microsoft.Health.Fhir.Api/Features/Routing/KnownActionParameterNames.cs b/src/Microsoft.Health.Fhir.Api/Features/Routing/KnownActionParameterNames.cs
@@ -13,5 +13,6 @@ internal class KnownActionParameterNames
         public const string Vid = "vidParameter";
         public const string CompartmentType = "compartmentTypeParameter";
         public const string Bundle = "bundle";
+        public const string ParamsResource = "paramsResource";
     }
 }
diff --git a/src/Microsoft.Health.Fhir.Api/Features/Routing/UrlResolver.cs b/src/Microsoft.Health.Fhir.Api/Features/Routing/UrlResolver.cs
@@ -145,7 +145,7 @@ private Uri ResolveResourceUrl(string resourceId, string resourceTypeName, strin
                 Request.Host.Value);
         }
 
-        public Uri ResolveRouteUrl(IEnumerable<Tuple<string, string>> unsupportedSearchParams = null, IReadOnlyList<(SearchParameterInfo searchParameterInfo, SortOrder sortOrder)> resultSortOrder = null, string continuationToken = null, bool removeTotalParameter = false)
+        public Uri ResolveRouteUrl(IReadOnlyCollection<Tuple<string, string>> unsupportedSearchParams = null, IReadOnlyList<(SearchParameterInfo searchParameterInfo, SortOrder sortOrder)> resultSortOrder = null, string continuationToken = null, bool removeTotalParameter = false)
         {
             string routeName = _fhirRequestContextAccessor.RequestContext.RouteName;
 
@@ -193,7 +193,7 @@ public Uri ResolveRouteUrl(IEnumerable<Tuple<string, string>> unsupportedSearchP
                     else
                     {
                         // 3. The exclude unsupported parameters
-                        IEnumerable<string> removedValues = searchParamsToRemove[searchParam.Key];
+                        var removedValues = searchParamsToRemove[searchParam.Key].ToList();
                         StringValues usedValues = removedValues.Any()
                             ? new StringValues(
                                 searchParam.Value.Select(x => x.SplitByOrSeparator().Except(removedValues).JoinByOrSeparator())

diff --git a/src/Microsoft.Health.Fhir.Api/Features/SMART/SmartClinicalScopesMiddleware.cs b/src/Microsoft.Health.Fhir.Api/Features/SMART/SmartClinicalScopesMiddleware.cs
@@ -99,7 +99,7 @@ public async Task Invoke(
                         switch (accessLevel)
                         {
                             case "read":
-                                permittedDataActions = DataActions.Read;
+                                permittedDataActions = DataActions.Read | DataActions.Export;
                                 break;
                             case "write":
                                 permittedDataActions = DataActions.Write;