Merge branch 'feat/document-import-token' into release/v1.39.2

scripts/__tests__/import-documents.test.ts

@@ -167,19 +167,20 @@ async function healthlog(
         size = v.size;
       }
     }
-    // The key rides the query string, where HealthLog reads it first, and
-    // the form; HealthLog refuses the two disagreeing.
+    // The key rides the form only: in the address HealthLog would meter it
+    // against the lookup allowance, which a spent lookup has already used up.
     if (
-      fields.sourceSystem !== url.searchParams.get("sourceSystem") ||
-      fields.sourceId !== url.searchParams.get("sourceId")
+      url.searchParams.has("sourceSystem") ||
+      url.searchParams.has("sourceId")
     ) {
       return {
-        status: 422,
-        json: { data: null, error: "source key mismatch" },
+        status: 429,
+        headers: { "retry-after": "3600" },
+        json: { data: null, error: "lookup allowance spent" },
       };
     }
     received.push({ auth: req.headers.authorization, fields, filename, size });
-    const key = queryKey;
+    const key = `${fields.sourceSystem}:${fields.sourceId}`;
     if (opts.tooLarge?.includes(key)) {
       return {
         status: 413,

scripts/import-documents.mjs

@@ -590,7 +590,11 @@ async function lookup(options, source, doc) {
 }
 
 async function upload(options, source, doc, file) {
-  const url = `${options.healthlogUrl}/api/documents/inbound?${keyQuery(source, doc)}`;
+  // The key goes in the form only. In the address HealthLog would check it
+  // against the lookup allowance first, and the lookup just asked that
+  // question; when the lookups are spent, the upload would then be refused
+  // with a 429 as well. In the form it costs one upload, like any other.
+  const url = `${options.healthlogUrl}/api/documents/inbound`;
   const kind = kindFor(options, doc);
   const response = await request(
     "HealthLog",
@@ -611,7 +615,6 @@ async function upload(options, source, doc, file) {
       if (doc.date) form.append("documentDate", doc.date);
       if (kind) form.append("kind", kind);
       if (!options.aiRead) form.append("aiRead", "defer");
-      // In the form as well as the address; HealthLog checks they agree.
       form.append("sourceSystem", source.system);
       form.append("sourceId", doc.sourceId.slice(0, SOURCE_ID_MAX));
       return form;