mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
The capabilities share descriptor exposed scopeable FHIR resourceTypes, but no /api/fhir/* route honours a share token — those routes require an authenticated fhir:read Bearer. The share serves the rendered record view only. Drop the unrouted resourceTypes from the advertised share scope and add an explicit fhirApi:false flag so an integrator knows the share to FHIR face is not live.