Bug openemr fix 7746 export since delta fix (openemr#7754)

* lastModifiedDate export support.

_since parameter was not working properly.  Need to expose on all of the
FHIR services the _lastModifiedDate search parameter and verify all the
endpoints are functioning and performant.

The export can specify a _since parameter and apparently the original
implementation only supported _since from the beginning of the system
implementation, and no actual date filtering.  Anyone wanting to do a
delta would not have their export data function properly.

This is in reference to issue openemr#7746

* Fixed _since implementation in bulk export.

The _since date filterer was broken and was only allowing dates from the
beginning of time for the _since filter. This was preventing any kind of
bulk export using the delta of a system.

Had to add everywhere the _lastModified parameter.  

Resources implemented here are
- DiagnosticReport
- ClinicalNotes
- AllergyIntolerance
- CarePlan
- CareTeam
- Coverage
- Device
- DocumentReference
- Encounter
- Goal
- Group (this was tricky, it uses the patient last updated date to
determine group membership)
- Immunization
- Patient
- Location
- ValueSet
- CareTeam,
- Practitioner,
- PractitionerRole
- Condition
- DiagnosticReport
- MedicationRequest
- Observation
- Organization
- Procedure
- Provenance

Had to add date fields to the facility and user table in order to handle their location data since the tables are denormalized using uuid_mapping for the date.

Needed to configure list service and appointments to handle searching on
list options and appointment categories w/ last updated status so people
can grab delta on if the value set has changed.  Really need better
support for published versions, etc.  But it is what it is for now.

Added db last_updated fields (and where missing date_create) fields for
 - Insurance companies
 - user&facility roles IE PractitionerRole endpoint
 - calendar categories
 - list options
- added _lastUpdated to form_clinical_notes

NOTE if you have a LOT of vital records the upgrade may take some time.
Need to make sure we mention this in the patch.

Added last_updated column to vitals form to track modifications to the
form.

Improved vitals query performance by making it use an index on the
forms_encounter.

* Fix FHIR _lastUpdated social history

Made it so the smoking status w/ social history works w/ the
_lastUpdated field.

* _lastUpdated for Organization resource

Added to table procedure_providers the following columns
- date_created
- procedure_providers

Implemented _lastUpdated for Organization resources which includes
facility, insurance, and procedure providers.

* _lastUpdated and FHIR fix for Medication

Had an issue in the Medication resource where drugs added via the
pharmacy/dispensary module would not actual show their valid RXCUI
system if there was no code system available.

Made _lastUpdated work for filtering on medications.

Added last_updated and date_created columns to the medication service.

* Add helpful message for internal data loads

* FHIR patient _lastUpdated, deceasedDate fix

Made the _lastUpdated work by adding a last_updated field to
patient_data. Hopefully people won't have maxed out their patient_data
table record for MySQL as we absolutely need to track the most recent
patient_data values from an API perspective so we have to make this
change.

Also discovered that deceasedDate was throwing errors in the API due to
a bad column value.  Fixed the issue so deceased boolean flag is now
reporting correctly.

* FHIR _lastUpdated search for Procedure resource

Made the fhir procedure service work with the _lastUpdated parameter for
both surgeries and openemr procedures.

Fixed issue with unix_timestamp conversion on the prescription service.

* Fix style issues.

* _lastUpdated Person resource implementation

Made it so the _lastUpdated search parameter works with the FHIR Person
resource.

* FHIR _lastUpdated database changes

added date_created to users and facility table.

Added all of the date_created and last_modified columns to the fresh
database installs.

* FHIR Provenance _lastUpdated support

Made it so the provenance _lastUpdated gets passed down to all of the
sub resources when working with the provenance piece.

* FHIR appointment,group bug fixes

Group was only showing the most recently changed patients when
_lastUpdated is used instead of showing the entire resource.

Appointment was not using the correct search field when doing an export.

Style fixes.

* Safer error messages if oauth2 key invalid

* Update api documentation

* Fix date_created, missing columns in new db

Date_created does not need on update clause.

Missed two database columns in the new database.

* Fix surrogate key provenance issue.

Provenance was incorrectly pushing out surrogate key values based on
lastUpdated value fields.  Now that lastUpdated is actually reflecting
on the actual resources instead of just the latest timestamp, we were
incorrectly getting surrogate keys if they the resource was updated
earlier than 2022 (V1 key value).

* Fix insert statements on calendar categories

* Provide better error messages on installer class

Error messages of actual SQL causing the installer to fail was being
surpressed.  Made it so the error messages show instead of just fatal
death w/o any more information.

_rest_config.php

@@ -202,19 +202,30 @@ public static function verifyAccessToken()
         $logger = new SystemLogger();
         $response = self::createServerResponse();
         $request = self::createServerRequest();
-        $server = new ResourceServer(
-            new AccessTokenRepository(),
-            self::$publicKey
-        );
         try {
+            // if we there's a key problem need to catch the exception
+            $server = new ResourceServer(
+                new AccessTokenRepository(),
+                self::$publicKey
+            );
             $raw = $server->validateAuthenticatedRequest($request);
         } catch (OAuthServerException $exception) {
             $logger->error("RestConfig->verifyAccessToken() OAuthServerException", ["message" => $exception->getMessage()]);
             return $exception->generateHttpResponse($response);
         } catch (\Exception $exception) {
-            $logger->error("RestConfig->verifyAccessToken() Exception", ["message" => $exception->getMessage()]);
-            return (new OAuthServerException($exception->getMessage(), 0, 'unknown_error', 500))
-                ->generateHttpResponse($response);
+            if ($exception instanceof LogicException) {
+                $logger->error(
+                    "RestConfig->verifyAccessToken() LogicException, likely oauth2 public key is missing, corrupted, or misconfigured",
+                    ["message" => $exception->getMessage()]
+                );
+                return (new OAuthServerException("Invalid access token", 0, 'invalid_token', 401))
+                    ->generateHttpResponse($response);
+            } else {
+                $logger->error("RestConfig->verifyAccessToken() Exception", ["message" => $exception->getMessage()]);
+                // do NOT reveal what happened at the server level if we have a server exception
+                return (new OAuthServerException("Server Error", 0, 'unknown_error', 500))
+                    ->generateHttpResponse($response);
+            }
         }
 
         return $raw;