...
| Note |
|---|
| It is important to notice that, when configuring permissions, some permissions are not compatible with some scopes. For example, a User having read_user permission only in a Room Access Scope will not be able to list users in the application. The reason behind this is that, in the application, Users are associated to Facilities and not to Rooms. |
Flow Diagrams
List Organization Units (OU)
OU list operations are always limited to a parent scope. Given the hierarchical structure of OUs, in order to list the OUs in one level (i.e. Facilities) we need to provide the parent of the OU (i.e. Organization).
Translated into REST URLs, these operations are:
/organizations
/organizations/{organizationId}/facilities
/organizations/{organizationId}/facilities/{facilityId}/workspaces
/organizations/{organizationId}/facilities/{facilityId}/workspaces/{workspaceId}/rooms
The tricky part here is that a OU should be available to a user even in the cases where the user only has access to a descendant of that OU. By doing this we can guarantee that the user will be able to locate a OU that he/she has access to even if he/she doesn't have access to any of its parents.
This is a specific behavior for the OU listing operations.
As an example let's analyse the following topology:
In the previous image, the green nodes are the OUs present in the User's Access Scope, the yellow nodes are the OUs reachable by a parent node and the blue nodes are the OUs that are reachable because of a children. The white nodes are OUs that are not accessible in the user's Access Scope.
These are the results of some of the list operations against that hierarchy:
| URL | Results |
|---|---|
| /organizations | Organization A, Organization B, Organization D |
| /organizations/A/facilities | Facility A.2 |
| /organizations/B/facilities | Facility B.1, Facility B.2 |
| /organizations/D/facilities | Facility D.1, Facility D.2 |
| /organizations/A/facilities/A.1/workspaces | FORBIDDEN |
| /organizations/A/facilities/A.2/workspaces | Workspace A |
| /organizations/A/facilities/B.1/workspaces | Workspace A |
| /organizations/A/facilities/B.2/workspaces | Workspace A |
| /organizations/A/facilities/A.2/workspaces/A/rooms | Room A, Room B |
| /organizations/A/facilities/B.1/workspaces/A/rooms | Room A |
| /organizations/A/facilities/B.2/workspaces/A/rooms | Room A |
| /organizations/A/facilities/D.1/workspaces/A/rooms | Room A |
Read OU
OUs are accessible for read as long as the user's Access Scope contains the OU itself or some of its parents.
.png?version=1&modificationDate=1413896339749&cacheVersion=1&api=v2)
Continuing with the sample OU hierarchy, any green or yellow node can be read. Any white or blue node will return a FORBIDDEN error.
List operations
List operations on resources that are not part of the OU hierarchy (i.e. users, patients, etc) have a similar behavior. The following example details the flow for a listUsers operation, but this flow can be extrapolated to other resources.
