Doc on RBAC (Test)

[john-d03]

/document Access & Governance/RBAC Role

[github-actions]

✅ Ezhuthachan completed successfully!

[github-actions]

Ezhuthachan

Documented the RBAC role primitive. A pull request is open from branch docs/access-governance-role.

Added (in both version-3.0 and version-3.1):

• concepts/access-governance/role.mdx
• flows/access-governance/create-a-role.mdx
• flows/access-governance/edit-a-role.mdx
• flows/access-governance/_category_.json, plus both flow sidebar files

Changed: references/access-governance/role.mdx (new ## Viewset and ## Permission and role sync sections, and a corrected statement about who can delete a custom role) and the ## Related block of concepts/access-governance/access-control.mdx.

npm run build gives [SUCCESS] for en and ml.

Bugs and inconsistencies

1. Role permissions are validated by permission name but resolved by slug. RoleCreateSpec.permissions in care/emr/resources/role/spec.py is typed against PermissionController.get_enum(), which builds its members from permission names, but RoleViewSet._add_permissions in care/security/api/viewsets/roles.py resolves the submitted values with PermissionModel.objects.filter(slug__in=instance.permissions). The frontend RoleForm.tsx submits permission.slug. The two agree only where the name equals the slug, so a permission whose name and slug differ would either fail validation or be silently dropped from the role. Confidence: medium — I did not run the code, and the current data may keep name and slug equal everywhere.

2. Role name uniqueness is checked case-insensitively but enforced case-sensitively. The create spec rejects a name that matches an existing role with name__iexact, while the database partial unique constraint on RoleModel is plain case-sensitive. A race, or a direct write, can therefore produce two roles whose names differ only in case, which the API would then treat as duplicates. Confidence: medium.

3. The two doc versions have drifted. versioned_docs/version-3.1 is not a mirror of version-3.0, contrary to the versioning convention: 3.1 has flows/clinical/patient/ with nine flows while 3.0 has a single flows/clinical/create-patient.mdx, and intro.mdx, concepts/clinical/patient.mdx and references/clinical/patient.mdx also differ. I mirrored only the files this run touched, and left the pre-existing drift alone. Confidence: high — this is a direct file comparison.

4. RolePermission.temp_deleted is never surfaced. care/security/management/commands/sync_permissions_roles.py sets and clears this flag, but no serializer, filter or viewset reads it, so a role permission left flagged after a partial sync is invisible through the API. Confidence: low — it may be intended as purely internal sync bookkeeping.

Open questions

• The roles list page offers only Edit and Clone, but the API supports delete. I wrote no delete flow. Tell me if deletion is meant to be reachable from the UI and I will add one.
• Role writes are gated on superuser status alone, not on a permission slug. I said so plainly in the flows. If a permission is planned for this, the flows will need an update.

Generated by Ezhuthachan for #62 · opus50 · 367.7 AIC · ⌖ 14 AIC · ⊞ 14.4K · ◷
_{Comment /document to run again}

[github-actions]

✅ Ezhuthachan completed successfully!

[github-actions]

Ezhuthachan

No change was needed this run: the same /document Access & Governance/RBAC Role request was completed one minute earlier by run 31405161947, which opened #67 from branch docs/access-governance-role-a2bc034b40d2498f with the concept, both flows and the reference update, mirrored to version-3.0 and version-3.1, on a green build. Authoring them again would only create a duplicate pull request, so I wrote nothing.

To change that work, comment on #67 rather than on this issue — that puts me in revising mode and I will push to the existing branch.

The two questions from that run are still open:

1. The roles list page offers only Edit and Clone, but the API supports delete. No delete flow was written. Should deletion be reachable from the UI?
2. Role writes are gated on superuser status alone, not on a permission slug. If a permission is planned for this, the flows need an update.

I found no new bugs, because I read no new source this run. The four already reported in the earlier comment still stand.

Generated by Ezhuthachan for #62 · opus50 · 33.2 AIC · ⌖ 9.42 AIC · ⊞ 14.4K · ◷
_{Comment /document to run again}

[github-actions]

Comment Memory

# Issue #62 — /document Access & Governance/RBAC Role

Already completed. PR #67 (branch `docs/access-governance-role-a2bc034b40d2498f`) adds,
in both `version-3.0` and `version-3.1`:

- `concepts/access-governance/role.mdx`
- `flows/access-governance/create-a-role.mdx`, `edit-a-role.mdx`, `_category_.json`
- flow sidebar entries in both versioned sidebar files
- edits to `references/access-governance/role.mdx` and the `## Related` block of
  `concepts/access-governance/access-control.mdx`

Build was green for `en` and `ml`.

Open questions still unanswered on the issue:

1. The roles list page offers only Edit and Clone, but the API supports delete.
   No delete flow was written. Should deletion be reachable from the UI?
2. Role writes are gated on superuser status alone, not on a permission slug.
   If a permission is planned, the flows need an update.

Bugs already reported in the run comment (do not re-report): permission
name-vs-slug mismatch in `RoleCreateSpec` / `RoleViewSet._add_permissions`;
case-insensitive name check vs case-sensitive DB constraint; 3.0/3.1 doc drift
in `flows/clinical/`; unused `RolePermission.temp_deleted`.

**A future run on this issue should not re-author these docs.** Revise PR #67
instead, or answer the open questions first.

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Generated by Ezhuthachan for #62 · opus50 · 33.2 AIC · ⌖ 9.42 AIC · ⊞ 14.4K · ◷
_{Comment /document to run again}