Client Consent

first consent: roi date, if not then first response date end date +3 yrs

User1 is a member of Agency2 and agency3 → user1 can edit if a member, can view if not a member and the agency is in the same consent group?

VIEW - show client profile, show responses, show enrollments (i.e. all data) EDIT - create surveys, create enrollments, switch between projects

• Cg2: [p2, p3, p4, p5,p6,p7,p8] = list of projects a user is able to VIEW Cg1: [p1]

• User Switched to cg1 -> consent with p1 will be created User Switched to cg2 -> consent with [p2, p3] will be created

NOTES A consent group, can be modified to add new projects for an agency [V1.0 -V1.1, Adding a whole new agency changes version eg. V1-> V2, This requires new ROI signed by clients. Cg1-V1.0 Includes [Agency1, p1, p2, p3], [Agency2, p4, p5, p6] Cg1-V1.1 includes [Agency1, p1, p2, p3, p7], [Agency2, p4, p5, p6] Cg1-V2.0 include [Agency1, p1, p2, p3, p7], [Agency2, p4, p5, p6][Agency3, p8, p9] ->requires new ROI signed by client.

Consent groups, include Whole Agencies [EG Agency1, p1,p2,p3, ALL projects must be in consent group, you cannot do p1 and p2 but not p3] When Agency adds projects, consent must be updated and new project must be added to existing consent for client.

Definitions

• Agency- List of projects
• Consent Group, list of agencies. Multiples per agency.
• When creating consent for client User can choose between Consent groups available for that agency.

Agency1, in cg1 and cg2, with p1

2 agencies should not have access to the same project

Current user can switch projects and agencies based on agency membership and member-project access grid:

member-project access grid:

Given** current user **and active project, we know active agency (agency that has active project) and active consent groups (consent groups which include active agency).

New consent group has “new” status. If there are any consents that are associated with a consent group, then cg status is “active”. If there are any consents that are associated with a consent group but all of them are expired (endDate < now), then status is “expired”. Only new consent group can be edited, otherwise it is impossible to edit CG, i.e. change agencies.

FUTURE: track new version of consent groups: If agency is already part of consentrgoup1 allow view, edit require new consent sigature If agency is not a part of consentgroup1 require new consent in v2

Accessing client’s information

consent.consentGroupId - consent group associated with this consent, determines read access. If any consent of the client include any of active consent groups, then grant read access.

**consent.projects **- list of projects associated with this consent, determines write access If active project is in one of the client’s consents - grant write access

When new project is added to an agency: All consents that share a project with modified agency get updated to include new project.

This part is outdated

Consent Data model

{
  "clientId": "",
  "startDate": "",
  "endDate": "",
  "permissions": {
    "view": {
      "consentGroups": [],
      "agencies": [],
      "projects": []
    },
    "edit": {
      "consentGroups": [],
      "agencies": [],
      "projects": []
    }
  }
}

Client can give consent to specific projects, agencies, consent groups. Giving consent to specific projects is most restrictive. If consent is given on multiple levels (i.e. both for projects and agencies).

It is sufficient to get permission on only one level (OR relation) to get access to client. For example, if permission is granted on consent group level, agency and project levels are not checked.

Edit permission includes View permission - if I can edit a client I can also view a client, but not the opposite

Permission is granted if: For Consent group: if current user is a member of the agency that belongs to the same consent group as in the consent. For Agency: if current user is a memeber of the same agency as in consent (even if he became member after consent was signed) For Project: if current user can access the project via any of agencies he belongs to (using Agency project access matrix) and this project is listed in the consent

Example 1

{
  "clientId": "client1",
  "startDate": "",
  "endDate": "",
  "permissions": {
    "view": {
      "consentGroups": [cg1],
      "agencies": [],
      "projects": []
    },
    "edit": {
      "consentGroups": [cg2],
      "agencies": [],
      "projects": []
    }
  }
}

• All members of all agencies that are in cg1 can view this client
• All members of all agencies that are in cg2 can edit this client

Example 2

{
  "clientId": "",
  "startDate": "",
  "endDate": "",
  "permissions": {
    "view": {
      "consentGroups": [],
      "agencies": [agency1],
      "projects": []
    },
    "edit": {
      "consentGroups": [],
      "agencies": [agency2],
      "projects": []
    }
  }
}

• All members of agency1 can view this client
• All members of agency2 can edit this client

Example 3

{
  "clientId": "",
  "startDate": "",
  "endDate": "",
  "permissions": {
    "view": {
      "consentGroups": [],
      "agencies": [],
      "projects": [p1]
    },
    "edit": {
      "consentGroups": [],
      "agencies": [],
      "projects": [p2]
    }
  }
}

• All users that can access p1 via any agency can view this client
• All users that can access p2 via any agency can edit this client

Example 4

{
  "clientId": "",
  "startDate": "",
  "endDate": "",
  "permissions": {
    "view": {
      "consentGroups": [cg1],
      "agencies": [],
      "projects": []
    },
    "edit": {
      "consentGroups": [],
      "agencies": [agency1],
      "projects": []
    }
  }
}

All members of all agencies that are in cg1 can view this client All members of agency1 can edit this client Given that agency2 is not in cg1, no one from this agency can access the client. In anyone from agency2 would like to view client, then agency would have to be added to cg1, or new consent (for edit: agency2) would have to be signed.

For currently logged in user we know: Agencies that he belongs to Consent groups of those agencies Projects he can access (based on agency/project permissions matrix) Therefore we can match current user consentGroups, agencies, projects with client’s consent consentGroups, agencies, projects. If there is a match, we give view/edit permissions.

When creating consent, default values for permissions are:

{
  "permissions": {
    "view": {
      "consentGroups": [consent groups of currently selected agency],
      "agencies": [],
      "projects": []
    },
    "edit": {
      "consentGroups": [],
      "agencies": [currently selected agency],
      "projects": []
    }
  }
}
```

Consent group entity
* Id
* Name
* List of Agencies
* getAllConsents()

Consent Group status: 
* new -  no consents exists with its id
* Active - there are consents, at least one is active (according to start/end date)
* Inactive - there are consents, but all expired

Active consent group cannot be edited or deleted

Agency adds new project - all existing consents for this agency must be updated to include new project

User select project - permission based on consent is checked:
activeAgency
activeProject must be in active
Check if currently selected project == one of projects in client consent
Check if currently


Agency.findByProject(user.activeProject)
Agency.hasMember(user)
Agencies.whereUserCanAccessProject