Doc on Org-Governance

[john-d03]

/document Access & Governance/Organisations Governance

[github-actions]

✅ Ezhuthachan completed successfully!

[github-actions]

Ezhuthachan

Opened a pull request with the organization documentation for the Access & Governance domain.

/document Access & Governance/Organisations Governance omitted the doc types, so all three layers were written for the organization primitive.

Concept — concepts/access-governance/organization.mdx, rewritten to the concept template. The old page printed raw code slugs (can_view_organization, org_type, team, govt) in a user-facing page, so the permission detail moved to the reference layer.

Flows — three new pages, in the order a user meets them:

1. How to create an organization
2. How to add a user to an organization
3. How to change the role of a user in an organization

Reference — references/access-governance/organization.mdx, with a new Viewsets & authorization section traced from OrganizationViewSet and OrganizationUsersViewSet.

Both versions were updated, and npm run build is green for en and ml.

Open question

The phrase "Organisations Governance" reads two ways: the organization primitive generally, or the Governance organization type in the admin area. The docs cover the primitive, and describe the governance type inside it. Tell me if you wanted a page about the governance hierarchy alone, and I will split it out.

Bugs and inconsistencies

1. The delete permission gates nothing. OrganizationPermissions.can_delete_organization ("Can Delete Organizations") and its handler OrganizationAccess.can_delete_organization in care/security/authorization/organization.py are never called. OrganizationViewSet.authorize_destroy in care/emr/api/viewsets/organization.py checks can_manage_organization_obj instead. A role that holds the delete permission and not the manage permission cannot delete anything. High confidence.

2. is_geo_admin is granted to no role. In care/security/permissions/organization.py the is_geo_admin permission has an empty roles list, but care/security/authorization/facilityorganization.py checks it in seven places. Those checks can only pass for a superuser. High confidence.

3. The UI shows raw organization type values. getOrgLabel in care_fe returns the raw org_type string for every type except govt, and OrganizationView.tsx renders orgChild.org_type directly. public/locale/en.json also has no SYSTEM__org_type__product_supplier key. So a user sees team, role and product_supplier. High confidence.

4. Typo in a page title. The govt key in care_fe/public/locale/en.json reads "Goverence". AdminOrganizationList uses t(organizationType) for the page heading, so the misspelling is visible to users. High confidence.

5. OrgType.OTHER has no backend counterpart. care_fe/src/types/organization/organization.ts declares OTHER = "other" in OrgType, but OrganizationTypeChoices in care/emr/resources/organization/spec.py has no other value; other belongs to FacilityOrganizationTypeChoices. A write with that value would be rejected. Medium confidence.

Generated by Ezhuthachan for #63 · opus50 · 467.6 AIC · ⌖ 12.8 AIC · ⊞ 14.4K · ◷
_{Comment /document to run again}

[github-actions]

Comment Memory

# Organization docs (access-governance) — run notes

Issue #63, `/document Access & Governance/Organisations Governance`. Parsed as all three doc
types for the `organization` primitive in domain `access-governance`. Branch
`docs/organisations-governance`. Build green for en + ml.

## Written
- `concepts/access-governance/organization.mdx` — full rewrite to the concept template.
- `flows/access-governance/{create-an-organization,add-a-user-to-an-organization,change-a-user-role-in-an-organization}.mdx` + `_category_.json`.
- `references/access-governance/organization.mdx` — kept models/specs sections, added
  `## Viewsets & authorization`, removed the FHIR-alignment narration.
- Flow sidebar category `access-governance-flows` added to both version sidebars.

## Verified facts worth reusing
- Org types: `team`, `govt`, `role`, `product_supplier` (`OrganizationTypeChoices`).
  Admin nav labels them Governance / Responsibilities / Suppliers.
- Create/edit organizations only in the admin area, via `AdminOrganizationFormSheet`
  (fields Name required, Description optional; `org_type` fixed by the page).
- `authorize_destroy` checks `can_manage_organization_obj`, NOT `can_delete_organization`.
- `get_accessible_organizations` makes all `govt` and `product_supplier` orgs visible to everyone.
- Membership role assignment requires the assigned role's permissions to be a subset of the actor's.
- `settings.ORGANIZATION_MAX_DEPTH` caps tree depth; default value not looked up.

## Open
- Ambiguity reported to the user: "Organisations Governance" may have meant the `govt`
  type alone rather than the primitive. Awaiting an answer.
- Not documented: the connected-role-organization management screen (`RoleOrganizationConnections`).

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Generated by Ezhuthachan for #63 · opus50 · 467.6 AIC · ⌖ 12.8 AIC · ⊞ 14.4K · ◷
_{Comment /document to run again}