@pld here's the issue that would track the work on multi-tenancy. On the question of unsynced data, I'm still not sure how to handle that, since we'd only allow users of the same team to login and they could probably share data

cc @ndegwamartin @f-odhiambo

Agree, not an issue if we only allow users who have access to the same set of data to log-in then we don't have to worry about unsynced data.

If access to data is only controlled by the CareTeam, then verifying that the user trying to log in is a member of that care team would be sufficient.

If people in the same CareTeam can have varying data access, then that would not work.

The ideas in the PR look good, I do want us all to think really hard about any edge cases or scenarios where people on the same team should not have access to the same data, think it over, please note any ideas or concerns you have here.

There is a possibility for two users (belonging to the same team) to have different permissions/keycloak roles. @dubdabasoduba will this be a concern?

Yes that is a problem, they must have the same permission (data access rights) in this modelOn Oct 6, 2023, at 08:36, Elly Kitoto @.> wrote: There is a possibility for two users (belonging to the same team) to have different permissions/keycloak roles. @dubdabasoduba will this be a concern? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: @.>

@LZRS Is it possible to add this check for multi-user login implementation?

Yes that is a problem, they must have the same permission (data access rights) in this modelOn Oct 6, 2023, at 08:36, Elly Kitoto @.> wrote: There is a possibility for two users (belonging to the same team) to have different permissions/keycloak roles. @dubdabasoduba will this be a concern? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: _@**.**_>

@LZRS Is it possible to add this check for multi-user login implementation?

Yeah I think it should be possible...we'd probably need to check and compare out roles as encoded in the jwt tokens