[ALS-7197] BDC Auth access: User able to access data

[Gcolon021]

• The clinical query template has been updated to include the parentAccessField in the fields section. The parentAccessionField value is now set to \\\\_Parent Study Accession with Subject ID\\\\.

• The TOPMED+PARENT access rule, associated with clinical privileges, has been fixed. The rule previously had misconfigured subAccessRules and gates:

  • The TOPMED_CONSENT gate consent rule was incorrectly set to IS_EMPTY instead of IS_NOT_EMPTY, causing queries to be erroneously rejected, even when the "categoryFilters": "\\_topmed_consents\\" section was correctly included in the query.
  • A missing subAccessRule named ALLOW_TOPMED_CONSENT was added. This rule ensures that all required consents are present in the \\_topmed_consents\\ section of the query template.
  • A new method, configureClinicalAccessRuleWithPhenoSubRule, was added to AccessRuleService. This method contains the configuration for this access rule.

• Previously, there were many unassociated access rules. All access rules are now correctly linked to other rules and privileges. In Spring Boot, any entity property defining a parent-child relationship must use the cascade = CascadeType.ALL option in the @ManyToOne or @ManyToMany annotations to ensure updates to the parent or child entities on save.

• A new role, MANUAL_ROLE_NAMED_DATASET, has been assigned to all BDC users. This role grants users access to the /named/dataset, /named/dataset/, /named/dataset/{uuid}, and /query/{uuid}/metadata endpoints. The role, along with its privilege and rule definition, is now part of the BDC infrastructure.

• The createPhoneTypeSubRule method now correctly removes double-escaped characters. For example, a concept path formatted as \\\\phs000xxx\\\\ is now converted to \\phs000xxx\\.

• The upsertConsentGate method now properly escapes backslashes in rules.

• The extractAndCheckRule method now correctly evaluates access rules that need to check map nodes. When using JsonPath to retrieve a node value, it is naturally converted into a list. This list is now converted into a Map for key checking.

• When evaluating subAccessRules for a given rule, the rules must first be merged before evaluation. Since sub access rules may overlap with other rules, the method preProcessARBySortedKeys is used to handle the merging process.

• The pic-sure-auth-micro-app was originally designed with an ephemeral database. With each deployment, all roles, privileges, and access rules were re-created. This provided an opportunity to add new allowed query types and standard access rules. Now that our database is persisted, there was no mechanism to add new allowed query types or standard access rules. A new method has been added to PrivilegeService named updateAllPrivilegesOnStartup.

  • This method updates all privileges to include all current standard access rules. Any standard access rules that need to be removed from a privilege must be handled via a migration script.
  • The method also updates all allowed query types. All existing allowed query types are removed from each access_rule that currently has allowed query types as subAccessRules. Once these are removed, all currently defined allowed query types are added to the access_rule, enabling the addition or removal of allowed query types without needing migration scripts.

[ramari16]

I don't think we have any external documentation for this functionality, which is pretty complicated. I think we should open a tech debt ticket to create some diagrams on how this all works.

[Gcolon021]

@ramari16 I absolutely agree. I will ask for time to provide comprehensive documentation on all of this functionality for other developers.

[Gcolon021]

@ramari16 A new technical debt ticket has been created.