- Ya
- 26 Agosti 2026, 21:03 UTC
- Mwandishi
- Kamo
- Ahadi ya
- e7ebd57
Only the four population-level rights — bulk export, quality measures, portal administration and EHR settings — were ever checked. Prescribe, sign, cosign, place orders, merge records, edit demographics, review results, book, break glass, review emergency access, claims, post payments and the rest were declared, grantable, listed in the roles editor, and enforced nowhere. The care-relationship gate does not cover this and was never meant to. It answers "is this member on this patient's care team", which decides whether they may touch the patient at all and says nothing about which clinical acts they may perform. Relationships are created by starting a visit, so the person who rooms a patient has one — and that was the only server-side check standing between them and signing a clinical note or prescribing a controlled substance. Several of these operations were gated in the browser only, which is not a gate. An administrator who deliberately withheld "Prescribe Controlled Substances" from a role got nothing for it. That is the bug. 78 handlers now name the right they need, at the controller, next to the mapping so the pairing is readable. The population modules keep enforcing in their service — one check where the work happens beats one per handler that reaches it — and are exempted by name with a test proving each named service really does enforce. A missing right now answers 403 saying which permission is absent, while a relationship denial keeps answering 404. They are different questions: "you are not on this patient's care team" must not confirm the patient exists, but "your role does not include Prescribe Medications" reveals nothing about any patient and is something an administrator can act on. Answering 404 there sent people to hunt a bug that was a permission. Two new guards: every mapped clinical handler must require a right, and the right it names must exist and belong to the EHR — otherwise a rename in shared-lib would turn every gated endpoint into a runtime 500 instead of a compile error.