Skip to content

Issue/367 user to task and questionnaire response association#369

Merged
hhund merged 27 commits intodevelop_2from
issue/367_User_to_Task_and_QuestionnaireResponse_Association
Oct 18, 2025
Merged

Issue/367 user to task and questionnaire response association#369
hhund merged 27 commits intodevelop_2from
issue/367_User_to_Task_and_QuestionnaireResponse_Association

Conversation

@hhund
Copy link
Copy Markdown
Member

@hhund hhund commented Oct 15, 2025

  • Task resources with status requested now need to reference a practitioner using system http://dsf.dev/sid/practitioner-identifier and the email address as value, if the resource is being created by a practitioner user. Meaning a local user that logs in using a client certificate or OIDC token, configured via role config. The behavior for local or remote organization users (authorized via allow-list) did not change.
  • Implementation of the TaskAuthorizationRule changed: Local practitioner users with DSF_ADMIN role, now have the same access as local organization users.
  • QuestionnaireResponse resources can now be configured with an authorization extension. If the extension is present, local practitioner users with either a specified identifier or role are allowed to update the resource from in-progress to completed.
      {
      "resourceType": "QuestionnaireResponse",
      "extension": [
        {
          "url": "http://dsf.dev/fhir/StructureDefinition/extension-questionnaire-authorization",
          "extension": [
            {
              "url": "practitioner",
              "valueIdentifier": {
                "system": "http://dsf.dev/sid/practitioner-identifier",
                "value": "practitioner@organization.com"
              }
            },
            {
              "url": "practitioner-role",
              "valueCoding": {
                "system": "http://dsf.dev/fhir/CodeSystem/practitioner-role",
                "code": "DIC_USER"
              }
            },
            {
              "url": "practitioner-role",
              "valueCoding": {
                "system": "http://organization.com/fhir/CodeSystem/my-role",
                "code": "SOMETHING"
              }
            }
          ]
        }
      ],
      "status": "in-progress"
    }
  • Implementation of the QuestionnaireResponseAuthorizationRule modified: Local practitioner users with DSF_ADMIN role, now have the same access as local organization users. Update allowed behavior for local organization users not changed.
  • BPE QuestionnaireResponseHandler now updates the QuestionnaireResponse resources from completed to amended after triggering the process to complete the associated user task.
  • API v2 DefaultUserTaskListener modified to allow for configuring practitioner identifier and practitioner roles via BPMN field injections. Field injections can be configured if the DefaultUserTaskListener is explicitly configured on User Tasks as a Java class for the Task Listener with event type created. If configured the DefaultUserTaskListener creates the authorization extension.
  • Additional API v2 integration tests for User Tasks with Questionnaire / QuestionnaireResponse resources.
  • Needed UI changes to set logical references to the current practitioner user for QuestionnaireResponse and Task input forms.
  • Modified Task.requester search parameter to support virtual Practitioner resources referenced by identifier.
  • Added QuestionnaireResponse.author search parameter with support for virtual Practitioner resources referenced by identifier.
  • Adds QuestionnaireResponse.author to the resource and search result UIs, also adds QuestionnaireResponse.authored to the resource UI.

All modifications together allow process plugins developers to fully take advantage of local practitioner users with different roles.

closes #367

hhund added 23 commits October 9, 2025 19:59
* Added new config option in dsf-maven-plugin to add a single E-Mail
address to generated certificates: <email>...</email>
* Practitioner users now need to reference themselves as Task.requesters
using NamingSystem http://dsf.dev/sid/practitioner-identifier as
Identifier.system and their eMail address as Identifier.value.
* Practitioner users with DSF_ADMIN role now have same Task
(create/read/update) privileges as local organization users.
* Task resources with status draft can be read by all practitioner
users.
* Task resources with status requested can be created by practitioner
users if they have the needed role authorized by the associated
ActivityDefinition. Practitioner users with role DSF_ADMIN can create
Task resources with status requested if they are allowed for the local
organization.
* Modified Task UI (incl. JavaScript) to specify the practitioner eMail
as requester. Main UI now shows the users roles and eMail as tooltip of
the "Hello, ..." text.
* New default eMail addresses for OIDC and certificate users without an
explicitly defined value. OIDC will use the pattern
<sub>.<iss-host>@oidc.invalid, certificate will use
<sha512-thumbprint-hex>@certificate.invalid.
- QuestionnaireResponse resources can be read if local org user,
DSF_ADMIN and practitioner authorized by extension
- QuestionnaireResponse resources can be created by local org user and
DSF_ADMIN
- QuestionnaireResponse resources can be updated:
  - in-progress -> completed by local org user, DSF_ADMIN and
practitioner authorized by extension
  - in-progress -> stopped by local org user and DSF_ADMIN
  - completed -> amended by local org user and DSF_ADMIN
- QuestionnaireResponse resources can be deleted by local org user and
DSF_ADMIN
- Modified and new integration tests
- QuestionnaireResponseHandler now updates received completed
QuestionnaireRespons resources to status amended, to make sure a out of
sync BPE DB is not flooded with already handled resources on startup.
- Author and authored are now shown in the info-box
- DefaultUserTaskListener can now be configured via bpmn field injection
using fields practitioner (for practitioner identifier),
practitionerRole (for practitioner role coding), practitioners (list of
identifiers, expression only) and practitionerRole (list of roles,
expression only). In order to use field injections,
dev.dsf.bpe.v2.activity.DefaultUserTaskListener needs to be explicitly
specified as task listener Java class. But does not need to be registerd
as prototype bean.
- The QuestionnaireResponse generated by the DefaultUserTaskListener no
self declares the
http://dsf.dev/fhir/StructureDefinition/questionnaire-response profile.
- Camunda engine requires code and message to be non null and non empty
- Added two practitioner users to the FHIR server role config with
minimal Task/Questionnaire/QuestionnaireResponse roles
- Added two client connection to the BPE server fhir client connections
config
- BPE client connection "dic-user" has practitioner role DIC_USER on
FHIR server with identifier dic-user@test.org
- BPE client connection "uac-user" has practitioner role UAC_USER on
FHIR server with identifier uac-user@test.org
- Additional Questionnaire/QuestionnaireResponse tests check role and
identifier authorization for updating (in-progress->completed)
QuestionnaireResponse resources. Existing test checks update for the
local organization user.
String list is serialized using java serialization to allow usage of the
variable with JUEL expressions, e.g. when setting the value via a Field
Injection and a setVariable(List<String>) method.
- New integration test checks setting multiple practitioner identifier
via DefaultUserTaskListener field injection with a List of strings
issue/367_User_to_Task_and_QuestionnaireResponse_Association
@hhund hhund added this to the 2.0.0 milestone Oct 15, 2025
@hhund hhund requested review from schwzr and wetret October 15, 2025 21:36
@hhund hhund self-assigned this Oct 15, 2025
@hhund hhund marked this pull request as draft October 15, 2025 21:38
@hhund hhund marked this pull request as ready for review October 16, 2025 21:18
@hhund hhund merged commit 8e77651 into develop_2 Oct 18, 2025
4 checks passed
@hhund hhund linked an issue Oct 18, 2025 that may be closed by this pull request
@hhund hhund deleted the issue/367_User_to_Task_and_QuestionnaireResponse_Association branch April 16, 2026 13:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve User to Task and QuestionnaireResponse Association

3 participants