Sormas-project: Only display cases and contacts from the user's jurisdiction by default [2]

[Iheanacho2027]

Bug Description

Contacts of confirmed cases having responsible regions in other places causes the source case to pop up as a confirmed case in the user account of the surveillance supervisor of that state. These confirmed cases are seen in the case directory @MartinWahnschaffeSymeda @MateStrysewskeSym @StefanKock

Steps to Reproduce

1. create a contact for a confirmed case in Lagos state, Nigeria
2. Select Kaduna State, Nigeria as the responsible region of that contact
3. Login as the surveillance supervisor of kaduna state
4. Filter out the confirmed cases and you will see the confirmed case of Lagos state popping up in Kaduna state

Expected Behavior

Screenshots

System Details

• Device:
• SORMAS version:
• Android version/Browser:

Additional Information

[MateStrysewske]

What we'd essentially need to do here is to remove all cases from the case directory that don't belong in the jurisdiction of the user. This not only includes cases based on the contact associations, but also cases created by the user if their jurisdiction has changed.

@Iheanacho2027 The only way for users to get access to these cases will be by actively searching the case by its UUID, epid number or external ID. I personally don't think that's a good idea because in my opinion the case directory should be a place where users can access all cases that they do have access to. I'd like to hear the opinions of @Chinedar and @bernardsilenou before we go ahead and implement this.

[Chinedar]

@Maté Strysewske [e-mail]
I suggest we do this, quoting what you mentioned earlier: " What we'd
essentially need to do here is to remove all cases from the case directory
that don't belong in the jurisdiction of the user. This not only includes
cases based on the contact associations, but also cases created by the user
if their jurisdiction has changed."

The reason is because, users in their various jurisdictions take a total
count of cases that belong in their jurisdiction. This is the norm and
approach based on the requests I've gotten from users across the country.
Thanks.

On Tue, May 19, 2020 at 7:12 AM Maté Strysewske [e-mail]
wrote:

What we'd essentially need to do here is to remove all cases from the case
directory that don't belong in the jurisdiction of the user. This not only
includes cases based on the contact associations, but also cases created by
the user if their jurisdiction has changed.

@Iheanacho2027 https://github.com/Iheanacho2027 The only way for
users to get access to these cases will be by actively searching the case
by its UUID, epid number or external ID. I personally don't think that's a
good idea because in my opinion the case directory should be a place where
users can access all cases that they do have access to. I'd like to hear
the opinions of @Chinedar https://github.com/Chinedar and
@bernardsilenou https://github.com/bernardsilenou before we go ahead
and implement this.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/hzi-braunschweig/SORMAS-Project/issues/2137#issuecomment-630604833,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AIPKP5AZAMUGHKFW4EIKQKDRSIPM7ANCNFSM4NEEZ5FQ
.

[MateStrysewske]

@Chinedar That means you don't see it as a problem that these users will lose direct access to the cases that they have created or that might otherwise be of interest of them, but that don't belong to their jurisdiction?

In addition to this: I understand that users need these counts for reporting purposes. Why can't they just filter the case directory by their jurisdiction (which is already possible) when they need to do the reporting?

My fear is that users will start complaining that they can't see case X or Y anymore once we've implemented this change and that we'll have to revert it again. Just want to make sure that this is actually what we need and there's no other, maybe a little less invasive way to do it.

[Iheanacho2027]

@MateStrysewskeSym Your thoughts are very good. However pls note that
1) surveillance supervisors are not able to filter by state on the case directory, they are only able to filter by LGAs as thats what is within their jurisdiction. This would have been possible if users can select multiple LGAs in the LGA filter
2) whatever counts or reporting info on foriegn contacts as regards #1561 , should be in the contacts directory
3) We can make it possible that the only cases from other regions which users can view are the ones they created

[MateStrysewske]

@Iheanacho2027 How do you feel about a checkbox filter that is either called "Show only cases from my jurisdiction" that they could use when they need the correct numbers for reporting?

[Iheanacho2027]

How about this
1) The case directory on first time navigation, should show only cases within the user's jurisdiction
2) Then we can also have a checkbox filter called "show cases from other regions created by me", which will allow users see cases from other regions created by them

[bernardsilenou]

@MateStrysewskeSym Can we apply the same logic for contacts and events also?
Apart from case, contact and event directories, i think we should exclude external cases and contacts from all reporting (statistics,dashboard) and data exports be default

[Chinedar]

let's run with this. The checkbox is a perfect solution I believe, to bring
in the flexibility based on what the users want to see at any given time.

On Tue, May 19, 2020 at 3:56 PM Iheanacho2027 [e-mail]
wrote:

How about this

1. The case directory on first time navigation, should show only cases
   within the user's jurisdiction
2. Then we can also have a checkbox filter called "show cases from
   other regions created by me", which will allow users see cases from other
   regions created by them

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/hzi-braunschweig/SORMAS-Project/issues/2137#issuecomment-630875734,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AIPKP5BJEFRATX2NE4FYKULRSKM2TANCNFSM4NEEZ5FQ
.

[MateStrysewske]

@Iheanacho2027 It's technically more difficult, but we can try to do it this way.
@bernardsilenou Events aren't affected by this, but we'll do the same for contacts.

[MateStrysewske]

• [ ] Add a new field to CaseCriteria and ContactCriteria: "includeCasesFromOtherJurisdictions"
• [ ] For the case and contact index lists, set this field to false by default
• [ ] Add a checkbox to the directories that sets the field to true
• [ ] Adjust the criteria filter builders accordingly

[Iheanacho2027]

@MateStrysewskeSym can this be prioritized for the next release, surveillance supervisors are already getting frustrated having to deal with this issue

[MateStrysewske]

@Iheanacho2027 That's not on me to decide, unfortunately. You might want to forward this request to @bernardsilenou.

[Iheanacho2027]

@bernardsilenou pls kindly approve

[bernardsilenou]

I will vote that we keep the "checkbox" option for next sprint (because this need programming resources).
@MateStrysewskeSym Can we in the current sprint drop the condition that users see cases and contacts that they create and only allow them to see cases and contacts in their jurisdiction? This can be a quick solution. We can latter activate it when we have the checkbox implemented to see additional cases. If This will affect the system, then we can just wait and implement the checkbox in the next sprint then.

[Iheanacho2027]

@bernardsilenou pls that's the best, let's allow users see only cases within their jurisdiction as that's the norm and practice in Nigeria. Alot of surveillance supervisors are already complaining

[bernardsilenou]

@Iheanacho2027 Not only in Nigeria, it is a universal norm. But since users in sormas can create cases outside their regions, at least we need to allow them see those cases if needed. I had a second though and think we should just refine and fix the logic that applies when sharing information across regions. ie add the box.

[Iheanacho2027]

According to key stakeholders in Nigeria, once the jurisdiction of users have changed, they shouldnt see cases that are not in their jurisdiction even if they created it. It is believed that cases entered by the user is owned by the region or district respectively and not by the user who created it. @MateStrysewskeSym @bernardsilenou pls lets leave out the checkbox option and allow users see only cases within their jurisdiction

[bernardsilenou]

According to key stakeholders in Nigeria, once the jurisdiction of users have changed, they shouldnt see cases that are not in their jurisdiction even if they created it. It is believed that cases entered by the user is owned by the region or district respectively and not by the user who created it. @MateStrysewskeSym @bernardsilenou pls lets leave out the checkbox option and allow users see only cases within their jurisdiction

You can't allow users to create cases outside their jurisdiction and prevent them from seeing those cases they create. In the past, users were allowed to create and see cases only in their jurisdiction (region and district) and this change was a request from Nigeria.

Please can you discuss this with the Nigerian team by latest, Monday about the following.

1. Should users like SO be allowed to create cases outside their region and district?
2. Should users like SO be allowed to see cases they create outside their region and district?
3. Use Version 1,45, login with different user accounts, perform test and write a note with the main points you find and how they should be changed. For example, login with SO in district A, create a case in district B, then login as national user to see if all directories (case, contact, samples, dashboard, etc) are correct with what you see with each of the SO accounts.

If we do not complete this refinement by Monday, then this issue can not go in the sprint because decision is made on Monday by noon. Counting on you to follow up and do many test as possible.

[Iheanacho2027]

You can't allow users to create cases outside their jurisdiction and prevent them from seeing those cases they create. In the past, users were allowed to create and see cases only in their jurisdiction (region and district) and this change was a request from Nigeria.

Pls can you share the ticket of that request from Nigeria to follow up on the issue and get more understanding

[bernardsilenou]

@Iheanacho2027 I do not understand what you need please, my last input on this issue is the comment above. I think we need more refinement for this issue

[bernardsilenou]

According to key stakeholders in Nigeria, once the jurisdiction of users have changed, they shouldnt see cases that are not in their jurisdiction even if they created it. It is believed that cases entered by the user is owned by the region or district respectively and not by the user who created it. @MateStrysewskeSym @bernardsilenou pls lets leave out the checkbox option and allow users see only cases within their jurisdiction

This is a big change that i think we need more information before decoding what to do

[Iheanacho2027]

You can't allow users to create cases outside their jurisdiction and prevent them from seeing those cases they create. In the past, users were allowed to create and see cases only in their jurisdiction (region and district) and this change was a request from Nigeria.

Pls can you share the ticket of that request from Nigeria to follow up on the issue and get more understanding

@bernardsilenou you said that the request for the change was from Nigeria, so i was asking for the ticket on that change request to follow up on the issue

[bernardsilenou]

3 yes ago, cant find it, at this time we only had Nigeria. I do not think preventing users from creating cases outside their district is a good idea. We will find another solution.

[bernardsilenou]

All the discussion in-between did not add anything new to @MateStrysewske solution. I suggest we go with this implementation.

Add a new field to CaseCriteria and ContactCriteria: "includeCasesFromOtherJurisdictions"
For the case and contact index lists, set this field to false by default
Add a checkbox to the directories that sets the field to true
Adjust the criteria filter builders accordingly

@Iheanacho2027 if the jurisdiction of a user changes, just create a new user account in the new jurisdiction and archive the old one.

[markusmann-vg]

• [x] Add a new field to CaseCriteria and ContactCriteria: "includeCasesFromOtherJurisdictions"

• [x] For the case and contact index lists, set this field to false by default

• [x] Add a checkbox to the directories that sets the field to true

• [x] Adjust the criteria filter builders accordingly

• [x] Hide this checkbox for users without a jurisdiction

[bernardsilenou]

for all indicators on dashboards, set this field to false by default

[bernardsilenou]

@MateStrysewske @markusmann-vg While testing release candidate 1,50, I came across a bug that is related to this issue and would add more comments here:
server: test1401

1. The data the users see depends on the user role. Surveillance officers (I did not test on all regional roles) see records that has nothing to do with their jurisdictions. The good thing is that the sensitive data a pseudonymized.
   eg The case SPGXTS-7AMG6T-R2V4B7-DK5O2LAM shows up in the case directory of a surveillance supervisor in Berlin, but none of the contacts of this case nor the reporting user is in Berlin. When the national user filter by region, the case does not show up.
   Such situations can happen when the surveillance supervisor create a case in another jurisdiction OR A contact of a case that is outside the jurisdiction of the survSup is created in the jurisdiction of the SurvSup. When the contact is then deleted, the system may have retained the case on the case directory.
   Suggested change: If the condition specified by "includeCasesFromOtherJurisdictions" is no longer true, delete those cases from the directory of the region. Each time the directory is opened and checkbox is activated, call the "includeCasesFromOtherJurisdictions" method.

1. When logged in as surveillance supervisor, I do see cases that are not in my jurisdiction with sensitive data hidden. When i then logged in as national user + admin role and filter the case directory with the same region and time, the confidential cases are excluded. It would be good to use the same default setting no matter the user role that i logged in with, which is what this issue is about.