apsislabs / phi_attrs

HIPAA compliant PHI access logging for Ruby on Rails.
MIT License
27 stars 3 forks source link

`disallow_phi!` should clear the whole stack #20

Closed HenryKeiter closed 5 years ago

HenryKeiter commented 6 years ago

Currently, the public disallow_phi! method just pops the top entry. This is pretty unintuitive IMO; I'd expect this call to absolutely, unequivocally disallow PHI access for whatever I've called it on. If we stick with a stack approach, I think this method should be made to clear the entire stack (both stacks in the event of a class-level call or maybe always), and the current behavior should be moved to an internal method.

If we move away from the access stack, this stops being a problem (though it should still probably be updated to remove access granted at both a class- and instance-level).