apsislabs / phi_attrs

HIPAA compliant PHI access logging for Ruby on Rails.
MIT License
27 stars 3 forks source link

Extend PHI Access on `allow_phi` call instead of on extension method call #60

Open wkirby opened 2 years ago

wkirby commented 2 years ago
# model with associations
class Foo < ActiveRecord::Base
  phi_model
  belongs_to :bar
  has_many :baz

  extend_phi_access :bar, :baz
end

# setup associations
foo = Foo.new
bar = Bar.new
baz = Baz.new
foo.bar = bar
foo.baz << baz

# PHI access is not extended until we call the wrapped method
foo.allow_phi!('me', 'reason')
foo.association(:bar).reader.phi_allowed? # => false
foo.bar.phi_allowed? # => true
foo.association(:bar).reader.phi_allowed? # => true

# desired outcome
foo.allow_phi!('me', 'reason')
foo.association(:bar).reader.phi_allowed? # => true
foo.bar.phi_allowed? # => true
foo.association(:bar).reader.phi_allowed? # => true

We should update allow_phi! to proactively iterate over PHI extensions and call allow PHI on them.