Delegated Access System (Local)

[TheoAtTechStack]

---

🧩 Delegated Resource Access System

Overview

The Delegated Resource Access feature allows users to grant editing permissions on specific FHIR resources to other authorized users.
This functionality is designed to support collaborative data management — for example, when an authorized delegate needs temporary or partial access to update a user’s records. We do not allow delegated edit for sources that are external (not Fasten).

Location

You can find this feature in the Settings page under the Delegated Access section.

Functionality

1. Owner Access

   • The main user (resource owner) has full control over their resources.

2. Delegated Access

   • A resource owner can delegate edit rights to another user.

   • Delegated users can view and edit resource JSON directly within the UI.

3. Read-Only Access

   • If a user is not delegated, the resource remains read-only.

   • The UI shows the JSON content but does not allow editing or saving.

Implementation Details

Real-time JSON validation via the validateJson() method.

A “Save Changes” button that is disabled when the JSON is invalid.

A warning message (Invalid JSON) appears next to the button when validation fails.

Read-only mode (non-delegated) displays:

The resource JSON content in a highlighted <pre><code> block.

🛠️ Backend Changes — Delegated Access API

To support delegated access and editing, several new secure API endpoints were added to the backend. These endpoints manage delegation creation, retrieval, and resource editing permissions.

Endpoints Overview

Method	Endpoint	Description
POST	/delegated-access	Creates a new delegation record. The owner can share access with another user, specifying permissions (e.g., view/edit).
GET	/delegated-access	Lists all delegations owned by the current user.
GET	/delegated-access/shared-with-me	Lists all delegations shared with the current user.
GET	/delegated-access/shared-with-me/summary/:ownerId/:sourceId	Returns a summary of resources delegated by a specific owner for a given source.
DELETE	/delegated-access/:id	Revokes an existing delegation by its unique ID.
GET	/delegated-access/shared-with-me/resources	Retrieves FHIR resources the current user has delegated access to.
GET	/delegated-access/:ownerUserId/source/:sourceId/resource/:resourceId	Fetches a specific delegated FHIR resource for viewing or editing.
PATCH	/delegated-access/resource/:resourceType/:resourceId/:sourceId	Updates (edits) the raw JSON content of a delegated FHIR resource. Used for delegated editing mode.

Security Notes

• All routes are protected under the secure group, ensuring authenticated access.

• Delegation permissions are verified per resource to prevent unauthorized edits.

• Future enhancements may include activity logging, delegation expiration support and mapping the delegated data as medical history or labs data.

---

DELEGATED_DEMO.mp4