Resolve source CE referral on enrollment by martha · Pull Request #5999 · greenriver/hmis-warehouse

martha · 2025-11-12T18:13:07Z

Merging this PR

use the squash-merge strategy for PRs targeting a release-X branch

Description

Repurpose the existing can_view_summary? referral policy for users who can view the target enrollment, even if they can't necessarily view details of the referral. (This policy was originally designed to display some limited data about the referral to a user who can send direct referrals from the source project, but can't view referrals in the target project.)
- I thought this was ergonomically nice because the frontend can then resolve the CeReferral schema object and use its access field to determine whether to link to the referral from the enrollment.
- I reviewed the list of summary fields on CeReferral that this would give the user access to, and they all seem okay to expose, especially since under this new use case, the user already can view enrollments in the target project.
- Alternative, if we are concerned that this repurposing exposes too much data: We could just resolve the referral-related fields needed (sourceCeReferralId, sourceCeReferralProjectName, etc.) directly on the enrollment.
Add source_ce_referral assoc on enrollment and resolve it on the graphql type

Frontend PR: greenriver/hmis-frontend#1319

Type of change

New feature

Checklist before requesting review

//: # NOTE: system tests may fail if there is no branch on the hmis-frontend that matches the Source or Target branch of this PR. This is expected

martha · 2025-11-12T19:47:34Z

    summary_field :created_at, GraphQL::Types::ISO8601DateTime, null: false
    summary_field :source_enrollment_id, ID, null: false
+    # source_project_name is resolved separately from source_enrollment as a summary field to minimize data exposure
+    summary_field :source_project_name, String, null: false


I'm proposing to add source_project_name as a new summary-level field, even though it is also resolvable through the sourceEnrollment field. As we currently have it set up, sourceEnrollment is not a summary-level field, so it's only resolvable by those who can view the referral. I thought about elevating it to a summary field, but it contains a lot of data (like assessments and household members) that are not needed to solve the current requirement.

I think this makes sense! I needs to be nullable though, because source_enrollment_id is not required on the referral table. (source_enrollment_id graphql field also should be nullable, which I incorporated into wip #6000 , but you can make the change here too).

martha · 2025-11-12T19:49:18Z

    summary_field :custom_status, HmisSchema::CeCustomReferralStatus, null: true
    summary_field :client_id, ID, null: false
    summary_field :client_name, String, null: true, description: 'The name of the referred client. Always available to those who can view the full referral, even without full client record access.'
-    # Special case: Client is a "summary field" because it doesn't require referral visibility, but resolving it does require permission to view the client record.


Removing unrelated - I think this comment was outdated, since client is not a summary-level field.

gigxz

Looks good!

gigxz · 2025-11-13T18:02:44Z

  # All referrals where this enrollment is the source enrollment. NOT only 'direct' referrals
  has_many :outgoing_ce_referrals, class_name: 'Hmis::Ce::Referral', foreign_key: :source_enrollment_id
+  # The referral that created this enrollment (if any)
+  has_one :source_ce_referral, class_name: 'Hmis::Ce::Referral', foreign_key: :target_enrollment_id


Thanks for adding this. This is a bit unrelated, but we have the same "dangling reference" problem as we do with the outgoing_ce_referrals association. If the target Enrollment is destroyed, the source enrollment will continue to have a target_enrollment_id that doesn't resolve to anything.

I will address this in #6000 since you're just adding the reference and not changing the default behavior here, it will need more tests etc. Just a note to self! I think we want dependent: :nullify In other words if the Target Enrollment is deleted, the referral should remain but have the target_enrollment_id nullified.

I agree, that makes sense!

gigxz · 2025-11-13T18:09:54Z

@@ -39,7 +39,13 @@ def can_view?
  def can_view_summary?
    return false unless Hmis::Ce.configuration.enabled?



Can we add a return true if can_view?
It doesn't feel logical to have scenarios where the use can view the full referral, but they can't view the summary of it.

gigxz · 2025-11-13T18:16:10Z

+    # Users who can view the target enrollment. Bakes in the assumption that the target enrollment is in the referral's project.
+    return true if referral.target_enrollment_id.present? && project_permissions.include?(:can_view_enrollment_details)


If we had an Enrollment Policy, it would be nice if we could check against that here. Maybe we can add a TODO referencing https://github.com/open-path/Green-River/issues/8549 for that.

Full Enrollment visibility currently requires both can_view_enrollment_details and can_view_project so we should check that both of those are included in project_permissions to be comprehensive. (This is the thing that would be ideal to encapsulate in the policy!)

Cool thanks for tracking down the open ticket! I'll add a todo and also add an extra check that the user can_view_project. b855f95

gigxz · 2025-11-13T18:17:06Z

+      end
+    end
+
+    context 'when referral has a target enrollment' do


Thanks for these tests! I think we are missing coverage for the case where the referral doesn't have a target enrollment. We should test that because I think we are wanting to limit summary visibility to only referrals that have resulted in an enrollment at the target project.

Oh yup makes sense, added test coverage for that 77b4f03

I was beginning to type up the question, Do you think we need coverage for the case where the target enrollment ID points at an enrollment that isn't in the target project? (referring back to my comment here)

But, thinking about this more, that really sounds like it should be a validation on the referral model. I'm taking a stab at that, but wanted to split it out into a separate diff, in case it causes a bunch of tests to fail, so it doesn't block this work. #6007

Co-authored-by: Gig <gig@greenriver.org>

gigxz

Looks great! Thanks!

martha added 4 commits November 12, 2025 12:44

update referral policy

fc5839f

add source referral field

f31a943

add spec

3254f90

Resolve project name on referral summary

0ca76f4

martha changed the title ~~Mke/8283 src enr ref~~ Resolve source CE referral on enrollment Nov 12, 2025

martha mentioned this pull request Nov 12, 2025

Display source CE referral on enrollment dashboard greenriver/hmis-frontend#1319

Merged

6 tasks

comment

ec88bbc

martha commented Nov 12, 2025

View reviewed changes

comments

6a9a4f6

martha commented Nov 12, 2025

View reviewed changes

martha added 3 commits November 12, 2025 14:50

update field description

8eddb06

Merge branch 'release-189' into mke/8283-src-enr-ref

de8e41c

merge

64ace82

martha requested a review from gigxz November 13, 2025 15:25

martha marked this pull request as ready for review November 13, 2025 15:25

gigxz reviewed Nov 13, 2025

View reviewed changes

Comment thread drivers/hmis/app/graphql/types/hmis_schema/ce_referral.rb

gigxz reviewed Nov 13, 2025

View reviewed changes

martha changed the base branch from release-189 to release-190 November 14, 2025 12:58

martha and others added 8 commits November 14, 2025 07:59

Merge branch 'release-190' into mke/8283-src-enr-ref

374f031

explicitly check policy

46412b4

Co-authored-by: Gig <gig@greenriver.org>

make fields nullable

3fa5e40

handle nil enrollment

350ae25

make can_view_summary always true if can_view

d15b9ac

add todo and extra project permission check

b855f95

add test coverage

77b4f03

update comment (assumes merge of #6007)

3159ffc

gigxz approved these changes Nov 14, 2025

View reviewed changes

martha merged commit 12f64f4 into release-190 Nov 14, 2025
18 checks passed

martha deleted the mke/8283-src-enr-ref branch November 14, 2025 22:17

		@@ -39,7 +39,13 @@ def can_view?
		def can_view_summary?
		return false unless Hmis::Ce.configuration.enabled?

		# Users who can view the target enrollment. Bakes in the assumption that the target enrollment is in the referral's project.
		return true if referral.target_enrollment_id.present? && project_permissions.include?(:can_view_enrollment_details)

Uh oh!

Conversation

martha commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR

Description

Type of change

Checklist before requesting review

Uh oh!

martha Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gigxz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

martha Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gigxz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

martha commented Nov 12, 2025 •

edited

Loading

martha Nov 12, 2025 •

edited

Loading

martha Nov 14, 2025 •

edited

Loading