Enhancing Case Management: Role-Based Access and Auditing

Managing sensitive data and complex workflows, especially in a critical application like seydinalimamoulayeyade/sivbg-project, demands robust access control and unwavering accountability. We recently rolled out a significant enhancement to our case management capabilities, focusing on granular permissions and a clear audit trail for all case-related activities.

This update introduces advanced features for handling dossiers (cases), ensuring that only authorized personnel can view or manage specific cases. A core part of this development is the ability to consult cases based on a user's defined role and to efficiently assign cases to dedicated case managers.

The Implementation Journey

On the backend, our NestJS application, powered by Prisma, now includes new API endpoints and data models specifically designed to support these operations. A critical component is the AccessAudit mechanism, which meticulously logs every case consultation and assignment. This ensures complete transparency and traceability, crucial for compliance and accountability within the system.

Implementing role-based access means that users with an 'operator' role can view a broader set of cases, while those designated as 'case managers' are restricted to only the cases explicitly assigned to them. Other roles, such as 'victim' or 'witness', are appropriately restricted from viewing case lists, receiving a 403 forbidden status if they attempt to access unauthorized data.

The assignment process has been streamlined for efficiency. Operators can now assign a case to a case manager by simply providing their email address, triggering the necessary backend logic to link the case to the manager and update the comprehensive audit log.

Frontend Experience

Complementing the backend, the frontend features a new Dossiers React screen. This intuitive interface allows authorized users to load cases relevant to their role and perform assignments directly. It integrates seamlessly with the backend APIs to fetch, filter, and update case information dynamically, providing a responsive and secure user experience.

// cases.service.ts
import { Injectable, UnauthorizedException } from '@nestjs/common';
import { PrismaService } from '../prisma/prisma.service';

@Injectable()
export class CasesService {
  constructor(private prisma: PrismaService) {}

  async assignCase(caseId: string, managerEmail: string, auditorId: string) {
    const caseRecord = await this.prisma.case.findUnique({ where: { id: caseId } });
    if (!caseRecord) {
      throw new UnauthorizedException('Case not found.');
    }

    const manager = await this.prisma.user.findUnique({ where: { email: managerEmail, role: 'CASE_MANAGER' } });
    if (!manager) {
      throw new UnauthorizedException('Case manager not found or invalid role.');
    }

    const updatedCase = await this.prisma.case.update({
      where: { id: caseId },
      data: { assignedToId: manager.id },
    });

    await this.prisma.accessAudit.create({
      data: {
        action: 'ASSIGN_CASE',
        entityType: 'Case',
        entityId: caseId,
        performedById: auditorId,
        details: `Assigned to ${manager.email}`,
      },
    });

    return updatedCase;
  }
}

This simplified TypeScript code snippet from our CasesService demonstrates how a case is assigned to a manager. It performs necessary checks to ensure the case and manager exist and have appropriate roles, updates the case record, and critically, creates an entry in our AccessAudit table to maintain a comprehensive log of the action.

Validation and Takeaways

Thorough local testing was conducted to validate role-based access, ensuring that operators can list and assign cases, case managers only see their assigned cases, and unauthorized roles are correctly denied access. This robust validation process, including Playwright captures, confirmed the feature's reliability and security.

Implementing fine-grained access control and comprehensive auditing for critical workflows not only enhances security and compliance but also provides a clear operational framework. This promotes accountability and ensures data integrity throughout the application, ultimately leading to a more secure and efficient system for managing sensitive cases.

Generated with Gitvlg.com