...
After a ResearchProject is created, only the creator can make changes to a ResearchProject. The owner can also change the ownership of a ResearchProject by changing the ownerId value to another userId that has been granted access to the dataset under the same ResearchProject. After taking over the ResearchProject, a user would have the same permissions with the DataAccessRequest's creator.
| DataAccessRequest Request implements DataAccessRequestInterfaceRequestInterface |
|---|
| String id |
| String accessRequirementId |
| String createdBy |
| Long createdOn |
| String researchProjectId |
| List<String> accessors |
| String ducFileHandleId |
| String irbFileHandleId |
| List<String> attachments |
| String modifiedBy |
| Long modifiedOn |
Any user can create a DataAccessRequest a Request to a given AccessRequirement. To create a DataAccessRequestRequest, the following fields are required: accessRequirementId, and createdBy. The following fields: id, createdOn, and modifiedOn are set by the system. A user cannot change these values.
Only creator of DataAccessRequest Request can update, and submit the request. To submit a request, it has to meet the requirements specified in the associated AccessRequirement.
Once a request is submitted, a DataAccessSubmission Submission object is created. While there is an DataAccessSubmission Submission with status SUBMITTED, it's associated DataAccessRequest Request no longer available for update & submit.
| DataAccessRenewal Renewal implements DataAccessRequestInterfaceRequestInterface extends DataAccessRequestRequest |
|---|
| String publication |
| String summaryOfUse |
Once a DataAccessSubmission Submission is approved and requestor wants to add/ remove accessors, he/she needs to update the request with a DataAccessRenewalRenewal, given the publication and summaryOfUse in addition to editing the existing information from the original DataAccessRequestRequest.
Submitting a DataAccessRenewal Renewal will also result in a DataAccessSubmission Submission being created with status SUBMITTED.
| DataAccessSubmissionSubmission |
|---|
| String id |
| String dataAccessRequestId |
| String submittedBy |
| Long submittedOn |
| ResearchProject researchProjectSnapshot |
| List<String> accessors |
| Boolean isRenewalSubmission |
| String ducFileHandleId |
| String irbFileHandleId |
| List<String> attachments |
| String publication |
| String summaryOfUse |
| DataAccessSubmissionSubmissionState state (SUBMITTED, APPROVED, REJECTED, CANCELED) |
| String reviewerId |
| Long reviewedOn |
| String rejectedReason |
Once a DataAccessSubmission Submission is created, it will have state SUBMITTED until a reviewer (ACT member) review and update its status.
...
| Action | Intended User | URI | Method | Request Params | Request Body | Response Body | |
|---|---|---|---|---|---|---|---|
| create or update Research Project | Synapse User | /researchProject | POST | ResearchProject | ResearchProject | ||
| get ResearchProject for update | creator | /accessRequirement/{id}/researchProjectForUpdate | GET | ResearchProject | |||
| 5 | |||||||
| 6 | |||||||
| 7 | asking the server for a suitable request object to start with | creator | /accessRequirement/{id}/dataAccessRequestForUpdate | GET | DataAccessRequestInterfaceRequestInterface | ||
| create or update DataAccessRequestRequest | Synapse User | /dataAccessRequest | POST | DataAccessRequestInterfaceRequestInterfaceDataAccessRequestInterface | RequestInterface | ||
| 9 | submit a DataAccessRequestRequest | creator, | /dataAccessRequest/{id}/submission | POST | etag | ACTAccessRequirementStatusSubmissionStatus | |
| 11 | cancel a DataAccessSubmissionSubmission | requestor, | /dataAccessSubmission/{id}/cancellation | PUT | ACTAccessRequirementStatusSubmissionStatus | ||
| 12 | update a DataAccessSubmissionSubmission | ACT | /dataAccessSubmission/{id} | PUT | SubmissionStateChangeRequest | DataAccessSubmissionSubmissionStatus | |
| 13 | retrieve a list of DataAccessSubmissionSubmission | ACT | /accessRequirement/{id}/submissions | GET | nextPageToken, order (DataAccessSubmissionOrderSubmissionOrder), filter (DataAccessSubmissionStateSubmissionState), asc | DataAccessSubmissionPageSubmissionPage | |
| / | |||||||
| retrieve restriction information | Synapse user | /restrictionInformation | POST | RestrictionInformationRequest | RestrictionInformationResponse | ||
| 16 | retrieve access requirement status | Synapse user | /accessRequirement/{id}/status | GET | AccessRequirementStatus | ||
| 17 | retrieve info about open submissions | ACT | /dataAccessSubmission/openSubmissions | GET | nextPageToken | OpenSubmissionPage | |
| BatchAccessApprovalRequest |
|---|
List<String> userIds String accessRequirementId |
...
| ACTAccessRequirementStatus implements AccessRequirementStatus |
|---|
| String accessRequirementId |
| Boolean isApproved |
| SubmissionStatus current submissionStatus |
SubmissionStatus |
|---|
| String submittedBy |
| String submissionId |
| DataAccessSubmissionSubmissionState state |
| String rejectedReason |
| Long reviewedOn |
...
| SubmissionStateChangeRequest |
|---|
| String submissionId |
| DataAccessSubmissionSubmissionState newState (only APPROVED and REJECTED are valid) |
| String rejectedReason |
| RestrictionInfoRestrictionInformationRequest |
|---|
| String objectId |
RestrictableObjectType objectType |
| RestrictionInformationResponse |
|---|
| RestrictionLevel restrictionLevel (OPEN, RESTRICTED_BY_TERMS_OF_USE, CONTROLLED_BY_ACT) |
| boolean hasUnmet |
...
| TermsOfUseAccessRequirementStatus implements AccessRequirementStatus |
|---|
| String accessRequirementId |
| boolean isApproved |
...
| user has not created a request | empty DataAccessRequest | |
| user has a request, zero APPROVED submission | the created DataAccessRequest | |
| user has an APPROVED submission, requires renewal | re-filled DataAccessRenewal | |
| user has an APPROVED submission, renewal not required | the created DataAccessRequest |
Notification
| Condition | Target User | Notes | |
|---|---|---|---|
| 1 | After a new submission is created | ACT member | Includes link to a page that manages the dataset's access requests |
| 2 | After a submission is approved | Requestor | Includes link to view request |
| 3 | After a submission is rejected | Requestor | Includes reason Includes link to create a new request from the rejected one |
May Summary
By May 2017, we have completed #1-4, #7 & #8 under Solution. We have implemented all APIs listed under Services. The feature is under alpha in stack-180.
From user's feedback, we still need to provide the following:1.
- Need notifications for ACT when there is a new submission - may only get 1-2 requests a week for old dataset.
...
- Revoking access - when user is removed in an updated request, revoke user access. System should send a message to the people removed (Amy to help with messaging).
...
- Bundle submission together (like Brian suggested) to see latest + history. May be able to work around if we have ability to sort by institution, and filter by Submitted By.
...
- RENEWAL SUPPORT. ACT currently manually revokes user access. We need to help support the existing process in the new system, or automate it.
...
- To help support, they need ability to filter by the date granted access, and ability to get the list of emails. Alternatively, system could automatically send out emails at specific reminder dates, and auto-revoke access after expiration.
As a path moving forward, we decided that when we bring the feature out of alpha, an ACT member can continue managing access outside of Synapse, or switch to use the new system. To be able to achieve this, SWC needs to know if an ACTAccessRequirement was configured to use Synapse to keep track of Submission.
After a discussion, we conclude on:
- Making AccessRequirement version-able.
- An access approval grants a user access to a specific access requirement version.
- On download, if a user have access approval for
...
- any version of the access requirement, the user meets the conditions specified by that access requirement.
- A new API need to be added to retrieve a version of an access requirement.
- Retrieving restriction information API needs to be generic (taking an ID and subject type instead of being specific for entity only)
- A submission points to a particular access requirement version.
- Retrieving Access Requirement Status always include information about whether or not a user have met the conditions specified by the access requirement regardless of version.