Public health — programme-scoped cross-tenant visibility

Overview

Public health (com.zhenus.uhp.api.publichealth) is a decoupled Feign plug-in domain module with its own publichealth PostgreSQL schema. It implements PH-001: when a patient is enrolled in a programme that an external tenant implements (for example a state TB programme), that implementing tenant may view only the programme-disclosed record, not the facility's whole population.

The module depends only on common + exchange, never imports core, and reaches the platform over Feign when needed. Core integrates minimally:

• PatientProgramServiceImpl.enrollPatient calls ProgrammeVisibilityEnrollmentClient (when bundled) after save to record disclosure grants.
• AccessDecisionServiceImpl.decidePatientAccess adds a programmeVisible leg via ProgrammeVisibilityQueryClient.

Data model

Table	Purpose
programme_implementing_tenant	Admin mapping: program_id → implementing_tenant_id, active
programme_visibility_grant	Disclosure row per enrolment: patient_program_id, person_id, implementing_tenant_id, granted_at, optional revoked_at

Liquibase master: publichealth.db.changelog-master.yaml (not db.changelog-master.yaml — classpath collision with core).

API surface

Base path: /api/v1/publichealth

Endpoint	Permission	Purpose
GET /visibility/check?personId=&viewerTenantId=	publichealth.visibility.read	Returns {visible: boolean}
POST /visibility/enrollments	publichealth.programme-mapping.write	Records grants after enrolment
CRUD /programme-implementing-tenants	publichealth.programme-mapping.read/write	Admin programme→tenant mapping

Feign clients (in exchange.client.publichealth):

• ProgrammeVisibilityQueryClient
• ProgrammeVisibilityEnrollmentClient

Permissions

Declared in PublicHealthModuleDescriptor:

• publichealth.programme-mapping.read
• publichealth.programme-mapping.write
• publichealth.visibility.read

Configuration

publichealth.service.url — loopback to the platform jar by default (uhp-module-defaults.yml).

Related tickets

• PH-001 — programme-scoped cross-tenant visibility (this module)
• M38-001 — multi-tenant per facility (coordinate; do not duplicate the join table)