fix: permission ceiling is <= not >= — L10 user sees L1..L10, not L10..L15

Author: Anubhav852

backend/permission_compiler.py

@@ -1,23 +1,23 @@
-# RESTRICTED_TAGS are the compliance tags that gate access.
-# Nodes with no tags, or tags like "ortho"/"medicine", are unrestricted.
 RESTRICTED_TAGS = {"MNPI", "CONFIDENTIAL", "PHI", "LEGAL_HOLD"}
 
 
 def compile_permissions(user, hierarchy_levels):
     """
     O(1) lookup: {level_id: can_read}
 
-    Permission rule (from spec):
-    - ADMIN: reads everything
-    - HOD: reads all levels in own dept + shared/global levels (no dept), ceiling-gated for other depts
-    - EDITOR / QUALITY: same as HOD
-    - VIEWER: ceiling-gated for ALL levels including own dept
-      (Priya at L10 cannot see L4 Ortho HOD decisions)
-
-    "ceiling_level" means: user can read nodes whose hierarchy_level_number >= their ceiling.
-    Lower number = higher in tree = more privileged.
-    Priya ceiling=10  can read L10, L11, L12, L13, L14, L15 only.
-    Vikram (HOD) ceiling=4  can read L4 and below in his dept.
+    The DAG goes from root (L1) DOWN to leaf nodes (L10, L12).
+    Lower level_number = higher in tree = more privileged.
+    Higher level_number = deeper in tree = more specific/restricted.
+
+    "ceiling_level" = the DEEPEST level a user can see.
+    Priya ceiling=10 → can read L1, L3, L5, L8, L10 (anything <= 10).
+                        Cannot read L12 patient-level nodes.
+    Vikram (HOD) ceiling=4 → can read L1, L3 only for cross-dept.
+                              But reads ALL ortho levels (his own dept).
+    Admin Suresh ceiling=1 → reads everything.
+
+    Rule: can_read = level_number <= user.ceiling_level
+    Exception: HOD/EDITOR/QUALITY read ALL levels in their own department.
     """
     role = user.get("role", "VIEWER")
     ceiling = user.get("ceiling_level", 15)
@@ -35,28 +35,27 @@ def compile_permissions(user, hierarchy_levels):
             permission_map[level_id] = True
 
         elif role == "HOD":
-            # HOD reads all levels in own dept (they manage the whole dept)
-            # + shared/global levels (no department set)
-            # + other depts only if at or below ceiling
-            if level_dept == user_dept or level_dept is None:
+            # HOD reads all levels in own dept
+            # + shared/global levels (no dept) within ceiling
+            # + other depts only within ceiling
+            if level_dept == user_dept:
                 permission_map[level_id] = True
             else:
-                permission_map[level_id] = level_number >= ceiling
+                permission_map[level_id] = level_number <= ceiling
 
         elif role in ("EDITOR", "QUALITY"):
             # Same as HOD for read permissions
-            if level_dept == user_dept or level_dept is None:
+            if level_dept == user_dept:
                 permission_map[level_id] = True
             else:
-                permission_map[level_id] = level_number >= ceiling
+                permission_map[level_id] = level_number <= ceiling
 
         elif role == "AUDITOR":
-            # AUDITOR reads everything (for compliance review) but ceiling-gated
-            permission_map[level_id] = level_number >= ceiling
+            permission_map[level_id] = level_number <= ceiling
 
         else:
-            # VIEWER: strictly ceiling-gated for ALL levels, including own dept
-            # Priya (VIEWER, L10, Ortho) cannot see L4 Ortho HOD decisions
-            permission_map[level_id] = level_number >= ceiling
+            # VIEWER: ceiling-gated for ALL levels including own dept
+            # Priya (VIEWER, L10, Ortho) can read L1-L10, not L12 patient nodes
+            permission_map[level_id] = level_number <= ceiling
 
     return permission_map