Include DeviceRegistration in DeviceDeploymentStatus

[Whathecode]

In a previous discussion, we concluded that not including DeviceRegistration was an omission, with an intent to not leak private data. However, it shouldn't contain private data which caused the original concern (e.g. passwords), and the other data a researcher would already have access to either way.

In terms of this issue, I think the solution is thus simply to include DeviceRegistration information in DeviceDeploymentStatus (which is contained within StudyDeploymentStatus). Either way, with the current recommended claim-based access documentation, the researcher who set up the deployment would have access to device registrations by calling getDeviceDeploymentFor() (which returns PrimaryDeviceDeployment and contains the registrations), since they have access to all deployment endpoints.

This data can thus safely be exposed to anyone with access to the deployment. And, what should and shouldn't go into device registrations is a separate discussion.

[yuanchen233]

After some discussion, there could be some missing information in the previous discussion.

getDeviceDeploymentFor is only available when all PrimaryDevice are registered.

This method checks for canObtainDeviceDeployment, which requires the specified device and all other primary devices it depends on to be registered. If the study contains more than one PrimaryDevice, it requires all of them to be registered. I guess all PrimaryDevices depends on each other.

Therefore, the problem becomes: When not all PrimaryDevices are registered, how to access DeviceRegistration for the already registered PrimaryDevice?

[Whathecode]

I think you are right this means the following line of reasoning was invalid:

Either way, with the current recommended claim-based access documentation, the researcher who set up the deployment would have access to device registrations by calling getDeviceDeploymentFor() (which returns PrimaryDeviceDeployment and contains the registrations), since they have access to all deployment endpoints.

But the proposal here is to:

In terms of this issue, I think the solution is thus simply to include DeviceRegistration information in DeviceDeploymentStatus (which is contained within StudyDeploymentStatus).

You can always get the deployment status. It contains exactly information on which devices still require registration, etc. The suggestion here is to add the actual registrations to this status.

More specifically, there already is a DeviceDeploymentStatus.Registered state, so it can just be added in there.