WEB-ADMIN: User Create (Journey 1)

[roywanyaga]

Objective

Enable administrators to create new users with a transactional flow that creates the Keycloak account, FHIR Practitioner resource, and supporting PractitionerRole resources atomically.

User Story

As an administrator,
I want to create a new user with their demographics, role assignments, and organizational assignments,
So that they can log in and access the system with appropriate permissions and be queryable by the mobile sync layer.

Key Deliverables

• User create form with demographics fields
• Role assignment during creation (multi-select)
• Organization and Location assignment (creates PractitionerRole resources)
• Gateway custom endpoint POST /custom/users integration
• Transactional create (Keycloak + Practitioner + PractitionerRoles with rollback)
• Client-side and server-side validation
• Practitioner.identifier stores Keycloak user ID

Acceptance Criteria

• Create form captures all required demographics
• Roles can be assigned during creation
• User can be assigned to one or more Organization and Location contexts via PractitionerRole
• Submit creates Keycloak user, Practitioner, and PractitionerRole(s) atomically
• Keycloak ID stored in Practitioner.identifier
• Partial failure rolls back (no orphan accounts)
• Validation errors are displayed clearly
• Success redirects to user list with confirmation

Cross-Repository Tasks

Web Portal (ohs-player-reference-web-portal)

• User create form UI
• Role assignment multi-select
• Organization and Location PractitionerRole UI (multi-context)
• Integration with POST /custom/users endpoint
• Validation and error handling

Backend (ohs-player-reference-backend)

• POST /custom/users endpoint (Keycloak + Practitioner + PractitionerRole transactional)
• Rollback on partial failure
• Idempotency handling

Dependencies

Depends on: Epic 2 (Core Library Extraction), Epic 7 (for PractitionerRole creation)