refactor(reports): standardise names, flatten admin (reports+datasets), gate sensitive reports (2.50.11)

[julianam-w]

Overview

The largest of the set — 2.50 still had the old admin/ report folder. Flattens reports and datasets into standard/, standardises report naming, requires a root-level name, and disables sensitive reports by default. Bumps to 2.50.11.

Changes

Flatten admin reports + standardise names + root-level name (536bb36)

• Flatten models/reports/{config,sql}/admin/admin-* (14 reports) → standard/, dropping the admin- prefix; removed the reports admin tag block from dbt_project.yml.
• Renames: audit-patient-details-edits-line-list → audit-patient-details-edit, audit-patient-views-line-list → audit-patient-views, audit-outpatient-appointments-line-list → audit-outpatient-appointments, user-audit-report → user-audit-line-list (+ sensitive- counterparts).
• Added missing root-level name and normalised display names (sentence case; dropped "Current"/"report"; "Registered birth" → "Registered births"; sensitive = "Sensitive ").
• Schema: root name now required; legacy queryOptions.name deprecated. Docs updated. validate_report_configs.py recurses subfolders (rglob).
• Version 2.50.10 → 2.50.11; dbt_utils 1.3.3 → 1.4.0.

Flatten admin datasets (7b43532)

• Folder-only move of all 23 models/datasets/admin/* into models/datasets/standard/; dropped the datasets admin tag block. Model names unchanged.

Gate sensitive reports (540ce13)

• Ported PR feat: gate sensitive report generation via has_sensitive_facility var #425: has_sensitive_facility: false var + report_utils.py gating + README. Sensitive (restricted) reports no longer emitted by default.

Also includes compiled-asset build commits (Update) and a .maui submodule bump made on the branch.

Verification

• validate_report_configs.py → all 58 report configs valid.

Note

The compiled Update commits were built before the has_sensitive_facility gate (540ce13) was added, so the bundled compiled/v2.50.11 may still include sensitive reports. Re-run scripts/build_reporting_assets.py with the flag in place to refresh.

🤖 Generated with Claude Code

[github-actions]

Claude finished @julianam-w's task in 5m 25s —— View job

---

PR Review: standardise report names, flatten admin, gate sensitive reports

✅ Verdict: looks good to merge — well-structured, low-risk refactor (mostly renames + a cleanly-documented gating feature). 0 blockers in source code, 1 action-required on the build artifacts (already acknowledged in the PR body), a few minor suggestions.

• Read review guidelines & repo AGENT.md
• Analyse the diff (names, flatten, gating, schema)
• Verify report config validity (all 58 have a root-level name)
• Check standard↔sensitive + config↔sql parity
• Post review

---

Findings

🟡 1. Compiled assets predate the gating commit (action required before release)

You already flagged this in the PR body, but it's the most important item so I'm surfacing it. compiled/v2.50.11/ was built on 639208f (before 540ce13 added has_sensitive_facility), so the shipped reporting-schema / analytics-metadata / import bundle may still contain the sensitive (restricted) reports — meaning the "disabled by default" behaviour is not reflected in the artifact deployments actually consume. Re-run scripts/build_reporting_assets.py with the flag in place and re-commit compiled/v2.50.11/ before merge/release.

🟢 2. Root-level name requirement is a genuine correctness fix (not just cosmetic)

Worth calling out as a positive: importReports reads json.name at the root (scripts/utils/report_utils.py:148), and compile_report writes the config verbatim into the output (report_utils.py:46). Any config that previously only had queryOptions.name would have imported with an undefined name. Making root name required + deprecating queryOptions.name aligns the schema with the actual consumer. I confirmed all 58 configs now carry a root-level name and none retain a leftover nested queryOptions.name.

🟡 3. Gating cross-tier dependency assumption — documented, fails loud, OK

generate_reporting_schema_script() excludes restricted nodes from nodes but the topological loop (report_utils.py:213-220) would stall and exit with the "no progress" error if a non-restricted model ever depended on a restricted one. The inline comment documents this assumption and it fails loudly rather than silently dropping data, which is the right trade-off. No change needed — just confirm no standard dataset/report references a sensitive//restricted model (none do today).

🔵 4. Field-ordering doc vs. example inconsistency (nit)

The new "Recommended Field Ordering" (documentations/tamanu-report-configuration-schema.md) lists root order as query → name → status → notes → dbSchema, but several configs (e.g. models/reports/config/standard/medication-dispensed-summary.json) order them query → name → notes → status → dbSchema. Harmless, but the convention you're documenting in the same PR isn't followed by the examples. Fix this →

🔵 5. dbt_utils 1.3.3 → 1.4.0 bump unexplained (nit)

packages.yml bumps dbt_utils a minor version with no note on why it's needed for this PR. If it's incidental, consider splitting it out; if a macro here needs it, a one-line note in the PR body would help future bisects.

---

What I verified ✅

• Flatten complete: no admin/ dirs remain under models/reports or models/datasets; the admin +tags block is fully removed from dbt_project.yml; no stale references to old report slugs (audit-*-line-list, user-audit-report, admin-*) outside .maui/.
• Parity: standard 38 configs ↔ 38 SQL, sensitive 20 ↔ 20; every sensitive-* report has its standard/ counterpart; sensitive display names follow Sensitive <standard>.
• validate_report_configs.py: rglob change correctly recurses the new subfolder layout (couldn't execute Python in this sandbox, but reviewed the schema + all 58 configs by hand — all valid against the updated required-name schema).
• get_dbt_project_vars() returns the vars dict and the YAML false resolves to Python False, so the default-off gating is correct.

Regression checklist (run before merge)

python scripts/validate_report_configs.py
dbt compile --profiles-dir config
python scripts/build_reporting_assets.py   # re-emit compiled/v2.50.11 WITH the gate
sqlfluff lint models/reports models/datasets/standard

· branch 2.50-report-name-consistency