Changeset 946877f for backend/src/main/java/medora/controller/DoctorController.java

Timestamp:

05/23/26 19:27:12 (4 months ago)

Author:

MBK <marija.karapandzova@…>

Branches:

master

Children:

ccb5a6b

Parents:

43e476a

Message:

Assign roles for doctors and patients and add role permissions

File:

• backend/src/main/java/medora/controller/DoctorController.java (modified) (4 diffs)

backend/src/main/java/medora/controller/DoctorController.java

@@ -1 +1 @@
 package medora.controller;
 
-import medora.dto.*;
-import medora.models.domain.Departments;
+import medora.dto.DoctorDTO;
+import medora.dto.CreateDoctorRequest;
+import medora.dto.DoctorLevelDTO;
+import medora.dto.DoctorSpecializationDTO;
+import medora.dto.DepartmentDTO;
+import medora.models.domain.Doctors;
 import medora.models.domain.DoctorLevel;
 import medora.models.domain.DoctorSpecialization;
-import medora.models.domain.Doctors;
+import medora.models.domain.Departments;
 import medora.service.DoctorService;
+import medora.util.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -12 +17 @@
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
+import jakarta.servlet.http.HttpServletRequest;
 
 import java.util.List;
@@ -24 +30 @@
 
     private final DoctorService doctorService;
-
-    public DoctorController(DoctorService doctorService) {
+    private final SecurityUtil securityUtil;
+
+    public DoctorController(DoctorService doctorService, SecurityUtil securityUtil) {
         this.doctorService = doctorService;
+        this.securityUtil = securityUtil;
     }
 
     @PostMapping
-    public ResponseEntity<?> createDoctor(@RequestBody CreateDoctorRequest request) {
-        try {
+    public ResponseEntity<?> createDoctor(@RequestBody CreateDoctorRequest request, HttpServletRequest httpRequest) {
+        try {
+            String role = securityUtil.getRoleFromRequest(httpRequest);
+            if (role == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body(Map.of("error", "Unauthorized"));
+            }
+
+            // Only ADMIN can create doctors
+            if (!role.equals("ADMIN")) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body(Map.of("error", "Only administrators can create doctors"));
+            }
             if (request.getFirstName() == null || request.getFirstName().isBlank()) {
                 return ResponseEntity.badRequest()
@@ -193 +212 @@
     @PutMapping("/{doctorId}")
     public ResponseEntity<?> updateDoctor(@PathVariable Long doctorId,
-                                         @RequestBody CreateDoctorRequest request) {
-        try {
+                                          @RequestBody CreateDoctorRequest request,
+                                          HttpServletRequest httpRequest) {
+        try {
+            String role = securityUtil.getRoleFromRequest(httpRequest);
+            if (role == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body(Map.of("error", "Unauthorized"));
+            }
+
+            // Only ADMIN can update doctors
+            if (!role.equals("ADMIN")) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body(Map.of("error", "Only administrators can update doctors"));
+            }
+
             logger.info("Updating doctor with ID: {}", doctorId);