Changeset 946877f for backend/src/main/java/medora/controller/PatientController.java

Timestamp:

05/23/26 19:27:12 (4 months ago)

Author:

MBK <marija.karapandzova@…>

Branches:

master

Children:

ccb5a6b

Parents:

43e476a

Message:

Assign roles for doctors and patients and add role permissions

File:

• backend/src/main/java/medora/controller/PatientController.java (modified) (4 diffs)

backend/src/main/java/medora/controller/PatientController.java

@@ -1 +1 @@
 package medora.controller;
 
+import medora.dto.PatientDTO;
 import medora.dto.CreatePatientRequest;
-import medora.dto.PatientDTO;
 import medora.models.domain.Patient;
 import medora.service.PatientService;
+import medora.util.SecurityUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -10 +11 @@
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.*;
+import jakarta.servlet.http.HttpServletRequest;
 
 import java.util.List;
@@ -22 +24 @@
 
     private final PatientService patientService;
-
-    public PatientController(PatientService patientService) {
+    private final SecurityUtil securityUtil;
+
+    public PatientController(PatientService patientService, SecurityUtil securityUtil) {
         this.patientService = patientService;
+        this.securityUtil = securityUtil;
     }
 
     @PostMapping
-    public ResponseEntity<?> createPatient(@RequestBody CreatePatientRequest request) {
-        try {
+    public ResponseEntity<?> createPatient(@RequestBody CreatePatientRequest request, HttpServletRequest httpRequest) {
+        try {
+            String role = securityUtil.getRoleFromRequest(httpRequest);
+            if (role == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body(Map.of("error", "Unauthorized"));
+            }
+
+            // Only ADMIN can create patients
+            if (!role.equals("ADMIN")) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body(Map.of("error", "Only administrators can create patients"));
+            }
             if (request.getFirstName() == null || request.getFirstName().isBlank()) {
                 return ResponseEntity.badRequest()
@@ -144 +159 @@
     @PutMapping("/{patientId}")
     public ResponseEntity<?> updatePatient(@PathVariable Long patientId,
-                                          @RequestBody CreatePatientRequest request) {
-        try {
+                                           @RequestBody CreatePatientRequest request,
+                                           HttpServletRequest httpRequest) {
+        try {
+            String role = securityUtil.getRoleFromRequest(httpRequest);
+            if (role == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body(Map.of("error", "Unauthorized"));
+            }
+
+            // Only ADMIN can update patients
+            if (!role.equals("ADMIN")) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body(Map.of("error", "Only administrators can update patients"));
+            }
+
             logger.info("Updating patient with ID: {}", patientId);