Changeset a64c772 for backend/src

Timestamp:

05/25/26 13:43:53 (4 months ago)

Author:

MBK <marija.karapandzova@…>

Branches:

master

Children:

f18b11b

Parents:

84249b1

Message:

Fix doctor authorization and prevent canceling other doctors appointments and restrict them from billing access

File:

• backend/src/main/java/medora/controller/AppointmentController.java (modified) (2 diffs)

backend/src/main/java/medora/controller/AppointmentController.java

@@ -243 +243 @@
             }
 
-            // Verify appointment exists and check permissions for patients
+            // Verify appointment exists and check permissions
             Appointment appointment = appointmentService.getAppointmentById(appointmentId)
                     .orElseThrow(() -> new RuntimeException("Appointment not found"));
@@ -251 +251 @@
                 Long appointmentPatientId = appointment.getPatient() != null ? appointment.getPatient().getPatientId() : null;
                 if (patientIdFromToken == null || !patientIdFromToken.equals(appointmentPatientId)) {
+                    return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                            .body(Map.of("error", "You can only cancel your own appointments"));
+                }
+            } else if (role.equals("DOCTOR")) {
+                Long doctorIdFromToken = securityUtil.getDoctorIdFromRequest(httpRequest);
+                Long appointmentDoctorId = appointment.getDoctor() != null ? appointment.getDoctor().getDoctorId() : null;
+                if (doctorIdFromToken == null || !doctorIdFromToken.equals(appointmentDoctorId)) {
                     return ResponseEntity.status(HttpStatus.FORBIDDEN)
                             .body(Map.of("error", "You can only cancel your own appointments"));