Index: backend/src/main/java/medora/controller/AppointmentController.java =================================================================== --- backend/src/main/java/medora/controller/AppointmentController.java (revision 84249b19ce0ac1cc4b9f406f63132d99f6759053) +++ backend/src/main/java/medora/controller/AppointmentController.java (revision a64c772a36870a2e14746a963e20b1e6ec1e1538) @@ -243,5 +243,5 @@ } - // Verify appointment exists and check permissions for patients + // Verify appointment exists and check permissions Appointment appointment = appointmentService.getAppointmentById(appointmentId) .orElseThrow(() -> new RuntimeException("Appointment not found")); @@ -251,4 +251,11 @@ Long appointmentPatientId = appointment.getPatient() != null ? appointment.getPatient().getPatientId() : null; if (patientIdFromToken == null || !patientIdFromToken.equals(appointmentPatientId)) { + return ResponseEntity.status(HttpStatus.FORBIDDEN) + .body(Map.of("error", "You can only cancel your own appointments")); + } + } else if (role.equals("DOCTOR")) { + Long doctorIdFromToken = securityUtil.getDoctorIdFromRequest(httpRequest); + Long appointmentDoctorId = appointment.getDoctor() != null ? appointment.getDoctor().getDoctorId() : null; + if (doctorIdFromToken == null || !doctorIdFromToken.equals(appointmentDoctorId)) { return ResponseEntity.status(HttpStatus.FORBIDDEN) .body(Map.of("error", "You can only cancel your own appointments")); Index: frontend/src/pages/appointments/AppointmentList.js =================================================================== --- frontend/src/pages/appointments/AppointmentList.js (revision 84249b19ce0ac1cc4b9f406f63132d99f6759053) +++ frontend/src/pages/appointments/AppointmentList.js (revision a64c772a36870a2e14746a963e20b1e6ec1e1538) @@ -47,5 +47,5 @@ await appointmentService.cancelAppointment(id); setAppointments(appointments.map(apt => - apt.appointmentId === id ? { ...apt, status: 'CANCELLED' } : apt + apt.appointmentId === id ? { ...apt, status: 'CANCELLED' } : apt )); } catch (err) { @@ -58,28 +58,28 @@ return ( -
-
-

- {patientId ? 'Patient Appointments' : doctorId ? 'My Appointments' : 'All Appointments'} -

- e.currentTarget.style.background = '#93c5fd'} onMouseLeave={(e) => e.currentTarget.style.background = '#bfdbfe'}> - New Appointment - -
+
+
+

+ {patientId ? 'Patient Appointments' : doctorId ? 'My Appointments' : 'All Appointments'} +

+ e.currentTarget.style.background = '#93c5fd'} onMouseLeave={(e) => e.currentTarget.style.background = '#bfdbfe'}> + New Appointment + +
- {error && setError(null)} />} + {error && setError(null)} />} -
- - +
+
+ @@ -90,37 +90,39 @@ - - + + {appointments.map(appointment => ( - - - - - - + + + + + - - + + + ))} - -
PatientActions
{appointment.patient?.firstName} {appointment.patient?.lastName}Dr. {appointment.doctor?.firstName} {appointment.doctor?.lastName}{appointment.appointmentDate}{appointment.appointmentTime} +
{appointment.patient?.firstName} {appointment.patient?.lastName}Dr. {appointment.doctor?.firstName} {appointment.doctor?.lastName}{appointment.appointmentDate}{appointment.appointmentTime} {appointment.status} - - {appointment.status === 'SCHEDULED' && ( - - )} -
+ {appointment.status === 'SCHEDULED' && ( + (user.role === 'DOCTOR' && appointment.doctor?.doctorId !== user.doctorId) ? null : ( + + ) + )} +
+ + +
-
); } Index: frontend/src/pages/billing/BillingDetail.js =================================================================== --- frontend/src/pages/billing/BillingDetail.js (revision 84249b19ce0ac1cc4b9f406f63132d99f6759053) +++ frontend/src/pages/billing/BillingDetail.js (revision a64c772a36870a2e14746a963e20b1e6ec1e1538) @@ -78,146 +78,156 @@ if (loading) return ; + // Prevent unauthorized access to billing + if (user.role === 'DOCTOR' || user.role === 'LAB_TECHNICIAN') { + return ( +
+

Access Denied

+

You do not have permission to access billing records.

+
+ ); + } + if (!billing) { return ( -
- navigate('/billing')} /> -
+
+ navigate('/billing')} /> +
); } return ( -
-
-

Billing Record #{billing.billId}

-
- - -
-
- - {error && setError(null)} />} - {success && setSuccess(null)} />} - -
-
-

Billing Information

-
- - - - +
+
+

Billing Record #{billing.billId}

+
+ +
- {!isPatient && ( + {error && setError(null)} />} + {success && setSuccess(null)} />} + +
-

Update Payment Status

-
-
- - -
- +

Billing Information

+
+ + + +
- )} - -
-

Patient Details

-
- {billingDetail && ( - <> - - - - - )} -
-
-
- -
-

Itemized Services

- - {billingDetail && (billingDetail.procedures.length > 0 || billingDetail.labTests.length > 0) ? ( -
- {billingDetail.procedures.length > 0 && ( -
-

Procedures

- - - - - - - - - {billingDetail.procedures.map((proc, idx) => ( - - - - - ))} - -
DescriptionCost
{proc.description}${proc.cost}
+ + {!isPatient && ( +
+

Update Payment Status

+
+
+ + +
+ +
- )} - - {billingDetail.labTests.length > 0 && ( -
-

Lab Tests

- - - - - - - - - {billingDetail.labTests.map((test, idx) => ( - - - - - ))} - -
DescriptionCost
{test.description}${test.cost}
-
- )} - -
-
-

Total Amount:

-

${billing.totalCost}

-
+ )} + +
+

Patient Details

+
+ {billingDetail && ( + <> + + + + + )}
- ) : ( -

No services itemized for this billing record.

- )} +
+ +
+

Itemized Services

+ + {billingDetail && (billingDetail.procedures.length > 0 || billingDetail.labTests.length > 0) ? ( +
+ {billingDetail.procedures.length > 0 && ( +
+

Procedures

+ + + + + + + + + {billingDetail.procedures.map((proc, idx) => ( + + + + + ))} + +
DescriptionCost
{proc.description}${proc.cost}
+
+ )} + + {billingDetail.labTests.length > 0 && ( +
+

Lab Tests

+ + + + + + + + + {billingDetail.labTests.map((test, idx) => ( + + + + + ))} + +
DescriptionCost
{test.description}${test.cost}
+
+ )} + +
+
+

Total Amount:

+

${billing.totalCost}

+
+
+
+ ) : ( +

No services itemized for this billing record.

+ )} +
-
); } @@ -225,8 +235,8 @@ function InfoRow({ label, value }) { return ( -
- {label}: - {value || 'N/A'} -
+
+ {label}: + {value || 'N/A'} +
); } Index: frontend/src/pages/billing/BillingList.js =================================================================== --- frontend/src/pages/billing/BillingList.js (revision 84249b19ce0ac1cc4b9f406f63132d99f6759053) +++ frontend/src/pages/billing/BillingList.js (revision a64c772a36870a2e14746a963e20b1e6ec1e1538) @@ -13,8 +13,4 @@ const user = JSON.parse(localStorage.getItem('user') || '{}'); - useEffect(() => { - fetchBillings(); - }, [patientId]); - const fetchBillings = async () => { try { @@ -24,5 +20,4 @@ response = await billingService.getBillingHistoryForPatient(patientId); } else if (user.role === 'PATIENT') { - // Patients can only view their own billing history response = await billingService.getBillingHistoryForPatient(user.patientId); } else { @@ -38,15 +33,29 @@ }; + useEffect(() => { + fetchBillings(); + }, [patientId]); + + // Prevent unauthorized access to billing + if (user.role === 'DOCTOR' || user.role === 'LAB_TECHNICIAN') { + return ( +
+

Access Denied

+

You do not have permission to access billing records.

+
+ ); + } + if (loading) return ; return ( -
-

{patientId ? 'Patient Billing History' : 'Billing Records'}

+
+

{patientId ? 'Patient Billing History' : 'Billing Records'}

- {error && setError(null)} />} + {error && setError(null)} />} -
- - +
+
+ @@ -56,31 +65,31 @@ - - + + {billings.map(billing => ( - - - - + + + - - - + + + + ))} - -
PatientActions
{billing.patientName}${billing.totalCost} +
{billing.patientName}${billing.totalCost} {billing.paymentStatus} - {billing.paymentDate || 'Not paid'} - e.currentTarget.style.textDecoration = 'underline'} onMouseLeave={(e) => e.currentTarget.style.textDecoration = 'none'}> - View - -
{billing.paymentDate || 'Not paid'} + e.currentTarget.style.textDecoration = 'underline'} onMouseLeave={(e) => e.currentTarget.style.textDecoration = 'none'}> + View + +
+ + +
-
); }