Changeset ed083e6

Timestamp:

05/24/26 11:34:17 (4 months ago)

Author:

MBK <marija.karapandzova@…>

Branches:

master

Children:

cb0881d

Parents:

ccb5a6b

Message:

Assign role permissions for billing admins and add migrations for logging

Location:

backend/src/main

Files:

• java/medora/controller/AppointmentController.java (modified) (2 diffs)
• java/medora/controller/PatientController.java (modified) (4 diffs)
• java/medora/models/domain/User.java (modified) (1 diff)
• java/medora/repository/BillingRepository.java (modified) (3 diffs)
• java/medora/service/AuthService.java (modified) (1 diff)
• java/medora/service/BillingService.java (modified) (1 diff)
• resources/db.migration/V3__Insert_Doctor_Users.sql (added)
• resources/db.migration/V4__Insert_Lab_Technician_Users.sql (added)
• resources/db.migration/V5__Insert_Billing_Admin_Users.sql (added)

backend/src/main/java/medora/controller/AppointmentController.java

@@ -119 +119 @@
             }
 
-            // Patients cannot view all appointments
-            if (role.equals("PATIENT")) {
+            // Patients, BILLING_ADMIN, and LAB_TECHNICIAN cannot view all appointments
+            if (role.equals("PATIENT") || role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) {
                 return ResponseEntity.status(HttpStatus.FORBIDDEN)
-                        .body(Map.of("error", "Patients cannot view all appointments"));
+                        .body(Map.of("error", "You do not have permission to view appointments"));
             }
 
@@ -137 +137 @@
                 appointments = appointmentService.getAppointmentsForDoctor(doctorIdFromToken);
             } else {
-                // ADMIN and other roles can view all appointments
+                // ADMIN can view all appointments
                 logger.info("Fetching all appointments");
                 appointments = appointmentService.getAllAppointments();

backend/src/main/java/medora/controller/PatientController.java

@@ -84 +84 @@
 
     @GetMapping("/{patientId}")
-    public ResponseEntity<?> getPatientById(@PathVariable Long patientId) {
-        try {
+    public ResponseEntity<?> getPatientById(@PathVariable Long patientId, HttpServletRequest httpRequest) {
+        try {
+            String role = securityUtil.getRoleFromRequest(httpRequest);
+            if (role == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body(Map.of("error", "Unauthorized"));
+            }
+
+            // BILLING_ADMIN and LAB_TECHNICIAN cannot view patients
+            if (role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body(Map.of("error", "You do not have permission to view patients"));
+            }
+
             logger.info("Fetching patient with ID: {}", patientId);
             return patientService.getPatientById(patientId)
@@ -102 +114 @@
 
     @GetMapping("/embg/{embg}")
-    public ResponseEntity<?> getPatientByEmbg(@PathVariable String embg) {
-        try {
+    public ResponseEntity<?> getPatientByEmbg(@PathVariable String embg, HttpServletRequest httpRequest) {
+        try {
+            String role = securityUtil.getRoleFromRequest(httpRequest);
+            if (role == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body(Map.of("error", "Unauthorized"));
+            }
+
+            // BILLING_ADMIN and LAB_TECHNICIAN cannot view patients
+            if (role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body(Map.of("error", "You do not have permission to view patients"));
+            }
+
             logger.info("Fetching patient with EMBG: {}", embg);
             return patientService.getPatientByEmbg(embg)
@@ -120 +144 @@
 
     @GetMapping("/email/{emailAddress}")
-    public ResponseEntity<?> getPatientByEmail(@PathVariable String emailAddress) {
-        try {
+    public ResponseEntity<?> getPatientByEmail(@PathVariable String emailAddress, HttpServletRequest httpRequest) {
+        try {
+            String role = securityUtil.getRoleFromRequest(httpRequest);
+            if (role == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body(Map.of("error", "Unauthorized"));
+            }
+
+            // BILLING_ADMIN and LAB_TECHNICIAN cannot view patients
+            if (role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body(Map.of("error", "You do not have permission to view patients"));
+            }
+
             logger.info("Fetching patient with email: {}", emailAddress);
             return patientService.getPatientByEmail(emailAddress)
@@ -138 +174 @@
 
     @GetMapping
-    public ResponseEntity<?> getAllPatients() {
-        try {
+    public ResponseEntity<?> getAllPatients(HttpServletRequest httpRequest) {
+        try {
+            String role = securityUtil.getRoleFromRequest(httpRequest);
+            if (role == null) {
+                return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
+                        .body(Map.of("error", "Unauthorized"));
+            }
+
+            // BILLING_ADMIN and LAB_TECHNICIAN cannot view patients
+            if (role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) {
+                return ResponseEntity.status(HttpStatus.FORBIDDEN)
+                        .body(Map.of("error", "You do not have permission to view patients"));
+            }
+
             logger.info("Fetching all patients");
             List<Patient> patients = patientService.getAllPatients();

backend/src/main/java/medora/models/domain/User.java

@@ -34 +34 @@
     private Boolean isActive = true;
 
-    // Foreign key to patient (only for PATIENT role)
-    @OneToOne(fetch = FetchType.LAZY)
+    // Foreign key to patient  for PATIENT role
+    @OneToOne(fetch = jakarta.persistence.FetchType.LAZY)
     @JoinColumn(name = "patient_id")
     private Patient patient;
 
-    // Foreign key to doctor (only for DOCTOR role)
-    @OneToOne(fetch = FetchType.LAZY)
+    // Foreign key to doctor for DOCTOR role
+    @OneToOne(fetch = jakarta.persistence.FetchType.LAZY)
     @JoinColumn(name = "doctor_id")
     private Doctors doctor;

backend/src/main/java/medora/repository/BillingRepository.java

@@ -55 +55 @@
     BigDecimal calculateTotalCostForMedicalRecord(@Param("recordId") Long recordId);
 
-    // Helper: Get billing records by payment status
+   //Get billing records by payment status
     @Query("""
         SELECT b FROM Billing b
@@ -63 +63 @@
     List<Billing> findByPaymentStatus(@Param("status") String status);
 
-    // Helper: Get unpaid bills for a patient
+    // Get unpaid bills for a patient
     @Query("""
         SELECT b FROM Billing b
@@ -72 +72 @@
     List<Billing> findUnpaidBillsForPatient(@Param("patientId") Long patientId);
 
-    // Helper: Get all bills for a patient sorted by date
+    //Get all bills for a patient sorted by date
     @Query("""
         SELECT b FROM Billing b

backend/src/main/java/medora/service/AuthService.java

@@ -54 +54 @@
         }
 
-        // Generate JWT token with patientId for patients
         Long patientId = user.getPatient() != null ? user.getPatient().getPatientId() : null;
-        String token = jwtUtil.generateToken(user.getUsername(), user.getRole(), user.getUserId(), patientId);
+        Long doctorId = user.getDoctor() != null ? user.getDoctor().getDoctorId() : null;
+        String token = jwtUtil.generateTokenWithDoctorId(user.getUsername(), user.getRole(), user.getUserId(), patientId, doctorId);
 
-        // Return response
         Map<String, Object> response = new HashMap<>();
         response.put("token", token);
         response.put("userId", user.getUserId());
-        response.put("patientId", user.getPatient() != null ? user.getPatient().getPatientId() : null);
+        response.put("patientId", patientId);
+        response.put("doctorId", doctorId);
         response.put("username", user.getUsername());
         response.put("role", user.getRole());

backend/src/main/java/medora/service/BillingService.java

@@ -429 +429 @@
         BillingDetailDTO detail = new BillingDetailDTO();
         detail.setBillId(billing.getBillId());
+        detail.setPatientId(billing.getMedicalRecord().getPatient().getPatientId());
         detail.setPatientName(billing.getMedicalRecord().getPatient().getFirstName() + " " +
                 billing.getMedicalRecord().getPatient().getLastName());