Index: backend/src/main/java/medora/controller/AppointmentController.java =================================================================== --- backend/src/main/java/medora/controller/AppointmentController.java (revision ccb5a6b951950c8dc8a7fd91a1588f3051aea026) +++ backend/src/main/java/medora/controller/AppointmentController.java (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -119,8 +119,8 @@ } - // Patients cannot view all appointments - if (role.equals("PATIENT")) { + // Patients, BILLING_ADMIN, and LAB_TECHNICIAN cannot view all appointments + if (role.equals("PATIENT") || role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) { return ResponseEntity.status(HttpStatus.FORBIDDEN) - .body(Map.of("error", "Patients cannot view all appointments")); + .body(Map.of("error", "You do not have permission to view appointments")); } @@ -137,5 +137,5 @@ appointments = appointmentService.getAppointmentsForDoctor(doctorIdFromToken); } else { - // ADMIN and other roles can view all appointments + // ADMIN can view all appointments logger.info("Fetching all appointments"); appointments = appointmentService.getAllAppointments(); Index: backend/src/main/java/medora/controller/PatientController.java =================================================================== --- backend/src/main/java/medora/controller/PatientController.java (revision ccb5a6b951950c8dc8a7fd91a1588f3051aea026) +++ backend/src/main/java/medora/controller/PatientController.java (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -84,6 +84,18 @@ @GetMapping("/{patientId}") - public ResponseEntity getPatientById(@PathVariable Long patientId) { - try { + public ResponseEntity getPatientById(@PathVariable Long patientId, HttpServletRequest httpRequest) { + try { + String role = securityUtil.getRoleFromRequest(httpRequest); + if (role == null) { + return ResponseEntity.status(HttpStatus.UNAUTHORIZED) + .body(Map.of("error", "Unauthorized")); + } + + // BILLING_ADMIN and LAB_TECHNICIAN cannot view patients + if (role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) { + return ResponseEntity.status(HttpStatus.FORBIDDEN) + .body(Map.of("error", "You do not have permission to view patients")); + } + logger.info("Fetching patient with ID: {}", patientId); return patientService.getPatientById(patientId) @@ -102,6 +114,18 @@ @GetMapping("/embg/{embg}") - public ResponseEntity getPatientByEmbg(@PathVariable String embg) { - try { + public ResponseEntity getPatientByEmbg(@PathVariable String embg, HttpServletRequest httpRequest) { + try { + String role = securityUtil.getRoleFromRequest(httpRequest); + if (role == null) { + return ResponseEntity.status(HttpStatus.UNAUTHORIZED) + .body(Map.of("error", "Unauthorized")); + } + + // BILLING_ADMIN and LAB_TECHNICIAN cannot view patients + if (role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) { + return ResponseEntity.status(HttpStatus.FORBIDDEN) + .body(Map.of("error", "You do not have permission to view patients")); + } + logger.info("Fetching patient with EMBG: {}", embg); return patientService.getPatientByEmbg(embg) @@ -120,6 +144,18 @@ @GetMapping("/email/{emailAddress}") - public ResponseEntity getPatientByEmail(@PathVariable String emailAddress) { - try { + public ResponseEntity getPatientByEmail(@PathVariable String emailAddress, HttpServletRequest httpRequest) { + try { + String role = securityUtil.getRoleFromRequest(httpRequest); + if (role == null) { + return ResponseEntity.status(HttpStatus.UNAUTHORIZED) + .body(Map.of("error", "Unauthorized")); + } + + // BILLING_ADMIN and LAB_TECHNICIAN cannot view patients + if (role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) { + return ResponseEntity.status(HttpStatus.FORBIDDEN) + .body(Map.of("error", "You do not have permission to view patients")); + } + logger.info("Fetching patient with email: {}", emailAddress); return patientService.getPatientByEmail(emailAddress) @@ -138,6 +174,18 @@ @GetMapping - public ResponseEntity getAllPatients() { - try { + public ResponseEntity getAllPatients(HttpServletRequest httpRequest) { + try { + String role = securityUtil.getRoleFromRequest(httpRequest); + if (role == null) { + return ResponseEntity.status(HttpStatus.UNAUTHORIZED) + .body(Map.of("error", "Unauthorized")); + } + + // BILLING_ADMIN and LAB_TECHNICIAN cannot view patients + if (role.equals("BILLING_ADMIN") || role.equals("LAB_TECHNICIAN")) { + return ResponseEntity.status(HttpStatus.FORBIDDEN) + .body(Map.of("error", "You do not have permission to view patients")); + } + logger.info("Fetching all patients"); List patients = patientService.getAllPatients(); Index: backend/src/main/java/medora/models/domain/User.java =================================================================== --- backend/src/main/java/medora/models/domain/User.java (revision ccb5a6b951950c8dc8a7fd91a1588f3051aea026) +++ backend/src/main/java/medora/models/domain/User.java (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -34,11 +34,11 @@ private Boolean isActive = true; - // Foreign key to patient (only for PATIENT role) - @OneToOne(fetch = FetchType.LAZY) + // Foreign key to patient for PATIENT role + @OneToOne(fetch = jakarta.persistence.FetchType.LAZY) @JoinColumn(name = "patient_id") private Patient patient; - // Foreign key to doctor (only for DOCTOR role) - @OneToOne(fetch = FetchType.LAZY) + // Foreign key to doctor for DOCTOR role + @OneToOne(fetch = jakarta.persistence.FetchType.LAZY) @JoinColumn(name = "doctor_id") private Doctors doctor; Index: backend/src/main/java/medora/repository/BillingRepository.java =================================================================== --- backend/src/main/java/medora/repository/BillingRepository.java (revision ccb5a6b951950c8dc8a7fd91a1588f3051aea026) +++ backend/src/main/java/medora/repository/BillingRepository.java (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -55,5 +55,5 @@ BigDecimal calculateTotalCostForMedicalRecord(@Param("recordId") Long recordId); - // Helper: Get billing records by payment status + //Get billing records by payment status @Query(""" SELECT b FROM Billing b @@ -63,5 +63,5 @@ List findByPaymentStatus(@Param("status") String status); - // Helper: Get unpaid bills for a patient + // Get unpaid bills for a patient @Query(""" SELECT b FROM Billing b @@ -72,5 +72,5 @@ List findUnpaidBillsForPatient(@Param("patientId") Long patientId); - // Helper: Get all bills for a patient sorted by date + //Get all bills for a patient sorted by date @Query(""" SELECT b FROM Billing b Index: backend/src/main/java/medora/service/AuthService.java =================================================================== --- backend/src/main/java/medora/service/AuthService.java (revision ccb5a6b951950c8dc8a7fd91a1588f3051aea026) +++ backend/src/main/java/medora/service/AuthService.java (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -54,13 +54,13 @@ } - // Generate JWT token with patientId for patients Long patientId = user.getPatient() != null ? user.getPatient().getPatientId() : null; - String token = jwtUtil.generateToken(user.getUsername(), user.getRole(), user.getUserId(), patientId); + Long doctorId = user.getDoctor() != null ? user.getDoctor().getDoctorId() : null; + String token = jwtUtil.generateTokenWithDoctorId(user.getUsername(), user.getRole(), user.getUserId(), patientId, doctorId); - // Return response Map response = new HashMap<>(); response.put("token", token); response.put("userId", user.getUserId()); - response.put("patientId", user.getPatient() != null ? user.getPatient().getPatientId() : null); + response.put("patientId", patientId); + response.put("doctorId", doctorId); response.put("username", user.getUsername()); response.put("role", user.getRole()); Index: backend/src/main/java/medora/service/BillingService.java =================================================================== --- backend/src/main/java/medora/service/BillingService.java (revision ccb5a6b951950c8dc8a7fd91a1588f3051aea026) +++ backend/src/main/java/medora/service/BillingService.java (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -429,4 +429,5 @@ BillingDetailDTO detail = new BillingDetailDTO(); detail.setBillId(billing.getBillId()); + detail.setPatientId(billing.getMedicalRecord().getPatient().getPatientId()); detail.setPatientName(billing.getMedicalRecord().getPatient().getFirstName() + " " + billing.getMedicalRecord().getPatient().getLastName()); Index: backend/src/main/resources/db.migration/V3__Insert_Doctor_Users.sql =================================================================== --- backend/src/main/resources/db.migration/V3__Insert_Doctor_Users.sql (revision ed083e633da5ec805b45993a197d8ccf823aacc0) +++ backend/src/main/resources/db.migration/V3__Insert_Doctor_Users.sql (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -0,0 +1,8 @@ +-- Insert Doctor users from doctors table +INSERT INTO users (username, password, role, first_name, last_name, doctor_id, is_active) +SELECT d.email_address, 'doctor123', 'DOCTOR', d.first_name, d.last_name, d.doctor_id, true +FROM doctors d +WHERE NOT EXISTS ( + SELECT 1 FROM users u WHERE u.username = d.email_address +) +ON CONFLICT (username) DO NOTHING; Index: backend/src/main/resources/db.migration/V4__Insert_Lab_Technician_Users.sql =================================================================== --- backend/src/main/resources/db.migration/V4__Insert_Lab_Technician_Users.sql (revision ed083e633da5ec805b45993a197d8ccf823aacc0) +++ backend/src/main/resources/db.migration/V4__Insert_Lab_Technician_Users.sql (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -0,0 +1,9 @@ +-- Insert Lab Technician users +INSERT INTO users (username, password, role, first_name, last_name, is_active) +VALUES + ('lab_darko', 'lab123', 'LAB_TECHNICIAN', 'Darko', 'Milosev', true), + ('lab_biljana', 'lab123', 'LAB_TECHNICIAN', 'Biljana', 'Trajkovska', true), + ('lab_stefan', 'lab123', 'LAB_TECHNICIAN', 'Stefan', 'Nikolovski', true), + ('lab_marina', 'lab123', 'LAB_TECHNICIAN', 'Marina', 'Petreska', true), + ('lab_aleksandar', 'lab123', 'LAB_TECHNICIAN', 'Aleksandar', 'Ristovski', true) +ON CONFLICT (username) DO NOTHING; Index: backend/src/main/resources/db.migration/V5__Insert_Billing_Admin_Users.sql =================================================================== --- backend/src/main/resources/db.migration/V5__Insert_Billing_Admin_Users.sql (revision ed083e633da5ec805b45993a197d8ccf823aacc0) +++ backend/src/main/resources/db.migration/V5__Insert_Billing_Admin_Users.sql (revision ed083e633da5ec805b45993a197d8ccf823aacc0) @@ -0,0 +1,16 @@ +-- Insert Billing Admin users +INSERT INTO users (username, password, role, first_name, last_name, is_active) +SELECT 'admin_ilija', 'adminmedora123', 'BILLING_ADMIN', 'Ilija', 'Admin', true +WHERE NOT EXISTS (SELECT 1 FROM users WHERE username = 'admin_ilija') +UNION ALL +SELECT 'admin_elena', 'adminmedora123', 'BILLING_ADMIN', 'Elena', 'Admin', true +WHERE NOT EXISTS (SELECT 1 FROM users WHERE username = 'admin_elena') +UNION ALL +SELECT 'admin_marjan', 'adminmedora123', 'BILLING_ADMIN', 'Marjan', 'Admin', true +WHERE NOT EXISTS (SELECT 1 FROM users WHERE username = 'admin_marjan') +UNION ALL +SELECT 'admin_vesna', 'adminmedora123', 'BILLING_ADMIN', 'Vesna', 'Admin', true +WHERE NOT EXISTS (SELECT 1 FROM users WHERE username = 'admin_vesna') +UNION ALL +SELECT 'admin_dushanka', 'adminmedora123', 'BILLING_ADMIN', 'Dushanka', 'Admin', true +WHERE NOT EXISTS (SELECT 1 FROM users WHERE username = 'admin_dushanka');