admin/dyolink
0
0
Fork 0
Code Issues 24 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

bugfix: clinic owner user access to other (dentist)staff's treatment plans terminated.

Browse Source
This commit is contained in:
Admin
2026-07-14 03:39:42 +03:30
parent 8de15ecdb5
commit a7ba33fb68
7 changed files with 106 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.cursor/skills/treatment-workspace/SKILL.md
View File

@@ -58,7 +58,7 @@ Thin route: `app/[locale]/(dashboard)/treatment/page.tsx` (supports `?appointmen
`GET /treatments/patients/:id/history` returns saved treatments for **that patient** (not the whole day’s schedule). Non-owners see plans where `Treatment.providerUserId` or linked `Appointment.providerUserId` matches the logged-in user; org owners see all saved plans for the patient. New saves set `Treatment.providerUserId` to the logged-in clinician.
`GET /treatments/patients/:id/history` returns saved treatments for **that patient** scoped to the **logged-in clinician** (`Treatment.providerUserId` or linked `Appointment.providerUserId`). **Owners are not exempt** — each user only sees plans they created or own via their appointments.
@@ -184,7 +184,7 @@ canEditTreatmentForDay = canEdit && selectedAppointment && !isViewingPastDay &&
Filter in **backend** `listPatientHistory` on patient + org; provider scoping for non-owners. History is **per selected patient**, not per day or all appointments on the strip.
Filter in **backend** `listPatientHistory` / lab-case lists on patient + org + **provider scope** (`common/treatment-provider-scope.ts`). History is **per selected patient and per clinician**, not per day or all org plans.
**UI filters** (not shipped, date) are client-side only — do not add API params unless product explicitly requires server-side filtering.