kovakmedya
ee9c0015a5
Clinics get a real patient ledger. Labs see only patientCode — no name,
phone, date of birth, or notes ever cross the team boundary.
Data model
- New table 'patients' (clinicTenantId, patientCode, firstName, lastName,
phone?, dateOfBirth?, notes?, archived). Unique index on
(clinicTenantId, patientCode) so each clinic gets its own code space.
Fulltext index on (firstName, lastName) for future patient search.
Row permissions Role.team(clinicTenantId) only — labs literally cannot
read the rows.
- jobs.patientId attribute (optional) + key index, references the
patient row when one exists. patientCode stays denormalised on jobs so
labs keep a stable identifier without joining patients.
Server
- createPatientAction: clinic-only, requireTenantKind guard. Protocol no
is optional; if absent we generate a 6-char unique code (re-roll on
collision, 8 attempts). Duplicate protocol no within a clinic is
rejected with a friendly error.
- updatePatientAction: edits name/phone/dob/notes. patientCode is
explicitly NOT mutable — re-keying historical jobs would be confusing.
- archivePatientAction: toggle, preserves history.
- listPatients / getPatient queries return plain objects via toPlain.
UI
- /patients page (clinic-only, sidebar nav 'Hastalar', middleware
protected): table + add form + edit dialog + archive.
- /jobs/new: patient Select replaces the bare patientCode input. Picking
a patient locks the patientCode field to that patient's code; falling
back to 'Hasta listesinde yok — kodu manuel gir' keeps the old free-
text flow.
- createJobAction validates patientId ownership and overwrites
patientCode with the patient's code on the server, so a manipulated
form can't desync the two.
- /jobs/[jobId] (clinic side only): adds a 'Hasta Bilgileri' card with
name/phone/dob/notes and uses the patient's full name as the page
title. Lab side is unchanged — code only.
The protocol-no / generated-code split matches what the user asked for:
existing patient management software's protocol number flows in directly,
otherwise the system mints one.
66 lines
1.5 KiB
TypeScript
66 lines
1.5 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import type { NextRequest } from "next/server";
|
|
|
|
const AUTH_COOKIE = "lab-session";
|
|
|
|
const PUBLIC_AUTH_PATHS = [
|
|
"/sign-in",
|
|
"/sign-in-2",
|
|
"/sign-in-3",
|
|
"/sign-up",
|
|
"/sign-up-2",
|
|
"/sign-up-3",
|
|
"/forgot-password",
|
|
"/forgot-password-2",
|
|
"/forgot-password-3",
|
|
"/reset-password",
|
|
];
|
|
|
|
const PROTECTED_PREFIXES = [
|
|
"/dashboard",
|
|
"/onboarding",
|
|
"/settings",
|
|
"/jobs",
|
|
"/products",
|
|
"/patients",
|
|
"/finance",
|
|
"/connections",
|
|
"/notifications",
|
|
];
|
|
|
|
export function middleware(request: NextRequest) {
|
|
const { pathname } = request.nextUrl;
|
|
const session = request.cookies.get(AUTH_COOKIE)?.value;
|
|
|
|
// Legacy redirects
|
|
if (pathname === "/login") {
|
|
return NextResponse.redirect(new URL("/sign-in", request.url));
|
|
}
|
|
if (pathname === "/register") {
|
|
return NextResponse.redirect(new URL("/sign-up", request.url));
|
|
}
|
|
|
|
const isAuthPath = PUBLIC_AUTH_PATHS.some(
|
|
(p) => pathname === p || pathname.startsWith(`${p}/`),
|
|
);
|
|
const isProtected = PROTECTED_PREFIXES.some(
|
|
(p) => pathname === p || pathname.startsWith(`${p}/`),
|
|
);
|
|
|
|
if (isProtected && !session) {
|
|
const url = new URL("/sign-in", request.url);
|
|
url.searchParams.set("redirect", pathname);
|
|
return NextResponse.redirect(url);
|
|
}
|
|
|
|
if (isAuthPath && session) {
|
|
return NextResponse.redirect(new URL("/dashboard", request.url));
|
|
}
|
|
|
|
return NextResponse.next();
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ["/((?!api|_next/static|_next/image|favicon.ico).*)"],
|
|
};
|