Add MedicalRecordController for managing medical record operations

src/main/java/org/example/vet1177/controllers/MedicalRecordController.java

@@ -0,0 +1,236 @@
+package org.example.vet1177.controllers;
+
+import jakarta.validation.Valid;
+import org.example.vet1177.entities.*;
+import org.example.vet1177.policy.MedicalRecordPolicy;
+import org.example.vet1177.services.MedicalRecordService;
+import org.example.vet1177.services.UserService;
+import org.springframework.http.ResponseEntity;
+import org.example.vet1177.dto.request.medicalrecord.*;
+import org.example.vet1177.dto.response.medicalrecord.*;
+import org.example.vet1177.entities.*;
+import org.example.vet1177.exception.ForbiddenException;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/medical-records")
+public class MedicalRecordController {
+
+    private final MedicalRecordService medicalRecordService;
+    private final MedicalRecordPolicy medicalRecordPolicy;
+    private final UserService userService;
+
+    public MedicalRecordController(
+            MedicalRecordService medicalRecordService,
+            MedicalRecordPolicy medicalRecordPolicy,
+            UserService userService) {
+        this.medicalRecordService = medicalRecordService;
+        this.medicalRecordPolicy = medicalRecordPolicy;
+        this.userService = userService;
+    }
+
+    // POST /api/medical-records
+    @PostMapping
+    @Transactional
+    public ResponseEntity<MedicalRecordResponse> create(
+            @Valid @RequestBody CreateMedicalRecordRequest request,
+            @AuthenticationPrincipal User currentUser) {
+
+        return ResponseEntity.ok(
+                MedicalRecordResponse.from(
+                        medicalRecordService.create(
+                                request.title(),
+                                request.description(),
+                                request.petId(),
+                                request.clinicId(),
+                                currentUser
+                        )
+                )
+        );
+    }
+
+    // GET /api/medical-records/{id}
+    @GetMapping("/{id}")
+    @Transactional(readOnly = true)
+    public ResponseEntity<MedicalRecordResponse> getById(
+            @PathVariable UUID id,
+            @AuthenticationPrincipal User currentUser) {
+
+        MedicalRecord record = medicalRecordService.getById(id);
+        medicalRecordPolicy.canView(currentUser, record);
+        return ResponseEntity.ok(MedicalRecordResponse.from(record));
+    }
+
+    // GET /api/medical-records/my-records (för OWNER)
+    @GetMapping("/my-records")
+    @Transactional(readOnly = true)
+    public ResponseEntity<List<MedicalRecordSummaryResponse>> getMyRecords(
+            @AuthenticationPrincipal User currentUser) {
+
+        if (currentUser.getRole() != Role.OWNER) {
+            throw new ForbiddenException("Endast djurägare kan se sina egna ärenden");
+        }
+
+        return ResponseEntity.ok(
+                medicalRecordService.getByOwner(currentUser.getId())
+                        .stream()
+                        .map(MedicalRecordSummaryResponse::from)
+                        .toList()
+        );
+    }
+
+
+    @GetMapping("/owner/{ownerId}")
+    @Transactional(readOnly = true)
+    public ResponseEntity<List<MedicalRecordSummaryResponse>> getByOwner(
+            @PathVariable UUID ownerId,
+            @AuthenticationPrincipal User currentUser) {
+
+        if (currentUser.getRole() == Role.OWNER &&
+                !currentUser.getId().equals(ownerId)) {
+            throw new ForbiddenException("Du kan bara se dina egna ärenden");
+        }
+
+        return ResponseEntity.ok(
+                medicalRecordService.getByOwnerAllowedForUser(ownerId, currentUser)
+                        .stream()
+                        .map(MedicalRecordSummaryResponse::from)
+                        .toList()
+        );
+    }
+
+    // GET /api/medical-records/pet/{petId}
+    // I controllern — enklare
+    @GetMapping("/pet/{petId}")
+    @Transactional(readOnly = true)
+    public ResponseEntity<List<MedicalRecordSummaryResponse>> getByPet(
+            @PathVariable UUID petId,
+            @AuthenticationPrincipal User currentUser) {
+
+        return ResponseEntity.ok(
+                medicalRecordService.getByPetAllowedForUser(petId, currentUser)
+                        .stream()
+                        .map(MedicalRecordSummaryResponse::from)
+                        .toList()
+        );
+    }
+
+    // GET /api/medical-records/clinic/{clinicId}
+    @GetMapping("/clinic/{clinicId}")
+    @Transactional(readOnly = true)
+    public ResponseEntity<List<MedicalRecordSummaryResponse>> getByClinic(
+            @PathVariable UUID clinicId,
+            @AuthenticationPrincipal User currentUser) {
+
+        medicalRecordPolicy.canViewClinic(currentUser, clinicId);
+        return ResponseEntity.ok(
+                medicalRecordService.getByClinic(clinicId)
+                        .stream()
+                        .map(MedicalRecordSummaryResponse::from)
+                        .toList()
+        );
+    }
+
+    // GET /api/medical-records/clinic/{clinicId}/status/{status}
+    @GetMapping("/clinic/{clinicId}/status/{status}")
+    @Transactional(readOnly = true)
+    public ResponseEntity<List<MedicalRecordSummaryResponse>> getByClinicAndStatus(
+            @PathVariable UUID clinicId,
+            @PathVariable RecordStatus status,
+            @AuthenticationPrincipal User currentUser) {
+
+        medicalRecordPolicy.canViewClinic(currentUser, clinicId);
+        return ResponseEntity.ok(
+                medicalRecordService.getByClinicAndStatus(clinicId, status)
+                        .stream()
+                        .map(MedicalRecordSummaryResponse::from)
+                        .toList()
+        );
+    }
+
+    // PUT /api/medical-records/{id}
+    @PutMapping("/{id}")
+    @Transactional
+    public ResponseEntity<MedicalRecordResponse> update(
+            @PathVariable UUID id,
+            @Valid @RequestBody UpdateMedicalRecordRequest request,
+            @AuthenticationPrincipal User currentUser) {
+
+        MedicalRecord record = medicalRecordService.getById(id);
+        medicalRecordPolicy.canUpdate(currentUser, record);
+
+        return ResponseEntity.ok(
+                MedicalRecordResponse.from(
+                        medicalRecordService.update(
+                                id,
+                                request.title(),
+                                request.description(),
+                                currentUser
+                        )
+                )
+        );
+    }
+
+    // PUT /api/medical-records/{id}/assign-vet
+    @PutMapping("/{id}/assign-vet")
+    @Transactional
+    public ResponseEntity<MedicalRecordResponse> assignVet(
+            @PathVariable UUID id,
+            @Valid @RequestBody AssignVetRequest request,
+            @AuthenticationPrincipal User currentUser) {
+
+        MedicalRecord record = medicalRecordService.getById(id);
+        User vetToAssign = userService.getById(request.vetId());
+        medicalRecordPolicy.canAssignVet(currentUser, record, vetToAssign);
+
+        return ResponseEntity.ok(
+                MedicalRecordResponse.from(
+                        medicalRecordService.assignVet(id, vetToAssign, currentUser)
+                )
+        );
+    }
+
+    // PUT /api/medical-records/{id}/status
+    @PutMapping("/{id}/status")
+    @Transactional
+    public ResponseEntity<MedicalRecordResponse> updateStatus(
+            @PathVariable UUID id,
+            @Valid @RequestBody UpdateStatusRequest request,
+            @AuthenticationPrincipal User currentUser) {
+
+        MedicalRecord record = medicalRecordService.getById(id);
+        medicalRecordPolicy.canUpdateStatus(currentUser, record, request.status());
+
+        return ResponseEntity.ok(
+                MedicalRecordResponse.from(
+                        medicalRecordService.updateStatus(
+                                id,
+                                request.status(),
+                                currentUser
+                        )
+                )
+        );
+    }
+
+    // PUT /api/medical-records/{id}/close
+    @PutMapping("/{id}/close")
+    @Transactional
+    public ResponseEntity<MedicalRecordResponse> close(
+            @PathVariable UUID id,
+            @AuthenticationPrincipal User currentUser) {
+
+        MedicalRecord record = medicalRecordService.getById(id);
+        medicalRecordPolicy.canClose(currentUser, record);
+
+        return ResponseEntity.ok(
+                MedicalRecordResponse.from(
+                        medicalRecordService.close(id, currentUser)
+                )
+        );
+    }
+}

src/main/java/org/example/vet1177/policy/MedicalRecordPolicy.java

@@ -70,6 +70,16 @@ public void canUpdateStatus(User user, MedicalRecord record, RecordStatus newSta
         }
     }
 
+
+    public boolean isAllowed(User user, MedicalRecord record) {
+        return switch (user.getRole()) {
+            case OWNER -> user.getId().equals(record.getOwner().getId());
+            case VET   -> user.getClinic() != null &&
+                    user.getClinic().getId().equals(record.getClinic().getId());
+            case ADMIN -> true;
+        };
+    }
+
     public void canAssignVet(User user, MedicalRecord record, User vetToAssign) {
         switch (user.getRole()) {
             case OWNER ->

src/main/java/org/example/vet1177/services/MedicalRecordService.java

@@ -3,7 +3,10 @@
 import org.example.vet1177.entities.*;
 import org.example.vet1177.exception.BusinessRuleException;
 import org.example.vet1177.exception.ResourceNotFoundException;
+import org.example.vet1177.policy.MedicalRecordPolicy;
+import org.example.vet1177.repository.ClinicRepository;
 import org.example.vet1177.repository.MedicalRecordRepository;
+import org.example.vet1177.repository.PetRepository;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -16,28 +19,44 @@
 public class MedicalRecordService {
 
     private final MedicalRecordRepository medicalRecordRepository;
-
-    public MedicalRecordService(MedicalRecordRepository medicalRecordRepository) {
+    private final PetRepository petRepository;
+    private final ClinicRepository clinicRepository;
+    private final MedicalRecordPolicy medicalRecordPolicy;
+
+    public MedicalRecordService(MedicalRecordRepository medicalRecordRepository,
+                                PetRepository petRepository,
+                                ClinicRepository clinicRepository,
+                                MedicalRecordPolicy medicalRecordPolicy) {
         this.medicalRecordRepository = medicalRecordRepository;
+        this.petRepository = petRepository;
+        this.clinicRepository = clinicRepository;
+        this.medicalRecordPolicy = medicalRecordPolicy;
     }
 
     // ── Skapa ────────────────────────────────────────────────
 
     public MedicalRecord create(
             String title,
             String description,
-            Pet pet,
-            User owner,
-            Clinic clinic,
-            User createdBy) {
+            UUID petId,
+            UUID clinicId,
+            User currentUser) {
+
+        Pet pet = petRepository.findById(petId)
+                .orElseThrow(() -> new ResourceNotFoundException("Pet", petId));
+
+        Clinic clinic = clinicRepository.findById(clinicId)
+                .orElseThrow(() -> new ResourceNotFoundException("Clinic", clinicId));
+
+        medicalRecordPolicy.canCreate(currentUser, pet, clinic);
 
         MedicalRecord record = new MedicalRecord();
         record.setTitle(title);
         record.setDescription(description);
         record.setPet(pet);
-        record.setOwner(owner);
+        record.setOwner(pet.getOwner());  // ← hämtas från pet
         record.setClinic(clinic);
-        record.setCreatedBy(createdBy);
+        record.setCreatedBy(currentUser);
         record.setStatus(RecordStatus.OPEN);
 
         return medicalRecordRepository.save(record);
@@ -71,12 +90,30 @@ public List<MedicalRecord> getByClinicAndStatus(UUID clinicId, RecordStatus stat
         return medicalRecordRepository.findByClinicIdAndStatus(clinicId, status);
     }
 
+    @Transactional(readOnly = true)
+    public List<MedicalRecord> getByPetAllowedForUser(UUID petId, User currentUser) {
+        List<MedicalRecord> all = medicalRecordRepository.findByPetId(petId);
+
+        return all.stream()
+                .filter(record -> medicalRecordPolicy.isAllowed(currentUser, record))
+                .toList();
+    }
+
+    @Transactional(readOnly = true)
+    public List<MedicalRecord> getByOwnerAllowedForUser(UUID ownerId, User currentUser) {
+        List<MedicalRecord> all = medicalRecordRepository.findByOwnerId(ownerId);
+
+        return all.stream()
+                .filter(record -> medicalRecordPolicy.isAllowed(currentUser, record))
+                .toList();
+    }
+
     // ── Uppdatera ─────────────────────────────────────────────
 
     public MedicalRecord update(UUID id, String title, String description, User updatedBy) {
         MedicalRecord record = getById(id);
 
-        if (record.getStatus().isFinal()) {                                               // ← mellan rad 75-76
+        if (record.getStatus().isFinal()) {
             throw new BusinessRuleException("Stängda ärenden kan inte uppdateras");
         }
 
@@ -86,16 +123,29 @@ public MedicalRecord update(UUID id, String title, String description, User upda
         return medicalRecordRepository.save(record);
     }
 
-    public MedicalRecord assignVet(UUID recordId, User vet, User updatedBy) {
+    public MedicalRecord assignVet(UUID recordId, User vetToAssign, User updatedBy) {
         MedicalRecord record = getById(recordId);
-        record.setAssignedVet(vet);
+        if (record.getStatus().isFinal()) {
+            throw new BusinessRuleException(
+                    "Kan inte tilldela handläggare till ett stängt ärende");
+        }
+
+        if (vetToAssign.getRole() != Role.VET) {
+            throw new BusinessRuleException(
+                    "Endast veterinärer kan tilldelas som handläggare");
+        }
+
+        record.setAssignedVet(vetToAssign);
         record.setStatus(RecordStatus.IN_PROGRESS);
         record.setUpdatedBy(updatedBy);
         return medicalRecordRepository.save(record);
     }
 
     public MedicalRecord updateStatus(UUID recordId, RecordStatus newStatus, User updatedBy) {
         MedicalRecord record = getById(recordId);
+
+        if (record.getStatus().isFinal()) {
+            throw new BusinessRuleException("Stängda ärenden kan inte ändras");}
         record.setStatus(newStatus);
         record.setUpdatedBy(updatedBy);
 
@@ -121,4 +171,8 @@ public MedicalRecord close(UUID recordId, User closedBy) {
 
         return medicalRecordRepository.save(record);
     }
+
+    public MedicalRecord save(MedicalRecord record) {
+        return medicalRecordRepository.save(record);
+    }
 }