mirror of
https://github.com/temetro/temetro.git
synced 2026-07-26 11:58:14 +00:00
Khalid Abdi
d096c4fe9d
Backend (new `invoice` RBAC resource, granted to clinicians + reception): - invoices table (line items + installments as JSONB), types, zod validation, service (CRUD + splitIntoInstallments + auto invoice numbers), org-scoped REST routes mounted at /api/invoices, activity logging (migration 0015) Frontend: - lib/invoices.ts API client + money/date helpers - /invoices page: list with KPIs and search, create/edit dialog (searchable patient combobox, inline line-item editor, live total), detail sheet to split a bill into equal monthly installments, delete, and Download PDF - dependency-free PDF via a print-styled window (browser "Save as PDF") - sidebar "Invoices" entry under the Patients group; "Added by AI" badge honored Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
115 lines
3.6 KiB
TypeScript
115 lines
3.6 KiB
TypeScript
import { createAccessControl } from "better-auth/plugins/access";
|
|
import {
|
|
adminAc,
|
|
memberAc,
|
|
ownerAc,
|
|
defaultStatements,
|
|
} from "better-auth/plugins/organization/access";
|
|
|
|
// Mirrors backend/src/lib/access.ts so the client's permission checks
|
|
// (organization.hasPermission / checkRolePermission) match the server.
|
|
export const statements = {
|
|
...defaultStatements,
|
|
patient: ["read", "write", "delete"],
|
|
appointment: ["read", "write", "delete"],
|
|
prescription: ["read", "write", "delete"],
|
|
invoice: ["read", "write", "delete"],
|
|
inventory: ["read", "write", "delete"],
|
|
task: ["read", "write", "delete"],
|
|
lab: ["read", "write"],
|
|
} as const;
|
|
|
|
export const ac = createAccessControl(statements);
|
|
|
|
// NOTE: `prescription: ["delete"]` doubles as the "full clinician" marker the
|
|
// route gating in lib/roles.ts probes (owner/admin/doctor/member only) — don't
|
|
// grant it to department roles like pharmacy.
|
|
export const owner = ac.newRole({
|
|
...ownerAc.statements,
|
|
patient: ["read", "write", "delete"],
|
|
appointment: ["read", "write", "delete"],
|
|
prescription: ["read", "write", "delete"],
|
|
invoice: ["read", "write", "delete"],
|
|
inventory: ["read", "write", "delete"],
|
|
task: ["read", "write", "delete"],
|
|
lab: ["read", "write"],
|
|
});
|
|
|
|
export const admin = ac.newRole({
|
|
...adminAc.statements,
|
|
patient: ["read", "write", "delete"],
|
|
appointment: ["read", "write", "delete"],
|
|
prescription: ["read", "write", "delete"],
|
|
invoice: ["read", "write", "delete"],
|
|
inventory: ["read", "write", "delete"],
|
|
task: ["read", "write", "delete"],
|
|
lab: ["read", "write"],
|
|
});
|
|
|
|
export const member = ac.newRole({
|
|
...memberAc.statements,
|
|
patient: ["read", "write"],
|
|
appointment: ["read", "write", "delete"],
|
|
prescription: ["read", "write", "delete"],
|
|
invoice: ["read", "write", "delete"],
|
|
inventory: ["read", "write", "delete"],
|
|
task: ["read", "write", "delete"],
|
|
lab: ["read", "write"],
|
|
});
|
|
|
|
// doctor (clinician): mirrors backend/src/lib/access.ts — same clinical access
|
|
// as `member`.
|
|
export const doctor = ac.newRole({
|
|
...memberAc.statements,
|
|
patient: ["read", "write"],
|
|
appointment: ["read", "write", "delete"],
|
|
prescription: ["read", "write", "delete"],
|
|
invoice: ["read", "write", "delete"],
|
|
inventory: ["read", "write", "delete"],
|
|
task: ["read", "write", "delete"],
|
|
lab: ["read", "write"],
|
|
});
|
|
|
|
// reception (front desk): scheduling + registration only, no clinical records.
|
|
export const reception = ac.newRole({
|
|
...memberAc.statements,
|
|
patient: ["read", "write"],
|
|
appointment: ["read", "write", "delete"],
|
|
invoice: ["read", "write", "delete"],
|
|
task: ["read", "write"],
|
|
});
|
|
|
|
// pharmacy (dispensing): read patients/appointments, read/write prescriptions
|
|
// (status updates, NOT delete), and work the task queue.
|
|
export const pharmacy = ac.newRole({
|
|
...memberAc.statements,
|
|
patient: ["read"],
|
|
appointment: ["read"],
|
|
prescription: ["read", "write"],
|
|
inventory: ["read", "write"],
|
|
task: ["read", "write"],
|
|
});
|
|
|
|
// lab (analyses): submits lab results via the dedicated `lab` statement (no
|
|
// patient:write) and works the lab task queue. No prescription statement.
|
|
export const lab = ac.newRole({
|
|
...memberAc.statements,
|
|
patient: ["read"],
|
|
appointment: ["read"],
|
|
task: ["read", "write"],
|
|
lab: ["read", "write"],
|
|
});
|
|
|
|
export const roles = { owner, admin, doctor, reception, pharmacy, lab, member };
|
|
|
|
// Human-readable labels for the role keys used in the UI.
|
|
export const ROLE_LABELS: Record<keyof typeof roles, string> = {
|
|
owner: "Owner",
|
|
admin: "Admin",
|
|
doctor: "Doctor",
|
|
reception: "Reception",
|
|
pharmacy: "Pharmacy",
|
|
lab: "Lab",
|
|
member: "Clinician",
|
|
};
|