fix (encounter): add guard for create, delete and cancel

internal/use-case/main-use-case/authentication/case.go

@@ -205,7 +205,7 @@ func ExtractToken(r *http.Request, tokenType TokenType) (data *pa.AuthInfo, err
 			User_Name: fmt.Sprintf("%v", claims["user_name"]),
 		}
 
-		data.User_ContractPosition_code = checkStrClaims(claims, "contractPosition_code")
+		data.User_ContractPosition_Code = checkStrClaims(claims, "contractPosition_code")
 		data.Employee_Position_Code = checkStrPtrClaims(claims, "employee_position_code")
 		data.Doctor_Code = checkStrPtrClaims(claims, "doctor_code")
 		data.Nurse_Code = checkStrPtrClaims(claims, "nurse_code")

internal/use-case/main-use-case/encounter/case.go

@@ -16,10 +16,10 @@ import (
 
 	erc "simrs-vx/internal/domain/references/common"
 	ere "simrs-vx/internal/domain/references/encounter"
+	erg "simrs-vx/internal/domain/references/organization"
 
 	eaeh "simrs-vx/internal/domain/main-entities/adm-employee-hist"
 	edc "simrs-vx/internal/domain/main-entities/death-cause"
-	eem "simrs-vx/internal/domain/main-entities/employee"
 	e "simrs-vx/internal/domain/main-entities/encounter"
 	eir "simrs-vx/internal/domain/main-entities/internal-reference"
 	erdh "simrs-vx/internal/domain/main-entities/responsible-doctor-hist"
@@ -27,7 +27,6 @@ import (
 
 	uaeh "simrs-vx/internal/use-case/main-use-case/adm-employee-hist"
 	udc "simrs-vx/internal/use-case/main-use-case/death-cause"
-	uem "simrs-vx/internal/use-case/main-use-case/employee"
 	uir "simrs-vx/internal/use-case/main-use-case/internal-reference"
 	urdh "simrs-vx/internal/use-case/main-use-case/responsible-doctor-hist"
 )
@@ -79,6 +78,19 @@ func Create(input e.CreateDto) (*d.Data, error) {
 		}
 	}
 
+	// check only user with registration position is allowed to create encounter
+	if input.AuthInfo.User_ContractPosition_Code != string(erg.EPCReg) {
+		event.Status = "failed"
+		event.ErrInfo = pl.ErrorInfo{
+			Code:   "auth-forbidden",
+			Detail: "user position is not allowed, only user with registration position is allowed to create encounter",
+			Raw:    errors.New("authentication failed"),
+		}
+		return nil, pl.SetLogError(&event, input)
+	} else {
+		input.Adm_Employee_Id = input.AuthInfo.Employee_Id
+	}
+
 	// check if patient is new in the hospital
 	input.NewStatus, err = identifyPatientStatus(input)
 
@@ -90,12 +102,6 @@ func Create(input e.CreateDto) (*d.Data, error) {
 			return err
 		}
 
-		if emp, err := uem.ReadDetailData(eem.ReadDetailDto{User_Id: &input.AuthInfo.User_Id}, &event, tx); err != nil {
-			return err
-		} else {
-			input.Adm_Employee_Id = &emp.Id
-		}
-
 		// create encounter
 		if resData, err := CreateData(input, &event, tx); err != nil {
 			return err
@@ -322,6 +328,17 @@ func Delete(input e.DeleteDto) (*d.Data, error) {
 	// Start log
 	pl.SetLogInfo(&event, input, "started", "delete")
 
+	// check only user with registration position is allowed to create encounter
+	if input.AuthInfo.User_ContractPosition_Code != string(erg.EPCReg) {
+		event.Status = "failed"
+		event.ErrInfo = pl.ErrorInfo{
+			Code:   "auth-forbidden",
+			Detail: "user position is not allowed, only user with registration position is allowed to create encounter",
+			Raw:    errors.New("authentication failed"),
+		}
+		return nil, pl.SetLogError(&event, input)
+	}
+
 	err = dg.I.Transaction(func(tx *gorm.DB) error {
 		pl.SetLogInfo(&event, rdDto, "started", "DBReadDetail")
 		if data, err = ReadDetailData(rdDto, &event, tx); err != nil {
@@ -494,6 +511,21 @@ func UpdateStatusCode(input e.UpdateStatusDto) (*d.Data, error) {
 			// TODO: Prevent cancellation if the billing has been verified
 
 			// TODO: Only "supervisi pendaftaran" could cancel encounter
+			roleAllowedToCancel := []string{
+				string(erg.EPCReg),
+				string(erg.EPCNur),
+				string(erg.EPCDoc),
+			}
+
+			if !pu.Contains(roleAllowedToCancel, input.AuthInfo.User_ContractPosition_Code) {
+				event.Status = "failed"
+				event.ErrInfo = pl.ErrorInfo{
+					Code:   "auth-forbidden",
+					Detail: "user position is not allowed, only user with registration, nurse, or doctor position is allowed to cancel encounter",
+					Raw:    errors.New("authentication failed"),
+				}
+				return pl.SetLogError(&event, input)
+			}
 
 			// Prevent cancellation if soapi exist
 			encounterId := uint(input.Id)