Files
hms/crates/erp-health/src/handler/appointment_handler.rs
iven 2e9eb55f2c
Some checks failed
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
fix(health): 修复审计发现的 10 个 CRITICAL 问题
权限与安全:
- 为全部 51 个 handler 端点添加 require_permission 权限检查
- 修复 CAS 预约操作中 doctor_id 为 None 时使用 Uuid::nil() 的问题

状态机修复:
- 预约初始状态从 "scheduled" 改为 "pending"(匹配设计规格)
- 排班状态从 "active" 改为 "enabled"
- 咨询会话添加 waiting→active 自动触发(首条消息时)
- 新增 create_session 端点和 DTO

数据完整性:
- doctor_profile 表添加 name 列(entity + migration + service)
- lab_report/health_trend 的 json 列改为 json_binary(支持 GIN 索引)
- 添加关键索引:patient.id_number UNIQUE、patient_tag UNIQUE、
  doctor_schedule 唯一排班槽位、health_trend、doctor_profile.name
- 随访记录完成后自动检查 next_follow_up_date 创建后续任务

事件总线:
- 实现 10 种核心事件发布(patient/appointment/follow_up/consultation/lab_report)
- 实现 workflow.task.completed 和 message.sent 事件订阅框架

种子数据:
- 实现 seed_tenant_health(8 个默认患者标签)
- 实现 soft_delete_tenant_data(16 张表级联软删除)
2026-04-23 23:25:53 +08:00

183 lines
5.6 KiB
Rust

use axum::Extension;
use axum::extract::{FromRef, Json, Path, Query, State};
use serde::Deserialize;
use utoipa::IntoParams;
use uuid::Uuid;
use erp_core::error::AppError;
use erp_core::rbac::require_permission;
use erp_core::types::{ApiResponse, PaginatedResponse, TenantContext};
use crate::dto::appointment_dto::*;
use crate::service::appointment_service;
use crate::state::HealthState;
#[derive(Debug, Deserialize, IntoParams)]
pub struct AppointmentListParams {
pub page: Option<u64>,
pub page_size: Option<u64>,
pub status: Option<String>,
pub patient_id: Option<Uuid>,
pub doctor_id: Option<Uuid>,
pub date: Option<chrono::NaiveDate>,
}
#[derive(Debug, Deserialize, IntoParams)]
pub struct ScheduleListParams {
pub page: Option<u64>,
pub page_size: Option<u64>,
pub doctor_id: Option<Uuid>,
pub date: Option<chrono::NaiveDate>,
}
#[derive(Debug, Deserialize, IntoParams)]
pub struct CalendarViewParams {
pub start_date: chrono::NaiveDate,
pub end_date: chrono::NaiveDate,
pub doctor_id: Option<Uuid>,
}
#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
pub struct UpdateScheduleWithVersion {
#[serde(flatten)]
pub data: UpdateScheduleReq,
pub version: i32,
}
#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
pub struct UpdateAppointmentStatusWithVersion {
pub status: String,
pub cancel_reason: Option<String>,
pub version: i32,
}
pub async fn list_appointments<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Query(params): Query<AppointmentListParams>,
) -> Result<Json<ApiResponse<PaginatedResponse<AppointmentResp>>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.list")?;
let page = params.page.unwrap_or(1);
let page_size = params.page_size.unwrap_or(20);
let result = appointment_service::list_appointments(
&state, ctx.tenant_id, page, page_size, params.status, params.patient_id,
params.doctor_id, params.date,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn create_appointment<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Json(req): Json<CreateAppointmentReq>,
) -> Result<Json<ApiResponse<AppointmentResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.manage")?;
let result = appointment_service::create_appointment(
&state, ctx.tenant_id, Some(ctx.user_id), req,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn update_appointment_status<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Path(id): Path<Uuid>,
Json(req): Json<UpdateAppointmentStatusWithVersion>,
) -> Result<Json<ApiResponse<AppointmentResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.manage")?;
let update_req = UpdateAppointmentStatusReq {
status: req.status,
cancel_reason: req.cancel_reason,
};
let result = appointment_service::update_appointment_status(
&state, ctx.tenant_id, id, Some(ctx.user_id), update_req, req.version,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn list_schedules<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Query(params): Query<ScheduleListParams>,
) -> Result<Json<ApiResponse<PaginatedResponse<ScheduleResp>>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.list")?;
let page = params.page.unwrap_or(1);
let page_size = params.page_size.unwrap_or(20);
let result = appointment_service::list_schedules(
&state, ctx.tenant_id, page, page_size, params.doctor_id, params.date,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn create_schedule<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Json(req): Json<CreateScheduleReq>,
) -> Result<Json<ApiResponse<ScheduleResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.manage")?;
let result = appointment_service::create_schedule(
&state, ctx.tenant_id, Some(ctx.user_id), req,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn update_schedule<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Path(id): Path<Uuid>,
Json(req): Json<UpdateScheduleWithVersion>,
) -> Result<Json<ApiResponse<ScheduleResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.manage")?;
let result = appointment_service::update_schedule(
&state, ctx.tenant_id, id, Some(ctx.user_id), req.data, req.version,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn calendar_view<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Query(params): Query<CalendarViewParams>,
) -> Result<Json<ApiResponse<Vec<CalendarDayResp>>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.list")?;
let result = appointment_service::calendar_view(
&state, ctx.tenant_id, params.start_date, params.end_date, params.doctor_id,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}