Files
hms/crates/erp-health/src/handler/appointment_handler.rs
iven 1d1f01df81 feat(health): 为所有 DTO 添加 sanitize 防止存储型 XSS
覆盖 patient/health_data/appointment/follow_up/consultation/doctor
6 个 DTO 模块共 14 个请求结构体,在 handler 层统一调用 sanitize。
2026-04-25 00:04:25 +08:00

200 lines
6.1 KiB
Rust

use axum::Extension;
use axum::extract::{FromRef, Json, Path, Query, State};
use serde::Deserialize;
use utoipa::IntoParams;
use uuid::Uuid;
use erp_core::error::AppError;
use erp_core::rbac::require_permission;
use erp_core::types::{ApiResponse, PaginatedResponse, TenantContext};
use crate::dto::appointment_dto::*;
use crate::service::appointment_service;
use crate::state::HealthState;
#[derive(Debug, Deserialize, IntoParams)]
pub struct AppointmentListParams {
pub page: Option<u64>,
pub page_size: Option<u64>,
pub status: Option<String>,
pub patient_id: Option<Uuid>,
pub doctor_id: Option<Uuid>,
pub date: Option<chrono::NaiveDate>,
}
#[derive(Debug, Deserialize, IntoParams)]
pub struct ScheduleListParams {
pub page: Option<u64>,
pub page_size: Option<u64>,
pub doctor_id: Option<Uuid>,
pub date: Option<chrono::NaiveDate>,
}
#[derive(Debug, Deserialize, IntoParams)]
pub struct CalendarViewParams {
pub start_date: chrono::NaiveDate,
pub end_date: chrono::NaiveDate,
pub doctor_id: Option<Uuid>,
}
#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
pub struct UpdateScheduleWithVersion {
#[serde(flatten)]
pub data: UpdateScheduleReq,
pub version: i32,
}
#[derive(Debug, serde::Deserialize, utoipa::ToSchema)]
pub struct UpdateAppointmentStatusWithVersion {
pub status: String,
pub cancel_reason: Option<String>,
pub version: i32,
}
pub async fn list_appointments<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Query(params): Query<AppointmentListParams>,
) -> Result<Json<ApiResponse<PaginatedResponse<AppointmentResp>>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.list")?;
let page = params.page.unwrap_or(1);
let page_size = params.page_size.unwrap_or(20);
let result = appointment_service::list_appointments(
&state, ctx.tenant_id, page, page_size, params.status, params.patient_id,
params.doctor_id, params.date,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn create_appointment<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Json(req): Json<CreateAppointmentReq>,
) -> Result<Json<ApiResponse<AppointmentResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.manage")?;
let mut req = req;
req.sanitize();
let result = appointment_service::create_appointment(
&state, ctx.tenant_id, Some(ctx.user_id), req,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn get_appointment<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Path(id): Path<Uuid>,
) -> Result<Json<ApiResponse<AppointmentResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.list")?;
let result = appointment_service::get_appointment(&state, ctx.tenant_id, id).await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn update_appointment_status<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Path(id): Path<Uuid>,
Json(req): Json<UpdateAppointmentStatusWithVersion>,
) -> Result<Json<ApiResponse<AppointmentResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.manage")?;
let mut update_req = UpdateAppointmentStatusReq {
status: req.status,
cancel_reason: req.cancel_reason,
};
update_req.sanitize();
let result = appointment_service::update_appointment_status(
&state, ctx.tenant_id, id, Some(ctx.user_id), update_req, req.version,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn list_schedules<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Query(params): Query<ScheduleListParams>,
) -> Result<Json<ApiResponse<PaginatedResponse<ScheduleResp>>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.list")?;
let page = params.page.unwrap_or(1);
let page_size = params.page_size.unwrap_or(20);
let result = appointment_service::list_schedules(
&state, ctx.tenant_id, page, page_size, params.doctor_id, params.date,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn create_schedule<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Json(req): Json<CreateScheduleReq>,
) -> Result<Json<ApiResponse<ScheduleResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.manage")?;
let result = appointment_service::create_schedule(
&state, ctx.tenant_id, Some(ctx.user_id), req,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn update_schedule<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Path(id): Path<Uuid>,
Json(req): Json<UpdateScheduleWithVersion>,
) -> Result<Json<ApiResponse<ScheduleResp>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.manage")?;
let result = appointment_service::update_schedule(
&state, ctx.tenant_id, id, Some(ctx.user_id), req.data, req.version,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}
pub async fn calendar_view<S>(
State(state): State<HealthState>,
Extension(ctx): Extension<TenantContext>,
Query(params): Query<CalendarViewParams>,
) -> Result<Json<ApiResponse<Vec<CalendarDayResp>>>, AppError>
where
HealthState: FromRef<S>,
S: Clone + Send + Sync + 'static,
{
require_permission(&ctx, "health.appointment.list")?;
let result = appointment_service::calendar_view(
&state, ctx.tenant_id, params.start_date, params.end_date, params.doctor_id,
)
.await?;
Ok(Json(ApiResponse::ok(result)))
}