patient:profile management

Author: linasliyakath

api-gateway/src/app.ts

@@ -25,8 +25,18 @@ app.use('/health', healthRoutes);
 app.use('/patients/public', patientAuthProxy);
 
 // PATIENT self routes
-app.use('/patients', authenticate, requirePatientSelf, patientDataProxy);
-
+app.use(
+  '/patients',
+  authenticate,
+  requirePatientSelf,
+  (req: any, _res, next) => {
+    if (req.user?.sub) {
+      req.headers['x-user-id'] = String(req.user.sub);
+    }
+    next();
+  },
+  patientDataProxy
+);
 // STAFF auth
 app.use('/staff/public', staffAuthProxy);
 app.use('/staff', authenticate, staffDataRouter);

api-gateway/src/middlewares/patient.guard.ts

@@ -10,13 +10,22 @@ export function requirePatientSelf(
     return res.status(401).json({ error: 'Unauthorized' });
   }
 
-  // URL will be /:id after /patients is stripped
   const patientIdFromPath = req.path.split('/')[1];
 
   if (!patientIdFromPath) {
     return res.status(400).json({ error: 'Invalid patient path' });
   }
 
+  /**
+   * Allow /patients/me directly
+   */
+  if (patientIdFromPath === 'me') {
+    return next();
+  }
+
+  /**
+   * Protect /patients/:id
+   */
   if (req.user.sub !== patientIdFromPath) {
     return res.status(403).json({ error: 'Access denied' });
   }