Merge branch 'linas' into dev

Author: linasliyakath

api-gateway/src/app.ts

@@ -4,13 +4,18 @@ import healthRoutes from './routes/health';
 import { patientAuthProxy } from './proxy/patient.auth.proxy';
 import { patientDataProxy } from './proxy/patient.data.proxy';
 import { staffAuthProxy } from './proxy/staff.auth.proxy';
-import { staffDataProxy } from './proxy/staff.data.proxy';
+// import { staffDataProxy } from './proxy/staff.data.proxy';
+import staffDataRouter from './routes/staff.data.router';
 import { authenticate } from './middlewares/auth.middleware';
 import { requirePatientSelf } from './middlewares/patient.guard';
 
 const app = express();
-
-app.use(cors());
+app.use(
+  cors({
+    origin: 'http://localhost:3000',
+    credentials: true,
+  })
+);
 
 // health
 app.use('/health', healthRoutes);
@@ -21,6 +26,6 @@ app.use('/patients/public', patientAuthProxy);
 app.use('/patients', authenticate, requirePatientSelf, patientDataProxy);
 
 app.use('/staff/public', staffAuthProxy);
-app.use('/staff', authenticate, staffDataProxy);
+app.use('/staff', authenticate, staffDataRouter);
 
 export default app;

api-gateway/src/middlewares/rbac.middleware.ts

@@ -0,0 +1,29 @@
+import { Response, NextFunction } from 'express';
+import { AuthenticatedRequest } from './auth.middleware';
+
+// what actions exist in the system
+export type Permission = 'CREATE_STAFF' | 'UPDATE_STAFF' | 'DEACTIVATE_STAFF';
+
+// staff role → permissions
+const STAFF_ROLE_PERMISSIONS: Record<string, Permission[]> = {
+  DOCTOR: [],
+  NURSE: [],
+};
+
+export function requirePermission(permission: Permission) {
+  return (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+    const user = req.user;
+
+    if (!user) {
+      return res.status(401).json({ error: 'Unauthorized' });
+    }
+
+    // ✅ ADMIN can do everything
+    if (user.type === 'ADMIN') {
+      return next();
+    }
+
+    // ❌ STAFF cannot do admin actions
+    return res.status(403).json({ error: 'Forbidden' });
+  };
+}

api-gateway/src/routes/staff.data.router.ts

@@ -0,0 +1,13 @@
+import express from 'express';
+import { requirePermission } from '../middlewares/rbac.middleware';
+import { staffDataProxy } from '../proxy/staff.data.proxy';
+
+const router = express.Router();
+
+// 🔒 ADMIN ONLY: create staff
+router.post('/', requirePermission('CREATE_STAFF'), staffDataProxy);
+
+// everything else just passes through
+router.use(staffDataProxy);
+
+export default router;

frontend/.gitignore

@@ -0,0 +1,41 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/versions
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# env files (can opt-in for committing if needed)
+.env*
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+next-env.d.ts

frontend/.gitkeep

@@ -0,0 +1,36 @@
+This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app).
+
+## Getting Started
+
+First, run the development server:
+
+```bash
+npm run dev
+# or
+yarn dev
+# or
+pnpm dev
+# or
+bun dev
+```
+
+Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
+
+You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file.
+
+This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel.
+
+## Learn More
+
+To learn more about Next.js, take a look at the following resources:
+
+- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
+- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.
+
+You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome!
+
+## Deploy on Vercel
+
+The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.
+
+Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details.

frontend/README.md

@@ -0,0 +1,18 @@
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextVitals from "eslint-config-next/core-web-vitals";
+import nextTs from "eslint-config-next/typescript";
+
+const eslintConfig = defineConfig([
+  ...nextVitals,
+  ...nextTs,
+  // Override default ignores of eslint-config-next.
+  globalIgnores([
+    // Default ignores of eslint-config-next:
+    ".next/**",
+    "out/**",
+    "build/**",
+    "next-env.d.ts",
+  ]),
+]);
+
+export default eslintConfig;

frontend/eslint.config.mjs

@@ -0,0 +1,7 @@
+import type { NextConfig } from 'next';
+
+const nextConfig: NextConfig = {
+  /* config options here */
+};
+
+export default nextConfig;

frontend/next.config.ts

@@ -0,0 +1,28 @@
+{
+  "name": "frontend",
+  "version": "0.1.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build",
+    "start": "next start",
+    "lint": "eslint"
+  },
+  "dependencies": {
+    "axios": "^1.13.5",
+    "next": "16.1.6",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@tailwindcss/postcss": "^4",
+    "@types/node": "^20",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "eslint": "^9",
+    "eslint-config-next": "16.1.6",
+    "tailwindcss": "^4",
+    "typescript": "^5"
+  }
+}