hamid
46 lines
2.7 KiB
Markdown
46 lines
2.7 KiB
Markdown
# Phase 14 — Partner / business-center accounts
|
|
|
|
**Blocker:** blockers.md § "Partner / business-center accounts." Largest single phase in this folder — mostly
|
|
new server surface.
|
|
**Depends on:** nothing structurally, but exercising it end-to-end benefits from
|
|
[01-admin-rbac.md](01-admin-rbac.md) for the staff-authorized paths.
|
|
|
|
---
|
|
|
|
Two distinct sub-issues.
|
|
|
|
## 14a. No real "which center am I" resolution
|
|
|
|
`client/src/services/partnerCenter/constants.ts:10,13` —
|
|
`USE_PARTNER_MOCK = true`, `MOCK_MY_CENTER_ID = 1` — every signed-in caller gets center #1. The "real" path
|
|
(`clientApi.ts:105`, `GET centers/me`) targets a route that **doesn't exist anywhere server-side.** The only
|
|
partner portal route is `GET centers/{id}/dashboard` (`CentersController.cs:16-26`), which requires already
|
|
knowing the id — it authorizes, but never resolves one. `IPartnerCenterRepository` has no reverse
|
|
`userId → centerId` lookup at all.
|
|
|
|
**Fix:** add a reverse lookup to `IPartnerCenterRepository` (the join shape already exists in
|
|
`GetDashboardAsync`, `PartnerCenterRepository.cs:114-144`), a `GetMyPartnerCenterQuery` keyed off
|
|
`ICurrentUser.UserId`, and `GET api/v1/centers/me` on `CentersController`.
|
|
|
|
**Flag:** should this same signal also close the separately-tracked REQ-038 (surfacing "you administer a
|
|
center" on `/me` so nav/routing can auto-detect the role)? Product call, not required for the fix itself.
|
|
|
|
## 14b. Booking list and settlement report have zero server endpoint
|
|
|
|
Confirmed by exhaustive search — no
|
|
query/command exists anywhere for "list a center's sponsored bookings" or "list a center's settlement
|
|
invoices." The only thing that exists is bare counts on `CenterDashboardDto`. There's no invoice *list*
|
|
capability anywhere in the codebase (only a single-by-booking-id read), and even that single read
|
|
(`GetInvoiceQuery.Handler.cs:25-27`) authorizes only `Admin` or the booking's own customer — a center owner
|
|
reading its own issued invoice currently 404s. The client is fully built against these phantom routes
|
|
(`partner/bookings/page.tsx`, `partner/settlement/page.tsx` — real, complete UIs with nothing to call).
|
|
|
|
**Fix:** new `ListSponsoredBookingsQuery` (join `Booking` → `NurseProfile.PartnerCenterId`) and
|
|
`ListCenterInvoicesQuery` (`Invoice.PartnerCenterId == centerId`), each authorized like
|
|
`GetCenterDashboardQuery` (owning admin or staff), routed under `centers/me/bookings` and
|
|
`centers/me/settlement` to match what the client already expects.
|
|
|
|
**Flag, don't guess:** should a non-merchant-of-record center (settlement runs through Balinyaar) get read
|
|
access to platform-issued invoices for its sponsored bookings? The client already UI-special-cases this
|
|
(`settlement_not_mor` state) but the data question isn't answered anywhere in `mvp/`/`archive/product/`.
|