hamid
2.7 KiB
Phase 14 — Partner / business-center accounts
Blocker: blockers.md § "Partner / business-center accounts." Largest single phase in this folder — mostly new server surface. Depends on: nothing structurally, but exercising it end-to-end benefits from 01-admin-rbac.md for the staff-authorized paths.
Two distinct sub-issues.
14a. No real "which center am I" resolution
client/src/services/partnerCenter/constants.ts:10,13 —
USE_PARTNER_MOCK = true, MOCK_MY_CENTER_ID = 1 — every signed-in caller gets center #1. The "real" path
(clientApi.ts:105, GET centers/me) targets a route that doesn't exist anywhere server-side. The only
partner portal route is GET centers/{id}/dashboard (CentersController.cs:16-26), which requires already
knowing the id — it authorizes, but never resolves one. IPartnerCenterRepository has no reverse
userId → centerId lookup at all.
Fix: add a reverse lookup to IPartnerCenterRepository (the join shape already exists in
GetDashboardAsync, PartnerCenterRepository.cs:114-144), a GetMyPartnerCenterQuery keyed off
ICurrentUser.UserId, and GET api/v1/centers/me on CentersController.
Flag: should this same signal also close the separately-tracked REQ-038 (surfacing "you administer a
center" on /me so nav/routing can auto-detect the role)? Product call, not required for the fix itself.
14b. Booking list and settlement report have zero server endpoint
Confirmed by exhaustive search — no
query/command exists anywhere for "list a center's sponsored bookings" or "list a center's settlement
invoices." The only thing that exists is bare counts on CenterDashboardDto. There's no invoice list
capability anywhere in the codebase (only a single-by-booking-id read), and even that single read
(GetInvoiceQuery.Handler.cs:25-27) authorizes only Admin or the booking's own customer — a center owner
reading its own issued invoice currently 404s. The client is fully built against these phantom routes
(partner/bookings/page.tsx, partner/settlement/page.tsx — real, complete UIs with nothing to call).
Fix: new ListSponsoredBookingsQuery (join Booking → NurseProfile.PartnerCenterId) and
ListCenterInvoicesQuery (Invoice.PartnerCenterId == centerId), each authorized like
GetCenterDashboardQuery (owning admin or staff), routed under centers/me/bookings and
centers/me/settlement to match what the client already expects.
Flag, don't guess: should a non-merchant-of-record center (settlement runs through Balinyaar) get read
access to platform-issued invoices for its sponsored bookings? The client already UI-special-cases this
(settlement_not_mor state) but the data question isn't answered anywhere in mvp//archive/product/.