refactor: update referrals auth, routes, fix facility filtering

- relocate referrals controller to /health-worker/referrals route and enable JWT auth guard
- extract facility ID from authenticated health worker's user session instead of query params
- fix referral service queries to use correct fromFacilityId field instead of facilityId
- add missing facilityId field to referral creation data
- clean up formatting and indentation in health-worker service files
- fix trailing newline in health-worker controller file

src/health-worker/health-worker.controller.ts

@@ -126,4 +126,4 @@ export class HealthWorkerController {
       facilityId,
     );
   }
-}
+}

src/health-worker/health-worker.service.ts

@@ -16,19 +16,15 @@ export class HealthWorkerService {
     private readonly monitoringEngine: MonitoringEngineService,
   ) {}
 
-  async getDashboardStats(
-  facilityId: string,
-) {
-  const totalPatients =
-    await this.prisma.patient.count({
+  async getDashboardStats(facilityId: string) {
+    const totalPatients = await this.prisma.patient.count({
       where: {
         facilityId,
         isActive: true,
       },
     });
 
-  const highRiskPatients =
-    await this.prisma.patient.count({
+    const highRiskPatients = await this.prisma.patient.count({
       where: {
         facilityId,
         latestRiskLevel: {
@@ -37,16 +33,14 @@ export class HealthWorkerService {
       },
     });
 
-  const emergencyAlerts =
-    await this.prisma.alert.count({
+    const emergencyAlerts = await this.prisma.alert.count({
       where: {
         facilityId,
         isResolved: false,
       },
     });
 
-  const upcomingAppointments =
-    await this.prisma.appointment.count({
+    const upcomingAppointments = await this.prisma.appointment.count({
       where: {
         facilityId,
         status: "SCHEDULED",
@@ -56,21 +50,17 @@ export class HealthWorkerService {
       },
     });
 
-  const missedAppointments =
-    await this.prisma.appointment.count({
+    const missedAppointments = await this.prisma.appointment.count({
       where: {
         facilityId,
         status: "MISSED",
       },
     });
 
-  const sevenDaysAgo = new Date();
-  sevenDaysAgo.setDate(
-    sevenDaysAgo.getDate() - 7,
-  );
+    const sevenDaysAgo = new Date();
+    sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
 
-  const newRegistrations =
-    await this.prisma.patient.count({
+    const newRegistrations = await this.prisma.patient.count({
       where: {
         facilityId,
         createdAt: {
@@ -79,219 +69,201 @@ export class HealthWorkerService {
       },
     });
 
-  return {
-    totalPregnantWomen: totalPatients,
-    highRiskPatients,
-    emergencyAlerts,
-    upcomingAppointments,
-    missedAppointments,
-    newRegistrations,
-  };
-}
+    return {
+      totalPregnantWomen: totalPatients,
+      highRiskPatients,
+      emergencyAlerts,
+      upcomingAppointments,
+      missedAppointments,
+      newRegistrations,
+    };
+  }
 
   /**
    * Returns all patients across both registration paths:
    * - Health worker registered: sourced from Patient model
    * - Self-registered: sourced from UserAuth where role=PATIENT and no Patient record
    */
-  async getAllPatients(
-  facilityId: string,
-) {
-  return this.prisma.patient.findMany({
-    where: {
-      facilityId,
-      isActive: true,
-    },
-    include: {
-      facility: {
-        select: {
-          name: true,
-        },
+  async getAllPatients(facilityId: string) {
+    return this.prisma.patient.findMany({
+      where: {
+        facilityId,
+        isActive: true,
       },
-      userAuth: {
-        include: {
-          monitoringStateRecord: true,
-          bloodPressureReadings: {
-            orderBy: {
-              recordedAt: "desc",
-            },
-            take: 1,
+      include: {
+        facility: {
+          select: {
+            name: true,
           },
-          symptomRecords: {
-            orderBy: {
-              recordedAt: "desc",
+        },
+        userAuth: {
+          include: {
+            monitoringStateRecord: true,
+            bloodPressureReadings: {
+              orderBy: {
+                recordedAt: "desc",
+              },
+              take: 1,
+            },
+            symptomRecords: {
+              orderBy: {
+                recordedAt: "desc",
+              },
+              take: 1,
             },
-            take: 1,
           },
         },
       },
-    },
-    orderBy: {
-      createdAt: "desc",
-    },
-  });
-}
+      orderBy: {
+        createdAt: "desc",
+      },
+    });
+  }
 
-  async getHighRiskPatients(
-  facilityId: string,
-) {
-  return this.prisma.patient.findMany({
-    where: {
-      facilityId,
-      latestRiskLevel: {
-        in: [
-          "HIGH",
-          "EMERGENCY",
-        ],
+  async getHighRiskPatients(facilityId: string) {
+    return this.prisma.patient.findMany({
+      where: {
+        facilityId,
+        latestRiskLevel: {
+          in: ["HIGH", "EMERGENCY"],
+        },
       },
-    },
-    include: {
-      facility: true,
-      userAuth: {
-        include: {
-          monitoringStateRecord: true,
-          bloodPressureReadings: {
-            orderBy: {
-              recordedAt: "desc",
+      include: {
+        facility: true,
+        userAuth: {
+          include: {
+            monitoringStateRecord: true,
+            bloodPressureReadings: {
+              orderBy: {
+                recordedAt: "desc",
+              },
+              take: 1,
             },
-            take: 1,
           },
         },
       },
-    },
-    orderBy: {
-      updatedAt: "desc",
-    },
-  });
-}
+      orderBy: {
+        updatedAt: "desc",
+      },
+    });
+  }
 
-  async getEmergencyAlerts(
-  facilityId: string,
-) {
-  return this.prisma.alert.findMany({
-    where: {
-      facilityId,
-      isResolved: false,
-    },
-    include: {
-      patient: {
-        include: {
-          userAuth: {
-            include: {
-              monitoringStateRecord: true,
-              symptomRecords: {
-                orderBy: {
-                  recordedAt: "desc",
+  async getEmergencyAlerts(facilityId: string) {
+    return this.prisma.alert.findMany({
+      where: {
+        facilityId,
+        isResolved: false,
+      },
+      include: {
+        patient: {
+          include: {
+            userAuth: {
+              include: {
+                monitoringStateRecord: true,
+                symptomRecords: {
+                  orderBy: {
+                    recordedAt: "desc",
+                  },
+                  take: 5,
                 },
-                take: 5,
               },
             },
           },
         },
       },
-    },
-    orderBy: {
-      createdAt: "desc",
-    },
-  });
-}
+      orderBy: {
+        createdAt: "desc",
+      },
+    });
+  }
 
-  async getAppointments(
-  facilityId: string,
-) {
-  return this.prisma.appointment.findMany({
-    where: {
-      facilityId,
-    },
-    include: {
-      patient: true,
-      facility: true,
-      userAuth: {
-        select: {
-          email: true,
-          phone: true,
+  async getAppointments(facilityId: string) {
+    return this.prisma.appointment.findMany({
+      where: {
+        facilityId,
+      },
+      include: {
+        patient: true,
+        facility: true,
+        userAuth: {
+          select: {
+            email: true,
+            phone: true,
+          },
         },
       },
-    },
-    orderBy: {
-      dateTime: "asc",
-    },
-  });
-}
+      orderBy: {
+        dateTime: "asc",
+      },
+    });
+  }
 
- async getPatientById(
-  id: string,
-  facilityId: string,
-) {
-  return this.prisma.patient.findFirst({
-    where: {
-      id,
-      facilityId,
-    },
-    include: {
-      facility: true,
-      appointments: {
-        orderBy: {
-          dateTime: "desc",
-        },
+  async getPatientById(id: string, facilityId: string) {
+    return this.prisma.patient.findFirst({
+      where: {
+        id,
+        facilityId,
       },
-      ancVisits: {
-        orderBy: {
-          visitDate: "desc",
+      include: {
+        facility: true,
+        appointments: {
+          orderBy: {
+            dateTime: "desc",
+          },
         },
-      },
-      alerts: {
-        orderBy: {
-          createdAt: "desc",
+        ancVisits: {
+          orderBy: {
+            visitDate: "desc",
+          },
         },
-      },
-      referrals: true,
-      userAuth: {
-        include: {
-          profile: true,
-          monitoringStateRecord: true,
-          bloodPressureReadings: {
-            orderBy: {
-              recordedAt: "desc",
-            },
-            take: 20,
+        alerts: {
+          orderBy: {
+            createdAt: "desc",
           },
-          symptomRecords: {
-            orderBy: {
-              recordedAt: "desc",
+        },
+        referrals: true,
+        userAuth: {
+          include: {
+            profile: true,
+            monitoringStateRecord: true,
+            bloodPressureReadings: {
+              orderBy: {
+                recordedAt: "desc",
+              },
+              take: 20,
+            },
+            symptomRecords: {
+              orderBy: {
+                recordedAt: "desc",
+              },
+              take: 20,
             },
-            take: 20,
           },
         },
       },
-    },
-  });
-}
+    });
+  }
 
- async logPatientBP(
-  patientId: string,
-  facilityId: string,
-  systolic: number,
-  diastolic: number,
-) {
-  const patient =
-    await this.prisma.patient.findFirst({
+  async logPatientBP(
+    patientId: string,
+    facilityId: string,
+    systolic: number,
+    diastolic: number,
+  ) {
+    const patient = await this.prisma.patient.findFirst({
       where: {
         id: patientId,
         facilityId,
       },
     });
 
-  if (!patient) {
-    throw new NotFoundException(
-      "Patient not found",
-    );
-  }
+    if (!patient) {
+      throw new NotFoundException("Patient not found");
+    }
 
-  const userId = patient.userId;
+    const userId = patient.userId;
 
-  const previousReadings =
-    await this.prisma.bloodPressureReading.findMany({
+    const previousReadings = await this.prisma.bloodPressureReading.findMany({
       where: {
         userId,
       },
@@ -301,8 +273,7 @@ export class HealthWorkerService {
       take: 5,
     });
 
-  const reading =
-    await this.prisma.bloodPressureReading.create({
+    const reading = await this.prisma.bloodPressureReading.create({
       data: {
         userId,
         systolic,
@@ -310,63 +281,48 @@ export class HealthWorkerService {
       },
     });
 
-  const monitoringResult =
-    await this.monitoringEngine.evaluate(
-      userId,
-    );
-
-  const trend =
-    this.calculateTrend(
-      previousReadings,
-      systolic,
-      diastolic,
-    );
-
-  return {
-    reading,
-    monitoringResult,
-    trend,
-    pointOfCareAlert:
-      this.buildPointOfCareAlert(
+    const monitoringResult = await this.monitoringEngine.evaluate(userId);
+
+    const trend = this.calculateTrend(previousReadings, systolic, diastolic);
+
+    return {
+      reading,
+      monitoringResult,
+      trend,
+      pointOfCareAlert: this.buildPointOfCareAlert(
         systolic,
         diastolic,
         trend,
         monitoringResult.state,
       ),
-  };
-}
+    };
+  }
 
   /**
    * Resolve an emergency alert
    */
- async resolveAlert(
-  alertId: string,
-  facilityId: string,
-) {
-  const alert =
-    await this.prisma.alert.findFirst({
+  async resolveAlert(alertId: string, facilityId: string) {
+    const alert = await this.prisma.alert.findFirst({
       where: {
         id: alertId,
         facilityId,
       },
     });
 
-  if (!alert) {
-    throw new NotFoundException(
-      "Alert not found",
-    );
-  }
+    if (!alert) {
+      throw new NotFoundException("Alert not found");
+    }
 
-  return this.prisma.alert.update({
-    where: {
-      id: alertId,
-    },
-    data: {
-      isResolved: true,
-      resolvedAt: new Date(),
-    },
-  });
-}
+    return this.prisma.alert.update({
+      where: {
+        id: alertId,
+      },
+      data: {
+        isResolved: true,
+        resolvedAt: new Date(),
+      },
+    });
+  }
 
   /**
    * Calculate BP trend compared to previous readings
@@ -394,14 +350,12 @@ export class HealthWorkerService {
     const systolicChange = currentSystolic - lastReading.systolic;
     const diastolicChange = currentDiastolic - lastReading.diastolic;
 
-    const msAgo =
-      new Date().getTime() - new Date(lastReading.recordedAt).getTime();
+    const msAgo = new Date().getTime() - new Date(lastReading.recordedAt).getTime();
     const weeksAgo = Math.round(msAgo / (7 * 24 * 60 * 60 * 1000));
 
     let direction: "rising" | "falling" | "stable";
     if (systolicChange >= 5 || diastolicChange >= 5) direction = "rising";
-    else if (systolicChange <= -5 || diastolicChange <= -5)
-      direction = "falling";
+    else if (systolicChange <= -5 || diastolicChange <= -5) direction = "falling";
     else direction = "stable";
 
     return { systolicChange, diastolicChange, direction, weeksAgo };
@@ -427,9 +381,7 @@ export class HealthWorkerService {
         level: "emergency",
         title: "Severe Hypertension",
         message: `BP ${systolic}/${diastolic} mmHg — severely elevated.${
-          trend.systolicChange !== null
-            ? ` Rose ${trend.systolicChange} points since last visit.`
-            : ""
+          trend.systolicChange !== null ? ` Rose ${trend.systolicChange} points since last visit.` : ""
         }`,
         action:
           "Administer antihypertensive immediately. Do not discharge. Prepare for referral to higher facility.",
@@ -446,8 +398,7 @@ export class HealthWorkerService {
         level: "urgent",
         title: "Rising Blood Pressure",
         message: `BP ${systolic}/${diastolic} mmHg — elevated and rising ${trend.systolicChange} points in ${trend.weeksAgo} week(s).`,
-        action:
-          "Schedule follow-up within 48 hours. Review symptoms. Consider referral.",
+        action: "Schedule follow-up within 48 hours. Review symptoms. Consider referral.",
       };
     }
 
@@ -457,8 +408,7 @@ export class HealthWorkerService {
         level: "urgent",
         title: "Elevated Blood Pressure",
         message: `BP ${systolic}/${diastolic} mmHg — above normal threshold.`,
-        action:
-          "Recheck in 15 minutes. If still elevated, initiate high-risk protocol.",
+        action: "Recheck in 15 minutes. If still elevated, initiate high-risk protocol.",
       };
     }
 
@@ -467,9 +417,10 @@ export class HealthWorkerService {
       return {
         level: "warning",
         title: "Borderline — Watch Trend",
-        message: `BP ${systolic}/${diastolic} mmHg — borderline, rising ${trend.systolicChange ?? 0} points since last visit.`,
-        action:
-          "Increase monitoring frequency. Recheck at next visit in 2 weeks.",
+        message: `BP ${systolic}/${diastolic} mmHg — borderline, rising ${
+          trend.systolicChange ?? 0
+        } points since last visit.`,
+        action: "Increase monitoring frequency. Recheck at next visit in 2 weeks.",
       };
     }
 

src/referral/referral.controller.ts

@@ -5,44 +5,49 @@ import {
   Patch,
   Param,
   Body,
-  Query,
   UseGuards,
+  Req,
 } from "@nestjs/common";
+import { Request } from "express";
 import { ReferralsService,  UpdateReferralDto } from "./referral.service";
 import { CreateReferralDto } from "./dto/create-referral-dto";
-// import { JwtAuthGuard } from "../auth/guards/jwt-auth.guard";
-// import { RolesGuard } from "../auth/guards/roles.guard";
+import { JwtAuthGuard } from "../auth/guards/jwt-auth.guard";
 
-// @UseGuards(JwtAuthGuard, RolesGuard)
-@Controller("referrals")
+@Controller("health-worker/referrals")
+@UseGuards(JwtAuthGuard)
 export class ReferralsController {
   constructor(private readonly referralsService: ReferralsService) {}
 
-  /** POST /referrals */
+  /** POST /health-worker/referrals */
   @Post()
-  create(@Body() dto: CreateReferralDto, facilityId: string) {
+  create(@Body() dto: CreateReferralDto, @Req() req: Request & { user: any }) {
+    const facilityId = req.user.healthcareWorker?.facilityId;
     return this.referralsService.create(dto, facilityId);
   }
 
-  /** GET /referrals?facilityId=xxx */
+  /** GET /health-worker/referrals */
   @Get()
-  findAll(@Query("facilityId") facilityId?: string) {
+  findAll(@Req() req: Request & { user: any }) {
+    const facilityId = req.user.healthcareWorker?.facilityId;
     return this.referralsService.findAll(facilityId);
   }
 
-  /** GET /referrals/stats?facilityId=xxx */
+  /** GET /health-worker/referrals/stats */
   @Get("stats")
-  getStats(@Query("facilityId") facilityId?: string) {
+  getStats(@Req() req: Request & { user: any }) {
+    const facilityId = req.user.healthcareWorker?.facilityId;
     return this.referralsService.getReferralStats(facilityId);
   }
 
   @Get(":id")
-  findOne(@Param("id") id: string) {
-    return this.referralsService.findOne(id);
+  findOne(@Param("id") id: string, @Req() req: Request & { user: any }) {
+    const facilityId = req.user.healthcareWorker?.facilityId;
+    return this.referralsService.findOne(id, facilityId);
   }
 
   @Patch(":id/status")
-  updateStatus(@Param("id") id: string, @Body() dto: UpdateReferralDto) {
-    return this.referralsService.updateStatus(id, dto);
+  updateStatus(@Param("id") id: string, @Body() dto: UpdateReferralDto, @Req() req: Request & { user: any }) {
+    const facilityId = req.user.healthcareWorker?.facilityId;
+    return this.referralsService.updateStatus(id, dto, facilityId);
   }
 }

src/referral/referral.service.ts

@@ -38,6 +38,7 @@ export class ReferralsService {
         patientId: patient.id,
         fromFacilityId: facilityId,
         toFacilityId: dto.toFacilityId,
+        facilityId: facilityId,
         reason: dto.reason,
         notes: dto.notes,
       },
@@ -70,7 +71,7 @@ export class ReferralsService {
 
   async findAll(facilityId?: string) {
     return this.prisma.referral.findMany({
-      where: facilityId ? { facilityId } : undefined,
+      where: facilityId ? { fromFacilityId: facilityId } : undefined,
       include: {
         patient: {
           select: {
@@ -87,15 +88,18 @@ export class ReferralsService {
             },
           },
         },
-        facility: { select: { name: true, address: true } },
+        fromFacility: { select: { name: true, address: true } },
       },
       orderBy: { createdAt: "desc" },
     });
   }
 
-  async findOne(id: string) {
+  async findOne(id: string, facilityId?: string) {
+    const where: any = { id };
+    if (facilityId) where.fromFacilityId = facilityId;
+
     const referral = await this.prisma.referral.findUnique({
-      where: { id },
+      where,
       include: {
         patient: {
           include: {
@@ -110,7 +114,7 @@ export class ReferralsService {
             },
           },
         },
-        facility: true,
+        fromFacility: true,
       },
     });
 
@@ -118,8 +122,8 @@ export class ReferralsService {
     return referral;
   }
 
-  async updateStatus(id: string, dto: UpdateReferralDto) {
-    await this.findOne(id);
+  async updateStatus(id: string, dto: UpdateReferralDto, facilityId?: string) {
+    await this.findOne(id, facilityId);
     return this.prisma.referral.update({
       where: { id },
       data: { status: dto.status },
@@ -127,13 +131,13 @@ export class ReferralsService {
         patient: {
           select: { firstName: true, lastName: true, patientId: true },
         },
-        facility: { select: { name: true } },
+        fromFacility: { select: { name: true } },
       },
     });
   }
 
   async getReferralStats(facilityId?: string) {
-    const where = facilityId ? { facilityId } : {};
+    const where = facilityId ? { fromFacilityId: facilityId } : {};
 
     const [total, pending, accepted, completed, cancelled] = await Promise.all([
       this.prisma.referral.count({ where }),