Problem
PatientEntity and UserAccountEntity are unrelated tables. When a patient logs in, their session resolves to an Actor whose userId is derived from their login credentials (UserAccountEntity.id). However, CaseEntity.patient points to PatientEntity, which has its own independent id. There is
no enforced relationship between the two, so the access check actor.userId().equals(caseEntity.getPatient().getId()) only works by coincidence if someone happened to set the IDs to match manually.
Suggested approach
Add a userAccountId column to PatientEntity as a foreign key to UserAccountEntity:
@OnetoOne
@joincolumn(name = "user_account_id", unique = true, nullable = true)
private UserAccountEntity userAccount;
Nullable to start with, so existing patients without an account aren't broken.
When a patient account is created (wherever that registration flow lives), set patient.setUserAccount(userAccount) to link them.
Update validateAccess in DocumentService (and the equivalent in CaseService) to compare against the linked account ID:
if (actor.isPatient()
&& caseEntity.getPatient() != null
&& caseEntity.getPatient().getUserAccount() != null
&& actor.userId().equals(caseEntity.getPatient().getUserAccount().getId())) return;
This makes the link explicit and enforced at the data model level rather than relying on ID coincidence.
Problem
PatientEntity and UserAccountEntity are unrelated tables. When a patient logs in, their session resolves to an Actor whose userId is derived from their login credentials (UserAccountEntity.id). However, CaseEntity.patient points to PatientEntity, which has its own independent id. There is
no enforced relationship between the two, so the access check actor.userId().equals(caseEntity.getPatient().getId()) only works by coincidence if someone happened to set the IDs to match manually.
Suggested approach
Add a userAccountId column to PatientEntity as a foreign key to UserAccountEntity:
@OnetoOne
@joincolumn(name = "user_account_id", unique = true, nullable = true)
private UserAccountEntity userAccount;
Nullable to start with, so existing patients without an account aren't broken.
When a patient account is created (wherever that registration flow lives), set patient.setUserAccount(userAccount) to link them.
Update validateAccess in DocumentService (and the equivalent in CaseService) to compare against the linked account ID:
if (actor.isPatient()
&& caseEntity.getPatient() != null
&& caseEntity.getPatient().getUserAccount() != null
&& actor.userId().equals(caseEntity.getPatient().getUserAccount().getId())) return;
This makes the link explicit and enforced at the data model level rather than relying on ID coincidence.