Restrict Unauthorized Users from Accessing Facility's Patient Registration

src/Components/Common/FacilitySelect.tsx

@@ -13,6 +13,7 @@ interface FacilitySelectProps {
   multiple?: boolean;
   facilityType?: number;
   district?: string;
+  state?: string;
   showAll?: boolean;
   showNOptions?: number;
   freeText?: boolean;
@@ -33,6 +34,7 @@ export const FacilitySelect = (props: FacilitySelectProps) => {
     className = "",
     facilityType,
     district,
+    state,
     freeText = false,
     errors = "",
   } = props;
@@ -47,6 +49,7 @@ export const FacilitySelect = (props: FacilitySelectProps) => {
         facility_type: facilityType,
         exclude_user: exclude_user,
         district,
+        state,
       };
 
       const { data } = await request(

src/Components/ExternalResult/FacilitiesSelectDialogue.tsx

@@ -3,6 +3,7 @@ import DialogModal from "../Common/Dialog";
 import { FacilitySelect } from "../Common/FacilitySelect";
 import { FacilityModel } from "../Facility/models";
 import { useTranslation } from "react-i18next";
+import useAuthUser from "../../Common/hooks/useAuthUser";
 
 interface Props {
   show: boolean;
@@ -15,6 +16,7 @@ interface Props {
 const FacilitiesSelectDialog = (props: Props) => {
   const { show, handleOk, handleCancel, selectedFacility, setSelected } = props;
   const { t } = useTranslation();
+  const authUser = useAuthUser();
 
   return (
     <DialogModal
@@ -29,6 +31,16 @@ const FacilitiesSelectDialog = (props: Props) => {
         errors=""
         showAll={false}
         multiple={false}
+        district={
+          authUser?.user_type === "DistrictAdmin"
+            ? authUser?.district?.toString()
+            : ""
+        }
+        state={
+          authUser?.user_type === "StateAdmin"
+            ? authUser?.state?.toString()
+            : ""
+        }
       />
       <div className="mt-4 flex flex-col gap-2 sm:flex-row sm:justify-end">
         <Cancel onClick={handleCancel} />

src/Components/Patient/ManagePatients.tsx

@@ -742,11 +742,19 @@
             <ButtonV2
               id="add-patient-details"
               onClick={() => {
+                const showAllFacilityUsers = ["DistrictAdmin", "StateAdmin"];
                 if (qParams.facility)
                   navigate(`/facility/${qParams.facility}/patient`);
                 else if (onlyAccessibleFacility)
                   navigate(`/facility/${onlyAccessibleFacility.id}/patient`);
-                else setShowDialog("create");
+                else if (
+                  !showAllFacilityUsers.includes(authUser.user_type) &&
+                  authUser.home_facility_object?.id
+                ) {
+                  navigate(
+                    `/facility/${authUser.home_facility_object.id}/patient`
+                  );
+                } else setShowDialog("create");
               }}
               className="w-full lg:w-fit"
             >

src/Components/Patient/PatientRegister.tsx

@@ -61,6 +61,7 @@ import useAuthUser from "../../Common/hooks/useAuthUser.js";
 import useQuery from "../../Utils/request/useQuery.js";
 import routes from "../../Redux/api.js";
 import request from "../../Utils/request/request.js";
+import Error404 from "../ErrorPages/404";
 import SelectMenuV2 from "../Form/SelectMenuV2.js";
 
 const Loading = lazy(() => import("../Common/Loading"));
@@ -1060,6 +1061,32 @@ export const PatientRegister = (props: PatientRegisterProps) => {
     return <Loading />;
   }
 
+  const PatientRegisterAuth = () => {
+    let check = false;
+    const showAllFacilityUsers = ["DistrictAdmin", "StateAdmin"];
+    if (
+      !showAllFacilityUsers.includes(authUser.user_type) &&
+      authUser.home_facility_object?.id === facilityId
+    ) {
+      check = true;
+    } else if (
+      authUser.user_type === "DistrictAdmin" &&
+      authUser.district === facilityObject?.district
+    ) {
+      check = true;
+    } else if (
+      authUser.user_type === "StateAdmin" &&
+      authUser.state === facilityObject?.state
+    ) {
+      check = true;
+    }
+    return check;
+  };
+
+  if (!isLoading && facilityId && facilityObject && !PatientRegisterAuth()) {
+    return <Error404 />;
+  }
+
   return (
     <div className="px-2 pb-2">
       {statusDialog.show && (