Therapy note authorship is never recorded (submitterId unused + Int/String mismatch)

Open
  • Is something wrong?
#294 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
58/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
typescript
Domain
authentication, backend-api-design, databases, full-stack

Research direction

Read prisma/schema.prisma alongside server/api/session/notes/index.post.ts and server/api/session/notes/[id].put.ts, then inspect composables/therapy/useTherapyNoteForm.ts and the note-reading views. Verify the authenticated user is the sole source of the author, the schema and migration represent a User reference, and author information is viewable where notes are read.

Written by the indexing model from the issue text.

Description

area: patient bug P1: high

Part of #285 (Group C — notes correctness).

Problem

For a clinical PHI record, "who wrote this note" is never recorded, and the field meant to hold it is the wrong type.

Evidence

  • server/api/session/notes/index.post.ts sets submitterId from the request body (data.submitterID ?? data.submitterId ?? null), not from event.context.user. The client never sends it — composables/therapy/useTherapyNoteForm.ts builds the payload with no submitterId key — so it is always null.
  • Type mismatch: TherapyNote.submitterId is Int? (prisma/schema.prisma:260) but User.id is a String uuid (prisma/schema.prisma:11). No FK relation is declared, and the Zod schema types it z.number().int(). A uuid can't be stored even if sent.
  • server/api/session/notes/[id].put.ts never touches submitterId.

Impact

P1 (data integrity / PHI). Notes have no author. The column is structurally unusable as a User reference.

Proposed approach

  • Change submitterId to String with a proper FK relation to User (migration).
  • Set submitterId = event.context.user.id server-side on create (ignore any client value).
  • Optionally display the author in NotesHistory/ViewNoteModal.

Acceptance criteria

  • Every new note records the authenticated author server-side.
  • submitterId is a String FK to User (or an explicit relation).
  • Author is viewable where notes are read.
Dominant language
Vue
Stars
0
Forks
1
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from UTDallasEPICS/connected-care

All issues in UTDallasEPICS/connected-care

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.