From ecc8c2b982033e8dc7b59fd7c2f07b8806eb6838 Mon Sep 17 00:00:00 2001
From: Karli <projects@supa.ee>
Date: Wed, 17 Sep 2025 11:17:23 +0300
Subject: [PATCH] feat(MED-161): update results sync validations

---
 .../medipost/medipostMessageBase.service.ts   | 71 ++++++++++---------
 .../medipostPrivateMessage.service.ts         | 46 +++++++++---
 2 files changed, 75 insertions(+), 42 deletions(-)

diff --git a/lib/services/medipost/medipostMessageBase.service.ts b/lib/services/medipost/medipostMessageBase.service.ts
index 07aeddc..5faf012 100644
--- a/lib/services/medipost/medipostMessageBase.service.ts
+++ b/lib/services/medipost/medipostMessageBase.service.ts
@@ -28,36 +28,41 @@ export function getLatestMessage({
 }
 
 export async function createMedipostActionLog({
-    action,
-    xml,
-    hasAnalysisResults = false,
-    medusaOrderId,
-    responseXml,
-    hasError = false,
-  }: {
-    action:
-    | 'send_order_to_medipost'
-    | 'sync_analysis_results_from_medipost'
-    | 'send_fake_analysis_results_to_medipost'
-    | 'send_analysis_results_to_medipost';
-    xml: string;
-    hasAnalysisResults?: boolean;
-    medusaOrderId?: string | null;
-    responseXml?: string | null;
-    hasError?: boolean;
-  }) {
-    await getSupabaseServerAdminClient()
-      .schema('medreport')
-      .from('medipost_actions')
-      .insert({
-        action,
-        xml,
-        has_analysis_results: hasAnalysisResults,
-        medusa_order_id: medusaOrderId,
-        response_xml: responseXml,
-        has_error: hasError,
-      })
-      .select('id')
-      .throwOnError();
-  }
-  
\ No newline at end of file
+  action,
+  xml,
+  hasAnalysisResults = false,
+  medusaOrderId,
+  responseXml,
+  hasError = false,
+  medipostExternalOrderId,
+  medipostPrivateMessageId,
+}: {
+  action:
+  | 'send_order_to_medipost'
+  | 'sync_analysis_results_from_medipost'
+  | 'send_fake_analysis_results_to_medipost'
+  | 'send_analysis_results_to_medipost';
+  xml: string;
+  hasAnalysisResults?: boolean;
+  medusaOrderId?: string | null;
+  responseXml?: string | null;
+  hasError?: boolean;
+  medipostExternalOrderId?: string | null;
+  medipostPrivateMessageId?: string | null;
+}) {
+  await getSupabaseServerAdminClient()
+    .schema('medreport')
+    .from('medipost_actions')
+    .insert({
+      action,
+      xml,
+      has_analysis_results: hasAnalysisResults,
+      medusa_order_id: medusaOrderId,
+      response_xml: responseXml,
+      has_error: hasError,
+      medipost_external_order_id: medipostExternalOrderId,
+      medipost_private_message_id: medipostPrivateMessageId,
+    })
+    .select('id')
+    .throwOnError();
+}
diff --git a/lib/services/medipost/medipostPrivateMessage.service.ts b/lib/services/medipost/medipostPrivateMessage.service.ts
index 2d05d03..d667b8e 100644
--- a/lib/services/medipost/medipostPrivateMessage.service.ts
+++ b/lib/services/medipost/medipostPrivateMessage.service.ts
@@ -1,5 +1,8 @@
 'use server';
 
+import type { PostgrestError } from '@supabase/supabase-js';
+import axios from 'axios';
+
 import {
   GetMessageListResponse,
   MedipostAction,
@@ -10,7 +13,7 @@ import type {
   MedipostOrderResponse
 } from '@/packages/shared/src/types/medipost-analysis';
 import { toArray } from '@/lib/utils';
-import axios from 'axios';
+import type { AnalysisOrder } from '~/lib/types/analysis-order';
 
 import { Tables } from '@kit/supabase/database';
 import { getSupabaseServerAdminClient } from '@/packages/supabase/src/clients/server-admin-client';
@@ -201,20 +204,27 @@ export async function readPrivateMessageResponse({
       };
     }
 
+    const { messageId: privateMessageId } = privateMessage;
     const { message: privateMessageContent, xml: privateMessageXml } = await getPrivateMessage(
-      privateMessage.messageId,
+      privateMessageId,
     );
 
     const messageResponse = privateMessageContent?.Saadetis?.Vastus;
-    analysisOrderId = Number(privateMessageContent?.Saadetis?.Tellimus?.ValisTellimuseId || messageResponse?.ValisTellimuseId);
+    const medipostExternalOrderId = privateMessageContent?.Saadetis?.Tellimus?.ValisTellimuseId || messageResponse?.ValisTellimuseId;
+    const patientPersonalCode = messageResponse?.Patsient.Isikukood?.toString();
+    analysisOrderId = Number(medipostExternalOrderId);
 
-    const hasInvalidOrderId = isNaN(analysisOrderId)
+    const hasInvalidOrderId = isNaN(analysisOrderId);
 
-    if (hasInvalidOrderId || !messageResponse) {
+    if (hasInvalidOrderId || !messageResponse || !patientPersonalCode) {
       await createMedipostActionLog({
         action: 'sync_analysis_results_from_medipost',
         xml: privateMessageXml,
         hasAnalysisResults: false,
+        medipostPrivateMessageId: privateMessageId,
+        medusaOrderId,
+        medipostExternalOrderId,
+        hasError: true,
       });
       return {
         messageId,
@@ -226,21 +236,39 @@ export async function readPrivateMessageResponse({
       };
     }
 
-    const analysisOrder = await getAnalysisOrder({ analysisOrderId: analysisOrderId }) 
-    medusaOrderId = analysisOrder.medusa_order_id;
+    let analysisOrder: AnalysisOrder;
+    try {
+      analysisOrder = await getAnalysisOrder({ analysisOrderId })
+      medusaOrderId = analysisOrder.medusa_order_id;
+    } catch (e) {
+      throw new Error(`No analysis order found for Medipost message ValisTellimuseId=${medipostExternalOrderId}`);
+    }
+
+    const orderPerson = await getAccountAdmin({ primaryOwnerUserId: analysisOrder.user_id });
+    if (orderPerson.personal_code !== patientPersonalCode) {
+      throw new Error(`Order person personal code does not match Medipost message Patsient.Isikukood=${patientPersonalCode}, orderPerson.personal_code=${orderPerson.personal_code}`);
+    }
 
     let order: Tables<{ schema: 'medreport' }, 'analysis_orders'>;
     try {
       order = await getAnalysisOrder({ medusaOrderId });
     } catch (e) {
       if (IS_ENABLED_DELETE_PRIVATE_MESSAGE) {
-        await deletePrivateMessage(privateMessage.messageId);
+        await deletePrivateMessage(privateMessageId);
       }
       throw new Error(`Order not found by Medipost message ValisTellimuseId=${medusaOrderId}`);
     }
 
     const status = await syncPrivateMessage({ messageResponse, order });
 
+    await createMedipostActionLog({
+      action: 'sync_analysis_results_from_medipost',
+      xml: privateMessageXml,
+      hasAnalysisResults: true,
+      medipostPrivateMessageId: privateMessageId,
+      medusaOrderId,
+      medipostExternalOrderId,
+    });
     if (status.isPartial) {
       await updateAnalysisOrderStatus({ medusaOrderId, orderStatus: 'PARTIAL_ANALYSIS_RESPONSE' });
       hasAnalysisResponse = true;
@@ -248,7 +276,7 @@ export async function readPrivateMessageResponse({
     } else if (status.isCompleted) {
       await updateAnalysisOrderStatus({ medusaOrderId, orderStatus: 'FULL_ANALYSIS_RESPONSE' });
       if (IS_ENABLED_DELETE_PRIVATE_MESSAGE) {
-        await deletePrivateMessage(privateMessage.messageId);
+        await deletePrivateMessage(privateMessageId);
       }
       hasAnalysisResponse = true;
       hasFullAnalysisResponse = true;