feat(patient notes): add edit window validation and update endpoint

care/facility/api/serializers/patient.py

@@ -26,6 +26,7 @@
     PatientRegistration,
 )
 from care.facility.models.notification import Notification
+from care.facility.models.patient import PATIENT_NOTE_EDIT_WINDOW
 from care.facility.models.patient_base import (
     BLOOD_GROUP_CHOICES,
     DISEASE_STATUS_CHOICES,
@@ -456,6 +457,10 @@ class PatientNotesSerializer(serializers.ModelSerializer):
     facility = FacilityBasicInfoSerializer(read_only=True)
     created_by_object = UserBaseMinimumSerializer(source="created_by", read_only=True)
     created_by_local_user = serializers.BooleanField(read_only=True)
+    edit_window_seconds = serializers.SerializerMethodField(read_only=True)
+
+    def get_edit_window_seconds(self, obj):
+        return PATIENT_NOTE_EDIT_WINDOW
 
     def validate_empty_values(self, data):
         if not data.get("note", "").strip():
@@ -465,10 +470,15 @@ def validate_empty_values(self, data):
     class Meta:
         model = PatientNotes
         fields = (
+            "id",
             "note",
             "facility",
             "created_by_object",
             "created_by_local_user",
-            "created_date",
+            "edit_window_seconds",
+        )
+        read_only_fields = (
+            "id",
+            "created_by_local_user",
+            "edit_window_seconds",
         )
-        read_only_fields = ("created_date",)

care/facility/api/viewsets/patient.py

@@ -17,7 +17,12 @@
 from rest_framework.exceptions import ValidationError
 from rest_framework.filters import BaseFilterBackend
 from rest_framework.generics import get_object_or_404
-from rest_framework.mixins import CreateModelMixin, ListModelMixin, RetrieveModelMixin
+from rest_framework.mixins import (
+    CreateModelMixin,
+    ListModelMixin,
+    RetrieveModelMixin,
+    UpdateModelMixin,
+)
 from rest_framework.pagination import PageNumberPagination
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.response import Response
@@ -590,7 +595,11 @@ def list(self, request, *args, **kwargs):
 
 
 class PatientNotesViewSet(
-    ListModelMixin, RetrieveModelMixin, CreateModelMixin, GenericViewSet
+    ListModelMixin,
+    RetrieveModelMixin,
+    CreateModelMixin,
+    UpdateModelMixin,
+    GenericViewSet,
 ):
     queryset = (
         PatientNotes.objects.all()
@@ -638,7 +647,7 @@ def perform_create(self, serializer):
         )
         if not patient.is_active:
             raise ValidationError(
-                {"patient": "Only active patients data can be updated"}
+                {"patient": "Updating patient data is only allowed for active patients"}
             )
         return serializer.save(
             facility=patient.facility,

care/facility/models/mixins/permissions/patient.py

@@ -173,9 +173,10 @@ def has_object_read_permission(self, request):
                 and request.user in self.patient.facility.users.all()
             )
             or (
-                self.assigned_to == request.user
-                or request.user == self.patient.assigned_to
+                getattr(self, "assigned_to", None)
+                and getattr(self, "assigned_to", None) == request.user
             )
+            or request.user == getattr(self.patient, "assigned_to", None)
             or (
                 request.user.user_type >= User.TYPE_VALUE_MAP["DistrictLabAdmin"]
                 and (
@@ -206,8 +207,8 @@ def has_object_update_permission(self, request):
                 and self.patient.facility == request.user.home_facility
             )
             or (
-                self.assigned_to == request.user
-                or request.user == self.patient.assigned_to
+                getattr(self, "assigned_to", None)
+                and getattr(self, "assigned_to", None) == request.user
             )
             or (
                 request.user.user_type >= User.TYPE_VALUE_MAP["DistrictLabAdmin"]

care/facility/models/patient.py

@@ -1,9 +1,11 @@
 import datetime
 import enum
 
+from django.core.exceptions import ValidationError
 from django.core.validators import MaxValueValidator, MinValueValidator
 from django.db import models
 from django.db.models import JSONField
+from django.utils.timezone import now
 from simple_history.models import HistoricalRecords
 
 from care.facility.models import (
@@ -41,6 +43,8 @@
 )
 from care.utils.models.base import BaseManager, BaseModel
 
+PATIENT_NOTE_EDIT_WINDOW = 30 * 60  # 30 minutes
+
 
 class PatientRegistration(PatientBaseModel, PatientPermissionMixin):
     # fields in the PatientSearch model
@@ -683,3 +687,18 @@ class PatientNotes(FacilityBaseModel, PatientRelatedPermissionMixin):
         null=True,
     )
     note = models.TextField(default="", blank=True)
+
+    def save(self, *args, **kwargs):
+        if self.pk:  # Updating an existing note
+            if not self.patient.is_active:
+                raise ValidationError(
+                    {
+                        "patient": "Updating patient data is only allowed for active patients"
+                    }
+                )
+            if now() > self.created_date + datetime.timedelta(
+                seconds=PATIENT_NOTE_EDIT_WINDOW
+            ):
+                raise ValidationError({"note": "Note is not editable anymore"})
+
+        super().save(*args, **kwargs)

care/facility/tests/test_patient_api.py

@@ -9,10 +9,12 @@
 
 
 class ExpectedPatientNoteKeys(Enum):
+    ID = "id"
     NOTE = "note"
     FACILITY = "facility"
     CREATED_BY_OBJECT = "created_by_object"
     CREATED_DATE = "created_date"
+    MODIFIED_DATE = "modified_date"
     CREATED_BY_LOCAL_USER = "created_by_local_user"
 
 

care/utils/tests/test_base.py

@@ -439,7 +439,7 @@ def create_consultation(
         return PatientConsultation.objects.create(**data)
 
     def create_patient_note(
-        self, patient=None, facility=None, note="Patient is doing find", **kwargs
+        self, patient=None, facility=None, note="Patient is doing fine", **kwargs
     ):
         data = {
             "patient": patient or self.patient,