Add Authorization, Improve Code Generation, Enhance E2E Testing and Much More

[MelbourneDeveloper]

Add Authorization, Improve Code Generation, and Enhance E2E Testing

TLDR

Adds JWT-based authorization to Clinical and Scheduling APIs, improves code generator to support nullable parameters, adds comprehensive E2E test coverage for Dashboard integration, and includes various bug fixes and improvements across the codebase.

Brief Details

Authorization System

• New Authorization project (Samples/Shared/Authorization/) with shared authentication helpers
• JWT token validation with role-based access control (RBAC)
• Permission-based endpoint filtering using ASP.NET Core endpoint filters
• Test token helper for integration testing with configurable claims
• Permission constants for clinical and scheduling operations (read/write patients, encounters, appointments, etc.)

Code Generation Improvements

• Nullable parameter support: Code generator now produces string? parameters for nullable database columns
• Null safety: Added #nullable enable directive to generated files
• Connection null checks: Generated code validates transaction.Connection before use, returning proper Result<T> errors instead of throwing
• Bulk operations: Added bulk insert and upsert method generation with proper null handling

Dashboard E2E Testing

• Split monolithic test file into focused test classes:
  • AuthE2ETests - Authentication and authorization flows
  • PatientE2ETests - Patient CRUD operations
  • PractitionerE2ETests - Practitioner management
  • AppointmentE2ETests - Appointment scheduling
  • CalendarE2ETests - Calendar view functionality
  • NavigationE2ETests - UI navigation
  • SyncE2ETests - Data synchronization
• New E2EFixture base class for shared test infrastructure
• CORS testing for API endpoints

Clinical & Scheduling API Updates

• Integrated authorization middleware
• Sync worker runs as part of the API process (no separate service needed)
• Fault tolerance improvements in sync workers
• Authorization tests covering all endpoints

Migration Enhancements

• LQL default value translation for portable schema definitions
• Schema diff and migration testing improvements
• PostgreSQL and SQLite migration test coverage

Other Changes

• CI workflow added (.github/workflows/ci.yml)
• Removed obsolete docker-compose.yml from Sync
• Various code cleanup and formatting fixes
• Updated to .NET 9.0 patterns

How Do The Tests Prove This Works?

Authorization Tests

• Clinical.Api.Tests/AuthorizationTests.cs - 19 tests verifying:

  • Unauthenticated requests return 401
  • Invalid tokens return 401
  • Missing permissions return 403
  • Valid tokens with correct permissions succeed

• Scheduling.Api.Tests/AuthorizationTests.cs - Similar coverage for scheduling endpoints

Code Generation Tests

• DataProvider.Tests/BulkOperationsTests.cs - Tests bulk insert/upsert with nullable values
• All Clinical.Api endpoint tests pass (85 tests) with nullable parameters flowing through generated code
• Generated files compile without nullable warnings

E2E Integration Tests

• Dashboard.Integration.Tests/ - 50+ E2E tests covering:
  • Full user workflows (create patient -> schedule appointment -> view calendar)
  • API integration with both Clinical and Scheduling backends
  • Sync operations between APIs and dashboard
  • Error handling and edge cases

Migration Tests

• Migration.Tests/SqliteMigrationTests.cs - SQLite schema migration scenarios
• Migration.Tests/PostgresMigrationTests.cs - PostgreSQL migration scenarios
• Migration.Tests/LqlDefaultsTests.cs - Default value translation
• Migration.Tests/SchemaDiffTests.cs - Schema comparison logic

Sync Tests

• SyncWorkerFaultToleranceTests.cs - Verifies sync continues after failures
• SyncE2ETests.cs - End-to-end sync between APIs