Update api/views.py

api/views.py

@@ -11,6 +11,8 @@ from .ml_engine import predict_xray as predict
 from .email_utils import send_test_result_email
 from .authentication import authenticate_user, get_user_from_token
 # pdf_generator import REMOVED for prototype
+from .models import Appointment # Add Appointment to imports
+from .serializers import AppointmentSerializer # Add AppointmentSerializer to imports
 
 import os
 import uuid
@@ -41,6 +43,8 @@ def login(request):
     return Response({"error": "Invalid credentials"}, status=status.HTTP_401_UNAUTHORIZED)
 
 
+
+
 # ─── PATIENT ENDPOINTS ──────────────────────────────────────────
 
 @api_view(['GET'])
@@ -151,6 +155,103 @@ def doctor_dashboard(request):
     ]
     return Response({"tests": dummy_tests}, status=status.HTTP_200_OK)
 
+# ─── APPOINTMENT ENDPOINTS ──────────────────────────────────────
+
+@api_view(['GET'])
+def doctors_list(request):
+    """
+    Returns a list of all users with role='doctor' so patients can choose one.
+    Authentication is optional depending on your preference, currently protected.
+    """
+    user = get_user_from_token(request)
+    if not user:
+        return Response({"error": "Unauthorized"}, status=status.HTTP_401_UNAUTHORIZED)
+
+    doctors = UserProfile.objects.filter(role='doctor')
+    serializer = UserProfileSerializer(doctors, many=True)
+    return Response(serializer.data)
+
+
+@api_view(['POST'])
+def book_appointment(request):
+    """
+    Allows a patient to book an appointment.
+    Expects JSON: { "doctor_id": 1, "date": "YYYY-MM-DD", "time": "HH:MM", "reason": "..." }
+    """
+    user = get_user_from_token(request)
+    if not user:
+        return Response({"error": "Unauthorized"}, status=status.HTTP_401_UNAUTHORIZED)
+
+    data = request.data
+    try:
+        doctor_id = data.get('doctor_id')
+        doctor_profile = UserProfile.objects.get(id=doctor_id, role='doctor')
+        
+        # 'user' here is the Patient's profile (from get_user_from_token)
+        appointment = Appointment.objects.create(
+            patient=user,
+            doctor=doctor_profile,
+            date=data.get('date'),
+            time=data.get('time'),
+            reason=data.get('reason', '')
+        )
+        return Response(AppointmentSerializer(appointment).data, status=status.HTTP_201_CREATED)
+        
+    except UserProfile.DoesNotExist:
+        return Response({"error": "Doctor not found"}, status=status.HTTP_404_NOT_FOUND)
+    except Exception as e:
+        return Response({"error": str(e)}, status=status.HTTP_400_BAD_REQUEST)
+
+
+@api_view(['GET'])
+def my_appointments(request):
+    """
+    Returns appointments for the logged-in user.
+    Auto-detects if user is Patient or Doctor.
+    """
+    user = get_user_from_token(request)
+    if not user:
+        return Response({"error": "Unauthorized"}, status=status.HTTP_401_UNAUTHORIZED)
+
+    try:
+        # Check role field on the user profile
+        if hasattr(user, 'role') and user.role == 'doctor':
+            appointments = Appointment.objects.filter(doctor=user).order_by('-date', '-time')
+        else:
+            appointments = Appointment.objects.filter(patient=user).order_by('-date', '-time')
+        
+        return Response(AppointmentSerializer(appointments, many=True).data)
+    except Exception as e:
+        return Response({"error": str(e)}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)
+
+
+@api_view(['POST'])
+def update_appointment_status(request, pk):
+    """
+    Doctor updates status (Confirm/Cancel).
+    Expects JSON: { "status": "Confirmed" }
+    """
+    user = get_user_from_token(request)
+    if not user:
+        return Response({"error": "Unauthorized"}, status=status.HTTP_401_UNAUTHORIZED)
+
+    try:
+        appointment = Appointment.objects.get(pk=pk)
+        
+        # Security: Ensure the logged-in user is the doctor for this appointment
+        if appointment.doctor != user:
+             return Response({"error": "Unauthorized action"}, status=status.HTTP_403_FORBIDDEN)
+
+        new_status = request.data.get('status')
+        if new_status in ['Confirmed', 'Cancelled', 'Completed']:
+            appointment.status = new_status
+            appointment.save()
+            return Response(AppointmentSerializer(appointment).data)
+        
+        return Response({"error": "Invalid status"}, status=status.HTTP_400_BAD_REQUEST)
+        
+    except Appointment.DoesNotExist:
+        return Response({"error": "Appointment not found"}, status=status.HTTP_404_NOT_FOUND)
 
 # ─── REPORT GENERATION — REMOVED FOR PROTOTYPE ─────────────────
 # All /api/report/* endpoints and pdf_generator usage have been removed.