LPA-Health-V1.3

2026-03-01 00:35:05 +00:00 · 2026-03-01 00:35:05 +00:00 · 6d7a771341
commit 6d7a771341
parent 8b1250d5af
7 changed files with 184 additions and 15 deletions
--- a/admin_dashboard.php
+++ b/admin_dashboard.php
@ -149,7 +149,7 @@ try {
                            <tbody>
                                <?php if (count($lpas) > 0): ?>
                                    <?php foreach ($lpas as $lpa): ?>
-                                        <tr>
+                                        <tr id="lpa-row-<?php echo $lpa['id']; ?>">
                                            <td class="ps-4">
                                                <div class="fw-bold mb-0"><?php echo htmlspecialchars($lpa['lpa_type']); ?></div>
                                                <div class="text-muted small">ID: #<?php echo $lpa['id']; ?></div>
@ -169,7 +169,8 @@ try {
                                                <span class="badge rounded-pill bg-info-subtle text-info"><?php echo ucfirst($lpa['status']); ?></span>
                                            </td>
                                            <td class="text-end pe-4">
-                                                <a href="api/generate_pdf.php?id=<?php echo $lpa['id']; ?>" class="btn btn-sm btn-outline-primary px-3 rounded-pill">PDF</a>
+                                                <a href="api/generate_pdf.php?id=<?php echo $lpa['id']; ?>" class="btn btn-sm btn-outline-primary px-3 rounded-pill me-2">PDF</a>
+                                                <button onclick="deleteLPA(<?php echo $lpa['id']; ?>)" class="btn btn-sm btn-outline-danger px-3 rounded-pill">Delete</button>
                                            </td>
                                        </tr>
                                    <?php endforeach; ?>
@ -185,5 +186,35 @@ try {
    </div>

    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
+    <script>
+        function deleteLPA(id) {
+            if (confirm('Are you sure you want to delete this LPA application? This action cannot be undone.')) {
+                fetch('api/delete_lpa.php', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                    },
+                    body: 'id=' + id
+                })
+                .then(response => response.json())
+                .then(data => {
+                    if (data.success) {
+                        const row = document.getElementById('lpa-row-' + id);
+                        if (row) {
+                            row.remove();
+                            // Update count display if needed or refresh
+                            location.reload(); 
+                        }
+                    } else {
+                        alert('Error: ' + data.error);
+                    }
+                })
+                .catch(error => {
+                    console.error('Error:', error);
+                    alert('An error occurred while trying to delete the application.');
+                });
+            }
+        }
+    </script>
 </body>
-</html>
+</html>
--- a/api/delete_lpa.php
+++ b/api/delete_lpa.php
@ -0,0 +1,59 @@
+<?php
+header('Content-Type: application/json');
+session_start();
+
+// 1. Verify Authentication and Authorization
+if (!isset($_SESSION["user_id"]) || ($_SESSION["user_role"] ?? '') !== 'Super User') {
+    echo json_encode(['success' => false, 'error' => 'Unauthorized access.']);
+    exit;
+}
+
+require_once __DIR__ . '/../db/config.php';
+
+// 2. Validate Input
+$lpa_id = isset($_POST['id']) ? (int)$_POST['id'] : null;
+
+if (!$lpa_id) {
+    echo json_encode(['success' => false, 'error' => 'Application ID is missing.']);
+    exit;
+}
+
+try {
+    $pdo = db();
+    
+    // 3. Start Transaction
+    $pdo->beginTransaction();
+
+    // 4. Delete related records
+    
+    // Delete Attorneys
+    $stmtAttorneys = $pdo->prepare("DELETE FROM lpa_attorneys WHERE lpa_id = ?");
+    $stmtAttorneys->execute([$lpa_id]);
+
+    // Delete Notified Persons
+    $stmtNotified = $pdo->prepare("DELETE FROM lpa_notified_persons WHERE application_id = ?");
+    $stmtNotified->execute([$lpa_id]);
+
+    // 5. Delete the application itself
+    $stmtLpa = $pdo->prepare("DELETE FROM lpa_applications WHERE id = ?");
+    $stmtLpa->execute([$lpa_id]);
+
+    if ($stmtLpa->rowCount() === 0) {
+        $pdo->rollBack();
+        echo json_encode(['success' => false, 'error' => 'Application not found or already deleted.']);
+        exit;
+    }
+
+    // 6. Commit Transaction
+    $pdo->commit();
+
+    echo json_encode(['success' => true, 'message' => 'LPA application and all related data deleted successfully.']);
+
+} catch (PDOException $e) {
+    // Rollback on error
+    if (isset($pdo)) {
+        $pdo->rollBack();
+    }
+    error_log("Delete LPA Error: " . $e->getMessage());
+    echo json_encode(['success' => false, 'error' => 'A database error occurred.']);
+}
--- a/api/generate_pdf.php
+++ b/api/generate_pdf.php
@ -1,7 +1,13 @@
 <?php
+session_start();
 require_once __DIR__ . '/../db/config.php';
 require_once __DIR__ . '/../fpdf/fpdf.php';

+if (!isset($_SESSION["user_id"])) {
+    die('Authentication required.');
+}
+
+$user_id = $_SESSION["user_id"];
 $lpa_id = isset($_GET['id']) ? (int)$_GET['id'] : null;

 if (!$lpa_id) {
@ -17,6 +23,11 @@ if (!$lpa_data) {
    die('LPA not found.');
 }

+// Authorization check
+if ($lpa_data['user_id'] != $user_id && ($_SESSION['user_role'] ?? '') !== 'Super User') {
+    die('Unauthorized access.');
+}
+
 // Fetch attorneys
 $stmt = db()->prepare("SELECT * FROM lpa_attorneys WHERE lpa_id = ? AND type = 'primary' ORDER BY id ASC");
 $stmt->execute([$lpa_id]);
@ -213,4 +224,4 @@ $pdf->Field('Reduced Fee Eligibility', $lpa_data['reduced_fee_eligibility'] ?? '
 $pdf->Field('Repeat Application', ($lpa_data['is_repeat_application'] ?? false) ? 'Yes (Case: ' . ($lpa_data['repeat_case_number'] ?? '') . ')' : 'No');

 $filename = 'LPA_' . str_replace(' ', '_', ($lpa_data['donor_name'] ?? 'Summary')) . '_' . date('Ymd') . '.pdf';
-$pdf->Output('D', $filename);
+$pdf->Output('D', $filename);
--- a/api/save_lpa.php
+++ b/api/save_lpa.php
@ -1,6 +1,14 @@
 <?php
 header('Content-Type: application/json');
 require_once __DIR__ . '/../db/config.php';
+session_start();
+
+if (!isset($_SESSION["user_id"])) {
+    echo json_encode(['success' => false, 'error' => 'Authentication required.']);
+    exit;
+}
+
+$user_id = $_SESSION["user_id"];

 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Check for specific actions first
@ -15,6 +23,14 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            }

            try {
+                // Verify ownership
+                $check = db()->prepare("SELECT id FROM lpa_applications WHERE id = ? AND user_id = ?");
+                $check->execute([$lpa_id, $user_id]);
+                if (!$check->fetch()) {
+                    echo json_encode(['success' => false, 'error' => 'Unauthorized.']);
+                    exit;
+                }
+
                $stmt = db()->prepare("DELETE FROM lpa_attorneys WHERE id = ? AND lpa_id = ?");
                $stmt->execute([$attorney_id, $lpa_id]);
                echo json_encode(['success' => true, 'message' => 'Attorney removed.']);
@ -32,6 +48,14 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            }

            try {
+                // Verify ownership
+                $check = db()->prepare("SELECT id FROM lpa_applications WHERE id = ? AND user_id = ?");
+                $check->execute([$lpa_id, $user_id]);
+                if (!$check->fetch()) {
+                    echo json_encode(['success' => false, 'error' => 'Unauthorized.']);
+                    exit;
+                }
+
                $stmt = db()->prepare("DELETE FROM lpa_notified_persons WHERE id = ? AND application_id = ?");
                $stmt->execute([$person_id, $lpa_id]);
                echo json_encode(['success' => true, 'message' => 'Person removed.']);
@ -45,10 +69,25 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $step = isset($_POST['step']) ? (int)$_POST['step'] : 1;
    $lpa_id = isset($_POST['lpa_id']) ? (int)$_POST['lpa_id'] : null;

+    // Verify ownership if lpa_id is provided
+    if ($lpa_id) {
+        try {
+            $check = db()->prepare("SELECT id FROM lpa_applications WHERE id = ? AND user_id = ?");
+            $check->execute([$lpa_id, $user_id]);
+            if (!$check->fetch()) {
+                echo json_encode(['success' => false, 'error' => 'Unauthorized access to this application.']);
+                exit;
+            }
+        } catch (PDOException $e) {
+            echo json_encode(['success' => false, 'error' => 'Database error.']);
+            exit;
+        }
+    }
+
    try {
        if ($step === 1) {
            $lpa_type = $_POST['lpa_type'] ?? '';
-            $donor_name = $_POST['donor_name'] ?? '';
+            $donor_name = trim($_POST['donor_name'] ?? '');
            $other_names = $_POST['other_names'] ?? '';
            $donor_dob = $_POST['donor_dob'] ?? '';
            $customer_email = $_POST['customer_email'] ?? '';
@ -62,15 +101,29 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
                exit;
            }

+            // Check for existing LPA of the same type for the same donor (name and DOB)
+            $checkSql = "SELECT id FROM lpa_applications WHERE user_id = ? AND lpa_type = ? AND donor_name = ? AND donor_dob = ?";
+            $checkParams = [$user_id, $lpa_type, $donor_name, $donor_dob];
+            if ($lpa_id) {
+                $checkSql .= " AND id != ?";
+                $checkParams[] = $lpa_id;
+            }
+            $checkStmt = db()->prepare($checkSql);
+            $checkStmt->execute($checkParams);
+            if ($checkStmt->fetch()) {
+                echo json_encode(['success' => false, 'error' => "A '$lpa_type' LPA already exists for donor '$donor_name' (born $donor_dob). Each donor may only have one of each type."]);
+                exit;
+            }
+
            if ($lpa_id) {
                // Update existing
-                $stmt = db()->prepare("UPDATE lpa_applications SET lpa_type = ?, donor_name = ?, other_names = ?, donor_dob = ?, customer_email = ?, donor_address_line1 = ?, donor_address_line2 = ?, donor_town = ?, donor_postcode = ?, step_reached = GREATEST(step_reached, 1) WHERE id = ?");
-                $stmt->execute([$lpa_type, $donor_name, $other_names, $donor_dob, $customer_email, $address1, $address2, $town, $postcode, $lpa_id]);
+                $stmt = db()->prepare("UPDATE lpa_applications SET lpa_type = ?, donor_name = ?, other_names = ?, donor_dob = ?, customer_email = ?, donor_address_line1 = ?, donor_address_line2 = ?, donor_town = ?, donor_postcode = ?, step_reached = GREATEST(step_reached, 1), user_id = ? WHERE id = ?");
+                $stmt->execute([$lpa_type, $donor_name, $other_names, $donor_dob, $customer_email, $address1, $address2, $town, $postcode, $user_id, $lpa_id]);
                $id = $lpa_id;
            } else {
                // Create new
-                $stmt = db()->prepare("INSERT INTO lpa_applications (practice_id, lpa_type, donor_name, other_names, donor_dob, customer_email, donor_address_line1, donor_address_line2, donor_town, donor_postcode, step_reached) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
-                $stmt->execute([1, $lpa_type, $donor_name, $other_names, $donor_dob, $customer_email, $address1, $address2, $town, $postcode, 1]);
+                $stmt = db()->prepare("INSERT INTO lpa_applications (practice_id, user_id, lpa_type, donor_name, other_names, donor_dob, customer_email, donor_address_line1, donor_address_line2, donor_town, donor_postcode, step_reached) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
+                $stmt->execute([1, $user_id, $lpa_type, $donor_name, $other_names, $donor_dob, $customer_email, $address1, $address2, $town, $postcode, 1]);
                $id = db()->lastInsertId();
            }
            
--- a/apply.php
+++ b/apply.php
@ -4,9 +4,9 @@ if (!isset($_SESSION["user_id"])) {
    header("Location: login.php");
    exit;
 }
-?>
-<?php
 require_once 'db/config.php';
+
+$user_id = $_SESSION["user_id"];
 $project_name = $_SERVER['PROJECT_NAME'] ?? 'LPA Online';

 $step = isset($_GET['step']) ? (int)$_GET['step'] : 1;
@ -17,6 +17,17 @@ if ($lpa_id) {
    $stmt = db()->prepare("SELECT * FROM lpa_applications WHERE id = ?");
    $stmt->execute([$lpa_id]);
    $lpa_data = $stmt->fetch();
+
+    if (!$lpa_data) {
+        header("Location: dashboard.php");
+        exit;
+    }
+
+    // Authorization check
+    if ($lpa_data['user_id'] != $user_id && ($_SESSION['user_role'] ?? '') !== 'Super User') {
+        header("Location: dashboard.php");
+        exit;
+    }
 }

 // Redirect to step 1 if no ID but step > 1
@ -1401,4 +1412,4 @@ foreach ($notified_persons as $np) {
    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
    <script src="assets/js/main.js?v=<?php echo time(); ?>"></script>
 </body>
-</html>
+</html>
--- a/dashboard.php
+++ b/dashboard.php
@ -6,11 +6,12 @@ if (!isset($_SESSION["user_id"])) {
 }
 require_once 'db/config.php';
 $project_name = $_SERVER['PROJECT_NAME'] ?? 'LPA Online';
+$user_id = $_SESSION["user_id"];

 $lpas = [];
 try {
-    $stmt = db()->prepare("SELECT * FROM lpa_applications ORDER BY created_at DESC");
-    $stmt->execute();
+    $stmt = db()->prepare("SELECT * FROM lpa_applications WHERE user_id = ? ORDER BY created_at DESC");
+    $stmt->execute([$user_id]);
    $lpas = $stmt->fetchAll();
 } catch (PDOException $e) {
    error_log($e->getMessage());
@ -145,4 +146,4 @@ try {

    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
 </body>
-</html>
+</html>
--- a/db/migrations/05_add_user_id_to_lpa_applications.sql
+++ b/db/migrations/05_add_user_id_to_lpa_applications.sql
@ -0,0 +1,3 @@
+-- Add user_id to lpa_applications
+ALTER TABLE lpa_applications ADD COLUMN user_id INT(11) AFTER practice_id;
+ALTER TABLE lpa_applications ADD CONSTRAINT fk_user_id FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL;