[Dev-Dare4]

Title: feat(orders): add patient orders read endpoint

Description:

Adds GET /orders/mine for patients to view their prescriptions and lab orders. By default, it returns only the latest version in each supersedes chain; ?includeHistory=true includes corrected versions. Results are scoped to the signed-in patient.

Adds integration coverage for supersedes chains and patient ownership, updates the Phase 4 roadmap and API docs.

Verification: git diff --check passes. Typecheck and integration tests could not run because backend dependencies are not installed.

Closes #11

[drips-wave]

@Dev-Dare4 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[afeezorobsco-cyber]

@Dev-Dare4 CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Backend (typecheck + test + build)

src/modules/orders/services/index.ts(140,32): error TS2552: Cannot find name 'patientsService'. Did you mean 'paymentsService'?

orders/services/index.ts calls patientsService, which isn't imported. Probably lost while resolving a conflict.

[github-actions]

@Dev-Dare4 This PR now has merge conflicts with main, most likely because #156 (feat(patients): account deletion with clinical-record retention: anonymise identity, keep the audit trail) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

✅ Malware scan: clean

The earlier findings are resolved as of 96d56d4.

[afeezorobsco-cyber]

@Dev-Dare4 ⚠️ This PR now contains malware. The latest push (17c1736, force-pushed from your account) adds .vscode/tasks.json (a task that runs automatically when the folder is opened in VS Code) and public/fonts/fa-solid.lfk (obfuscated JavaScript disguised as a font), plus backend/api.js and changes to the dev/build/start scripts so that they run it.

It's the same payload that was force-pushed to several other contributors' PRs in this org over the last day, usually as a "fix: resolve merge conflicts with base" commit or a fake "Merge branch 'main'" commit. The required Malware scan check blocks this PR, so it can't be merged or run in CI until the payload is gone.

Your account or machine is probably compromised. Please:

1. Don't open this branch in VS Code or run npm scripts from it. If you already did, treat that machine as infected.
2. Revoke your GitHub personal access tokens, OAuth app grants and SSH keys, change your password, and check Settings → Security log for pushes you didn't make.
3. Scan the machine, and check other projects for .vscode/tasks.json files with "runOn": "folderOpen".
4. From a clean machine, reset this branch to your last good commit (one without .vscode/, public/fonts/ or api.js) and force-push. Then remove the conflicts by merging main normally.

Everyone else: don't check out this branch until the scan passes again.

[afeezorobsco-cyber]

@Dev-Dare4 CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Backend (typecheck + test + build)

src/modules/orders/repositories/index.ts(61,23): error TS1005: ':' expected.
src/modules/orders/repositories/index.ts(61,56): error TS1005: ',' expected.
src/modules/orders/repositories/index.ts(61,65): error TS1005: ',' expected.
src/modules/orders/repositories/index.ts(61,84): error TS1005: '(' expected.
src/modules/orders/repositories/index.ts(69,1): error TS1005: ',' expected.
src/modules/orders/repositories/index.ts(69,23): error TS1005: ':' expected.
src/modules/orders/repositories/index.ts(70,5): error TS1005: ',' expected.
src/modules/orders/repositories/index.ts(71,10): error TS1005: ',' expected.
src/modules/orders/repositories/index.ts(72,19): error TS1005: ',' expected.
src/modules/orders/repositories/index.ts(73,3): error TS1005: ',' expected.

orders/repositories/index.ts has a syntax error at line 61 (and again around line 69), probably a half-merged function from the rebase. Run npm run typecheck in backend/ locally.

[afeezorobsco-cyber]

@Dev-Dare4 CI is failing at npm run typecheck. There's a syntax error in the repository file:

src/modules/orders/repositories/index.ts(61,23): error TS1005: ':' expected.
src/modules/orders/repositories/index.ts(61,56): error TS1005: ',' expected.
src/modules/orders/repositories/index.ts(61,84): error TS1005: '(' expected.
src/modules/orders/repositories/index.ts(69,1): error TS1005: ',' expected.

Line 61 looks like a half-resolved merge. Please fix it, run npm run typecheck in backend/, and push.

[afeezorobsco-cyber]

@Dev-Dare4 Thanks, the syntax error is fixed. After updating to main, npm run typecheck still fails:

src/modules/orders/controllers/index.ts(3,10): error TS6133: 'HttpError' is declared but its value is never read.
src/modules/orders/services/index.ts(179,32): error TS2552: Cannot find name 'patientsService'. Did you mean 'paymentsService'?
tests/integration/orders-mine.test.mts(74,56): error TS2322: Type '{ userId: string; fullName: string; }' is not assignable to type '...DoctorProfileUncheckedCreateInput...'

• orders/services/index.ts uses patientsService but doesn't import it. main only imports paginate from ../../patients/services, so add import * as patientsService from '../../patients/services'; (or use the named functions).
• Remove the unused HttpError import in the controller.
• DoctorProfile.timeZone is now required (Implement cancellation policy (issue #56), waitlist with time-boxed offers (issue #55), and reschedule (issue #54) #164), so add timeZone: 'UTC' where the test creates the doctor profile (or use the doctor factory in tests/factories/).

Run npm run typecheck in backend/ and push.

[github-actions]

@Dev-Dare4 This PR now has merge conflicts with main, most likely because #260 (chore(changelog): fold changelog.d fragments into ROADMAP.md) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@Dev-Dare4 Closing this PR because its commit history contains cfee3199, a forged copy of a maintainer commit (the real one is ae853e09) that carries a known malicious payload. The current code is clean, but we are closing PRs with this indicator. Your account may have been compromised, so please check your machine and rotate your GitHub credentials and tokens. You are welcome to open a new PR from a fresh branch based on current main, containing only your own commits.