+
+
+ {
+ setQuery(e.target.value);
+ setIsOpen(true);
+ }}
+ onFocus={() => setIsOpen(true)}
+ onKeyDown={handleKeyDown}
+ placeholder="Zoek patient (naam of BSN)..."
+ className={cn(
+ "w-full pl-10 pr-10 py-2 border rounded-md",
+ "focus:outline-none focus:ring-2 focus:ring-teal-500",
+ error && "border-red-500"
+ )}
+ />
+ {isLoading && (
+
+ )}
+
+
+ {error && (
+
{error}
+ )}
+
+ {/* Dropdown */}
+ {isOpen && (displayItems.length > 0 || query.length >= 2) && (
+
+ {showRecent && (
+
+ Recente patiënten
+
+ )}
+
+ {query.length >= 2 && patients.length === 0 && !isLoading && (
+
+ Geen patiënt gevonden
+
+ )}
+
+ {displayItems.map((patient, index) => (
+
+ ))}
+
+ )}
+
+ );
+}
+```
+
+---
+
+## 7. Security & Compliance
+
+🎯 **Doel:** Beschrijf security maatregelen en compliance vereisten.
+
+### 7.1 Security Checklist
+
+| Maatregel | Implementatie | Status |
+|-----------|---------------|--------|
+| **Authentication** | Supabase Auth (bestaand) | ✅ |
+| **Authorization** | Row Level Security (RLS) policies | 🔧 Toe te voegen |
+| **Data Encryption** | At rest (PostgreSQL), in transit (HTTPS) | ✅ |
+| **Input Validation** | Zod schemas op alle endpoints | ✅ |
+| **CORS** | Next.js default (same-origin) | ✅ |
+| **CSRF** | SameSite cookies | ✅ |
+| **Rate Limiting** | Vercel Edge (basic) | ✅ |
+
+### 7.2 Row Level Security Policies
+
+```sql
+-- Encounters: Users can only see/modify their own appointments
+CREATE POLICY "Users can view own encounters"
+ON encounters FOR SELECT
+USING (
+ practitioner_id IN (
+ SELECT practitioner_id FROM practitioners
+ WHERE user_id = auth.uid()
+ )
+);
+
+CREATE POLICY "Users can insert own encounters"
+ON encounters FOR INSERT
+WITH CHECK (
+ practitioner_id IN (
+ SELECT practitioner_id FROM practitioners
+ WHERE user_id = auth.uid()
+ )
+);
+
+CREATE POLICY "Users can update own encounters"
+ON encounters FOR UPDATE
+USING (
+ practitioner_id IN (
+ SELECT practitioner_id FROM practitioners
+ WHERE user_id = auth.uid()
+ )
+);
+
+-- No DELETE policy - we use soft delete (status = 'cancelled')
+```
+
+### 7.3 Data Privacy (AVG/GDPR)
+
+| Vereiste | Implementatie |
+|----------|---------------|
+| **Data minimalisatie** | Alleen noodzakelijke velden in encounters |
+| **Doelbinding** | Data alleen voor afspraakbeheer |
+| **Bewaartermijn** | Conform zorgsector: 15 jaar (post-MVP) |
+| **Inzagerecht** | Via patient dossier (bestaand) |
+| **Verwijderrecht** | Soft delete, anonimisatie (post-MVP) |
+
+### 7.4 Audit Logging (Post-MVP)
+
+```typescript
+// Future: Audit log structure
+interface AuditLog {
+ id: string;
+ timestamp: Date;
+ user_id: string;
+ action: 'create' | 'update' | 'delete' | 'view';
+ entity_type: 'encounter';
+ entity_id: string;
+ changes?: Record