feat: migrate clients module to patients + add docs

app/api/deepgram/transcribe/route.ts

@@ -0,0 +1,52 @@
+import { NextRequest, NextResponse } from 'next/server';
+
+const DEEPGRAM_URL = 'https://api.deepgram.com/v1/listen';
+
+export async function POST(request: NextRequest) {
+  try {
+    const apiKey = process.env.DEEPGRAM_API_KEY;
+    if (!apiKey) {
+      return NextResponse.json(
+        { error: 'DEEPGRAM_API_KEY ontbreekt' },
+        { status: 500 }
+      );
+    }
+
+    const formData = await request.formData();
+    const file = formData.get('file');
+
+    if (!(file instanceof File)) {
+      return NextResponse.json({ error: 'Bestand ontbreekt' }, { status: 400 });
+    }
+
+    const arrayBuffer = await file.arrayBuffer();
+    const buffer = Buffer.from(arrayBuffer);
+
+    const response = await fetch(DEEPGRAM_URL, {
+      method: 'POST',
+      headers: {
+        Authorization: `Token ${apiKey}`,
+        'Content-Type': file.type || 'audio/webm',
+      },
+      body: buffer,
+    });
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      console.error('Deepgram error', response.status, errorText);
+      return NextResponse.json(
+        { error: 'Deepgram transcribe mislukt', details: errorText },
+        { status: 502 }
+      );
+    }
+
+    const data = await response.json();
+    const transcript =
+      data.results?.channels?.[0]?.alternatives?.[0]?.transcript?.trim() || '';
+
+    return NextResponse.json({ transcript });
+  } catch (error) {
+    console.error('Unexpected error in Deepgram route', error);
+    return NextResponse.json({ error: 'Onverwachte fout' }, { status: 500 });
+  }
+}

app/api/intakes/[intakeId]/route.ts

@@ -0,0 +1,203 @@
+/**
+ * Intake Detail API Routes
+ *
+ * GET    /api/intakes/{intakeId}  - Get specific intake
+ * PUT    /api/intakes/{intakeId}  - Update intake
+ * DELETE /api/intakes/{intakeId}  - Delete intake
+ */
+
+import { createClient } from '@/lib/auth/server';
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+
+// Validation schema for updates
+const UpdateIntakeSchema = z.object({
+  title: z.string().min(1).optional(),
+  department: z.enum(['Volwassenen', 'Jeugd', 'Ouderen']).optional(),
+  status: z.enum(['bezig', 'afgerond']).optional(),
+  start_date: z.string().optional(),
+  end_date: z.string().nullable().optional(),
+  psychologist_id: z.string().uuid().nullable().optional(),
+  notes: z.string().nullable().optional(),
+});
+
+/**
+ * GET /api/intakes/{intakeId}
+ * Get a specific intake by ID
+ */
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ intakeId: string }> }
+) {
+  try {
+    const { intakeId } = await params;
+
+    // Validate UUID format
+    if (!z.string().uuid().safeParse(intakeId).success) {
+      return NextResponse.json(
+        { error: 'intakeId moet een geldige UUID zijn' },
+        { status: 400 }
+      );
+    }
+
+    const supabase = await createClient();
+
+    const { data, error } = await supabase
+      .from('intakes')
+      .select('*')
+      .eq('id', intakeId)
+      .single();
+
+    if (error) {
+      // Check if it's a not found error
+      if (error.code === 'PGRST116') {
+        return NextResponse.json(
+          { error: 'Intake niet gevonden' },
+          { status: 404 }
+        );
+      }
+
+      console.error('Error fetching intake:', error);
+      return NextResponse.json(
+        { error: 'Fout bij ophalen intake', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error('Unexpected error in GET /api/intakes/[intakeId]:', error);
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout' },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * PUT /api/intakes/{intakeId}
+ * Update an existing intake
+ */
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ intakeId: string }> }
+) {
+  try {
+    const { intakeId } = await params;
+
+    // Validate UUID format
+    if (!z.string().uuid().safeParse(intakeId).success) {
+      return NextResponse.json(
+        { error: 'intakeId moet een geldige UUID zijn' },
+        { status: 400 }
+      );
+    }
+
+    const body = await request.json();
+
+    // Validate input
+    const result = UpdateIntakeSchema.safeParse(body);
+
+    if (!result.success) {
+      return NextResponse.json(
+        {
+          error: 'Validatiefout',
+          details: result.error.errors.map(e => ({
+            field: e.path.join('.'),
+            message: e.message,
+          })),
+        },
+        { status: 400 }
+      );
+    }
+
+    const supabase = await createClient();
+
+    // Update intake
+    const { data, error } = await supabase
+      .from('intakes')
+      .update(result.data)
+      .eq('id', intakeId)
+      .select()
+      .single();
+
+    if (error) {
+      // Check if it's a not found error
+      if (error.code === 'PGRST116') {
+        return NextResponse.json(
+          { error: 'Intake niet gevonden' },
+          { status: 404 }
+        );
+      }
+
+      console.error('Error updating intake:', error);
+      return NextResponse.json(
+        { error: 'Fout bij bijwerken intake', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json(data);
+  } catch (error) {
+    console.error('Unexpected error in PUT /api/intakes/[intakeId]:', error);
+
+    // Handle JSON parse errors
+    if (error instanceof SyntaxError) {
+      return NextResponse.json(
+        { error: 'Ongeldige JSON in request body' },
+        { status: 400 }
+      );
+    }
+
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout' },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * DELETE /api/intakes/{intakeId}
+ * Delete an intake
+ */
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ intakeId: string }> }
+) {
+  try {
+    const { intakeId } = await params;
+
+    // Validate UUID format
+    if (!z.string().uuid().safeParse(intakeId).success) {
+      return NextResponse.json(
+        { error: 'intakeId moet een geldige UUID zijn' },
+        { status: 400 }
+      );
+    }
+
+    const supabase = await createClient();
+
+    // Delete intake
+    const { error } = await supabase
+      .from('intakes')
+      .delete()
+      .eq('id', intakeId);
+
+    if (error) {
+      console.error('Error deleting intake:', error);
+      return NextResponse.json(
+        { error: 'Fout bij verwijderen intake', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    // Return 204 No Content on successful deletion
+    return new NextResponse(null, { status: 204 });
+  } catch (error) {
+    console.error('Unexpected error in DELETE /api/intakes/[intakeId]:', error);
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout' },
+      { status: 500 }
+    );
+  }
+}

app/api/intakes/route.ts

@@ -0,0 +1,151 @@
+/**
+ * Intakes API Routes
+ *
+ * GET  /api/intakes?patientId={id}  - List all intakes for a patient
+ * POST /api/intakes                 - Create new intake
+ */
+
+import { createClient } from '@/lib/auth/server';
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+
+// Validation schemas
+const CreateIntakeSchema = z.object({
+  patient_id: z.string().uuid('Patient ID moet een geldige UUID zijn'),
+  title: z.string().min(1, 'Titel is verplicht'),
+  department: z.enum(['Volwassenen', 'Jeugd', 'Ouderen'], {
+    errorMap: () => ({ message: 'Afdeling moet Volwassenen, Jeugd of Ouderen zijn' }),
+  }),
+  start_date: z.string().min(1, 'Startdatum is verplicht'),
+  psychologist_id: z.string().uuid().optional(),
+  notes: z.string().optional(),
+});
+
+/**
+ * GET /api/intakes?patientId={id}
+ * List all intakes for a specific patient
+ */
+export async function GET(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const patientId = searchParams.get('patientId');
+
+    if (!patientId) {
+      return NextResponse.json(
+        { error: 'patientId query parameter is verplicht' },
+        { status: 400 }
+      );
+    }
+
+    // Validate UUID format
+    if (!z.string().uuid().safeParse(patientId).success) {
+      return NextResponse.json(
+        { error: 'patientId moet een geldige UUID zijn' },
+        { status: 400 }
+      );
+    }
+
+    const supabase = await createClient();
+
+    const { data, error } = await supabase
+      .from('intakes')
+      .select('*')
+      .eq('patient_id', patientId)
+      .order('start_date', { ascending: false });
+
+    if (error) {
+      console.error('Error fetching intakes:', error);
+      return NextResponse.json(
+        { error: 'Fout bij ophalen intakes', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json({
+      intakes: data,
+      total: data.length,
+    });
+  } catch (error) {
+    console.error('Unexpected error in GET /api/intakes:', error);
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+    const errorStack = error instanceof Error ? error.stack : undefined;
+    
+    return NextResponse.json(
+      { 
+        error: 'Onverwachte serverfout',
+        details: errorMessage,
+        ...(process.env.NODE_ENV === 'development' && { stack: errorStack }),
+      },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * POST /api/intakes
+ * Create a new intake
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+
+    // Validate input
+    const result = CreateIntakeSchema.safeParse(body);
+
+    if (!result.success) {
+      return NextResponse.json(
+        {
+          error: 'Validatiefout',
+          details: result.error.errors.map(e => ({
+            field: e.path.join('.'),
+            message: e.message,
+          })),
+        },
+        { status: 400 }
+      );
+    }
+
+    const { patient_id, title, department, start_date, psychologist_id, notes } = result.data;
+    const supabase = await createClient();
+
+    // Create intake
+    const { data, error } = await supabase
+      .from('intakes')
+      .insert({
+        patient_id,
+        title,
+        department,
+        start_date,
+        psychologist_id,
+        notes,
+        status: 'bezig', // Default status in database enum
+      })
+      .select()
+      .single();
+
+    if (error) {
+      console.error('Error creating intake:', error);
+      return NextResponse.json(
+        { error: 'Fout bij aanmaken intake', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json(data, { status: 201 });
+  } catch (error) {
+    console.error('Unexpected error in POST /api/intakes:', error);
+
+    // Handle JSON parse errors
+    if (error instanceof SyntaxError) {
+      return NextResponse.json(
+        { error: 'Ongeldige JSON in request body' },
+        { status: 400 }
+      );
+    }
+
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout' },
+      { status: 500 }
+    );
+  }
+}

app/api/screenings/[screeningId]/activities/route.ts

@@ -0,0 +1,121 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+import { createClient } from '@/lib/auth/server';
+
+const createSchema = z.object({
+  activity_text: z
+    .string()
+    .min(3, 'Beschrijf minimaal 3 tekens')
+    .max(2000, 'Maximaal 2000 tekens'),
+});
+
+async function getPractitionerForUser(supabase: Awaited<ReturnType<typeof createClient>>, userId?: string) {
+  if (!userId) return null;
+
+  const { data } = await supabase
+    .from('practitioners')
+    .select('id, name_given, name_family')
+    .eq('user_id', userId)
+    .maybeSingle();
+
+  return data;
+}
+
+function formatPractitionerName(practitioner: any) {
+  if (!practitioner) return null;
+  const given = (practitioner.name_given || []).join(' ');
+  const family = practitioner.name_family || '';
+  return `${given} ${family}`.trim();
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ screeningId: string }> }
+) {
+  try {
+    const { screeningId } = await params;
+    const supabase = await createClient();
+
+    const { data, error } = await supabase
+      .from('screening_activities')
+      .select('*')
+      .eq('screening_id', screeningId)
+      .order('created_at', { ascending: false });
+
+    if (error) {
+      console.error('Error fetching activities:', error);
+      return NextResponse.json(
+        { error: 'Fout bij ophalen activiteiten', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json({ activities: data || [] });
+  } catch (error) {
+    console.error('Unexpected error in GET /api/screenings/[screeningId]/activities:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout', details: message },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ screeningId: string }> }
+) {
+  try {
+    const body = await request.json();
+    const parsed = createSchema.safeParse(body);
+
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Validatiefout', details: parsed.error.flatten().fieldErrors },
+        { status: 400 }
+      );
+    }
+
+    const { screeningId } = await params;
+    const supabase = await createClient();
+
+    const {
+      data: { user },
+    } = await supabase.auth.getUser();
+
+    if (!user) {
+      return NextResponse.json({ error: 'Niet geautoriseerd' }, { status: 401 });
+    }
+
+    const practitioner = await getPractitionerForUser(supabase, user.id);
+    const displayName = formatPractitionerName(practitioner) || user.user_metadata?.full_name || user.email || 'Onbekende gebruiker';
+
+    const { data, error } = await supabase
+      .from('screening_activities')
+      .insert({
+        screening_id: screeningId,
+        activity_text: parsed.data.activity_text,
+        created_by: practitioner?.id || null,
+        created_by_name: displayName,
+      })
+      .select('*')
+      .single();
+
+    if (error) {
+      console.error('Error creating activity:', error);
+      return NextResponse.json(
+        { error: 'Fout bij toevoegen activiteit', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json({ activity: data }, { status: 201 });
+  } catch (error) {
+    console.error('Unexpected error in POST /api/screenings/[screeningId]/activities:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout', details: message },
+      { status: 500 }
+    );
+  }
+}

app/api/screenings/[screeningId]/documents/[documentId]/route.ts

@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { createClient } from '@/lib/auth/server';
+import { supabaseAdmin } from '@/lib/supabase/server';
+
+const BUCKET = 'screening-documents';
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: Promise<{ screeningId: string; documentId: string }> }
+) {
+  try {
+    const { documentId } = await params;
+    const supabase = await createClient();
+
+    const {
+      data: { user },
+    } = await supabase.auth.getUser();
+
+    if (!user) {
+      return NextResponse.json({ error: 'Niet geautoriseerd' }, { status: 401 });
+    }
+
+    const { data: document, error } = await supabase
+      .from('screening_documents')
+      .select('*')
+      .eq('id', documentId)
+      .maybeSingle();
+
+    if (error) {
+      console.error('Fetch document error:', error);
+      return NextResponse.json(
+        { error: 'Document niet gevonden', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    if (!document) {
+      return NextResponse.json({ error: 'Document niet gevonden' }, { status: 404 });
+    }
+
+    const { error: deleteError } = await supabaseAdmin.storage
+      .from(BUCKET)
+      .remove([document.file_path]);
+
+    if (deleteError) {
+      console.error('Storage delete error:', deleteError);
+      // Don't stop here; attempt DB delete even if storage failed
+    }
+
+    const { error: dbError } = await supabase
+      .from('screening_documents')
+      .delete()
+      .eq('id', documentId);
+
+    if (dbError) {
+      console.error('DB delete error:', dbError);
+      return NextResponse.json(
+        { error: 'Verwijderen mislukt', details: dbError.message },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json({ success: true });
+  } catch (error) {
+    console.error('Unexpected error in DELETE /documents/[documentId]:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

app/api/screenings/[screeningId]/documents/route.ts

@@ -0,0 +1,128 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { createClient } from '@/lib/auth/server';
+import { supabaseAdmin } from '@/lib/supabase/server';
+
+const BUCKET = 'screening-documents';
+
+async function ensureBucket() {
+  const { data, error } = await supabaseAdmin.storage.getBucket(BUCKET);
+  if (!data) {
+    const { error: createError } = await supabaseAdmin.storage.createBucket(BUCKET, {
+      public: true,
+      fileSizeLimit: 50 * 1024 * 1024, // 50 MB
+    });
+    if (createError && !createError.message.includes('already exists')) {
+      throw createError;
+    }
+  } else if (error && !error.message.includes('not found')) {
+    throw error;
+  }
+}
+
+async function getPractitionerByUser(supabase: Awaited<ReturnType<typeof createClient>>, userId?: string) {
+  if (!userId) return null;
+  const { data } = await supabase
+    .from('practitioners')
+    .select('id, name_given, name_family')
+    .eq('user_id', userId)
+    .maybeSingle();
+  return data;
+}
+
+function formatDisplayName(practitioner: any, fallback: string) {
+  if (practitioner) {
+    const given = (practitioner.name_given || []).join(' ');
+    const family = practitioner.name_family || '';
+    return `${given} ${family}`.trim();
+  }
+  return fallback;
+}
+
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ screeningId: string }> }
+) {
+  try {
+    const { screeningId } = await params;
+    const supabase = await createClient();
+
+    const {
+      data: { user },
+      error: userError,
+    } = await supabase.auth.getUser();
+
+    if (userError || !user) {
+      return NextResponse.json({ error: 'Niet geautoriseerd' }, { status: 401 });
+    }
+
+    const formData = await request.formData();
+    const file = formData.get('file');
+    if (!(file instanceof File)) {
+      return NextResponse.json({ error: 'Bestand ontbreekt' }, { status: 400 });
+    }
+
+    const documentType = (formData.get('documentType') as string) || 'overig';
+
+    await ensureBucket();
+
+    const filePath = `${screeningId}/${Date.now()}-${file.name}`;
+    const arrayBuffer = await file.arrayBuffer();
+    const { error: uploadError } = await supabaseAdmin.storage
+      .from(BUCKET)
+      .upload(filePath, Buffer.from(arrayBuffer), {
+        contentType: file.type,
+        cacheControl: '3600',
+        upsert: false,
+      });
+
+    if (uploadError) {
+      console.error('Upload error:', uploadError);
+      return NextResponse.json(
+        { error: 'Upload mislukt', details: uploadError.message },
+        { status: 500 }
+      );
+    }
+
+    const practitioner = await getPractitionerByUser(supabase, user.id);
+    const displayName = formatDisplayName(
+      practitioner,
+      (user.user_metadata?.full_name as string) || user.email || 'Onbekend'
+    );
+
+    const { data, error } = await supabase
+      .from('screening_documents')
+      .insert({
+        screening_id: screeningId,
+        file_name: file.name,
+        file_type: file.type,
+        file_size: file.size,
+        file_path: filePath,
+        document_type: documentType,
+        uploaded_by: practitioner?.id || null,
+        uploaded_by_name: displayName,
+      })
+      .select('*')
+      .single();
+
+    if (error) {
+      console.error('DB insert error:', error);
+      return NextResponse.json(
+        { error: 'Opslaan mislukt', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    const { data: publicUrlData } = supabaseAdmin.storage.from(BUCKET).getPublicUrl(filePath);
+
+    return NextResponse.json({
+      document: {
+        ...data,
+        publicUrl: publicUrlData.publicUrl,
+      },
+    });
+  } catch (error) {
+    console.error('Unexpected error in POST /documents:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

app/api/screenings/[screeningId]/route.ts

@@ -0,0 +1,177 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+import { createClient } from '@/lib/auth/server';
+
+const updateSchema = z.object({
+  request_for_help: z.string().optional(),
+  decision: z.enum(['geschikt', 'niet_geschikt']).optional(),
+  decision_notes: z.string().optional(),
+  decision_department: z.string().optional(),
+});
+
+function serializeScreening(screening: any) {
+  const activities = [...(screening.screening_activities || [])].sort((a, b) => {
+    const aTime = a.created_at ? new Date(a.created_at).getTime() : 0;
+    const bTime = b.created_at ? new Date(b.created_at).getTime() : 0;
+    return bTime - aTime;
+  });
+
+  const documents = [...(screening.screening_documents || [])].sort((a, b) => {
+    const aTime = a.uploaded_at ? new Date(a.uploaded_at).getTime() : 0;
+    const bTime = b.uploaded_at ? new Date(b.uploaded_at).getTime() : 0;
+    return bTime - aTime;
+  });
+
+  return {
+    ...screening,
+    screening_activities: activities,
+    screening_documents: documents,
+  };
+}
+
+async function getPractitionerForUser(supabase: Awaited<ReturnType<typeof createClient>>, userId?: string) {
+  if (!userId) return null;
+
+  const { data } = await supabase
+    .from('practitioners')
+    .select('id, name_given, name_family')
+    .eq('user_id', userId)
+    .maybeSingle();
+
+  return data;
+}
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ screeningId: string }> }
+) {
+  try {
+    const { screeningId } = await params;
+    const supabase = await createClient();
+
+    const { data, error } = await supabase
+      .from('screenings')
+      .select('*, screening_activities(*), screening_documents(*)')
+      .eq('id', screeningId)
+      .maybeSingle();
+
+    if (error) {
+      console.error('Error fetching screening:', error);
+      return NextResponse.json(
+        { error: 'Fout bij ophalen screening', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    if (!data) {
+      return NextResponse.json({ error: 'Screening niet gevonden' }, { status: 404 });
+    }
+
+    return NextResponse.json({ screening: serializeScreening(data) });
+  } catch (error) {
+    console.error('Unexpected error in GET /api/screenings/[screeningId]:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout', details: message },
+      { status: 500 }
+    );
+  }
+}
+
+export async function PUT(
+  request: NextRequest,
+  { params }: { params: Promise<{ screeningId: string }> }
+) {
+  try {
+    const body = await request.json();
+    const parsed = updateSchema.safeParse(body);
+
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Validatiefout', details: parsed.error.flatten().fieldErrors },
+        { status: 400 }
+      );
+    }
+
+    const { screeningId } = await params;
+    const supabase = await createClient();
+
+    const updates: Record<string, unknown> = {};
+
+    if (Object.prototype.hasOwnProperty.call(parsed.data, 'request_for_help')) {
+      updates.request_for_help = parsed.data.request_for_help || null;
+    }
+
+    if (Object.prototype.hasOwnProperty.call(parsed.data, 'decision_notes')) {
+      updates.decision_notes = parsed.data.decision_notes || null;
+    }
+
+    if (Object.prototype.hasOwnProperty.call(parsed.data, 'decision_department')) {
+      updates.decision_department = parsed.data.decision_department || null;
+    }
+
+    if (Object.prototype.hasOwnProperty.call(parsed.data, 'decision')) {
+      const decision = parsed.data.decision;
+
+      if (decision === 'geschikt' && !parsed.data.decision_department) {
+        return NextResponse.json(
+          { error: 'Afdeling is verplicht bij een positief besluit' },
+          { status: 400 }
+        );
+      }
+
+      const {
+        data: { user },
+      } = await supabase.auth.getUser();
+
+      const practitioner = await getPractitionerForUser(supabase, user?.id);
+
+      updates.decision = decision;
+      updates.decision_date = new Date().toISOString();
+      updates.decision_by = practitioner?.id || null;
+    }
+
+    if (Object.keys(updates).length === 0) {
+      return NextResponse.json(
+        { error: 'Geen velden om bij te werken ontvangen' },
+        { status: 400 }
+      );
+    }
+
+    const { data, error } = await supabase
+      .from('screenings')
+      .update(updates)
+      .eq('id', screeningId)
+      .select('*, screening_activities(*), screening_documents(*)')
+      .single();
+
+    if (error) {
+      console.error('Error updating screening:', error);
+      return NextResponse.json(
+        { error: 'Fout bij bijwerken screening', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    if (parsed.data.decision) {
+      const newStatus = parsed.data.decision === 'geschikt' ? 'active' : 'cancelled';
+      const { error: statusError } = await supabase
+        .from('patients')
+        .update({ status: newStatus })
+        .eq('id', data.patient_id);
+
+      if (statusError) {
+        console.error('Error updating patient status:', statusError);
+      }
+    }
+
+    return NextResponse.json({ screening: serializeScreening(data) });
+  } catch (error) {
+    console.error('Unexpected error in PUT /api/screenings/[screeningId]:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout', details: message },
+      { status: 500 }
+    );
+  }
+}

app/api/screenings/route.ts

@@ -0,0 +1,127 @@
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+import { createClient } from '@/lib/auth/server';
+
+const querySchema = z.object({
+  patientId: z.string().uuid('patientId moet een geldige UUID zijn'),
+});
+
+const createSchema = z.object({
+  patient_id: z.string().uuid('patient_id moet een geldige UUID zijn'),
+});
+
+function serializeScreening(screening: any) {
+  const activities = [...(screening.screening_activities || [])].sort((a, b) => {
+    const aTime = a.created_at ? new Date(a.created_at).getTime() : 0;
+    const bTime = b.created_at ? new Date(b.created_at).getTime() : 0;
+    return bTime - aTime;
+  });
+
+  const documents = [...(screening.screening_documents || [])].sort((a, b) => {
+    const aTime = a.uploaded_at ? new Date(a.uploaded_at).getTime() : 0;
+    const bTime = b.uploaded_at ? new Date(b.uploaded_at).getTime() : 0;
+    return bTime - aTime;
+  });
+
+  return {
+    ...screening,
+    screening_activities: activities,
+    screening_documents: documents,
+  };
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url);
+    const parsed = querySchema.safeParse({ patientId: searchParams.get('patientId') });
+
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'patientId query parameter is verplicht' },
+        { status: 400 }
+      );
+    }
+
+    const supabase = await createClient();
+    const { patientId } = parsed.data;
+
+    const { data, error } = await supabase
+      .from('screenings')
+      .select('*, screening_activities(*), screening_documents(*)')
+      .eq('patient_id', patientId)
+      .maybeSingle();
+
+    if (error && error.code !== 'PGRST116') {
+      console.error('Error fetching screening:', error);
+      return NextResponse.json(
+        { error: 'Fout bij ophalen screening', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    if (!data) {
+      const { data: created, error: insertError } = await supabase
+        .from('screenings')
+        .insert({ patient_id: patientId })
+        .select('*, screening_activities(*), screening_documents(*)')
+        .single();
+
+      if (insertError) {
+        console.error('Error creating screening:', insertError);
+        return NextResponse.json(
+          { error: 'Fout bij aanmaken screening', details: insertError.message },
+          { status: 500 }
+        );
+      }
+
+      return NextResponse.json({ screening: serializeScreening(created) });
+    }
+
+    return NextResponse.json({ screening: serializeScreening(data) });
+  } catch (error) {
+    console.error('Unexpected error in GET /api/screenings:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout', details: message },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json();
+    const parsed = createSchema.safeParse(body);
+
+    if (!parsed.success) {
+      return NextResponse.json(
+        { error: 'Validatiefout', details: parsed.error.flatten().fieldErrors },
+        { status: 400 }
+      );
+    }
+
+    const supabase = await createClient();
+    const { data, error } = await supabase
+      .from('screenings')
+      .insert({ patient_id: parsed.data.patient_id })
+      .select('*, screening_activities(*), screening_documents(*)')
+      .single();
+
+    if (error) {
+      console.error('Error creating screening:', error);
+      return NextResponse.json(
+        { error: 'Fout bij aanmaken screening', details: error.message },
+        { status: 500 }
+      );
+    }
+
+    return NextResponse.json({ screening: serializeScreening(data) }, { status: 201 });
+  } catch (error) {
+    console.error('Unexpected error in POST /api/screenings:', error);
+    const message = error instanceof Error ? error.message : 'Unknown error';
+    return NextResponse.json(
+      { error: 'Onverwachte serverfout', details: message },
+      { status: 500 }
+    );
+  }
+}