Guard routes so client cannot access patients, Appointments outside of group

[kchapple]

No description provided.

[Leo24]

Do you mean to add check of patient group_id?
How interacts patients group_id with user emr_id?

[kchapple]

Yes @Leo24 . The patient group_id equals the pid for the master patient in the EHR database. Dependents have their own pid, and the group_id field is the pid of the master patient record. We need to disallow the user account from accessing patients outside their group, meaning that the patient must have the currently logged-in user's emr_id in the group_id field in order to access the Patient resource, or we should return an unauthorized response.

[Leo24]

#87 - Add check of patient group_id