temetro/backend/CLAUDE.md

CLAUDE.md

Guidance for Claude Code when working in backend/. See the root ../CLAUDE.md for the project vision and README.md here for run/setup instructions.

What this is

The temetro API: TypeScript + Express 5 + Postgres (Drizzle ORM), with authentication and multi-tenant clinics via Better Auth. Serves the ../frontend app. ESM ("type": "module"), Node ≥ 20. This is its own git repo — commit changes here with the Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> trailer.

Commands

npm run dev          # tsx watch on http://localhost:4000
npm run build        # tsc -> dist/
npm run typecheck    # tsc --noEmit
npm run auth:generate  # Better Auth CLI -> src/db/schema/auth.ts (re-run after auth config changes)
npm run db:generate    # drizzle-kit: schema -> ./drizzle/*.sql migration
npm run db:migrate     # drizzle-kit: apply migrations (local dev)
npm run db:apply       # node dist/migrate.js — runtime migrator (used by Docker)

No test runner is configured. Verify by running the stack (docker compose up) and curling, or npm run dev against a local Postgres. See README.md.

Architecture

• src/auth.ts — the Better Auth config (the CLI auto-discovers it). Email/password + username plugin (staff sign in by username) and the organization plugin (clinics) with custom RBAC from src/lib/access.ts (owner/admin/doctor/reception/pharmacy/lab/member over patient/appointment/prescription/task/lab resources). reception has no prescription statement — it's scoped to scheduling + registration, and src/services/patients.ts redacts clinical fields for it. pharmacy has prescription read/write (no delete — prescription:delete is the full-clinician marker the frontend route gating probes); lab submits results via the lab statement (POST /api/patients/:fileNumber/labs) without patient:write. Mounted in src/index.ts via toNodeHandler(auth) at /api/auth/*.
• src/routes/staff.ts — admin-provisioned staff: POST /api/staff creates a user (auth.api.signUpEmail) + attaches them to the clinic (auth.api.addMember); GET /api/staff lists members with usernames. Replaces the old email-invitation flow. Gated by requirePermission({ member: ["create"] }).
• Better Auth = the single source of RBAC. Manage all permissions through Better Auth, not a custom layer. Authoritative references live as repo skills under .claude/skills/{better-auth-best-practices,organization-best-practices, email-and-password-best-practices,better-auth-security-best-practices} — consult them before changing auth.ts, src/lib/access.ts, or the auth schema.
• src/db/ — index.ts is the Drizzle client (no schema passed; we use the core query builder). schema/auth.ts is generated by the Better Auth CLI; schema/patients.ts is hand-written and references the generated organization/user tables.
• src/services/patients.ts maps DB rows ⇆ the canonical Patient shape (src/types/patient.ts, mirrors ../frontend/lib/patients.ts). src/routes/patients.ts is org-scoped CRUD, gated by src/middleware/auth.ts (requireAuth → requireOrg → requirePermission).
• Other resources follow the patients/notes pattern (schema → validation → types → service → org-scoped route): appointments, prescriptions, tasks (RBAC-gated like patients), plus activity (an audit log written best-effort from every resource route via services/activity.ts), analytics (computed aggregates), messaging (conversations / participants / messages) and notifications (per-recipient, auto-generated).
• Real-time lives in src/realtime.ts — a Socket.io server attached to the same HTTP server in index.ts; the handshake reuses Better Auth's getSession. Other modules push via emitToUser / emitToConversation (no direct socket import, so no circular deps).
• Patient-wallet relay is no longer hosted here. Devices connect to the standalone Temetro Network service (~/Desktop/Temetro-network, see root CLAUDE.md), which is multi-clinic. This backend connects to it as a /hub client in src/services/relay-client.ts, keeping one authenticated connection per network-enabled org (hubs map keyed by orgId). Each org authenticates by signing the relay's hub:challenge with its clinic signing key (signWithClinicKey) — no shared RELAY_TOKEN needed (it's now optional/legacy, only for a private relay). emitToWallet(orgId, …) (realtime.ts) delegates to sendToWallet(orgId, …), and device responses (wallet:share-response / wallet:update-response / wallet:revoke) + wallet:online replay are handled per-org there, calling the same wallet-share / wallet-updates services the old /wallet namespace did. A clinic opts in via "Join Temetro Network" (Settings → Signing → PUT /api/signing/network, clinic_signing_keys.network_enabled); connectOrg/disconnectOrg open/close its connection, and wallet routes 409 when it's off.
• src/lib/email.ts — sendEmail logs links to the console when SMTP is unset.

Gotchas / conventions

• Schema generation order (circular bootstrap): auth.ts → db/index.ts must NOT pull in the patient schema, so the Better Auth CLI can load auth.ts to (re)generate schema/auth.ts. After any auth/plugin change: npm run auth:generate → npm run db:generate → npm run db:migrate.
• Express 5 needs a named wildcard: app.all("/api/auth/*splat", …), and the Better Auth handler must be registered before express.json().
• Secure cookies key off BETTER_AUTH_URL scheme (https), not NODE_ENV — otherwise login breaks over http://localhost in the production-mode Docker stack.
• Rate limiting needs a client IP; behind no proxy we backfill x-forwarded-for from the socket in index.ts so it still applies.
• Env: src/env.ts (zod) treats empty strings as unset (compose passes ${VAR:-} as "") and has dev defaults so the CLIs can load the config offline.
• Email verification is wired but NOT enforced at sign-in (emailAndPassword.requireEmailVerification: false in auth.ts) — re-enable by flipping it to true (and route signup back to /verify-email in the frontend).
• Docker: migrations run on container start (node dist/migrate.js); docker-compose.yml exposes a configurable POSTGRES_PORT host port.

AI chat

• src/routes/chat.ts — POST /api/chat, a tool-using agent (AI SDK v6 streamText) gated by patient:read. Providers resolve from the picked model id via src/services/ai/provider.ts (Anthropic / OpenAI / Gemini for API-key mode, or a local Ollama via the OpenAI-compatible endpoint). Tools (src/services/ai/tools.ts) reuse the patient service under the same role scoping and stream real record data to the client as custom data parts while the model sees only Veil-redacted results.
• Veil (src/services/ai/veil.ts) de-identifies PHI to tokens before external calls, resolves tokens on tool args, and rehydrates the final text (external mode runs non-streamed so the rehydrated text is correct). Local mode bypasses it.
• AI config lives in src/routes/ai.ts (/api/ai/config, /test, /import) over the user_ai_settings table; provider keys are encrypted with src/lib/crypto.ts (AI_CREDENTIALS_KEY). The migration import is gated behind a client approval step and re-validated server-side.

Not built yet

The signing / patient-owned-storage / approval flow.