Khalid Abdi
6213da9477
Replace the email-invitation flow with admin-provisioned staff accounts and
add role-based access that changes what each member sees.
Backend:
- Enable Better Auth `username` plugin (staff sign in by username); regenerate
auth schema (+ username/displayUsername on user) and migration 0007.
- Add `doctor` and `reception` roles to the access-control RBAC. `reception` is
scoped to scheduling + registration (no `prescription` statement).
- New `/api/staff` route: POST creates a user (auth.api.signUpEmail) and adds
them to the active clinic (auth.api.addMember); GET lists members + usernames.
Gated by requirePermission({ member: ["create"] }).
- Redact clinical PHI for the reception role in the patients service (read,
create and update) so demographics-only is enforced server-side.
Frontend:
- usernameClient + Email|Username tabs on the login form.
- lib/roles.ts: useActiveRole + Better-Auth-permission-driven nav visibility,
default landing, and a route guard (reception -> /appointments, blocked from
clinical routes). Applied to the sidebar, command palette and auth guard.
- Care team page now provisions staff via a two-step Add-team-member dialog
(details -> username/password) hitting /api/staff; removes the email-invite
and pending-invitation UI. New members are contactable from Messages
automatically (they become org members).
- Hide clinical sections of the patient form and the admin-only settings tabs
for non-clinical/non-admin roles.
All permission management stays in Better Auth (per the better-auth skills now
referenced in backend/CLAUDE.md).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
temetro backend
TypeScript + Express + Postgres API for temetro. Authentication is powered by
Better Auth (email/password with verification, password reset, and
multi-tenant organizations with role-based access control). Patient records are scoped to an
organization (a clinic) and exposed over a small REST API that mirrors the frontend's Patient
shape exactly.
Quick start (Docker)
cp .env.example .env
# set a strong secret:
# openssl rand -base64 32 -> paste into BETTER_AUTH_SECRET
docker compose up # db + backend + frontend
- Frontend → http://localhost:3000
- Backend → http://localhost:4000 (health:
GET /health, auth health:GET /api/auth/ok) - Postgres → localhost:5432
Run only the API + database: docker compose up db backend.
Browse the DB with Adminer: docker compose --profile tools up adminer → http://localhost:8080.
Migrations are applied automatically on container start (node dist/migrate.js).
Local development (without Docker)
npm install
cp .env.example .env # point DATABASE_URL at a local Postgres (localhost:5432)
npm run db:migrate # apply migrations (drizzle-kit)
npm run dev # tsx watch on http://localhost:4000
Auth & schema workflow
The Better Auth tables are generated into src/db/schema/auth.ts from src/auth.ts. Re-run after
changing auth config/plugins, then regenerate the SQL migration:
npm run auth:generate # better-auth CLI -> src/db/schema/auth.ts
npm run db:generate # drizzle-kit -> ./drizzle/*.sql
npm run db:migrate # apply
API
All patient routes require a signed-in user (Better Auth session cookie) and an active organization; access is gated by the caller's clinic role.
| Method | Path | Permission | Notes |
|---|---|---|---|
| GET | /api/patients |
patient:read |
list patients in the active clinic |
| GET | /api/patients/:fileNumber |
patient:read |
one patient (404 if absent) |
| POST | /api/patients |
patient:write |
create (409 if file number exists) |
| PUT | /api/patients/:fileNumber |
patient:write |
replace the full record |
| DELETE | /api/patients/:fileNumber |
patient:delete |
remove a patient |
Other org-scoped resources follow the same pattern (CRUD, role-gated):
| Resource | Base path | Permission | Notes |
|---|---|---|---|
| Appointments | /api/appointments |
appointment:* |
list / create / update / delete |
| Prescriptions | /api/prescriptions |
prescription:* |
prescriber defaults to the signed-in user |
| Tasks | /api/tasks |
task:* |
PATCH /:id for partial updates / the done toggle |
| Notes | /api/notes |
— (author-scoped) | private to the signed-in author |
| Activity | GET /api/activity |
— (any member) | audit feed of record changes |
| Analytics | GET /api/analytics |
— (any member) | computed clinic aggregates |
| Conversations | /api/conversations |
— (participant-scoped) | staff messaging; real-time over Socket.io |
| Notifications | /api/notifications |
— (per-recipient) | auto-generated; read-all + per-id read |
Real-time messaging and live notifications are delivered over Socket.io, attached to the same HTTP server; the handshake is authenticated with the Better Auth session cookie.
Auth endpoints (sign up / in / out, verify email, reset password, organizations & invitations) are
served by Better Auth under /api/auth/*.
Roles
| Role | Patient access | Clinic management |
|---|---|---|
owner |
read / write / delete | full |
admin |
read / write / delete | members, invitations, settings |
member (clinician) |
read / write | — |
viewer |
read | — |
Environment
See .env.example. If SMTP_HOST is unset, verification / reset / invitation emails are printed
to the server console instead of being sent — no setup required for local development.