diff --git a/.env.example b/.env.example index 3622a44..68ea53c 100644 --- a/.env.example +++ b/.env.example @@ -91,6 +91,10 @@ ELEVENLABS_API_KEY= # App PORT=3000 APP_URL=https://your-domain.com + +# Cloudflare Turnstile (anti-bot on registration, optional) +# TURNSTILE_SITE_KEY=your-site-key +# TURNSTILE_SECRET_KEY=your-secret-key JWT_SECRET=generate-a-random-64-char-string-here # Email (for verification & password reset) diff --git a/README.md b/README.md index 46053af..c885589 100644 --- a/README.md +++ b/README.md @@ -1,67 +1,78 @@ -# 🩺 Pediatric AI Scribe v3 +# Pediatric AI Scribe v6 -AI-powered clinical documentation platform for pediatric medicine. Generates HPIs, hospital courses, chart reviews, SOAP notes, and developmental milestone assessments from voice recordings or dictation β€” in seconds, in plain copy-ready text. +AI-powered clinical documentation platform for pediatric medicine. Generates HPIs, hospital courses, chart reviews, SOAP notes, well/sick visit notes, and developmental milestone assessments from voice recordings or dictation. ## Features -- **Live Encounter β†’ HPI** β€” record a live doctor-patient conversation, AI generates a structured OLDCARTS HPI -- **Voice Dictation β†’ HPI / SOAP** β€” dictate your narrative, AI cleans and restructures it -- **Hospital Course Generator** β€” paste progress notes, AI generates prose, day-by-day, organ-system (ICU), or psych format summaries -- **Chart Review / Precharting** β€” summarize outpatient, subspecialty, and ED notes into a precharting brief -- **SOAP Note Generator** β€” full SOAP or subjective-only from dictation -- **Well Visit / Preventive Care** β€” AAP 2025 Bright Futures periodicity; vaccines, screenings, billing codes; By Visit Age, Milestones, SSHADESS (12+), and Visit Note subtabs -- **Sick Visit Note** β€” quick documentation with auto-suggested ROS and PE systems from chief complaint -- **Developmental Milestones** β€” AAP/Nelson milestone tracker (birth–11 years) with narrative, structured list, or 3-sentence summary; copy to Visit Note -- **SSHADESS Assessment** β€” adolescent psychosocial screening for ages 12+; auto-fills into Visit Note -- **Vaccine Schedule** β€” full AAP immunization schedule reference -- **Catch-Up Schedule** β€” catch-up immunization guide -- **Plain text output** β€” all documents generated without markdown, ready to paste into any EHR -- **Read Aloud** β€” browser TTS reads generated documents; ElevenLabs (Adam voice) supported -- **Copy & Export** β€” one-click copy or export to Nextcloud -- **Refine & Shorten** β€” edit any document with plain-language AI instructions -- **Per-tab model selector** β€” choose fast vs. smart vs. reasoning models per task -- **Collapsible sidebar** β€” desktop sidebar collapses to icon rail, state persisted -- **Save & Resume** β€” encounters saved with unique IDs; persist across page refresh -- **Admin Panel** β€” user management, registration control, audit logs +### Clinical Documentation +- **Live Encounter** β€” record doctor-patient conversations, AI generates structured OLDCARTS HPI +- **Voice Dictation** β€” dictate narrative, AI cleans and restructures +- **Hospital Course** β€” paste progress notes, generates prose, day-by-day, organ-system (ICU), or psych format +- **Chart Review / Precharting** β€” summarize outpatient, subspecialty, and ED notes +- **SOAP Notes** β€” full SOAP or subjective-only from dictation +- **Well Visit** β€” AAP 2025 Bright Futures periodicity with vaccines, screenings, billing codes, SSHADESS (12+), milestones +- **Sick Visit** β€” quick documentation with auto-suggested ROS and PE from chief complaint +- **Developmental Milestones** β€” AAP/Nelson tracker (birth-11y) with narrative/structured/summary output + +### AI & Speech +- **5 AI Providers** β€” OpenRouter, AWS Bedrock, Azure OpenAI, Google Vertex AI, LiteLLM +- **5 STT Providers** β€” Google Gemini, Amazon Transcribe (Medical), OpenAI Whisper, Local Whisper, LiteLLM +- **3 TTS Providers** β€” Google Cloud TTS, LiteLLM (OpenAI), ElevenLabs +- **Browser Whisper** β€” fully offline in-browser transcription via WebAssembly (HIPAA-safe) +- **Per-tab model selector** β€” choose fast vs. smart vs. premium models per task +- **Physician memory system** β€” Dragon-like learning from your corrections + +### Learning Hub +- **Content Management** β€” articles, clinical pearls, quizzes, presentations +- **AI Content Generation** β€” generate from topics, uploaded PDFs, or Nextcloud files +- **Marp Presentations** β€” slide editor with preview and PPTX export +- **Semantic Search** β€” vector-based search via pgvector embeddings +- **Quiz System** β€” MCQ, multi-select, true/false with scoring and progress tracking + +### Platform +- **Multi-user with roles** β€” admin, moderator, user +- **OIDC/SSO** β€” Azure AD, Okta, Keycloak, PocketID, Google - **2FA** β€” TOTP-based two-factor authentication -- **Multi-provider AI** β€” OpenRouter, AWS Bedrock, or Azure OpenAI +- **Cloudflare Turnstile** β€” bot protection on login, register, password reset +- **Email verification** β€” with customizable templates +- **Nextcloud integration** β€” WebDAV export +- **S3 Document Storage** β€” AWS S3, Backblaze B2, MinIO +- **PWA** β€” installable, works on mobile +- **Admin Panel** β€” user management, settings, prompt editor, model configuration, logs --- -## Quick Start (Docker) +## Quick Start -### 1. Clone and configure +### 1. Configure ```bash -git clone https://github.com/ifedan-ed/pediatric-ai-scribe-v3.git -cd pediatric-ai-scribe-v3 cp .env.example .env ``` Edit `.env` β€” at minimum set: ```env -OPENROUTER_API_KEY=sk-or-v1-... -OPENAI_API_KEY=sk-... # for Whisper transcription -JWT_SECRET=<64-char random string> +AI_PROVIDER=litellm # or openrouter, bedrock, azure, vertex +LITELLM_API_BASE=https://your-litellm.example.com +LITELLM_API_KEY=sk-... + +OPENAI_API_KEY=sk-... # for Whisper transcription (if not using LiteLLM STT) + +JWT_SECRET=<64-char random> # openssl rand -hex 32 DB_PASSWORD= APP_URL=https://your-domain.com ``` -Generate a strong JWT secret: -```bash -openssl rand -hex 32 -``` - ### 2. Start ```bash docker compose up -d ``` -App runs on **port 3552** by default. The first user to register becomes admin automatically. +App runs on **port 3552**. First user to register becomes admin. -### 3. Admin CLI (inside container) +### 3. Admin CLI ```bash docker exec pediatric-ai-scribe node admin-cli.js list-users @@ -74,13 +85,90 @@ docker exec pediatric-ai-scribe node admin-cli.js stats --- +## AI Provider Configuration + +Switch providers by setting `AI_PROVIDER` in `.env`. No code changes needed. + +| Provider | HIPAA | Config | +|----------|-------|--------| +| **LiteLLM** | Depends on backend | `LITELLM_API_BASE`, `LITELLM_API_KEY` | +| **AWS Bedrock** | Yes (with BAA) | `AWS_BEDROCK_REGION`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` | +| **Azure OpenAI** | Yes (with BAA) | `AZURE_OPENAI_ENDPOINT`, `AZURE_OPENAI_API_KEY`, `AZURE_DEPLOYMENT_NAME` | +| **Google Vertex AI** | Yes (with BAA) | `GOOGLE_VERTEX_PROJECT`, `GOOGLE_VERTEX_LOCATION` | +| **OpenRouter** | No | `OPENROUTER_API_KEY` | + +--- + +## Transcription (Speech-to-Text) + +Set `TRANSCRIBE_PROVIDER` or let the app auto-detect. + +| Provider | HIPAA | Config | +|----------|-------|--------| +| **Google Gemini** | Yes | `GOOGLE_VERTEX_PROJECT`, `GOOGLE_STT_MODEL` | +| **Amazon Transcribe** | Yes | AWS creds + `TRANSCRIBE_PROVIDER=aws` | +| **Amazon Transcribe Medical** | Yes | `AWS_TRANSCRIBE_MEDICAL=true`, `AWS_TRANSCRIBE_SPECIALTY=PRIMARYCARE` | +| **Local Whisper** | Yes (offline) | `TRANSCRIBE_PROVIDER=local`, `WHISPER_BINARY`, `WHISPER_MODEL_SIZE` | +| **OpenAI Whisper** | No | `OPENAI_API_KEY` | +| **LiteLLM** | Depends | `TRANSCRIBE_PROVIDER=litellm`, `LITELLM_STT_MODEL` | +| **Browser Whisper** | Yes (client-side) | No config needed β€” toggle in user settings | + +--- + +## Text-to-Speech + +| Provider | HIPAA | Config | +|----------|-------|--------| +| **Google Cloud TTS** | Yes | `GOOGLE_VERTEX_PROJECT`, `GOOGLE_TTS_VOICE` | +| **LiteLLM** | Depends | `LITELLM_TTS_MODEL`, `LITELLM_TTS_VOICE` | +| **ElevenLabs** | No | `ELEVENLABS_API_KEY` | + +--- + +## OpenID Connect / SSO + +Supports Azure AD, Okta, Keycloak, PocketID, Google, and any OIDC-compliant provider. + +1. Register callback URL: `https://your-domain.com/api/auth/oidc/callback` +2. Admin Panel > Settings > Configure OIDC (Issuer URL, Client ID, Client Secret) +3. Users are auto-created and linked by email on first SSO login + +See [OPENID_SETUP.md](OPENID_SETUP.md) for provider-specific guides. + +--- + +## Cloudflare Turnstile (Bot Protection) + +Optional CAPTCHA on login, registration, and password reset forms. + +```env +TURNSTILE_SITE_KEY=0x4AAA... +TURNSTILE_SECRET_KEY=0x4AAA... +``` + +--- + +## Email + +Without SMTP, email verification is skipped and users are auto-verified. + +```env +SMTP_HOST=smtp.gmail.com +SMTP_PORT=587 +SMTP_USER=your-email@gmail.com +SMTP_PASS=your-app-password +SMTP_FROM=noreply@yourdomain.com +``` + +--- + ## Docker Hub ```bash docker pull danielonyejesi/pediatric-ai-scribe-v3:latest ``` -### Minimal docker-compose without building +Minimal compose without building: ```yaml services: @@ -95,7 +183,7 @@ services: restart: unless-stopped postgres: - image: postgres:16-alpine + image: pgvector/pgvector:pg16 environment: POSTGRES_DB: pedscribe POSTGRES_USER: pedscribe @@ -114,182 +202,35 @@ volumes: --- -## AI Provider Configuration - -Switch providers by changing `AI_PROVIDER` in `.env`. No code changes needed. - -### OpenRouter (default β€” cheapest, NOT HIPAA) - -```env -AI_PROVIDER=openrouter -OPENROUTER_API_KEY=sk-or-v1-... -``` - -### AWS Bedrock (HIPAA compliant with BAA) - -```env -AI_PROVIDER=bedrock -AWS_BEDROCK_REGION=us-east-1 -AWS_ACCESS_KEY_ID=AKIA... -AWS_SECRET_ACCESS_KEY=... -``` - -Or use an IAM role (no keys needed when running on EC2/ECS β€” just set the region). - -Available Bedrock models (auto-selected when `AI_PROVIDER=bedrock`): -- vendor model Opus 4.6 β€” best language nuance (`anthropic.agent-config-opus-4-6-20251001-v1:0`) -- vendor model Sonnet 4.6 β€” recommended (`anthropic.agent-config-sonnet-4-6-20251001-v1:0`) -- vendor model Sonnet 4 (`anthropic.agent-config-sonnet-4-20250514-v1:0`) -- vendor model 3.5 Sonnet (`anthropic.agent-config-3-5-sonnet-20241022-v2:0`) -- vendor model 3 Haiku β€” cheapest (`anthropic.agent-config-3-haiku-20240307-v1:0`) -- Llama 3.1 70B / 8B -- Mistral Large - -### Azure OpenAI (HIPAA compliant with BAA) - -```env -AI_PROVIDER=azure -AZURE_OPENAI_ENDPOINT=https://your-resource.openai.azure.com -AZURE_OPENAI_API_KEY=... -AZURE_DEPLOYMENT_NAME=gpt-4o-mini -AZURE_OPENAI_API_VERSION=2024-02-01 -``` - ---- - -## Transcription (Speech-to-Text) - -Two providers supported. The app auto-selects AWS Transcribe when `AWS_BEDROCK_REGION` is set, otherwise falls back to OpenAI Whisper. - -### Amazon Transcribe (recommended for clinical use β€” HIPAA eligible) - -Uses your existing Bedrock AWS credentials. No S3 bucket required β€” audio streams directly to AWS. - -**Requires `ffmpeg` installed on the server** (handles audio format conversion from browser WebM to PCM). The Docker image includes ffmpeg automatically. - -```env -# Auto-enabled when AWS_BEDROCK_REGION is set. -# To force it explicitly: -TRANSCRIBE_PROVIDER=aws - -# Amazon Transcribe Medical β€” trained on clinical speech. -# Knows drug names, diagnoses, procedures. Recommended. -AWS_TRANSCRIBE_MEDICAL=true -AWS_TRANSCRIBE_SPECIALTY=PRIMARYCARE -# Other specialty options: CARDIOLOGY, NEUROLOGY, ONCOLOGY, RADIOLOGY, UROLOGY -``` - -Install ffmpeg on non-Docker servers: -```bash -# Ubuntu/Debian -sudo apt-get install -y ffmpeg - -# Amazon Linux / RHEL -sudo yum install -y ffmpeg - -# macOS -brew install ffmpeg -``` - -### OpenAI Whisper (default fallback) - -```env -OPENAI_API_KEY=sk-... -# Optionally force Whisper even when AWS is configured: -# TRANSCRIBE_PROVIDER=openai -``` - ---- - -## OpenID Connect / SSO (optional β€” PocketID, Keycloak, Azure AD, etc.) - -Enable Single Sign-On authentication with any OpenID Connect provider. Users can log in with their SSO provider, and existing accounts are automatically linked by email. - -**Supported providers:** PocketID, Keycloak, Azure AD / Entra ID, Okta, Google Workspace, and any OIDC-compliant provider. - -### Quick Setup - -1. Register this app with your OIDC provider using callback URL: - ``` - https://your-domain.com/api/auth/oidc/callback - ``` - -2. Log into the app as admin and navigate to **Admin Panel** β†’ **Settings** - -3. Configure OIDC settings: - - Enable OIDC - - Set Issuer URL (e.g., `https://id.example.com`) - - Enter Client ID and Client Secret from your provider - - Customize the button label (e.g., "Sign in with PocketID") - -4. Save and test the login - -**Detailed setup guide with examples for all providers:** [OPENID_SETUP.md](OPENID_SETUP.md) - -### Linking Existing Users - -When a user signs in via SSO, the system automatically links their account if the email matches an existing user. No manual intervention needed. - -For advanced scenarios (manual linking, CLI commands, troubleshooting), see [OPENID_SETUP.md](OPENID_SETUP.md). - ---- - -## Email (optional β€” for verification & password reset) - -Without SMTP configured, email verification is skipped and users are auto-verified on registration. - -```env -SMTP_HOST=smtp.gmail.com -SMTP_PORT=587 -SMTP_USER=your-email@gmail.com -SMTP_PASS=your-app-password -SMTP_FROM=noreply@yourdomain.com -``` - ---- - -## Environment Variables Reference - -| Variable | Required | Description | -|---|---|---| -| `OPENROUTER_API_KEY` | If using OpenRouter | OpenRouter API key | -| `AI_PROVIDER` | No | `openrouter` (default), `bedrock`, or `azure` | -| `AWS_BEDROCK_REGION` | If using Bedrock | e.g. `us-east-1` | -| `AWS_ACCESS_KEY_ID` | If using Bedrock (no IAM role) | AWS access key | -| `AWS_SECRET_ACCESS_KEY` | If using Bedrock (no IAM role) | AWS secret key | -| `AZURE_OPENAI_ENDPOINT` | If using Azure | Azure OpenAI endpoint URL | -| `AZURE_OPENAI_API_KEY` | If using Azure | Azure API key | -| `AZURE_DEPLOYMENT_NAME` | If using Azure | Deployment name, e.g. `gpt-4o-mini` | -| `OPENAI_API_KEY` | For Whisper transcription | OpenAI key (Whisper fallback) | -| `TRANSCRIBE_PROVIDER` | No | `aws` or `openai` β€” auto-detected from AWS config | -| `AWS_TRANSCRIBE_MEDICAL` | No | `true` to use Transcribe Medical (clinical accuracy) | -| `AWS_TRANSCRIBE_SPECIALTY` | No | `PRIMARYCARE` (default), `CARDIOLOGY`, `NEUROLOGY`, etc. | -| `ELEVENLABS_API_KEY` | No | ElevenLabs TTS (optional) | -| `JWT_SECRET` | **Yes** | Random 64-char string β€” keep secret | -| `DATABASE_URL` | No | PostgreSQL URL (auto-set by docker-compose) | -| `DB_PASSWORD` | **Yes** | PostgreSQL password | -| `APP_URL` | Recommended | Public URL e.g. `https://scribe.example.com` (used for CORS, emails) | -| `PORT` | No | Internal port, default `3000` | -| `SMTP_HOST` | No | SMTP server for email | -| `SMTP_PORT` | No | Default `587` | -| `SMTP_USER` | No | SMTP username | -| `SMTP_PASS` | No | SMTP password / app password | -| `SMTP_FROM` | No | From address for emails | - ---- - ## HIPAA Notice This application processes data through third-party AI APIs. -- βœ… All connections use HTTPS/TLS -- βœ… Authentication required for all AI endpoints -- βœ… 2FA available -- βœ… No patient data stored on server (only audit logs) -- ⚠️ **OpenRouter does not offer a BAA** β€” do not use with real PHI -- βœ… **AWS Bedrock** and **Azure OpenAI** offer BAAs β€” suitable for PHI with proper configuration +- All connections use HTTPS/TLS +- Authentication required for all AI endpoints +- 2FA and SSO available +- Cloudflare Turnstile bot protection +- **AWS Bedrock**, **Azure OpenAI**, and **Google Vertex AI** offer BAAs +- **OpenRouter** and **ElevenLabs** do NOT offer BAAs +- **Browser Whisper** and **Local Whisper** keep audio fully private -**Recommendation:** Do not enter real patient data until your organization has executed BAAs with all AI providers in use. +**Do not use real PHI without executed BAAs with all providers in your deployment.** + +--- + +## Documentation + +See the [docs/](docs/) directory for detailed documentation: + +- [Architecture Overview](docs/architecture.md) +- [API Reference](docs/api-reference.md) +- [Database Schema](docs/database.md) +- [Authentication & Security](docs/authentication.md) +- [AI Providers & Models](docs/ai-providers.md) +- [Speech (STT/TTS)](docs/speech.md) +- [Learning Hub & CMS](docs/learning-hub.md) +- [Configuration Reference](docs/configuration.md) +- [Deployment Guide](docs/deployment.md) --- @@ -298,6 +239,6 @@ This application processes data through third-party AI APIs. ```bash npm install cp .env.example .env # edit with your keys -# Requires a running PostgreSQL instance (see DATABASE_URL in .env) +# Requires PostgreSQL with pgvector node server.js ``` diff --git a/docker-compose.yml b/docker-compose.yml index 96b9836..a2d9543 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,8 +1,9 @@ services: pediatric-scribe: - image: danielonyejesi/pediatric-ai-scribe-v3:v6 + build: . + image: ped-ai-local:latest ports: - - "3552:3000" + - "127.0.0.1:3552:3000" env_file: - .env volumes: @@ -20,11 +21,11 @@ services: start_period: 20s postgres: - image: postgres:16-alpine + image: pgvector/pgvector:pg16 environment: POSTGRES_DB: pedscribe POSTGRES_USER: pedscribe - POSTGRES_PASSWORD: ${DB_PASSWORD:-pedscribe_secret_change_me} + POSTGRES_PASSWORD: ${DB_PASSWORD:-zy9LK958SAcfUM7SJTkdthSYyYy6} volumes: - pgdata:/var/lib/postgresql/data restart: unless-stopped diff --git a/docs/ai-providers.md b/docs/ai-providers.md new file mode 100644 index 0000000..e205821 --- /dev/null +++ b/docs/ai-providers.md @@ -0,0 +1,114 @@ +# AI Providers + +This document covers the AI provider system, model management, prompt configuration, and usage logging for the Pediatric AI Scribe application. + +--- + +## Provider Selection + +The active AI provider is determined in one of two ways: + +1. **Explicit**: Set the `AI_PROVIDER` environment variable to one of the supported provider names. +2. **Auto-detect**: If `AI_PROVIDER` is not set, the system checks for provider-specific credentials in the environment and selects the first match using this priority order: + + `bedrock` > `azure` > `vertex` > `litellm` > `openrouter` + +All providers expose a unified `callAI()` interface defined in `src/utils/ai.js`. Calling code does not need to know which backend is active. + +--- + +## Provider Details + +### 1. AWS Bedrock (HIPAA-eligible with BAA) + +- **SDK**: `@aws-sdk/client-bedrock-runtime` +- Uses **inference profiles** for newer models, enabling cross-region routing. +- **Available model families**: vendor model (Anthropic), Amazon Nova, Llama (Meta), Mistral, DeepSeek, Cohere. +- **Default temperature**: 0.3 + +### 2. Azure OpenAI (HIPAA-eligible with BAA) + +- **SDK**: OpenAI SDK configured to point at an Azure endpoint. +- Requires a **deployment name** that maps to the desired model. +- **Available model families**: GPT-4o family, GPT-4.1 family. + +### 3. Google Vertex AI (HIPAA-eligible with BAA) + +- **SDK**: `@google-cloud/vertexai` +- In addition to text generation, Vertex AI handles: + - **Speech-to-Text (STT)**: via Gemini inline audio capabilities. + - **Text-to-Speech (TTS)**: via Vertex AI TTS endpoint. +- **Available model families**: Gemini 2.5/2.0, vendor model on Vertex (Anthropic models hosted on Google Cloud), Llama. + +### 4. LiteLLM Proxy (self-hosted) + +- **SDK**: OpenAI SDK pointed at the `LITELLM_API_BASE` URL. +- Acts as a proxy that routes requests to any backend configured within LiteLLM. +- **Model discovery**: queries `/v1/models` on the LiteLLM instance to populate the available model list. +- Also supports **TTS and STT** passthrough. +- Model names are used **as-configured in LiteLLM** -- the application does not auto-prefix or transform them. + +### 5. OpenRouter (NOT HIPAA-compliant) + +- **SDK**: OpenAI SDK pointed at `https://openrouter.ai`. +- **Cost discovery**: queries the OpenRouter API to retrieve per-model pricing. +- Offers the **cheapest option** and the **widest model selection** across many providers. +- Not suitable for environments that require HIPAA compliance. + +--- + +## Model Management + +### Model Definitions + +Models are defined in `src/utils/models.js` and organized into four categories: + +| Category | Description | +|-----------|------------------------------------------------| +| `free` | No-cost models (typically smaller or rate-limited) | +| `fast` | Low-latency models optimized for speed | +| `smart` | Balanced models with strong reasoning ability | +| `premium` | Top-tier models with the highest capability | + +### Admin Controls + +- Administrators can **enable or disable** individual models from the Admin Panel. +- A **default model** can be set for new users. +- **Custom models** can be added with a user-defined name and cost per token. + +### Model Discovery + +The system queries the active provider's API to retrieve the list of models that are actually available. This list is intersected with the configured model definitions to determine what appears in the UI. + +### Frontend Display + +The model selector dropdown groups models by category (free, fast, smart, premium) for easy navigation. + +--- + +## AI Prompts + +### Storage and Override + +- All default prompts are defined in `src/utils/prompts.js`. +- Prompts can be **overridden via the database** using the `app_settings` table with keys following the pattern `prompt.{name}`. +- Administrators can view and edit all prompts directly from the Admin Panel. + +### Physician Memories + +When a physician saves corrections or preferences (referred to as "memories"), these are injected into the prompt as **low-priority style hints**. This allows the AI to adapt its output to the physician's preferred documentation style without overriding the core clinical prompt. + +--- + +## Logging + +Every AI call is recorded in the `api_log` database table with the following fields: + +| Field | Description | +|------------|-----------------------------------------------------| +| `model` | The model identifier used for the request | +| `tokens` | Input and output token counts | +| `cost` | Estimated cost of the call | +| `duration` | Wall-clock time for the request in milliseconds | + +Cost estimates are calculated from **hardcoded per-model rates** defined in the codebase. For OpenRouter, rates may also be fetched from the OpenRouter pricing API. diff --git a/docs/api-reference.md b/docs/api-reference.md new file mode 100644 index 0000000..3d37114 --- /dev/null +++ b/docs/api-reference.md @@ -0,0 +1,2144 @@ +# API Reference + +Complete endpoint reference for the PedAI application. All endpoints are prefixed with the application base URL. Unless noted otherwise, authenticated endpoints require a valid JWT token passed via cookie or `Authorization: Bearer ` header. + +--- + +## Table of Contents + +- [Authentication](#authentication) +- [OIDC / SSO](#oidc--sso) +- [AI Generation](#ai-generation) +- [Transcription](#transcription) +- [Text-to-Speech](#text-to-speech) +- [Models](#models) +- [Encounters](#encounters) +- [Memories](#memories) +- [Audio Backups](#audio-backups) +- [Documents](#documents) +- [User Preferences](#user-preferences) +- [Nextcloud Integration](#nextcloud-integration) +- [Learning Hub (Public)](#learning-hub-public) +- [Learning Hub CMS (Moderator+)](#learning-hub-cms-moderator) +- [Admin - Users](#admin---users) +- [Admin - Configuration](#admin---configuration) +- [Logs](#logs) +- [Milestones (Admin)](#milestones-admin) +- [Health](#health) + +--- + +## Authentication + +Base path: `/api/auth/` + +### POST /api/auth/register + +Register a new user account. The first user to register is automatically assigned the admin role. Requires Cloudflare Turnstile verification. A verification email is sent on success. + +- **Auth required:** No +- **Request body:** + ```json + { + "name": "string", + "email": "string", + "password": "string", + "turnstileToken": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "message": "Registration successful. Please check your email to verify your account." + } + ``` + +--- + +### GET /api/auth/verify-email + +Verify a user's email address via the link sent during registration. + +- **Auth required:** No +- **Query parameters:** + | Parameter | Type | Description | + |-----------|--------|--------------------------------------| + | `token` | string | Email verification token from the link | +- **Response:** Redirects to the login page with a success or error message. + +--- + +### POST /api/auth/resend-verification + +Resend the email verification link. + +- **Auth required:** No +- **Request body:** + ```json + { + "email": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "message": "Verification email sent." + } + ``` + +--- + +### POST /api/auth/login + +Authenticate a user. Supports optional TOTP two-factor authentication. On success, sets an HTTP-only JWT cookie and returns user data. + +- **Auth required:** No +- **Request body:** + ```json + { + "email": "string", + "password": "string", + "totpCode": "string (optional, required if 2FA is enabled)", + "turnstileToken": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "token": "jwt-string", + "user": { + "id": "number", + "name": "string", + "email": "string", + "role": "admin | moderator | user" + } + } + ``` + If 2FA is enabled but `totpCode` is not provided: + ```json + { + "requires2FA": true + } + ``` + +--- + +### POST /api/auth/setup-2fa + +Generate a TOTP secret and QR code for setting up two-factor authentication. + +- **Auth required:** Yes +- **Request body:** None +- **Response:** + ```json + { + "secret": "string", + "qrCode": "string (data URI)" + } + ``` + +--- + +### POST /api/auth/verify-2fa + +Verify a TOTP code and enable two-factor authentication for the user. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "code": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "message": "2FA enabled successfully." + } + ``` + +--- + +### POST /api/auth/disable-2fa + +Disable two-factor authentication. Requires password confirmation. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "password": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "message": "2FA disabled successfully." + } + ``` + +--- + +### POST /api/auth/forgot-password + +Initiate password reset. Sends a reset link to the user's email. + +- **Auth required:** No +- **Request body:** + ```json + { + "email": "string", + "turnstileToken": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "message": "If an account exists with that email, a reset link has been sent." + } + ``` + +--- + +### POST /api/auth/reset-password + +Reset the user's password using a valid reset token. + +- **Auth required:** No +- **Request body:** + ```json + { + "token": "string", + "password": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "message": "Password reset successfully." + } + ``` + +--- + +### POST /api/auth/logout + +Log out the current user by clearing the JWT cookie. + +- **Auth required:** No +- **Request body:** None +- **Response:** + ```json + { + "success": true, + "message": "Logged out." + } + ``` + +--- + +### GET /api/auth/me + +Retrieve the currently authenticated user's profile. + +- **Auth required:** Yes +- **Response:** + ```json + { + "id": "number", + "name": "string", + "email": "string", + "role": "admin | moderator | user", + "twoFactorEnabled": "boolean" + } + ``` + +--- + +### GET /api/auth/registration-status + +Check whether new user registration is enabled on this instance. + +- **Auth required:** No +- **Response:** + ```json + { + "enabled": true + } + ``` + +--- + +## OIDC / SSO + +Base path: `/api/auth/` + +### GET /api/auth/oidc-status + +Check whether OIDC single sign-on is configured and enabled. + +- **Auth required:** No +- **Response:** + ```json + { + "oidcEnabled": true, + "disableLocalAuth": false, + "buttonLabel": "Sign in with SSO" + } + ``` + +--- + +### GET /api/auth/oidc + +Initiates the OIDC login flow. Redirects the user to the configured identity provider. + +- **Auth required:** No +- **Response:** HTTP 302 redirect to the IdP authorization endpoint. + +--- + +### GET /api/auth/oidc/callback + +Handles the callback from the identity provider after authentication. Processes the authorization code and creates/logs in the user. + +- **Auth required:** No +- **Query parameters:** Standard OIDC callback parameters (`code`, `state`). +- **Response:** Redirects to the application with a session cookie set. + +--- + +## AI Generation + +All generation endpoints require authentication and stream or return AI-generated clinical text. Each accepts a `model` parameter to select the LLM. + +### POST /api/generate-hpi-encounter + +Generate a History of Present Illness note from a patient encounter transcript. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "transcript": "string", + "patientAge": "string", + "patientGender": "string", + "model": "string", + "setting": "string", + "physicianMemories": "string (optional)" + } + ``` +- **Response:** Streamed text (text/event-stream) or JSON with the generated HPI note. + +--- + +### POST /api/generate-hpi-dictation + +Generate an HPI note from a physician's dictated summary (same parameters as encounter). + +- **Auth required:** Yes +- **Request body:** + ```json + { + "transcript": "string", + "patientAge": "string", + "patientGender": "string", + "model": "string", + "setting": "string", + "physicianMemories": "string (optional)" + } + ``` +- **Response:** Streamed text (text/event-stream) or JSON with the generated HPI note. + +--- + +### POST /api/generate-soap + +Generate a SOAP note from a patient encounter transcript. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "transcript": "string", + "patientAge": "string", + "patientGender": "string", + "model": "string", + "type": "string", + "additionalInstructions": "string (optional)", + "physicianMemories": "string (optional)" + } + ``` +- **Response:** Streamed text (text/event-stream) or JSON with the generated SOAP note. + +--- + +### POST /api/generate-chart-review + +Generate a chart review summary from clinical notes. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "notes": "string", + "visitType": "string", + "model": "string" + } + ``` +- **Response:** Streamed text or JSON with the chart review. + +--- + +### POST /api/generate-hospital-course + +Generate a hospital course summary from clinical notes. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "notes": "string", + "patientAge": "string", + "patientGender": "string", + "model": "string", + "format": "string", + "physicianMemories": "string (optional)" + } + ``` +- **Response:** Streamed text or JSON with the hospital course summary. + +--- + +### POST /api/well-visit/shadess + +Generate a SHADESS (Strengths, Home, Activities, Drugs, Emotions, Sexuality, Safety) assessment from well-visit responses. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "responses": "object", + "patientAge": "string", + "model": "string" + } + ``` +- **Response:** Streamed text or JSON with the SHADESS assessment. + +--- + +### POST /api/generate-sick-visit + +Generate a sick visit note from a transcript, incorporating diagnosis information. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "transcript": "string", + "patientAge": "string", + "patientGender": "string", + "model": "string", + "diagnoses": "string | array", + "physicianMemories": "string (optional)" + } + ``` +- **Response:** Streamed text or JSON with the sick visit note. + +--- + +### POST /api/generate-milestone-narrative + +Generate a developmental milestone narrative from milestone data. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "milestones": "object | array", + "patientAge": "string", + "patientGender": "string", + "model": "string" + } + ``` +- **Response:** Streamed text or JSON with the milestone narrative. + +--- + +### POST /api/generate-milestone-summary + +Generate a concise summary from a previously generated milestone narrative. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "narrative": "string", + "model": "string" + } + ``` +- **Response:** Streamed text or JSON with the milestone summary. + +--- + +### POST /api/refine + +Refine existing clinical text according to provided instructions. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "text": "string", + "instructions": "string", + "model": "string" + } + ``` +- **Response:** Streamed text or JSON with the refined text. + +--- + +### POST /api/shorten + +Shorten a block of clinical text while preserving key information. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "text": "string", + "model": "string" + } + ``` +- **Response:** Streamed text or JSON with the shortened text. + +--- + +### POST /api/clarify + +Improve clarity and readability of clinical text. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "text": "string", + "model": "string" + } + ``` +- **Response:** Streamed text or JSON with the clarified text. + +--- + +## Transcription + +### GET /api/transcribe/status + +Check whether speech-to-text transcription is available and which provider is configured. + +- **Auth required:** Yes +- **Response:** + ```json + { + "available": true, + "provider": "whisper | deepgram | browser" + } + ``` + +--- + +### POST /api/transcribe + +Transcribe an audio file to text. Accepts multipart form data with the audio file. + +- **Auth required:** Yes +- **Content-Type:** `multipart/form-data` +- **File size limit:** 25 MB +- **Form fields:** + | Field | Type | Description | + |---------|------|--------------------| + | `audio` | file | Audio file to transcribe | +- **Response:** + ```json + { + "success": true, + "text": "string", + "provider": "string", + "duration": "number (seconds)" + } + ``` + +--- + +## Text-to-Speech + +### POST /api/text-to-speech + +Convert text to speech. Returns an audio stream. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "text": "string", + "voice": "string (optional)" + } + ``` +- **Response:** Audio stream (`audio/mpeg`). +- **Response headers:** + | Header | Description | + |------------------|------------------------------------| + | `X-TTS-Provider` | The TTS provider used for synthesis | + +--- + +## Models + +### GET /api/models + +List available AI models for the current instance. + +- **Auth required:** Yes +- **Response:** + ```json + { + "provider": "string", + "models": [ + { + "id": "string", + "name": "string", + "cost": "string", + "category": "string" + } + ], + "defaultModel": "string" + } + ``` + +--- + +## Encounters + +### GET /api/encounters/saved + +List all saved encounters for the authenticated user. + +- **Auth required:** Yes +- **Response:** + ```json + [ + { + "id": "number", + "label": "string", + "enc_type": "string", + "created_at": "string (ISO 8601)", + "updated_at": "string (ISO 8601)" + } + ] + ``` + +--- + +### GET /api/encounters/saved/:id + +Retrieve a single saved encounter with full data. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-----------------| + | `id` | number | Encounter ID | +- **Response:** + ```json + { + "id": "number", + "label": "string", + "enc_type": "string", + "transcript": "string", + "generated_note": "string", + "partial_data": "object | null", + "created_at": "string (ISO 8601)", + "updated_at": "string (ISO 8601)" + } + ``` + +--- + +### POST /api/encounters/saved + +Create or update a saved encounter. Uses `idempotency_key` to prevent duplicates. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "label": "string", + "enc_type": "string", + "transcript": "string", + "generated_note": "string", + "partial_data": "object (optional)", + "idempotency_key": "string (optional)" + } + ``` +- **Response:** + ```json + { + "success": true, + "id": "number" + } + ``` + +--- + +### DELETE /api/encounters/saved/:id + +Delete a saved encounter. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-----------------| + | `id` | number | Encounter ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +## Memories + +Physician memories are reusable context snippets (preferences, style corrections, common instructions) injected into AI generation prompts. + +### GET /api/memories + +List all memories for the authenticated user. Returns up to 200 entries. + +- **Auth required:** Yes +- **Response:** + ```json + [ + { + "id": "number", + "category": "string", + "name": "string", + "content": "string", + "created_at": "string (ISO 8601)" + } + ] + ``` + +--- + +### POST /api/memories + +Create a new memory. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "category": "string", + "name": "string", + "content": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "id": "number" + } + ``` + +--- + +### PUT /api/memories/:id + +Update an existing memory. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-------------| + | `id` | number | Memory ID | +- **Request body:** + ```json + { + "category": "string", + "name": "string", + "content": "string" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### DELETE /api/memories/:id + +Delete a memory. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-------------| + | `id` | number | Memory ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### GET /api/memories/context + +Retrieve all memories formatted for injection into AI generation prompts. + +- **Auth required:** Yes +- **Response:** + ```json + { + "context": "string" + } + ``` + +--- + +### POST /api/memories/correction + +Automatically save a style correction as a memory. Used when the physician corrects AI output. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "section": "string", + "original_snippet": "string", + "corrected_snippet": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "id": "number" + } + ``` + +--- + +## Audio Backups + +Temporary audio backup storage with automatic 24-hour expiry. + +### POST /api/audio-backups + +Upload an audio backup. The file is gzip-compressed on the server. + +- **Auth required:** Yes +- **Content-Type:** `multipart/form-data` +- **Form fields:** + | Field | Type | Description | + |---------|------|------------------------| + | `audio` | file | Audio file to back up | +- **Response:** + ```json + { + "success": true, + "id": "number" + } + ``` + +--- + +### GET /api/audio-backups + +List all audio backups for the authenticated user. + +- **Auth required:** Yes +- **Response:** + ```json + [ + { + "id": "number", + "filename": "string", + "created_at": "string (ISO 8601)", + "expires_at": "string (ISO 8601)" + } + ] + ``` + +--- + +### GET /api/audio-backups/:id/audio + +Download a decompressed audio backup. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-------------------| + | `id` | number | Audio backup ID | +- **Response:** Binary audio stream with appropriate content-type header. + +--- + +### DELETE /api/audio-backups/:id + +Delete an audio backup. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-------------------| + | `id` | number | Audio backup ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +## Documents + +S3-backed document storage for clinical files. + +### GET /api/documents + +List all documents for the authenticated user. + +- **Auth required:** Yes +- **Response:** + ```json + [ + { + "id": "number", + "filename": "string", + "mimetype": "string", + "size": "number", + "created_at": "string (ISO 8601)" + } + ] + ``` + +--- + +### POST /api/documents/upload + +Upload a document to S3 storage. + +- **Auth required:** Yes +- **Content-Type:** `multipart/form-data` +- **File size limit:** 10 MB +- **Allowed types:** PDF, images (JPEG, PNG, GIF, WebP), Word documents (.doc, .docx), plain text (.txt), CSV (.csv) +- **Form fields:** + | Field | Type | Description | + |--------|------|---------------------| + | `file` | file | Document to upload | +- **Response:** + ```json + { + "success": true, + "id": "number", + "filename": "string" + } + ``` + +--- + +### GET /api/documents/:id/download + +Download a document. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|---------------| + | `id` | number | Document ID | +- **Response:** Binary file stream with appropriate content-type and content-disposition headers. + +--- + +### DELETE /api/documents/:id + +Delete a document from S3 storage. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|---------------| + | `id` | number | Document ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +## User Preferences + +### GET /api/user/preferences + +Get the authenticated user's preferences. + +- **Auth required:** Yes +- **Response:** + ```json + { + "stt_model": "string", + "tts_voice": "string" + } + ``` + +--- + +### POST /api/user/preferences + +Save user preferences. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "stt_model": "string", + "tts_voice": "string" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### GET /api/user/preferences/options + +List available STT models and TTS voices that the user can choose from. + +- **Auth required:** Yes +- **Response:** + ```json + { + "sttModels": [ + { "id": "string", "name": "string" } + ], + "ttsVoices": [ + { "id": "string", "name": "string" } + ] + } + ``` + +--- + +### POST /api/user/webdav-path + +Save the user's preferred WebDAV learning content path. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "path": "string" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +## Nextcloud Integration + +### POST /api/nextcloud/connect + +Connect the user's account to a Nextcloud instance via WebDAV. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "url": "string", + "username": "string", + "password": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "message": "Connected to Nextcloud." + } + ``` + +--- + +### POST /api/nextcloud/export + +Export text content to the connected Nextcloud instance. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "text": "string", + "title": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "path": "string" + } + ``` + +--- + +### POST /api/nextcloud/disconnect + +Disconnect the user's Nextcloud integration. + +- **Auth required:** Yes +- **Request body:** None +- **Response:** + ```json + { + "success": true, + "message": "Disconnected from Nextcloud." + } + ``` + +--- + +## Learning Hub (Public) + +Public-facing learning content endpoints. Authentication is required to track progress and submit quizzes. + +### GET /api/learning/categories + +List all learning content categories. + +- **Auth required:** Yes +- **Response:** + ```json + [ + { + "id": "number", + "name": "string", + "slug": "string", + "description": "string" + } + ] + ``` + +--- + +### GET /api/learning/feed + +Get a paginated feed of learning content. + +- **Auth required:** Yes +- **Query parameters:** + | Parameter | Type | Default | Description | + |-----------|--------|---------|-----------------------| + | `limit` | number | 20 | Items per page | + | `offset` | number | 0 | Pagination offset | +- **Response:** + ```json + [ + { + "id": "number", + "title": "string", + "slug": "string", + "summary": "string", + "category": "string", + "created_at": "string (ISO 8601)" + } + ] + ``` + +--- + +### GET /api/learning/category/:slug + +Get all learning content within a specific category. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|----------------| + | `slug` | string | Category slug | +- **Response:** Array of content items in the category. + +--- + +### GET /api/learning/content/:slug + +Get a single piece of learning content, including quiz questions, answer options, and the user's progress. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|---------------| + | `slug` | string | Content slug | +- **Response:** + ```json + { + "id": "number", + "title": "string", + "slug": "string", + "body": "string (markdown)", + "category": "object", + "questions": [ + { + "id": "number", + "text": "string", + "options": [ + { + "id": "number", + "text": "string" + } + ] + } + ], + "progress": { + "completed": "boolean", + "score": "number | null" + } + } + ``` + +--- + +### GET /api/learning/content/:slug/slides + +Render Marp-formatted markdown content as HTML presentation slides. + +- **Auth required:** Yes +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|---------------| + | `slug` | string | Content slug | +- **Response:** HTML presentation content. + +--- + +### POST /api/learning/submit-quiz + +Submit quiz answers for a piece of learning content. + +- **Auth required:** Yes +- **Request body:** + ```json + { + "contentId": "number", + "answers": [ + { + "questionId": "number", + "optionIds": ["number"] + } + ] + } + ``` +- **Response:** + ```json + { + "success": true, + "score": "number", + "total": "number", + "results": [ + { + "questionId": "number", + "correct": "boolean" + } + ] + } + ``` + +--- + +### GET /api/learning/search + +Keyword-based search across learning content. + +- **Auth required:** Yes +- **Query parameters:** + | Parameter | Type | Description | + |-----------|--------|-----------------| + | `q` | string | Search query | +- **Response:** Array of matching content items. + +--- + +### GET /api/learning/search/semantic + +Semantic (vector-based) search across learning content using embeddings. + +- **Auth required:** Yes +- **Query parameters:** + | Parameter | Type | Description | + |-----------|--------|-----------------| + | `q` | string | Search query | +- **Response:** Array of matching content items ranked by semantic similarity. + +--- + +### GET /api/learning/search/hybrid + +Combined keyword and semantic search for best-of-both-worlds results. + +- **Auth required:** Yes +- **Query parameters:** + | Parameter | Type | Description | + |-----------|--------|-----------------| + | `q` | string | Search query | +- **Response:** Array of matching content items with combined ranking. + +--- + +## Learning Hub CMS (Moderator+) + +Content management endpoints for learning content. Requires moderator or admin role. + +### GET /api/admin/learning/categories + +List all learning categories (admin view). + +- **Auth required:** Yes (moderator+) +- **Response:** Array of category objects. + +--- + +### POST /api/admin/learning/categories + +Create a new learning category. + +- **Auth required:** Yes (moderator+) +- **Request body:** + ```json + { + "name": "string", + "slug": "string", + "description": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "id": "number" + } + ``` + +--- + +### PUT /api/admin/learning/categories/:id + +Update a learning category. + +- **Auth required:** Yes (moderator+) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|---------------| + | `id` | number | Category ID | +- **Request body:** + ```json + { + "name": "string", + "slug": "string", + "description": "string" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### DELETE /api/admin/learning/categories/:id + +Delete a learning category. + +- **Auth required:** Yes (moderator+) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|---------------| + | `id` | number | Category ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### GET /api/admin/learning/content + +List all learning content (admin view, includes unpublished). + +- **Auth required:** Yes (moderator+) +- **Response:** Array of content objects. + +--- + +### POST /api/admin/learning/content + +Create new learning content. + +- **Auth required:** Yes (moderator+) +- **Request body:** + ```json + { + "title": "string", + "slug": "string", + "body": "string (markdown)", + "categoryId": "number", + "questions": "array (optional)" + } + ``` +- **Response:** + ```json + { + "success": true, + "id": "number" + } + ``` + +--- + +### GET /api/admin/learning/content/:id + +Get a single content item for editing. + +- **Auth required:** Yes (moderator+) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|--------------| + | `id` | number | Content ID | +- **Response:** Full content object with questions and metadata. + +--- + +### PUT /api/admin/learning/content/:id + +Update existing learning content. + +- **Auth required:** Yes (moderator+) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|--------------| + | `id` | number | Content ID | +- **Request body:** + ```json + { + "title": "string", + "slug": "string", + "body": "string (markdown)", + "categoryId": "number", + "questions": "array (optional)" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### DELETE /api/admin/learning/content/:id + +Delete learning content. + +- **Auth required:** Yes (moderator+) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|--------------| + | `id` | number | Content ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### POST /api/admin/learning/ai-generate + +Generate learning content or presentations using AI. Accepts either multipart form data (with file uploads) or JSON. + +- **Auth required:** Yes (moderator+) +- **Content-Type:** `multipart/form-data` or `application/json` +- **Request body (JSON):** + ```json + { + "topic": "string", + "type": "article | presentation", + "model": "string" + } + ``` +- **Request body (multipart):** Same fields plus uploaded reference files. +- **Response:** + ```json + { + "success": true, + "content": "string (markdown)" + } + ``` + +--- + +### POST /api/admin/learning/ai-refine + +Refine learning content body text using AI. + +- **Auth required:** Yes (moderator+) +- **Request body:** + ```json + { + "body": "string", + "instructions": "string", + "model": "string" + } + ``` +- **Response:** + ```json + { + "success": true, + "content": "string" + } + ``` + +--- + +### POST /api/admin/learning/preview-slides + +Preview Marp-formatted markdown as rendered presentation slides. + +- **Auth required:** Yes (moderator+) +- **Request body:** + ```json + { + "markdown": "string" + } + ``` +- **Response:** + ```json + { + "css": "string", + "slides": ["string (HTML)"] + } + ``` + +--- + +### POST /api/admin/learning/generate-pptx + +Generate a PowerPoint file from Marp markdown. + +- **Auth required:** Yes (moderator+) +- **Request body:** + ```json + { + "markdown": "string", + "title": "string" + } + ``` +- **Response:** Binary `.pptx` file download. + +--- + +### GET /api/admin/learning/webdav-browse + +Browse files on the connected WebDAV/Nextcloud server. + +- **Auth required:** Yes (moderator+) +- **Query parameters:** + | Parameter | Type | Description | + |-----------|--------|------------------------------| + | `path` | string | Directory path to browse | +- **Response:** Array of file/directory entries. + +--- + +### GET /api/admin/learning/stats + +Get learning hub statistics (content counts, quiz completion rates, etc.). + +- **Auth required:** Yes (moderator+) +- **Response:** + ```json + { + "totalContent": "number", + "totalCategories": "number", + "totalQuizSubmissions": "number", + "averageScore": "number" + } + ``` + +--- + +## Admin - Users + +Requires admin role. + +### GET /api/admin/users + +List all registered users. + +- **Auth required:** Yes (admin) +- **Response:** + ```json + [ + { + "id": "number", + "name": "string", + "email": "string", + "role": "string", + "verified": "boolean", + "disabled": "boolean", + "created_at": "string (ISO 8601)" + } + ] + ``` + +--- + +### GET /api/admin/users/:id + +Get detailed information and usage statistics for a specific user. + +- **Auth required:** Yes (admin) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-------------| + | `id` | number | User ID | +- **Response:** + ```json + { + "id": "number", + "name": "string", + "email": "string", + "role": "string", + "verified": "boolean", + "disabled": "boolean", + "stats": { + "totalGenerations": "number", + "totalTranscriptions": "number", + "lastActive": "string (ISO 8601)" + } + } + ``` + +--- + +### POST /api/admin/users/:id/verify + +Manually verify a user's email address (bypass email verification). + +- **Auth required:** Yes (admin) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-------------| + | `id` | number | User ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### POST /api/admin/users/:id/disable + +Disable a user account, preventing login. + +- **Auth required:** Yes (admin) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-------------| + | `id` | number | User ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### POST /api/admin/users/:id/enable + +Re-enable a previously disabled user account. + +- **Auth required:** Yes (admin) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|-------------| + | `id` | number | User ID | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +## Admin - Configuration + +Requires admin role unless noted otherwise. + +### GET /api/admin/config/announcement + +Get the current announcement banner. This endpoint is public and does not require authentication. + +- **Auth required:** No +- **Response:** + ```json + { + "announcement": "string | null" + } + ``` + +--- + +### GET /api/admin/config + +Get all application configuration settings. + +- **Auth required:** Yes (admin) +- **Response:** Object containing all configuration key-value pairs. + +--- + +### POST /api/admin/config + +Update application configuration settings. + +- **Auth required:** Yes (admin) +- **Request body:** Object with configuration key-value pairs to update. +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### POST /api/admin/config/test-email + +Send a test email to verify SMTP configuration. + +- **Auth required:** Yes (admin) +- **Request body:** + ```json + { + "to": "string (email address)" + } + ``` +- **Response:** + ```json + { + "success": true, + "message": "Test email sent." + } + ``` + +--- + +### GET /api/admin/config/prompts + +Get all AI prompt templates, including any admin overrides. + +- **Auth required:** Yes (admin) +- **Response:** Object mapping prompt keys to their current values. + +--- + +### POST /api/admin/config/prompts + +Save AI prompt template overrides. + +- **Auth required:** Yes (admin) +- **Request body:** Object mapping prompt keys to new values. +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### POST /api/admin/config/prompts/:key/reset + +Reset a specific AI prompt template back to its default value. + +- **Auth required:** Yes (admin) +- **Path parameters:** + | Parameter | Type | Description | + |-----------|--------|---------------------| + | `key` | string | Prompt template key | +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### POST /api/admin/config/reset-defaults + +Reset all configuration settings to their default values. + +- **Auth required:** Yes (admin) +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### GET /api/admin/config/smtp/status + +Check the current SMTP configuration status. + +- **Auth required:** Yes (admin) +- **Response:** + ```json + { + "configured": "boolean", + "host": "string", + "port": "number" + } + ``` + +--- + +### POST /api/admin/config/smtp/update + +Update SMTP email configuration. + +- **Auth required:** Yes (admin) +- **Request body:** + ```json + { + "host": "string", + "port": "number", + "username": "string", + "password": "string", + "from": "string" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### POST /api/admin/config/registration + +Update registration settings (enable/disable new registrations). + +- **Auth required:** Yes (admin) +- **Request body:** + ```json + { + "enabled": "boolean" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### GET /api/admin/config/oidc + +Get the current OIDC/SSO configuration. + +- **Auth required:** Yes (admin) +- **Response:** + ```json + { + "enabled": "boolean", + "clientId": "string", + "issuerUrl": "string", + "buttonLabel": "string", + "disableLocalAuth": "boolean" + } + ``` + +--- + +### POST /api/admin/config/oidc + +Update the OIDC/SSO configuration. + +- **Auth required:** Yes (admin) +- **Request body:** + ```json + { + "enabled": "boolean", + "clientId": "string", + "clientSecret": "string", + "issuerUrl": "string", + "buttonLabel": "string", + "disableLocalAuth": "boolean" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### GET /api/admin/config/models + +List all AI models with their enabled/disabled status. + +- **Auth required:** Yes (admin) +- **Response:** + ```json + [ + { + "id": "string", + "name": "string", + "enabled": "boolean", + "isDefault": "boolean", + "category": "string" + } + ] + ``` + +--- + +### PUT /api/admin/config/models/toggle + +Enable or disable a specific AI model. + +- **Auth required:** Yes (admin) +- **Request body:** + ```json + { + "modelId": "string", + "enabled": "boolean" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### PUT /api/admin/config/models/default + +Set the default AI model for all users. + +- **Auth required:** Yes (admin) +- **Request body:** + ```json + { + "modelId": "string" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### POST /api/admin/config/models/custom + +Add a custom AI model definition. + +- **Auth required:** Yes (admin) +- **Request body:** + ```json + { + "id": "string", + "name": "string", + "category": "string" + } + ``` +- **Response:** + ```json + { + "success": true + } + ``` + +--- + +### GET /api/admin/config/models/discover + +Discover available models from the configured AI provider. + +- **Auth required:** Yes (admin) +- **Response:** + ```json + { + "models": [ + { + "id": "string", + "name": "string" + } + ] + } + ``` + +--- + +## Logs + +Requires admin role. + +### GET /api/logs/usage + +Get a 30-day usage summary broken down by model and endpoint. + +- **Auth required:** Yes (admin) +- **Response:** + ```json + { + "byModel": [ + { + "model": "string", + "count": "number", + "tokens": "number" + } + ], + "byEndpoint": [ + { + "endpoint": "string", + "count": "number" + } + ] + } + ``` + +--- + +### GET /api/logs/audit + +Get the audit log of user actions (login, settings changes, etc.). + +- **Auth required:** Yes (admin) +- **Response:** Array of audit log entries with timestamps, user IDs, and action descriptions. + +--- + +### GET /api/logs/api + +Get API call metrics (request counts, latency, error rates). + +- **Auth required:** Yes (admin) +- **Response:** Array of API metric entries. + +--- + +### GET /api/logs/access + +Get user access history (login times, IP addresses). + +- **Auth required:** Yes (admin) +- **Response:** Array of access log entries. + +--- + +## Milestones (Admin) + +Developmental milestones management. Requires admin role. + +### GET /api/admin/milestones + +List all developmental milestones in the database. + +- **Auth required:** Yes (admin) +- **Response:** Array of milestone objects organized by age group and domain. + +--- + +### POST /api/admin/milestones/seed + +Seed the database with the default set of developmental milestones. + +- **Auth required:** Yes (admin) +- **Request body:** None +- **Response:** + ```json + { + "success": true, + "count": "number" + } + ``` + +--- + +## Health + +### GET /api/health + +Application health check endpoint. + +- **Auth required:** No +- **Response:** + ```json + { + "status": "ok", + "provider": "string", + "uptime": "number (seconds)" + } + ``` diff --git a/docs/architecture.md b/docs/architecture.md new file mode 100644 index 0000000..56df15e --- /dev/null +++ b/docs/architecture.md @@ -0,0 +1,172 @@ +# Pediatric AI Scribe - Architecture Overview + +## System Overview + +The Pediatric AI Scribe is a self-hosted, Dockerized clinical documentation assistant built on the following stack: + +- **Runtime:** Node.js 20 (Alpine) with Express +- **Database:** PostgreSQL 16 with the pgvector extension for embedding-based similarity search +- **Containerization:** Docker Compose with two services (app + database) +- **Frontend:** Vanilla JavaScript single-page application (no framework) + +The application provides AI-powered transcription, note generation, and learning tools for pediatric clinicians. It runs entirely behind a reverse proxy and is designed for single-institution or personal deployment. + +--- + +## File Structure + +``` +/ +β”œβ”€β”€ server.js # Application entry point +β”œβ”€β”€ package.json +β”œβ”€β”€ Dockerfile +β”œβ”€β”€ docker-compose.yml +β”œβ”€β”€ sw.js # Service worker (copied into public/) +β”‚ +β”œβ”€β”€ src/ +β”‚ β”œβ”€β”€ routes/ # 27 route files (Express routers) +β”‚ β”‚ β”œβ”€β”€ encounters.js +β”‚ β”‚ β”œβ”€β”€ auth.js +β”‚ β”‚ β”œβ”€β”€ admin.js +β”‚ β”‚ β”œβ”€β”€ learning.js +β”‚ β”‚ β”œβ”€β”€ ... # (27 total) +β”‚ β”‚ +β”‚ β”œβ”€β”€ utils/ +β”‚ β”‚ β”œβ”€β”€ ai.js # LLM client abstraction (OpenAI-compatible) +β”‚ β”‚ β”œβ”€β”€ models.js # Model registry and selection +β”‚ β”‚ β”œβ”€β”€ prompts.js # System/user prompt templates +β”‚ β”‚ β”œβ”€β”€ config.js # App settings helpers (DB-backed) +β”‚ β”‚ β”œβ”€β”€ logger.js # Winston logger setup +β”‚ β”‚ β”œβ”€β”€ embeddings.js # pgvector embedding generation +β”‚ β”‚ β”œβ”€β”€ transcribeAWS.js # AWS Transcribe integration +β”‚ β”‚ β”œβ”€β”€ transcribeGoogle.js # Google Cloud Speech-to-Text +β”‚ β”‚ β”œβ”€β”€ transcribeLocal.js # Local Whisper WASM transcription +β”‚ β”‚ └── ttsGoogle.js # Google Cloud Text-to-Speech +β”‚ β”‚ +β”‚ β”œβ”€β”€ middleware/ +β”‚ β”‚ β”œβ”€β”€ auth.js # JWT + session authentication +β”‚ β”‚ └── logging.js # Request/response logging middleware +β”‚ β”‚ +β”‚ └── db/ +β”‚ └── database.js # PostgreSQL connection pool + query helpers +β”‚ +β”œβ”€β”€ public/ # Static frontend assets +β”‚ β”œβ”€β”€ index.html # SPA shell +β”‚ β”œβ”€β”€ app.js # Tab/navigation manager +β”‚ β”œβ”€β”€ components/ # HTML partials loaded via fetch +β”‚ β”œβ”€β”€ js/ # 20+ JS modules +β”‚ └── css/ # Stylesheets +β”‚ +└── scripts/ # Utility and migration scripts +``` + +--- + +## Request Flow + +Every incoming HTTP request passes through the following middleware chain in order: + +``` +Client Request + | + v +Helmet (CSP headers, security hardening) + | + v +CORS (origin validation) + | + v +Cookie Parser (signed cookies for sessions) + | + v +Rate Limiting (per-IP and per-route limits) + | + v +Static File Serving (public/ directory) + | + v +Route Matching (src/routes/*.js) + | + v +Auth Middleware (JWT verification, role checks) + | + v +Route Handler (business logic, DB queries, AI calls) + | + v +JSON Response +``` + +Static assets are served before route matching, so unauthenticated users can load the SPA shell and login page. All API routes under `/api/` require authentication unless explicitly excluded (e.g., `/api/auth/login`, `/api/auth/register`). + +--- + +## Frontend Architecture + +The frontend is a vanilla JavaScript SPA with no build step and no framework. + +### Loading + +`index.html` serves as the application shell. It contains a `
` placeholder and loads 20+ JS modules via ` @@ -50,6 +51,7 @@
+
+
Back to sign in @@ -96,6 +99,7 @@
+
Back to sign in @@ -156,7 +160,7 @@
diff --git a/public/js/app.js b/public/js/app.js index 7911cdd..dd452b9 100644 --- a/public/js/app.js +++ b/public/js/app.js @@ -392,6 +392,17 @@ function loadAnnouncement() { .catch(function() {}); // silently ignore if endpoint not yet available } +// Close button β€” dismiss for this page view only (reappears on refresh/re-login) +(function() { + var closeBtn = document.getElementById('announcement-close'); + if (closeBtn) { + closeBtn.addEventListener('click', function() { + var banner = document.getElementById('announcement-banner'); + if (banner) banner.classList.add('hidden'); + }); + } +})(); + function getSelectedModel() { // Prefer the active tab's own model selector if present var activeTab = document.querySelector('.tab-content.active'); @@ -576,11 +587,6 @@ AudioRecorder.prototype.stop = function() { self.mediaRecorder.onstop = function() { var blob = new Blob(self.chunks, { type: self.mediaRecorder.mimeType }); if (self.stream) self.stream.getTracks().forEach(function(t) { t.stop(); }); - // Auto-save to IndexedDB backup before transcription - if (blob.size > 0 && typeof saveAudioBackup === 'function') { - var module = self._module || 'unknown'; - saveAudioBackup(blob, module).catch(function() {}); - } resolve(blob); }; self.mediaRecorder.stop(); @@ -614,14 +620,12 @@ function transcribeAudio(blob) { .then(function(text) { var elapsed = ((Date.now() - startTime) / 1000).toFixed(1); showToast('Transcribed locally (' + elapsed + 's)', 'success'); - if (window._lastAudioBackupId && typeof deleteAudioBackup === 'function') { - deleteAudioBackup(window._lastAudioBackupId); - window._lastAudioBackupId = null; - } + window._lastAudioBackupId = null; return { success: true, text: text, provider: 'browser-whisper' }; }) .catch(function(err) { console.warn('[BrowserWhisper] Failed:', err.message, 'β€” falling back to server'); + if (typeof saveAudioBackup === 'function') saveAudioBackup(blob, 'browser-whisper-failed').catch(function() {}); return _serverTranscribe(blob); }); } @@ -646,11 +650,23 @@ function _serverTranscribe(blob) { if (data.success && data.provider) { showToast('Transcribed via ' + data.provider + ' (' + elapsed + 's)', 'info'); } - if (data.success && window._lastAudioBackupId) { - if (typeof deleteAudioBackup === 'function') deleteAudioBackup(window._lastAudioBackupId); - window._lastAudioBackupId = null; + if (!data.success && blob.size > 0 && typeof saveAudioBackup === 'function') { + console.log('[AudioBackup] Transcription failed, saving backup...'); + saveAudioBackup(blob, 'failed-transcription').then(function(id) { + console.log('[AudioBackup] Saved with id:', id); + showToast('Audio backed up for retry', 'info'); + }).catch(function(e) { console.error('[AudioBackup] Save failed:', e); }); } return data; + }).catch(function(err) { + if (blob.size > 0 && typeof saveAudioBackup === 'function') { + console.log('[AudioBackup] Transcription error, saving backup...'); + saveAudioBackup(blob, 'failed-transcription').then(function(id) { + console.log('[AudioBackup] Saved with id:', id); + showToast('Audio backed up for retry', 'info'); + }).catch(function(e) { console.error('[AudioBackup] Save failed:', e); }); + } + return { success: false, error: err.message }; }); } diff --git a/public/js/audioBackup.js b/public/js/audioBackup.js index 33d35cc..fbeb206 100644 --- a/public/js/audioBackup.js +++ b/public/js/audioBackup.js @@ -44,16 +44,18 @@ }; function saveToServer(blob, module) { - var token = window.AUTH_TOKEN || localStorage.getItem('ped_scribe_token') || ''; - if (!token) return Promise.resolve(null); - var formData = new FormData(); formData.append('audio', blob, 'audio.webm'); formData.append('module', module || 'encounter'); + var headers = {}; + var token = window.AUTH_TOKEN || localStorage.getItem('ped_scribe_token') || ''; + if (token) headers['Authorization'] = 'Bearer ' + token; + return fetch('/api/audio-backups', { method: 'POST', - headers: { 'Authorization': 'Bearer ' + token }, + headers: headers, + credentials: 'same-origin', body: formData }) .then(function(r) { return r.json(); }) @@ -142,10 +144,12 @@ }; function fetchServerBackups() { + var headers = { 'Content-Type': 'application/json' }; var token = window.AUTH_TOKEN || localStorage.getItem('ped_scribe_token') || ''; - if (!token) return Promise.resolve([]); + if (token) headers['Authorization'] = 'Bearer ' + token; return fetch('/api/audio-backups', { - headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' } + headers: headers, + credentials: 'same-origin' }) .then(function(r) { return r.json(); }) .then(function(data) { return data.success ? (data.backups || []) : []; }) diff --git a/public/js/auth.js b/public/js/auth.js index 40b6dc7..642cbff 100644 --- a/public/js/auth.js +++ b/public/js/auth.js @@ -311,9 +311,17 @@ document.addEventListener('DOMContentLoaded', function() { return false; } + // Cloudflare Turnstile + var loginTurnstile = document.querySelector('#login-form [name="cf-turnstile-response"]'); + var loginToken = loginTurnstile ? loginTurnstile.value : ''; + if (!loginToken) { + showToast('Please complete the verification', 'error'); + return false; + } + showLoading('Signing in...'); - var body = { email: email, password: password }; + var body = { email: email, password: password, turnstileToken: loginToken }; if (totpCode) body.totpCode = totpCode; fetch('/api/auth/login', { @@ -344,12 +352,14 @@ document.addEventListener('DOMContentLoaded', function() { showToast('Welcome, ' + data.user.name + '!', 'success'); } else { showToast(data.error || 'Login failed', 'error'); + if (window.turnstile) turnstile.reset('#turnstile-login'); } }) .catch(function(err) { hideLoading(); console.error('[Auth] Login error:', err); showToast('Connection error', 'error'); + if (window.turnstile) turnstile.reset('#turnstile-login'); }); return false; @@ -407,12 +417,20 @@ document.addEventListener('DOMContentLoaded', function() { return false; } + // Cloudflare Turnstile verification + var turnstileResponse = document.querySelector('[name="cf-turnstile-response"]'); + var turnstileToken = turnstileResponse ? turnstileResponse.value : ''; + if (!turnstileToken) { + showToast('Please complete the verification challenge', 'error'); + return false; + } + showLoading('Creating account...'); fetch('/api/auth/register', { method: 'POST', headers: { 'Content-Type': 'application/json' }, - body: JSON.stringify({ name: name, email: email, password: password }) + body: JSON.stringify({ name: name, email: email, password: password, turnstileToken: turnstileToken }) }) .then(function(r) { return r.json(); }) .then(function(data) { @@ -426,12 +444,14 @@ document.addEventListener('DOMContentLoaded', function() { showLoginForm(); } else { showToast(data.error || 'Registration failed', 'error'); + if (window.turnstile) turnstile.reset(); } }) .catch(function(err) { hideLoading(); console.error('[Auth] Register error:', err); showToast('Connection error', 'error'); + if (window.turnstile) turnstile.reset(); }); return false; @@ -447,12 +467,20 @@ document.addEventListener('DOMContentLoaded', function() { var email = document.getElementById('forgot-email').value.trim(); if (!email) { showToast('Enter email', 'error'); return false; } + // Cloudflare Turnstile + var forgotTurnstile = document.querySelector('#forgot-form [name="cf-turnstile-response"]'); + var forgotToken = forgotTurnstile ? forgotTurnstile.value : ''; + if (!forgotToken) { + showToast('Please complete the verification', 'error'); + return false; + } + showLoading('Sending...'); fetch('/api/auth/forgot-password', { method: 'POST', headers: { 'Content-Type': 'application/json' }, - body: JSON.stringify({ email: email }) + body: JSON.stringify({ email: email, turnstileToken: forgotToken }) }) .then(function(r) { return r.json(); }) .then(function(data) { @@ -463,6 +491,7 @@ document.addEventListener('DOMContentLoaded', function() { .catch(function(err) { hideLoading(); showToast('Error', 'error'); + if (window.turnstile) turnstile.reset('#turnstile-forgot'); }); return false; diff --git a/server.js b/server.js index 674993e..d623160 100644 --- a/server.js +++ b/server.js @@ -22,7 +22,7 @@ app.use(helmet({ // 'wasm-unsafe-eval' required for WebAssembly (Whisper in-browser transcription) // cdn.jsdelivr.net required for @xenova/transformers worker script // 'unsafe-eval' needed for transformers.js dynamic imports in worker - scriptSrc: ["'self'", "'wasm-unsafe-eval'", "'unsafe-eval'", 'https://cdn.jsdelivr.net'], + scriptSrc: ["'self'", "'wasm-unsafe-eval'", "'unsafe-eval'", 'https://cdn.jsdelivr.net', 'https://challenges.cloudflare.com'], scriptSrcAttr: ["'none'"], styleSrc: ["'self'", "'unsafe-inline'", 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com'], fontSrc: ["'self'", 'https://fonts.gstatic.com', 'https://cdnjs.cloudflare.com'], @@ -32,11 +32,13 @@ app.use(helmet({ // HuggingFace CDN for Whisper model downloads 'https://huggingface.co', 'https://cdn-lfs.huggingface.co', 'https://cdn-lfs-us-1.huggingface.co', 'https://cdn-lfs-us-2.huggingface.co', // jsdelivr for worker importScripts - 'https://cdn.jsdelivr.net'], + 'https://cdn.jsdelivr.net', + // Cloudflare Turnstile + 'https://challenges.cloudflare.com'], workerSrc: ["'self'", 'blob:'], // Allow workers to load scripts from jsdelivr childSrc: ["'self'", 'blob:', 'https://cdn.jsdelivr.net'], - frameSrc: ["'none'"], + frameSrc: ["'self'", 'https://challenges.cloudflare.com'], objectSrc: ["'none'"], } } diff --git a/src/middleware/auth.js b/src/middleware/auth.js index eea8541..2d9f181 100644 --- a/src/middleware/auth.js +++ b/src/middleware/auth.js @@ -8,8 +8,9 @@ async function authMiddleware(req, res, next) { var authHeader = req.headers.authorization; if (authHeader && authHeader.startsWith('Bearer ')) { - token = authHeader.substring(7); - } else if (req.cookies && req.cookies.ped_auth) { + token = authHeader.substring(7) || null; + } + if (!token && req.cookies && req.cookies.ped_auth) { token = req.cookies.ped_auth; } diff --git a/src/routes/adminConfig.js b/src/routes/adminConfig.js index e32d557..dfae7b6 100644 --- a/src/routes/adminConfig.js +++ b/src/routes/adminConfig.js @@ -541,7 +541,7 @@ router.post('/config/tts/test', async function(req, res) { } else if (provider === 'litellm') { if (!process.env.LITELLM_API_BASE) return res.json({ success: false, error: 'LITELLM_API_BASE not set' }); var rawModel = process.env.LITELLM_TTS_MODEL || 'tts-1'; - var ttsModel = rawModel.indexOf('/') === -1 ? 'openai/' + rawModel : rawModel; + var ttsModel = rawModel.indexOf('/') !== -1 || rawModel.indexOf('-tts-') !== -1 || rawModel.startsWith('openai-') || rawModel.startsWith('elevenlabs-') || rawModel.startsWith('gemini-') ? rawModel : 'openai/' + rawModel; usedVoice = voice || process.env.LITELLM_TTS_VOICE || 'alloy'; var base = process.env.LITELLM_API_BASE.replace(/\/+$/, ''); var ttsHeaders = { 'Content-Type': 'application/json' }; diff --git a/src/routes/audioBackups.js b/src/routes/audioBackups.js index a1c895c..4978db3 100644 --- a/src/routes/audioBackups.js +++ b/src/routes/audioBackups.js @@ -17,6 +17,7 @@ router.use(authMiddleware); // ── POST save audio backup (compressed) ────────────────────────────────── router.post('/audio-backups', upload.single('audio'), async function(req, res) { + console.log('[AudioBackup] POST received, hasFile=' + !!req.file + ', user=' + (req.user ? req.user.id : 'none')); try { if (!req.file) return res.status(400).json({ error: 'No audio file' }); @@ -36,7 +37,7 @@ router.post('/audio-backups', upload.single('audio'), async function(req, res) { ); var ratio = originalSize > 0 ? Math.round((1 - compressed.length / originalSize) * 100) : 0; - console.log('[AudioBackup] Saved ' + (originalSize / 1024).toFixed(0) + 'KB β†’ ' + (compressed.length / 1024).toFixed(0) + 'KB (' + ratio + '% compression)'); + console.log('[AudioBackup] Saved ' + (originalSize / 1024).toFixed(0) + 'KB β†’ ' + (compressed.length / 1024).toFixed(0) + 'KB (' + ratio + '% compression) id=' + result.lastInsertRowid + ' user=' + req.user.id); res.json({ success: true, id: result.lastInsertRowid, originalSize: originalSize, compressedSize: compressed.length }); } catch (e) { diff --git a/src/routes/auth.js b/src/routes/auth.js index 515cef7..d9ea914 100644 --- a/src/routes/auth.js +++ b/src/routes/auth.js @@ -143,10 +143,25 @@ router.post('/register', async (req, res) => { return res.status(403).json({ error: 'Registration is currently disabled. Contact an administrator.' }); } - var { email, password, name } = req.body; + var { email, password, name, turnstileToken } = req.body; if (!email || !password || !name) return res.status(400).json({ error: 'All fields required' }); if (password.length < 8) return res.status(400).json({ error: 'Password must be 8+ characters' }); + // Cloudflare Turnstile verification + if (process.env.TURNSTILE_SECRET_KEY) { + if (!turnstileToken) return res.status(400).json({ error: 'Please complete the verification challenge' }); + var turnstileRes = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ secret: process.env.TURNSTILE_SECRET_KEY, response: turnstileToken, remoteip: req.ip }) + }); + var turnstileData = await turnstileRes.json(); + if (!turnstileData.success) { + console.error('[Auth] Turnstile verification failed:', turnstileData['error-codes']); + return res.status(400).json({ error: 'Bot verification failed. Please try again.' }); + } + } + var existing = await db.get('SELECT id FROM users WHERE email = ?', [email.toLowerCase()]); if (existing) return res.status(400).json({ error: 'Email already registered' }); @@ -238,9 +253,20 @@ router.post('/resend-verification', async (req, res) => { // ============================================================ router.post('/login', async (req, res) => { try { - var { email, password, totpCode } = req.body; + var { email, password, totpCode, turnstileToken } = req.body; if (!email || !password) return res.status(400).json({ error: 'Email and password required' }); + // Cloudflare Turnstile verification + if (process.env.TURNSTILE_SECRET_KEY) { + if (!turnstileToken) return res.status(400).json({ error: 'Please complete the verification' }); + var tsRes = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', { + method: 'POST', headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ secret: process.env.TURNSTILE_SECRET_KEY, response: turnstileToken, remoteip: req.ip }) + }); + var tsData = await tsRes.json(); + if (!tsData.success) return res.status(400).json({ error: 'Verification failed. Please try again.' }); + } + var user = await db.get('SELECT * FROM users WHERE email = ?', [email.toLowerCase()]); if (!user) return res.status(401).json({ error: 'Invalid credentials' }); @@ -309,6 +335,18 @@ router.post('/disable-2fa', authMiddleware, async (req, res) => { // Password reset router.post('/forgot-password', async (req, res) => { try { + // Cloudflare Turnstile verification + if (process.env.TURNSTILE_SECRET_KEY) { + var turnstileToken = req.body.turnstileToken; + if (!turnstileToken) return res.status(400).json({ error: 'Please complete the verification' }); + var tsRes = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', { + method: 'POST', headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ secret: process.env.TURNSTILE_SECRET_KEY, response: turnstileToken, remoteip: req.ip }) + }); + var tsData = await tsRes.json(); + if (!tsData.success) return res.status(400).json({ error: 'Verification failed. Please try again.' }); + } + var user = await db.get('SELECT id, name FROM users WHERE email = ?', [req.body.email.toLowerCase()]); if (!user) return res.json({ success: true, message: 'If account exists, reset email sent' }); var token = crypto.randomBytes(32).toString('hex'); diff --git a/src/routes/hospitalCourse.js b/src/routes/hospitalCourse.js index 4539b8b..5bbbb13 100644 --- a/src/routes/hospitalCourse.js +++ b/src/routes/hospitalCourse.js @@ -81,7 +81,7 @@ router.post('/generate-hospital-course', authMiddleware, async (req, res) => { prompt += `\n\nADDITIONAL INSTRUCTIONS FROM PHYSICIAN:\n${additionalInstructions}`; } - if (physicianMemories) clinicalData += '\n\n[PHYSICIAN PREFERENCES & LEARNED PATTERNS β€” Apply these preferences to your output. These reflect how this physician writes notes, their preferred style, terminology, and corrections from past outputs. Adapt your response accordingly, but user instructions in the current prompt take priority if they conflict.]\n' + physicianMemories + '\n[END PREFERENCES]'; + if (physicianMemories) clinicalData += '\n\n[STYLE HINTS (low priority β€” only apply if relevant to the current note, never copy content from these examples)]\n' + physicianMemories + '\n[END STYLE HINTS]'; const result = await callAI([ { role: 'system', content: prompt }, diff --git a/src/routes/hpi.js b/src/routes/hpi.js index 853f988..7d6847c 100644 --- a/src/routes/hpi.js +++ b/src/routes/hpi.js @@ -13,7 +13,7 @@ router.post('/generate-hpi-encounter', authMiddleware, async (req, res) => { const prompt = setting === 'inpatient' ? PROMPTS.hpiInpatient : PROMPTS.hpiEncounter; var context = `Patient: ${patientAge || 'Unknown'}, ${patientGender || 'Unknown'}\nSetting: ${setting || 'outpatient'}\n\nTRANSCRIPT:\n${transcript}`; - if (physicianMemories) context += '\n\n[PHYSICIAN PREFERENCES & LEARNED PATTERNS β€” Apply these preferences to your output. These reflect how this physician writes notes, their preferred style, terminology, and corrections from past outputs. Adapt your response accordingly, but user instructions in the current prompt take priority if they conflict.]\n' + physicianMemories + '\n[END PREFERENCES]'; + if (physicianMemories) context += '\n\n[STYLE HINTS (low priority β€” only apply if relevant to the current note, never copy content from these examples)]\n' + physicianMemories + '\n[END STYLE HINTS]'; const result = await callAI([ { role: 'system', content: prompt }, @@ -35,7 +35,7 @@ router.post('/generate-hpi-dictation', authMiddleware, async (req, res) => { const prompt = setting === 'inpatient' ? PROMPTS.hpiInpatient : PROMPTS.hpiDictation; var context = `Patient: ${patientAge || 'Unknown'}, ${patientGender || 'Unknown'}\nSetting: ${setting || 'outpatient'}\n\nDICTATION:\n${transcript}`; - if (physicianMemories) context += '\n\n[PHYSICIAN PREFERENCES & LEARNED PATTERNS β€” Apply these preferences to your output. These reflect how this physician writes notes, their preferred style, terminology, and corrections from past outputs. Adapt your response accordingly, but user instructions in the current prompt take priority if they conflict.]\n' + physicianMemories + '\n[END PREFERENCES]'; + if (physicianMemories) context += '\n\n[STYLE HINTS (low priority β€” only apply if relevant to the current note, never copy content from these examples)]\n' + physicianMemories + '\n[END STYLE HINTS]'; const result = await callAI([ { role: 'system', content: prompt }, diff --git a/src/routes/learningAI.js b/src/routes/learningAI.js index 18c4ada..918acd1 100644 --- a/src/routes/learningAI.js +++ b/src/routes/learningAI.js @@ -465,73 +465,230 @@ router.post('/generate-pptx', async function(req, res) { pptx.layout = 'LAYOUT_WIDE'; // 16:9 - // Strip frontmatter - var md = markdown.replace(/^---[\s\S]*?---\n?/, '').trim(); + // ── Helpers ──────────────────────────────────────────────── - // Split into slides on --- + // Parse inline markdown (**bold**, *italic*, `code`, ***both***) into pptxgenjs text objects + function parseInline(text, defaults) { + var parts = []; + var re = /(\*\*\*(.+?)\*\*\*|\*\*(.+?)\*\*|\*(.+?)\*|`(.+?)`)/g; + var last = 0; + var m; + while ((m = re.exec(text)) !== null) { + if (m.index > last) parts.push({ text: text.slice(last, m.index), options: Object.assign({}, defaults) }); + if (m[2]) parts.push({ text: m[2], options: Object.assign({}, defaults, { bold: true, italic: true }) }); + else if (m[3]) parts.push({ text: m[3], options: Object.assign({}, defaults, { bold: true }) }); + else if (m[4]) parts.push({ text: m[4], options: Object.assign({}, defaults, { italic: true }) }); + else if (m[5]) parts.push({ text: m[5], options: Object.assign({}, defaults, { fontFace: 'Courier New', color: '7c3aed' }) }); + last = m.index + m[0].length; + } + if (last < text.length) parts.push({ text: text.slice(last), options: Object.assign({}, defaults) }); + return parts.length ? parts : [{ text: text, options: Object.assign({}, defaults) }]; + } + + // Parse a markdown table block into { headers: string[], rows: string[][] } + function parseTable(lines) { + var headers = lines[0].split('|').map(function(c) { return c.trim(); }).filter(Boolean); + var rows = []; + for (var i = 2; i < lines.length; i++) { + var cells = lines[i].split('|').map(function(c) { return c.trim(); }).filter(Boolean); + if (cells.length) rows.push(cells); + } + return { headers: headers, rows: rows }; + } + + // Classify a line by type + function classifyLine(line) { + if (/^\|.+\|/.test(line)) return 'table'; + if (/^\|[\s:-]+\|/.test(line)) return 'table-sep'; + if (/^>\s+/.test(line)) return 'blockquote'; + if (/^```/.test(line)) return 'code-fence'; + if (/^\d+\.\s+/.test(line)) return 'ordered'; + if (/^[-*]\s+/.test(line)) return 'bullet'; + if (/^#{1,3}\s+/.test(line)) return 'heading'; + if (line.trim() === '') return 'blank'; + return 'paragraph'; + } + + // ── Parse slides ─────────────────────────────────────────── + + var md = markdown.replace(/^---[\s\S]*?---\n?/, '').trim(); var rawSlides = md.split(/\n---\n/); - rawSlides.forEach(function(slideText) { + rawSlides.forEach(function(slideText, slideIdx) { slideText = slideText.trim(); if (!slideText) return; var slide = pptx.addSlide(); - - // Add subtle background slide.background = { color: 'FFFFFF' }; - // Extract title (first # heading) + // Extract slide title (first # heading) var titleMatch = slideText.match(/^#{1,3}\s+(.+)$/m); var slideTitle = titleMatch ? titleMatch[1].trim() : ''; var body = slideText.replace(/^#{1,3}\s+.+$/m, '').trim(); - // Title if (slideTitle) { - slide.addText(slideTitle, { - x: 0.5, y: 0.4, w: '90%', h: 0.8, - fontSize: 28, bold: true, color: '1e40af', - fontFace: 'Calibri' + slide.addText(parseInline(slideTitle, { fontSize: 28, bold: true, color: '1e40af', fontFace: 'Calibri' }), { + x: 0.5, y: 0.3, w: '90%', h: 0.8, valign: 'middle' }); } - // Parse body: bullet lines (- item) and paragraphs - if (body) { - var lines = body.split('\n').filter(function(l) { return l.trim(); }); - var bullets = []; - var paragraphs = []; + if (!body) { + slide.addText((slideIdx + 1).toString(), { x: '90%', y: '92%', w: '8%', h: 0.3, fontSize: 9, color: 'bbbbbb', align: 'right', fontFace: 'Calibri' }); + return; + } - lines.forEach(function(line) { - var bulletMatch = line.match(/^[-*]\s+(.+)/); - if (bulletMatch) { - bullets.push(bulletMatch[1].trim()); - } else if (!line.startsWith('#')) { - // Strip inline markdown - var clean = line.replace(/\*\*(.+?)\*\*/g, '$1').replace(/\*(.+?)\*/g, '$1').replace(/`(.+?)`/g, '$1'); - paragraphs.push(clean); + var contentY = slideTitle ? 1.3 : 0.6; + var maxH = 5.2 - contentY; + var lines = body.split('\n'); + var i = 0; + var inCodeBlock = false; + var codeLines = []; + + while (i < lines.length) { + var line = lines[i]; + var type = classifyLine(line); + + // ── Code block ── + if (type === 'code-fence' || inCodeBlock) { + if (type === 'code-fence' && !inCodeBlock) { + inCodeBlock = true; codeLines = []; i++; continue; } - }); - - var contentY = slideTitle ? 1.4 : 0.8; - - if (bullets.length > 0) { - var bulletObjs = bullets.map(function(b) { - return { text: b, options: { bullet: { type: 'bullet' }, fontSize: 18, color: '374151', paraSpaceBefore: 6 } }; - }); - slide.addText(bulletObjs, { - x: 0.6, y: contentY, w: '88%', h: (5 - contentY), - fontFace: 'Calibri', valign: 'top' - }); - } else if (paragraphs.length > 0) { - slide.addText(paragraphs.join('\n'), { - x: 0.5, y: contentY, w: '90%', h: (5 - contentY), - fontSize: 18, color: '374151', fontFace: 'Calibri', - valign: 'top', wrap: true - }); + if (type === 'code-fence' && inCodeBlock) { + inCodeBlock = false; + if (codeLines.length) { + var codeText = codeLines.join('\n'); + var codeH = Math.min(Math.max(codeLines.length * 0.28, 0.6), maxH - (contentY - (slideTitle ? 1.3 : 0.6))); + slide.addShape(pptx.ShapeType.rect, { x: 0.5, y: contentY, w: '90%', h: codeH, fill: { color: 'f3f4f6' }, rectRadius: 0.08 }); + slide.addText(codeText, { + x: 0.65, y: contentY + 0.08, w: '86%', h: codeH - 0.16, + fontSize: 13, fontFace: 'Courier New', color: '1f2937', valign: 'top', wrap: true + }); + contentY += codeH + 0.2; + codeLines = []; + } + i++; continue; + } + codeLines.push(line); + i++; continue; } + + // ── Table ── + if (type === 'table') { + var tableLines = []; + while (i < lines.length && /^\|/.test(lines[i])) { tableLines.push(lines[i]); i++; } + var tbl = parseTable(tableLines); + if (tbl.headers.length) { + var colW = (12 / tbl.headers.length); + var tblRows = []; + // Header row + tblRows.push(tbl.headers.map(function(h) { + return { text: h, options: { bold: true, fontSize: 13, color: 'ffffff', fill: { color: '1e40af' }, fontFace: 'Calibri', align: 'center', valign: 'middle' } }; + })); + // Data rows + tbl.rows.forEach(function(row, ri) { + tblRows.push(row.map(function(cell) { + return { text: cell, options: { fontSize: 12, color: '374151', fill: { color: ri % 2 === 0 ? 'f9fafb' : 'ffffff' }, fontFace: 'Calibri', valign: 'middle' } }; + })); + }); + var tblH = Math.min((tblRows.length * 0.38) + 0.1, maxH - (contentY - (slideTitle ? 1.3 : 0.6))); + slide.addTable(tblRows, { + x: 0.5, y: contentY, w: 12, + colW: Array(tbl.headers.length).fill(colW), + border: { type: 'solid', pt: 0.5, color: 'dee2e6' }, + rowH: 0.36, + autoPage: false + }); + contentY += tblH + 0.15; + } + continue; + } + + // ── Blockquote ── + if (type === 'blockquote') { + var quoteText = line.replace(/^>\s*/, '').trim(); + i++; + while (i < lines.length && /^>\s*/.test(lines[i])) { quoteText += '\n' + lines[i].replace(/^>\s*/, '').trim(); i++; } + var qH = Math.max(0.5, Math.ceil(quoteText.length / 100) * 0.35); + slide.addShape(pptx.ShapeType.rect, { x: 0.5, y: contentY, w: '90%', h: qH, fill: { color: 'eff6ff' }, rectRadius: 0.06 }); + slide.addShape(pptx.ShapeType.rect, { x: 0.5, y: contentY, w: 0.06, h: qH, fill: { color: '3b82f6' } }); + slide.addText(parseInline(quoteText, { fontSize: 16, italic: true, color: '1e40af', fontFace: 'Calibri' }), { + x: 0.8, y: contentY + 0.06, w: '85%', h: qH - 0.12, valign: 'middle', wrap: true + }); + contentY += qH + 0.15; + continue; + } + + // ── Bullets (unordered) ── + if (type === 'bullet') { + var bulletItems = []; + while (i < lines.length && /^[-*]\s+/.test(lines[i])) { + bulletItems.push(lines[i].replace(/^[-*]\s+/, '').trim()); + i++; + } + var bulletObjs = []; + bulletItems.forEach(function(b) { + var inlineParts = parseInline(b, { fontSize: 17, color: '374151', fontFace: 'Calibri' }); + inlineParts[0].options.bullet = { type: 'bullet' }; + inlineParts[0].options.paraSpaceBefore = 4; + bulletObjs.push(inlineParts); + }); + var flat = []; bulletObjs.forEach(function(arr) { arr.forEach(function(p) { flat.push(p); }); }); + var bH = Math.min(Math.max(bulletItems.length * 0.35, 0.6), maxH - (contentY - (slideTitle ? 1.3 : 0.6))); + slide.addText(flat, { x: 0.6, y: contentY, w: '88%', h: bH, fontFace: 'Calibri', valign: 'top' }); + contentY += bH + 0.1; + continue; + } + + // ── Numbered list ── + if (type === 'ordered') { + var orderedItems = []; + while (i < lines.length && /^\d+\.\s+/.test(lines[i])) { + orderedItems.push(lines[i].replace(/^\d+\.\s+/, '').trim()); + i++; + } + var orderedObjs = []; + orderedItems.forEach(function(item, idx) { + var inlineParts = parseInline(item, { fontSize: 17, color: '374151', fontFace: 'Calibri' }); + inlineParts[0].options.bullet = { type: 'number', numberStartAt: idx === 0 ? 1 : undefined }; + inlineParts[0].options.paraSpaceBefore = 4; + orderedObjs.push(inlineParts); + }); + var flatOrd = []; orderedObjs.forEach(function(arr) { arr.forEach(function(p) { flatOrd.push(p); }); }); + var oH = Math.min(Math.max(orderedItems.length * 0.35, 0.6), maxH - (contentY - (slideTitle ? 1.3 : 0.6))); + slide.addText(flatOrd, { x: 0.6, y: contentY, w: '88%', h: oH, fontFace: 'Calibri', valign: 'top' }); + contentY += oH + 0.1; + continue; + } + + // ── Sub-heading (## or ### inside body) ── + if (type === 'heading') { + var hText = line.replace(/^#{1,3}\s+/, '').trim(); + slide.addText(parseInline(hText, { fontSize: 22, bold: true, color: '1e3a5f', fontFace: 'Calibri' }), { + x: 0.5, y: contentY, w: '90%', h: 0.45, valign: 'bottom' + }); + contentY += 0.5; + i++; continue; + } + + // ── Paragraph ── + if (type === 'paragraph') { + var paraText = line.trim(); + i++; + // Merge consecutive paragraph lines + while (i < lines.length && classifyLine(lines[i]) === 'paragraph') { paraText += ' ' + lines[i].trim(); i++; } + var pParts = parseInline(paraText, { fontSize: 17, color: '374151', fontFace: 'Calibri' }); + var pH = Math.max(0.4, Math.ceil(paraText.length / 110) * 0.3); + slide.addText(pParts, { x: 0.5, y: contentY, w: '90%', h: pH, valign: 'top', wrap: true }); + contentY += pH + 0.1; + continue; + } + + // ── Blank / skip ── + i++; } - // Slide number bottom right - slide.addText('', { x: '85%', y: '90%', w: '12%', h: 0.3, fontSize: 10, color: 'aaaaaa', align: 'right' }); + // Slide number + slide.addText((slideIdx + 1).toString(), { x: '90%', y: '92%', w: '8%', h: 0.3, fontSize: 9, color: 'bbbbbb', align: 'right', fontFace: 'Calibri' }); }); // Write to buffer and send diff --git a/src/routes/memories.js b/src/routes/memories.js index 6e8565f..7169640 100644 --- a/src/routes/memories.js +++ b/src/routes/memories.js @@ -98,9 +98,24 @@ router.get('/memories/context', async function(req, res) { }); } if (corrections.length > 0) { - context += '\n\nPHYSICIAN CORRECTION HISTORY (learn from these preferences β€” apply similar corrections to future outputs):\n'; - corrections.slice(-20).forEach(function(r) { - context += '--- CORRECTION (' + r.category.replace('correction_', '').toUpperCase() + '): ' + r.name + ' ---\n' + r.content + '\n\n'; + context += '\n\nSTYLE CORRECTIONS (these are examples of past edits β€” use only the writing style, never the clinical content):\n'; + corrections.slice(-10).forEach(function(r) { + // Trim to just the key style difference, not full encounter text + var lines = r.content.split('\n').filter(function(l) { return l.trim(); }); + var orig = '', corr = ''; + var inCorrected = false; + lines.forEach(function(l) { + if (l.startsWith('CORRECTED TO:')) { inCorrected = true; corr = l.replace('CORRECTED TO:', '').trim(); } + else if (l.startsWith('ORIGINAL:')) { orig = l.replace('ORIGINAL:', '').trim(); } + else if (inCorrected) { corr += ' ' + l.trim(); } + else { orig += ' ' + l.trim(); } + }); + // Keep only first 200 chars of each to avoid flooding the prompt + orig = orig.substring(0, 200); + corr = corr.substring(0, 200); + if (orig && corr) { + context += '- Before: "' + orig + '..."\n After: "' + corr + '..."\n'; + } }); } res.json({ success: true, context: context.trim() }); diff --git a/src/routes/sickVisit.js b/src/routes/sickVisit.js index 0a7f76c..8d98138 100644 --- a/src/routes/sickVisit.js +++ b/src/routes/sickVisit.js @@ -49,7 +49,7 @@ router.post('/sick-visit/note', authMiddleware, async function(req, res) { } if (physicianMemories) { - context += '[PHYSICIAN PREFERENCES & LEARNED PATTERNS β€” Apply these preferences to your output. These reflect how this physician writes notes, their preferred style, terminology, and corrections from past outputs. Adapt your response accordingly, but user instructions in the current prompt take priority if they conflict.]\n' + physicianMemories + '\n[END PREFERENCES]\n\n'; + context += '[STYLE HINTS (low priority β€” only apply if relevant to the current note, never copy content from these examples)]\n' + physicianMemories + '\n[END STYLE HINTS]\n\n'; } var result = await callAI([ diff --git a/src/routes/soap.js b/src/routes/soap.js index 64cf04c..31c8a67 100644 --- a/src/routes/soap.js +++ b/src/routes/soap.js @@ -21,7 +21,7 @@ router.post('/generate-soap', authMiddleware, async (req, res) => { } var context = `Patient: ${patientAge || 'Unknown'}, ${patientGender || 'Unknown'}\n\nINPUT:\n${transcript}`; - if (physicianMemories) context += '\n\n[PHYSICIAN PREFERENCES & LEARNED PATTERNS β€” Apply these preferences to your output. These reflect how this physician writes notes, their preferred style, terminology, and corrections from past outputs. Adapt your response accordingly, but user instructions in the current prompt take priority if they conflict.]\n' + physicianMemories + '\n[END PREFERENCES]'; + if (physicianMemories) context += '\n\n[STYLE HINTS (low priority β€” only apply if relevant to the current note, never copy content from these examples)]\n' + physicianMemories + '\n[END STYLE HINTS]'; const result = await callAI([ { role: 'system', content: prompt }, diff --git a/src/routes/tts.js b/src/routes/tts.js index e3e958a..7473625 100644 --- a/src/routes/tts.js +++ b/src/routes/tts.js @@ -50,9 +50,9 @@ router.post('/text-to-speech', authMiddleware, async (req, res) => { if (!process.env.LITELLM_API_BASE) return res.status(400).json({ error: 'LITELLM_API_BASE not set.' }); // Use the full model path (e.g. vertex_ai/google-tts) or the model_name alias // from your LiteLLM model_list. Full path is safer if your config uses it directly. - // Prefix with openai/ so LiteLLM routes correctly to the TTS endpoint + // Use model name as-is if set explicitly, else prefix with openai/ for generic names like 'tts-1' var rawModel = adminModel || process.env.LITELLM_TTS_MODEL || 'tts-1'; - var ttsModel = rawModel.indexOf('/') === -1 ? 'openai/' + rawModel : rawModel; + var ttsModel = rawModel.indexOf('/') !== -1 || rawModel.indexOf('-tts-') !== -1 || rawModel.startsWith('openai-') || rawModel.startsWith('elevenlabs-') || rawModel.startsWith('gemini-') ? rawModel : 'openai/' + rawModel; var ttsVoice = userVoice || adminVoice || process.env.LITELLM_TTS_VOICE || 'alloy'; var base = process.env.LITELLM_API_BASE.replace(/\/+$/, ''); var ttsHeaders = { 'Content-Type': 'application/json' }; diff --git a/src/routes/wellVisit.js b/src/routes/wellVisit.js index 72bab44..96ee95c 100644 --- a/src/routes/wellVisit.js +++ b/src/routes/wellVisit.js @@ -187,7 +187,7 @@ router.post('/well-visit/note', authMiddleware, async function(req, res) { context += diagnoses + '\n\n'; } if (physicianMemories) { - context += '[PHYSICIAN PREFERENCES & LEARNED PATTERNS β€” Apply these preferences to your output. These reflect how this physician writes notes, their preferred style, terminology, and corrections from past outputs. Adapt your response accordingly, but user instructions in the current prompt take priority if they conflict.]\n' + physicianMemories + '\n[END PREFERENCES]\n\n'; + context += '[STYLE HINTS (low priority β€” only apply if relevant to the current note, never copy content from these examples)]\n' + physicianMemories + '\n[END STYLE HINTS]\n\n'; } // Add growth reference and feeding guidance for this age