No description
Find a file
Daniel 272ea94768 feat: admin lockdown, so several admins do not all get to change everything
With more than one admin, every setting in the panel was editable by all of
them — prompts, model policy, retrieval budgets, SMTP, email templates.
ADMIN_LOCKDOWN separates running the service from changing how it behaves.

It is an environment variable on purpose: a setting could be switched off by
the very admin it restrains, so lifting this needs host access and a restart.

The server is the control. One gate refuses configuration writes rather than
a check in each of the fifteen write routes, because that list grows and a
route added later would quietly miss it. Reads always pass — lockdown hides
nothing. Day-to-day operation stays available: invitations, announcements,
registration, feature flags, and the test endpoints, which persist nothing.
A setting invented later is locked until someone deliberately makes it
editable, rather than defaulting to open.

The panel disables what it cannot save and says why, but that is courtesy;
the refusal is what enforces it.

Two things this taught me, both fixed: my first version painted the panel
from an IIFE, which the module conventions forbid, and fetched the whole
config a second time just to read one flag — breaking the test that pins
admin loaders firing exactly once. The state now rides on the invites
response the panel already requests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dv6sqaY6Vq3ChZHMem3cnU
2026-09-10 23:20:29 +02:00
.forgejo/workflows feat: ship reviewed prompt history, conversation limits and account protections 2026-09-07 04:01:01 +02:00
.github feat: ship reviewed prompt history, conversation limits and account protections 2026-09-07 04:01:01 +02:00
android
docs docs: correct the DeepL claim and refresh the renamed paths 2026-09-10 18:47:49 +02:00
e2e Fix Turnstile in the mobile app; drop it from login 2026-07-30 17:22:03 +02:00
migrations feat: invite-only registration 2026-09-10 23:12:07 +02:00
mobile Release v7.14.16 2026-07-31 01:12:47 +02:00
monitoring
public feat: admin lockdown, so several admins do not all get to change everything 2026-09-10 23:20:29 +02:00
scripts chore: script to move audio backups onto MinIO; record where things stand 2026-09-10 17:00:02 +02:00
src feat: admin lockdown, so several admins do not all get to change everything 2026-09-10 23:20:29 +02:00
test feat: admin lockdown, so several admins do not all get to change everything 2026-09-10 23:20:29 +02:00
.dockerignore feat: ship reviewed prompt history, conversation limits and account protections 2026-09-07 04:01:01 +02:00
.env.example feat: admin lockdown, so several admins do not all get to change everything 2026-09-10 23:20:29 +02:00
.gitignore feat: add extension import preview 2026-05-08 22:26:53 +02:00
.gitmessage
.node-pg-migraterc.json
admin-cli.js
CONTRIBUTING.md feat: ship reviewed prompt history, conversation limits and account protections 2026-09-07 04:01:01 +02:00
docker-compose.e2e.yml feat: ship reviewed prompt history, conversation limits and account protections 2026-09-07 04:01:01 +02:00
docker-compose.local.yml feat: ship reviewed prompt history, conversation limits and account protections 2026-09-07 04:01:01 +02:00
docker-compose.monitoring.yml
docker-compose.yml chore: follow the storage stack's renamed assets network 2026-09-10 18:08:55 +02:00
docker-entrypoint.sh fix(entrypoint): docker-compose env overrides win over OpenBao-fetched values 2026-04-22 21:04:46 +02:00
Dockerfile feat: ship reviewed prompt history, conversation limits and account protections 2026-09-07 04:01:01 +02:00
grafana-dashboard.json feat: neonatal calculator, DOCX/PPTX/ODT/EPUB support, gateway-agnostic URL helper, TTS/STT fixes 2026-04-19 02:17:06 +02:00
package-lock.json fix: patch nodemailer; Settings offers STT models the gateway really has 2026-09-10 15:54:57 +02:00
package.json fix: patch nodemailer; Settings offers STT models the gateway really has 2026-09-10 15:54:57 +02:00
README.md feat: ship reviewed prompt history, conversation limits and account protections 2026-09-07 04:01:01 +02:00
server.js feat: the assistant is its own full page at /assistant — no underlying app scrolling, back returns home; menu links to it 2026-09-09 13:36:30 +02:00
TODO.md docs: correct the DeepL claim and refresh the renamed paths 2026-09-10 18:47:49 +02:00

Ped-AI

Ped-AI is a pediatric clinical documentation, education, and bedside decision-support app. This fork has moved well beyond the original scribe app: it now combines encounter documentation, clinical workflows, Learning Hub CMS, admin controls, MCP-backed clinical assistant integration, Redis-backed operational state, and hardened deployment defaults.

The app runs as an authenticated Express/Postgres service with a browser frontend and optional integrations for LiteLLM, Vertex/Gemini, AWS, OpenAI-compatible APIs, Nextcloud WebDAV, S3-compatible storage, OpenBao, Redis, OIDC, TOTP, and Cloudflare Turnstile.

Current Scope

Clinical Documentation

  • Live encounter capture with structured pediatric HPI generation.
  • Dictation cleanup for narrative notes.
  • SOAP, sick visit, well visit, hospital course, chart review, precharting, and ED encounter workflows.
  • Parent-facing education handouts generated from clinician notes, with diagnosis, medication, emergency-care guidance, and preferred-language support.
  • Pediatric developmental milestone tooling.
  • Templates, physician memory, and per-tab model overrides.
  • Server-side speech-to-text routing through configured providers.

Bedside Tools

  • Pediatric calculators and emergency dosing helpers.
  • PE guide and clinical reference content.
  • Vaccines, catch-up schedules, growth/vitals, bilirubin, BSA, GCS, equipment, and resuscitation helpers.
  • Mobile-friendly PWA layout for bedside use.
  • Per-user phone extension and pager directory with soft-delete, search, ZIP export, and JSON/ZIP import for handoff between users.

Learning Hub

  • CMS for articles, clinical pearls, quizzes, and presentations.
  • Tiptap article editor, quiz builder, category management, and draft/publish flow.
  • AI-assisted content generation from topic text, uploaded files, or connected Nextcloud WebDAV files.
  • Marp slide editing with preview and PPTX export.
  • Keyword, semantic, and hybrid search using Postgres/pgvector where configured.

Clinical Assistant

  • Optional MCP-backed clinical assistant integration.
  • Prompt suggestions backed by Redis operational cache.
  • No clinical answer response caching.
  • Designed to retrieve from indexed clinical material while keeping provider selection explicit.

Admin And Security

  • Local auth, role-based access, TOTP 2FA, OIDC/SSO, email verification, and optional Turnstile.
  • Admin panel for users, settings, prompts, models, logs, and Learning Hub content.
  • Audit, API, access, and client-error logs with redaction hardening.
  • OpenBao secret loading support at container startup.
  • S3-compatible document storage support.

Removed Browser STT

Browser Whisper has been removed from the runtime. The app should not ship browser Whisper workers, browser-local Whisper model downloads, Transformers.js browser STT, or Browser Whisper setup docs.

Speech-to-text is handled server-side through configured providers such as Google/Gemini, AWS Transcribe, LiteLLM, or OpenAI Whisper. Browser-native Web Speech remains gated behind an explicit user setting when present in the browser.

Quick Start

cp .env.example .env
./scripts/build-image.sh
docker compose up -d --no-build

The default compose exposes the app on 127.0.0.1:3552 and starts:

  • pediatric-ai-scribe for the Node app.
  • pedscribe-db for Postgres with pgvector.
  • ped-ai-redis for operational Redis state.

Health check:

curl -fsS http://127.0.0.1:3552/api/health

Prometheus metrics are exposed at GET /metrics with the ped_ai_ metric prefix.

The first registered user becomes an admin unless registration has already been configured differently.

Core Environment

Set real values in .env before production use.

APP_URL=https://your-domain.example
JWT_SECRET=<64-char-random-secret>
DB_PASSWORD=<strong-database-password>

AI_PROVIDER=litellm
LITELLM_API_BASE=https://your-litellm.example/v1
LITELLM_API_KEY=<key>

TRANSCRIBE_PROVIDER=litellm
LITELLM_STT_MODEL=whisper-1

REDIS_URL=redis://ped-ai-redis:6379

Supported text AI providers include LiteLLM, OpenRouter, AWS Bedrock, Azure OpenAI, and Google Vertex AI. Supported STT routing includes Google/Gemini, AWS Transcribe, OpenAI Whisper, and LiteLLM. Supported TTS routing includes Google Cloud TTS, LiteLLM/OpenAI-compatible audio, and ElevenLabs where configured.

Admin CLI

docker exec pediatric-ai-scribe node admin-cli.js list-users
docker exec pediatric-ai-scribe node admin-cli.js create-admin admin@example.com password123 "Dr. Admin"
docker exec pediatric-ai-scribe node admin-cli.js make-admin user@example.com
docker exec pediatric-ai-scribe node admin-cli.js reset-password user@example.com newpassword
docker exec pediatric-ai-scribe node admin-cli.js toggle-registration
docker exec pediatric-ai-scribe node admin-cli.js stats

Maintenance

The app checks Postgres collation drift on startup and can reindex text indexes after image or OS-library changes.

docker exec pediatric-ai-scribe npm run maint:check
docker exec pediatric-ai-scribe npm run maint:reindex

Run the reindex command after major Postgres image changes, restoring a dump from another distro, or seeing lookup behavior that suggests collation/index drift.

Testing

Run the Node test suite:

npm test

Run syntax checks for touched files when doing focused backend work:

node --check server.js
node --check src/routes/transcribe.js

Run the Playwright smoke suite against the e2e compose stack:

docker compose -f docker-compose.yml -f docker-compose.e2e.yml up -d pediatric-scribe-e2e
npm run e2e

Deployment Notes

  • Put the app behind HTTPS before clinical use.
  • Use only AI/STT/TTS providers covered by your BAA and data-processing requirements.
  • Configure OIDC/SSO and 2FA for production users.
  • Keep JWT_SECRET, database credentials, provider keys, S3 keys, SMTP credentials, and OpenBao tokens out of git.
  • Treat logs as sensitive operational data even with redaction enabled.
  • Use the Caddy/reverse-proxy layer to expose only intended public routes.

Documentation

Primary references:

  • docs/ARCHITECTURE.md for the current system map and service boundaries.
  • docs/DEVELOPMENT.md for day-to-day code-change workflow.
  • docs/SCALING.md for scaling priorities and readiness work.
  • docs/CLINICAL_ASSISTANT.md for MCP-backed assistant behavior and safety rules.
  • docs/MODULE_CONVENTIONS.md for CommonJS, ESM, globals, and rendering rules.
  • docs/architecture.md for high-level architecture.
  • docs/api-reference.md for API routes.
  • docs/authentication.md for auth, OIDC, and security configuration.
  • docs/ai-providers.md for model/provider setup.
  • docs/speech.md for server-side STT/TTS setup.
  • docs/learning-hub.md for the CMS and education workflow.
  • docs/configuration.md for environment variables.
  • docs/deployment.md for production deployment.
  • docs/mobile-build.md for the Capacitor wrapper and app-store build notes.
  • docs/logic/README.md for the deeper code walkthrough.

Some deep docs/logic/ files still describe historical implementation details. Prefer runtime code and tests when documentation conflicts with current behavior.

Clinical Safety

Ped-AI is documentation and education support software. It does not replace clinical judgment, local policy, medication verification, or attending review. Validate generated notes, calculations, and recommendations before use in patient care.