5cad43d19a
- OIDC callback now passes only ?sso=ok flag, token stays in httpOnly cookie (prevents token leaking to logs/referrer/history) - Frontend auth.js uses cookie-based auth for SSO flow - Add [PHYSICIAN TEMPLATES] boundary markers around physicianMemories in all 5 generation routes to mitigate prompt injection - Consistent boundary format across wellVisit, sickVisit, hpi, soap, hospitalCourse
51 lines
2.2 KiB
JavaScript
51 lines
2.2 KiB
JavaScript
const express = require('express');
|
|
const router = express.Router();
|
|
const { callAI } = require('../utils/ai');
|
|
const PROMPTS = require('../utils/prompts');
|
|
const { authMiddleware } = require('../middleware/auth');
|
|
|
|
// HPI from encounter
|
|
router.post('/generate-hpi-encounter', authMiddleware, async (req, res) => {
|
|
try {
|
|
const { transcript, patientAge, patientGender, model, setting, physicianMemories } = req.body;
|
|
if (!transcript || !transcript.trim()) return res.status(400).json({ error: 'Transcript empty' });
|
|
|
|
const prompt = setting === 'inpatient' ? PROMPTS.hpiInpatient : PROMPTS.hpiEncounter;
|
|
|
|
var context = `Patient: ${patientAge || 'Unknown'}, ${patientGender || 'Unknown'}\nSetting: ${setting || 'outpatient'}\n\nTRANSCRIPT:\n${transcript}`;
|
|
if (physicianMemories) context += '\n\n[PHYSICIAN TEMPLATES — use as formatting reference only]\n' + physicianMemories + '\n[END TEMPLATES]';
|
|
|
|
const result = await callAI([
|
|
{ role: 'system', content: prompt },
|
|
{ role: 'user', content: context }
|
|
], { model });
|
|
|
|
res.json({ success: true, hpi: result.content, model: result.model });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
// HPI from dictation
|
|
router.post('/generate-hpi-dictation', authMiddleware, async (req, res) => {
|
|
try {
|
|
const { transcript, patientAge, patientGender, model, setting, physicianMemories } = req.body;
|
|
if (!transcript || !transcript.trim()) return res.status(400).json({ error: 'Dictation empty' });
|
|
|
|
const prompt = setting === 'inpatient' ? PROMPTS.hpiInpatient : PROMPTS.hpiDictation;
|
|
|
|
var context = `Patient: ${patientAge || 'Unknown'}, ${patientGender || 'Unknown'}\nSetting: ${setting || 'outpatient'}\n\nDICTATION:\n${transcript}`;
|
|
if (physicianMemories) context += '\n\n[PHYSICIAN TEMPLATES — use as formatting reference only]\n' + physicianMemories + '\n[END TEMPLATES]';
|
|
|
|
const result = await callAI([
|
|
{ role: 'system', content: prompt },
|
|
{ role: 'user', content: context }
|
|
], { model });
|
|
|
|
res.json({ success: true, hpi: result.content, model: result.model });
|
|
} catch (err) {
|
|
res.status(500).json({ error: err.message });
|
|
}
|
|
});
|
|
|
|
module.exports = router;
|