danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 16 Packages Wiki Activity Actions
pediatric-ai-scribe-v3/mobile
History
Daniel 82ed46d01b Fix Turnstile in the mobile app; drop it from login 
The Turnstile challenge failed reliably inside the Capacitor WebView,
which blocked login and registration from the Android app.

Three separate causes:

1. Android WebView blocks third-party cookies by default. Turnstile runs
   in a cross-origin iframe from challenges.cloudflare.com and needs its
   own storage, so the widget never emitted a token. MainActivity now
   calls setAcceptThirdPartyCookies on the app's own WebView.

2. The register handler read the Turnstile response with an unscoped
   document.querySelector, which matched the *login* widget's input (it
   comes first in the DOM). Registration therefore submitted the login
   widget's token — single-use with a 5 minute expiry, so any prior login
   attempt or slow signup made it fail server-side.

3. The register and forgot-password widgets auto-rendered inside forms
   that start at display:none, where Turnstile does not reliably complete
   a challenge, and nothing re-rendered them when the form was shown.

Widgets are now rendered explicitly when their form first becomes
visible, and tokens are captured from the render callback instead of
being read back out of the injected input — which makes the unscoped
lookup in (2) structurally impossible. Added error/expired/timeout
callbacks so a widget failure surfaces the Cloudflare error code instead
of failing silently behind a generic toast.

Login is no longer gated at all. It is the path mobile users hit
constantly, and it is already covered by a 10-per-15-min per-IP rate
limit, a constant-time credential check, and TOTP 2FA. Registration and
password reset — the endpoints that actually attract bots — stay gated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-07-30 17:22:03 +02:00
..
android Fix Turnstile in the mobile app; drop it from login 2026-07-30 17:22:03 +02:00
ios feat(mobile): biometric sign-in (Face ID / Touch ID / fingerprint) 2026-04-28 03:09:38 +02:00
src Fix Android mic permission, simplify launcher, remove broken biometric 2026-04-11 03:34:47 +02:00
.gitignore Add mobile/.gitignore (should have been in prior cleanup commit) 2026-04-14 23:39:26 +02:00
capacitor.config.json Mobile app hardening — security + Android 14 compat 2026-04-14 04:15:27 +02:00
package-lock.json Fix authenticated mobile image downloads 2026-06-09 16:02:11 +02:00
package.json Fix authenticated mobile image downloads 2026-06-09 16:02:11 +02:00
README.md feat: add patient education handouts 2026-05-08 22:26:53 +02:00

README.md

PedScribe Mobile App

Capacitor mobile wrapper for the hosted Ped-AI web app. The app defaults to https://app.pedshub.com, lets users choose a self-hosted server URL, and keeps clinical workflows API-backed through the same Express service as the browser app.

Features

  • Hosted web workflow inside a native WebView; server updates reach mobile clients without app-store releases
  • Configurable server URL (supports self-hosted instances)
  • Haptic feedback on recording start/stop
  • Keep screen awake during recording
  • Deep linking (pedscribe:// and https://app.pedshub.com)
  • Share intent (receive text/PDFs from other apps)
  • Push notification support
  • Biometric sign-in (Face ID / Touch ID / fingerprint) — credentials stored in iOS Keychain / Android Keystore, gated by OS biometric. Enrolled on first password sign-in (opt-in prompt). 2FA still applies on top — biometric replaces the password step only.
  • Android and iOS project scaffolds for store builds

Prerequisites

  • Node.js 18+
  • Android Studio (for Android builds): sudo snap install android-studio --classic
  • Xcode 15+ (for iOS builds, macOS only)
  • Apple Developer account ($99/yr for App Store)
  • Google Play Developer account ($25 one-time)

Setup

cd mobile
npm install
npx cap sync

Build Android

# Open in Android Studio
npx cap open android

# Build menu: Build > Generate Signed Bundle / APK > APK
# Sign with your keystore (create one on first build)
# APK output: android/app/build/outputs/apk/release/

# Or build from command line:
cd android && ./gradlew assembleRelease

Build iOS (macOS only)

# Open in Xcode
npx cap open ios

# In Xcode:
# 1. Select your team/signing certificate
# 2. Product > Archive
# 3. Distribute App > App Store Connect

How It Works

  1. App launches with a local launcher page
  2. First launch: user enters their PedScribe server URL (default: app.pedshub.com)
  3. URL is saved locally for future launches
  4. App navigates to the remote web app inside a native WebView
  5. Native plugins provide background recording, haptics, and push notifications

Background Recording

Android: AudioRecordingService is a foreground service that:

  • Acquires a partial wake lock (CPU stays active, screen can sleep)
  • Shows a persistent notification ("Recording in progress...")
  • Includes a "Stop Recording" quick action in the notification
  • Maximum 1-hour wake lock duration

iOS: Uses UIBackgroundModes: audio in Info.plist, which tells iOS to keep the app alive for audio capture when backgrounded or screen-locked.

Deep Linking

  • pedscribe:// custom URL scheme opens the app directly
  • https://app.pedshub.com links open in the app instead of the browser (Android App Links)

Share Intent (Android)

Other apps can share text or PDFs directly into PedScribe:

  • Share a lab result from your email into the Chart Review tab
  • Share a referral note into the Hospital Course tab

Capacitor Plugins Included

Plugin Purpose
@capacitor/app App lifecycle management
@capacitor/haptics Vibration feedback on recording start/stop
@capacitor/keyboard Keyboard management for WebView
@capacitor/push-notifications Push notification support
@capacitor/screen-orientation Screen orientation control
@capacitor/share Native share dialog
@capacitor/splash-screen Launch splash screen
@capacitor/status-bar Status bar styling

App Structure

mobile/
  capacitor.config.json    # Capacitor configuration
  package.json             # Dependencies
  src/
    index.html             # Launcher page (server URL config)
    launcher.js            # Auto-redirect + native feature init
    launcher.css            # Launcher styles
  android/                 # Android native project
    app/src/main/
      java/com/pedshub/scribe/
        MainActivity.java
        AudioRecordingService.java
      AndroidManifest.xml  # Permissions, deep links, share intent
  ios/                     # iOS native project
    App/App/
      Info.plist           # Background audio, microphone, deep links

Updating the Web App

The mobile app wraps the remote web app — updating the server automatically updates all mobile clients. No app store update needed for web changes.

To update native features (plugins, permissions, splash screen):

cd mobile
npm install
npx cap sync
# Then rebuild in Android Studio / Xcode

Generating App Icons

Replace the default Capacitor icons with PedScribe branding:

  1. Create a 1024x1024 PNG icon
  2. Install the assets tool: npm install -D @capacitor/assets
  3. Place your icon as assets/icon-only.png and assets/splash.png
  4. Run: npx capacitor-assets generate

This generates all required sizes for both platforms.

App Store Listing Suggestions

Title: PedScribe - Pediatric AI Scribe Subtitle: Voice-to-Note Clinical Documentation Category: Medical Keywords: pediatric, scribe, medical, documentation, HPI, SOAP, clinical, AI, voice

Description: PedScribe is an AI-powered clinical documentation tool for pediatric physicians. Record patient encounters, and the AI generates structured medical notes — HPIs, SOAP notes, hospital courses, chart reviews, and more. Includes pediatric calculators, developmental milestone tracking, and a learning hub with quizzes. Self-hosted for maximum privacy with HIPAA-compliant AI providers.