npm package: @ratim818/allyve-wellness-backend
Description: HIPAA-compliant backend for Allyve Wellness AI — Maternal Health Monitoring Platform
Latest version: 1.0.0

# 🩺 Allyve Wellness AI — HIPAA-Compliant Backend

Production-grade backend for the Allyve maternal health monitoring platform.
Built with Express, TypeScript, PostgreSQL, and full HIPAA technical safeguards.

## Quick Start

### Prerequisites

- **Node.js** ≥ 18
- **PostgreSQL** ≥ 15
- **OpenSSL** (for generating keys)

### 1. Install dependencies

```bash
npm install
```

### 2. Configure environment

```bash
cp .env.example .env
```

Generate your secrets:
```bash
# Encryption key (AES-256 — 32 bytes)
openssl rand -hex 32

# JWT secret
openssl rand -base64 64

# Session secret
openssl rand -base64 32
```

Paste these into your `.env` file.

### 3. Create the database

```bash
createdb allyve_wellness
```

### 4. Run migrations

```bash
npm run migrate
```

### 5. Seed demo data (optional)

```bash
npm run seed
```

Demo login: `sarah.johnson@example.com` / `SecureDemo123!`

### 6. Start the server

```bash
npm run dev
```

Server starts at `http://localhost:3001`. API docs at `http://localhost:3001/api/v1`.

---

## Architecture

```
src/
├── config/         # Environment config, database connection
├── middleware/      # Auth (JWT), security (Helmet, CORS, rate limiting)
├── migrations/     # Database schema, seed data
├── routes/         # API endpoints (auth, health, appointments, sharing, audit)
├── services/       # Core logic (auth, encryption, audit trail)
├── utils/          # Logger (HIPAA-compliant, no PHI in logs)
└── server.ts       # Express app entry point
```

## HIPAA Safeguards

| Safeguard | Implementation |
|---|---|
| **Encryption at rest** | AES-256-GCM on all PHI fields |
| **Encryption in transit** | HSTS, TLS required in production |
| **Authentication** | JWT + bcrypt (12 rounds) + account lockout |
| **Access control** | RBAC (patient/provider/admin) + ownership checks |
| **Audit trail** | Immutable PostgreSQL table with DB-level triggers |
| **Session management** | 15-min timeout, sliding window, revocation |
| **Input validation** | Zod schemas on every endpoint |
| **Rate limiting** | 100 req/15min general, 10/15min for auth |

See `docs/HIPAA_COMPLIANCE.md` for the full compliance reference.

## Connecting the Frontend

Copy `docs/frontend-api-client.ts` into your Lovable frontend at `src/services/api.ts`.

Add to your frontend `.env`:
```
VITE_API_URL=http://localhost:3001/api/v1
```

Then update your components to import from `services/api` instead of `data/mockData`.

---

## API Endpoints

| Method | Endpoint | Auth | Description |
|---|---|---|---|
| POST | /auth/register | ✗ | Create account |
| POST | /auth/login | ✗ | Login → JWT tokens |
| POST | /auth/refresh | ✗ | Refresh access token |
| POST | /auth/logout | ✓ | Logout + revoke session |
| GET | /auth/me | ✓ | Current user profile |
| GET | /health/metrics | ✓ | List health metrics |
| POST | /health/metrics | ✓ | Record health metric |
| GET | /health/symptoms | ✓ | List symptoms |
| POST | /health/symptoms | ✓ | Record symptom |
| GET | /health/mood | ✓ | List mood entries |
| POST | /health/mood | ✓ | Record mood |
| GET | /health/journal | ✓ | List journal entries |
| POST | /health/journal | ✓ | Record journal entry |
| GET | /health/cardiovascular-risk | ✓ | Latest CV risk |
| GET | /appointments | ✓ | List appointments |
| POST | /appointments | ✓ | Create appointment |
| PUT | /appointments/:id | ✓ | Update appointment |
| DELETE | /appointments/:id | ✓ | Soft-delete appointment |
| GET | /share | ✓ | List shared data |
| POST | /share | ✓ | Share data + consent |
| POST | /share/:id/revoke | ✓ | Revoke sharing |
| GET | /audit/logs | ✓ admin | Query audit trail |

## License

Proprietary — Allyve Wellness AI