@omniradiology/omnirad 0.1.3

package/app/api/auth/check/route.ts

@@ -0,0 +1,17 @@
+import { NextResponse } from "next/server";
+import { db } from "@/db";
+import { users } from "@/db/schema";
+import { count } from "drizzle-orm";
+
+export const dynamic = 'force-dynamic';
+
+export async function GET() {
+    try {
+        const usersCountResult = await db.select({ value: count() }).from(users);
+        const numUsers = usersCountResult[0].value;
+        return NextResponse.json({ hasUsers: numUsers > 0 });
+    } catch (error) {
+        console.error("[Auth Check] Error checking database:", error);
+        return NextResponse.json({ hasUsers: false }, { status: 500 });
+    }
+}

package/app/api/auth/login/route.ts

@@ -0,0 +1,72 @@
+import { NextResponse } from 'next/server';
+import { db } from '@/db';
+import { users, sessions } from '@/db/schema';
+import { eq, or } from 'drizzle-orm';
+import { verifyPassword, generateSessionId } from '@/lib/auth';
+import { cookies } from 'next/headers';
+
+export async function POST(req: Request) {
+    try {
+        const { identifier, password, rememberMe } = await req.json();
+
+        if (!identifier || !password) {
+            return NextResponse.json({ error: 'Username/Email and password are required' }, { status: 400 });
+        }
+
+        // Find user by either email or username
+        const foundUsers = await db.select().from(users).where(
+            or(
+                eq(users.email, identifier),
+                eq(users.username, identifier)
+            )
+        ).limit(1);
+
+        const user = foundUsers[0];
+
+        if (!user) {
+            return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
+        }
+
+        // Verify hash
+        const isValid = await verifyPassword(password, user.passwordHash);
+        if (!isValid) {
+            return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
+        }
+
+        // Create Session
+        const sessionId = generateSessionId();
+        
+        // Expiration: 30 days if rememberMe, otherwise 24 hours
+        const expiresInSeconds = rememberMe ? (60 * 60 * 24 * 30) : (60 * 60 * 24);
+        const expiresAt = Math.floor(Date.now() / 1000) + expiresInSeconds;
+        
+        await db.insert(sessions).values({
+            id: sessionId,
+            userId: user.id,
+            expiresAt
+        });
+
+        // Set session cookie
+        const cookieStore = await cookies();
+        cookieStore.set('omnirad_session_id', sessionId, {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === 'production',
+            sameSite: 'lax',
+            path: '/',
+            maxAge: expiresInSeconds
+        });
+
+        return NextResponse.json({ 
+            success: true, 
+            user: {
+                id: user.id,
+                fullName: user.fullName,
+                username: user.username,
+                role: user.role
+            }
+        });
+    } catch (e: any) {
+        console.error("Login Error", e);
+        return NextResponse.json({ error: 'An unexpected error occurred' }, { status: 500 });
+    }
+}

package/app/api/auth/logout/route.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from 'next/server';
+import { db } from '@/db';
+import { sessions } from '@/db/schema';
+import { eq } from 'drizzle-orm';
+import { cookies } from 'next/headers';
+
+export async function POST(req: Request) {
+    try {
+        const cookieStore = await cookies();
+        const sessionId = cookieStore.get('omnirad_session_id')?.value;
+
+        if (sessionId) {
+            // Remove session from DB
+            await db.delete(sessions).where(eq(sessions.id, sessionId));
+        }
+
+        // Clear the cookie
+        cookieStore.delete('omnirad_session_id');
+
+        return NextResponse.json({ success: true });
+    } catch (e: any) {
+        console.error("Logout Error", e);
+        return NextResponse.json({ error: 'An unexpected error occurred' }, { status: 500 });
+    }
+}

package/app/api/auth/me/route.ts

@@ -0,0 +1,75 @@
+import { NextResponse } from 'next/server';
+import { db } from '@/db';
+import { users, sessions } from '@/db/schema';
+import { eq } from 'drizzle-orm';
+import { cookies } from 'next/headers';
+
+async function getCurrentUser() {
+    const cookieStore = await cookies();
+    const sessionId = cookieStore.get('omnirad_session_id')?.value;
+    if (!sessionId) return null;
+
+    const sessionList = await db.select().from(sessions).where(eq(sessions.id, sessionId)).limit(1);
+    const session = sessionList[0];
+    
+    if (!session || session.expiresAt * 1000 < Date.now()) return null;
+
+    const userList = await db.select().from(users).where(eq(users.id, session.userId)).limit(1);
+    return userList[0];
+}
+
+export async function GET() {
+    try {
+        const user = await getCurrentUser();
+        if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+
+        return NextResponse.json({
+            id: user.id,
+            fullName: user.fullName,
+            username: user.username,
+            email: user.email,
+            role: user.role,
+            position: user.position || ""
+        });
+    } catch (e) {
+        return NextResponse.json({ error: 'Internal Server Error' }, { status: 500 });
+    }
+}
+
+export async function PUT(req: Request) {
+    try {
+        const user = await getCurrentUser();
+        if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+
+        const body = await req.json();
+        const { fullName, username, email, position } = body;
+
+        // Ensure unique username/email 
+        const existingUsers = await db.select().from(users).where(
+            eq(users.username, username)
+        );
+        
+        if (existingUsers.length > 0 && existingUsers[0].id !== user.id) {
+            return NextResponse.json({ error: 'Username is already taken' }, { status: 400 });
+        }
+
+        const existingEmails = await db.select().from(users).where(
+            eq(users.email, email)
+        );
+
+        if (existingEmails.length > 0 && existingEmails[0].id !== user.id) {
+            return NextResponse.json({ error: 'Email is already correctly registered' }, { status: 400 });
+        }
+
+        await db.update(users).set({
+            fullName,
+            username,
+            email,
+            position
+        }).where(eq(users.id, user.id));
+
+        return NextResponse.json({ success: true });
+    } catch (e: any) {
+        return NextResponse.json({ error: e.message || 'Internal Server Error' }, { status: 500 });
+    }
+}

package/app/api/auth/password/route.ts

@@ -0,0 +1,49 @@
+import { NextResponse } from 'next/server';
+import { db } from '@/db';
+import { users, sessions } from '@/db/schema';
+import { eq } from 'drizzle-orm';
+import { cookies } from 'next/headers';
+import { verifyPassword, hashPassword } from '@/lib/auth';
+
+async function getCurrentUser() {
+    const cookieStore = await cookies();
+    const sessionId = cookieStore.get('omnirad_session_id')?.value;
+    if (!sessionId) return null;
+
+    const sessionList = await db.select().from(sessions).where(eq(sessions.id, sessionId)).limit(1);
+    const session = sessionList[0];
+    
+    if (!session || session.expiresAt * 1000 < Date.now()) return null;
+
+    const userList = await db.select().from(users).where(eq(users.id, session.userId)).limit(1);
+    return userList[0];
+}
+
+export async function PUT(req: Request) {
+    try {
+        const user = await getCurrentUser();
+        if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+
+        const { currentPassword, newPassword } = await req.json();
+
+        if (newPassword.length < 8) {
+             return NextResponse.json({ error: 'New password must be at least 8 characters' }, { status: 400 });
+        }
+
+        const isValid = await verifyPassword(currentPassword, user.passwordHash);
+        if (!isValid) {
+            return NextResponse.json({ error: 'Incorrect current password' }, { status: 401 });
+        }
+
+        const passwordHash = await hashPassword(newPassword);
+
+        await db.update(users).set({
+            passwordHash
+        }).where(eq(users.id, user.id));
+
+        return NextResponse.json({ success: true });
+
+    } catch (e: any) {
+        return NextResponse.json({ error: 'Internal Server Error' }, { status: 500 });
+    }
+}

package/app/api/auth/setup/route.ts

@@ -0,0 +1,63 @@
+import { NextResponse } from 'next/server';
+import { db } from '@/db';
+import { users, sessions } from '@/db/schema';
+import { count } from 'drizzle-orm';
+import { hashPassword, generateSessionId } from '@/lib/auth';
+import { cookies } from 'next/headers';
+
+export async function POST(req: Request) {
+    try {
+        const { fullName, username, email, password } = await req.json();
+
+        // 1. Verify there are truly no users (security check)
+        const usersCount = await db.select({ value: count() }).from(users);
+        if (usersCount[0].value > 0) {
+            return NextResponse.json({ error: 'Setup has already been completed.' }, { status: 403 });
+        }
+
+        // 2. Hash password
+        const passwordHash = await hashPassword(password);
+        const userId = crypto.randomUUID();
+
+        // 3. Create Admin user
+        await db.insert(users).values({
+            id: userId,
+            fullName,
+            username,
+            email,
+            passwordHash,
+            role: 'Admin',
+            createdAt: new Date().toISOString()
+        });
+
+        // 4. Create Session
+        const sessionId = generateSessionId();
+        const expiresAt = Math.floor(Date.now() / 1000) + (60 * 60 * 24 * 7); // 7 days
+        
+        await db.insert(sessions).values({
+            id: sessionId,
+            userId,
+            expiresAt
+        });
+
+        // 5. Set session cookie and setup complete cookie
+        const cookieStore = await cookies();
+        cookieStore.set('omnirad_session_id', sessionId, {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === 'production',
+            sameSite: 'lax',
+            path: '/',
+            maxAge: 60 * 60 * 24 * 7 // 7 days
+        });
+        
+        cookieStore.set('omnirad_setup_complete', 'true', {
+            path: '/',
+            maxAge: 60 * 60 * 24 * 365 * 10 // 10 years
+        });
+
+        return NextResponse.json({ success: true });
+    } catch (e: any) {
+        console.error("Setup Error", e);
+        return NextResponse.json({ error: e.message || 'Error creating admin account.' }, { status: 500 });
+    }
+}

package/app/api/auth/users/route.ts

@@ -0,0 +1,100 @@
+import { NextResponse } from 'next/server';
+import { db } from '@/db';
+import { users, sessions } from '@/db/schema';
+import { eq, not } from 'drizzle-orm';
+import { hashPassword } from '@/lib/auth';
+import { cookies } from 'next/headers';
+
+async function checkIsAdmin() {
+    const cookieStore = await cookies();
+    const sessionId = cookieStore.get('omnirad_session_id')?.value;
+    if (!sessionId) return false;
+
+    const sessionList = await db.select().from(sessions).where(eq(sessions.id, sessionId)).limit(1);
+    const session = sessionList[0];
+    if (!session || session.expiresAt * 1000 < Date.now()) return false;
+
+    const userList = await db.select().from(users).where(eq(users.id, session.userId)).limit(1);
+    if (!userList[0] || userList[0].role !== 'Admin') return false;
+
+    return true;
+}
+
+export async function GET() {
+    if (!await checkIsAdmin()) return NextResponse.json({ error: 'Unauthorized' }, { status: 403 });
+
+    try {
+        const allUsers = await db.select({
+            id: users.id,
+            fullName: users.fullName,
+            username: users.username,
+            email: users.email,
+            role: users.role,
+            createdAt: users.createdAt
+        }).from(users);
+
+        return NextResponse.json(allUsers);
+    } catch (e: any) {
+        return NextResponse.json({ error: e.message }, { status: 500 });
+    }
+}
+
+export async function POST(req: Request) {
+    if (!await checkIsAdmin()) return NextResponse.json({ error: 'Unauthorized' }, { status: 403 });
+
+    try {
+        const { fullName, username, email, password, role } = await req.json();
+
+        // Ensure unique username/email
+        const existingUsers = await db.select().from(users).where(eq(users.username, username));
+        if (existingUsers.length > 0) return NextResponse.json({ error: 'Username is taken' }, { status: 400 });
+
+        const passwordHash = await hashPassword(password);
+        await db.insert(users).values({
+            id: crypto.randomUUID(),
+            fullName,
+            username,
+            email,
+            passwordHash,
+            role: role || 'User',
+            createdAt: new Date().toISOString()
+        });
+
+        return NextResponse.json({ success: true });
+    } catch (e: any) {
+        return NextResponse.json({ error: e.message }, { status: 500 });
+    }
+}
+
+export async function PUT(req: Request) {
+    if (!await checkIsAdmin()) return NextResponse.json({ error: 'Unauthorized' }, { status: 403 });
+
+    try {
+        const { id, role } = await req.json();
+        
+        await db.update(users).set({ role }).where(eq(users.id, id));
+
+        return NextResponse.json({ success: true });
+    } catch (e: any) {
+        return NextResponse.json({ error: e.message }, { status: 500 });
+    }
+}
+
+export async function DELETE(req: Request) {
+    if (!await checkIsAdmin()) return NextResponse.json({ error: 'Unauthorized' }, { status: 403 });
+
+    try {
+        const url = new URL(req.url);
+        const id = url.searchParams.get('id');
+        if (!id) return NextResponse.json({ error: 'ID is required' }, { status: 400 });
+
+        // First remove all their sessions
+        await db.delete(sessions).where(eq(sessions.userId, id));
+        // Then delete the user
+        await db.delete(users).where(eq(users.id, id));
+
+        return NextResponse.json({ success: true });
+    } catch (e: any) {
+         return NextResponse.json({ error: e.message }, { status: 500 });
+    }
+}

package/app/api/auth/wipe/route.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from "next/server";
+import { db } from "@/db";
+import { users, sessions, reports, config, profile, appearance } from "@/db/schema";
+import { cookies } from "next/headers";
+
+// DELETE /api/auth/wipe — Wipe ALL data and reset application to factory state
+export async function DELETE() {
+    try {
+        // Wipe everything in order (sessions first due to FK)
+        db.delete(sessions).run();
+        db.delete(reports).run();
+        db.delete(users).run();
+        db.delete(config).run();
+        db.delete(profile).run();
+        db.delete(appearance).run();
+
+        // Clear all auth cookies
+        const cookieStore = await cookies();
+        cookieStore.delete('omnirad_session_id');
+        cookieStore.delete('omnirad_setup_complete');
+
+        return NextResponse.json({ success: true });
+    } catch (error) {
+        console.error("[API] Error wiping all data:", error);
+        return NextResponse.json({ error: "Failed to wipe data" }, { status: 500 });
+    }
+}

package/app/api/compliance/anonymize/patient/[id]/route.ts

@@ -0,0 +1,104 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db, sqlite } from "@/db";
+import { patients, reports } from "@/db/schema";
+import { eq } from "drizzle-orm";
+import { requireUser, requirePermission, handleAuthError } from "@/lib/security/authz";
+import { safeError } from "@/lib/security/phi-redaction";
+import { auditSuccess, auditEventFromContext } from "@/lib/security/audit";
+import { randomUUID } from "crypto";
+
+// POST /api/compliance/anonymize/patient/[id] — GDPR Article 17: Right to Erasure (Anonymization)
+export async function POST(
+    request: NextRequest,
+    { params }: { params: Promise<{ id: string }> }
+) {
+    try {
+        const ctx = await requireUser(request);
+        requirePermission(ctx, "compliance.manage");
+
+        const { id } = await params;
+
+        // Validate patient exists
+        const patient = await db.select().from(patients).where(eq(patients.id, id)).limit(1);
+        if (patient.length === 0) {
+            return NextResponse.json({ error: "Patient not found" }, { status: 404 });
+        }
+
+        const now = new Date().toISOString();
+        const anonymizedName = `ANONYMIZED_${Date.now()}`;
+
+        // Anonymize patient record — replace PII with placeholder values
+        db.update(patients).set({
+            patientName: anonymizedName,
+            patientIdNumber: null,
+            dob: null,
+            age: null,
+            gender: null,
+            mobile: null,
+            address: null,
+            contactInfo: null,
+            notes: null,
+            updatedAt: now,
+        }).where(eq(patients.id, id)).run();
+
+        // Anonymize reports — strip patient-identifying info from report_data JSON
+        const patientReports = sqlite.prepare(
+            "SELECT id, report_data FROM reports WHERE patient_id = ?"
+        ).all(id) as any[];
+
+        for (const r of patientReports) {
+            try {
+                const reportData = JSON.parse(r.report_data);
+                // Strip patient section
+                if (reportData.patient) {
+                    reportData.patient = {
+                        name: anonymizedName,
+                        patient_id: null,
+                        dob: null,
+                        age: null,
+                        gender: null,
+                    };
+                }
+                // Strip image data
+                delete reportData.image_data;
+
+                sqlite.prepare(
+                    "UPDATE reports SET patient_name = ?, report_data = ?, image_data = NULL WHERE id = ?"
+                ).run(anonymizedName, JSON.stringify(reportData), r.id);
+            } catch { /* skip reports that fail to parse */ }
+        }
+
+        // Update privacy controls
+        const existing = sqlite.prepare(
+            "SELECT id FROM patient_privacy_controls WHERE patient_id = ?"
+        ).get(id) as any;
+
+        if (existing) {
+            sqlite.prepare(`
+                UPDATE patient_privacy_controls 
+                SET restriction = 'anonymized', anonymized_at = ?, anonymized_by = ?, updated_at = ?
+                WHERE patient_id = ?
+            `).run(now, ctx.userId, now, id);
+        } else {
+            sqlite.prepare(`
+                INSERT INTO patient_privacy_controls (id, patient_id, restriction, anonymized_at, anonymized_by, created_at, updated_at)
+                VALUES (?, ?, 'anonymized', ?, ?, ?, ?)
+            `).run(randomUUID(), id, now, ctx.userId, now, now);
+        }
+
+        await auditSuccess(auditEventFromContext(ctx, "patient.anonymize", "patient", {
+            resourceId: id,
+            patientId: id,
+            metadata: { count: patientReports.length },
+        }));
+
+        return NextResponse.json({
+            success: true,
+            anonymizedReports: patientReports.length,
+        });
+    } catch (error) {
+        if ((error as any)?.statusCode) return handleAuthError(error);
+        safeError("Error anonymizing patient:", error);
+        return NextResponse.json({ error: "Failed to anonymize patient" }, { status: 500 });
+    }
+}

package/app/api/compliance/audit/route.ts

@@ -0,0 +1,110 @@
+import { NextRequest, NextResponse } from "next/server";
+import { sqlite } from "@/db";
+import { requireUser, requireRole, requirePermission, handleAuthError } from "@/lib/security/authz";
+import { safeError } from "@/lib/security/phi-redaction";
+
+// GET /api/compliance/audit — Query audit logs (Admin only)
+export async function GET(request: NextRequest) {
+    try {
+        const ctx = await requireUser(request);
+        requireRole(ctx, ["Admin"]);
+
+        const { searchParams } = new URL(request.url);
+        const page = parseInt(searchParams.get("page") || "1");
+        const limit = Math.min(parseInt(searchParams.get("limit") || "50"), 200);
+        const action = searchParams.get("action");
+        const resourceType = searchParams.get("resourceType");
+        const actorUserId = searchParams.get("actorUserId");
+        const patientId = searchParams.get("patientId");
+        const startDate = searchParams.get("startDate");
+        const endDate = searchParams.get("endDate");
+        const success = searchParams.get("success");
+
+        // Build dynamic query
+        const conditions: string[] = [];
+        const params: any[] = [];
+
+        if (action) {
+            conditions.push("action LIKE ?");
+            params.push(`%${action}%`);
+        }
+        if (resourceType) {
+            conditions.push("resource_type = ?");
+            params.push(resourceType);
+        }
+        if (actorUserId) {
+            conditions.push("actor_user_id = ?");
+            params.push(actorUserId);
+        }
+        if (patientId) {
+            conditions.push("patient_id = ?");
+            params.push(patientId);
+        }
+        if (startDate) {
+            conditions.push("created_at >= ?");
+            params.push(startDate);
+        }
+        if (endDate) {
+            conditions.push("created_at <= ?");
+            params.push(endDate);
+        }
+        if (success !== null && success !== undefined) {
+            conditions.push("success = ?");
+            params.push(success === "true" ? 1 : 0);
+        }
+
+        const whereClause = conditions.length > 0
+            ? `WHERE ${conditions.join(" AND ")}`
+            : "";
+
+        // Count total
+        const countRow = sqlite.prepare(`SELECT COUNT(*) as total FROM audit_logs ${whereClause}`).get(...params) as any;
+        const total = countRow?.total || 0;
+
+        // Fetch page
+        const offset = (page - 1) * limit;
+        const rows = sqlite.prepare(
+            `SELECT * FROM audit_logs ${whereClause} ORDER BY created_at DESC LIMIT ? OFFSET ?`
+        ).all(...params, limit, offset) as any[];
+
+        // Enrich with user names
+        const enriched = rows.map((row: any) => {
+            let actorName = "System";
+            if (row.actor_user_id) {
+                const user = sqlite.prepare("SELECT full_name, username FROM users WHERE id = ?").get(row.actor_user_id) as any;
+                actorName = user?.full_name || user?.username || row.actor_user_id;
+            }
+
+            return {
+                id: row.id,
+                actorUserId: row.actor_user_id,
+                actorName,
+                actorRole: row.actor_role,
+                actorType: row.actor_type,
+                action: row.action,
+                resourceType: row.resource_type,
+                resourceId: row.resource_id,
+                patientId: row.patient_id,
+                ipAddress: row.ip_address,
+                success: !!row.success,
+                reason: row.reason,
+                metadata: row.metadata_json ? JSON.parse(row.metadata_json) : null,
+                createdAt: row.created_at,
+            };
+        });
+
+        return NextResponse.json({
+            data: enriched,
+            pagination: {
+                page,
+                limit,
+                total,
+                totalPages: Math.ceil(total / limit),
+            },
+        });
+    } catch (error) {
+        if ((error as any)?.statusCode) return handleAuthError(error);
+        safeError("Error fetching audit logs:", error);
+        return NextResponse.json({ error: "Failed to fetch audit logs" }, { status: 500 });
+    }
+}