@omniradiology/omnirad 0.1.3

package/app/api/reports/route.ts

@@ -0,0 +1,112 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/db";
+import { reports, patients } from "@/db/schema";
+import { desc, eq } from "drizzle-orm";
+import { randomUUID } from "crypto";
+
+// GET /api/reports — List all reports
+export async function GET() {
+    try {
+        const rows = db.select().from(reports).orderBy(desc(reports.createdAt)).all();
+        const parsed = rows.map((r) => {
+            const reportData = JSON.parse(r.reportData);
+            if (r.imageData && !reportData.image_data) {
+                reportData.image_data = r.imageData;
+            }
+            return {
+                id: r.id,
+                patient_name: r.patientName,
+                modality: r.modality,
+                urgency: r.urgency,
+                report_status: r.reportStatus,
+                report_data: reportData,
+                created_at: r.createdAt,
+                pacs_study_uid: r.pacsStudyUid,
+                pacs_series_uid: r.pacsSeriesUid,
+                pacs_source: r.pacsSource,
+            };
+        });
+        return NextResponse.json(parsed);
+    } catch (error) {
+        console.error("[API] Error fetching reports:", error);
+        return NextResponse.json([], { status: 500 });
+    }
+}
+
+// POST /api/reports — Create a new report
+export async function POST(request: NextRequest) {
+    try {
+        const body = await request.json();
+        const { report_data, id } = body;
+
+        const reportId = id || `local_${Date.now()}`;
+        const pName = report_data.patient?.name || "Unknown";
+        const pIdNumber = report_data.patient?.patient_id || body.patientIdNumber || null;
+
+        // Auto-link or auto-create patient
+        let linkedPatientId = "";
+        
+        // 1. Try to find by ID number first if provided
+        let existing: any[] = [];
+        if (pIdNumber) {
+            existing = await db.select().from(patients).where(eq(patients.patientIdNumber, pIdNumber)).limit(1);
+        }
+        // 2. If not found by ID, try exact match by Name
+        if (existing.length === 0) {
+            existing = await db.select().from(patients).where(eq(patients.patientName, pName)).limit(1);
+        }
+
+        if (existing.length > 0) {
+            linkedPatientId = existing[0].id;
+
+            // Backfill any missing patient metadata from the new report
+            const updates: Record<string, any> = {};
+            const incomingAge = report_data.patient?.age || body.age;
+            const incomingDob = report_data.patient?.dob || body.dob;
+            const incomingGender = report_data.patient?.gender || body.gender;
+
+            if (!existing[0].age && incomingAge) updates.age = incomingAge;
+            if (!existing[0].dob && incomingDob) updates.dob = incomingDob;
+            if (!existing[0].gender && incomingGender) updates.gender = incomingGender;
+
+            if (Object.keys(updates).length > 0) {
+                updates.updatedAt = new Date().toISOString();
+                await db.update(patients).set(updates).where(eq(patients.id, linkedPatientId));
+            }
+        } else {
+            // Auto-create
+            linkedPatientId = randomUUID();
+            await db.insert(patients).values({
+                id: linkedPatientId,
+                patientName: pName,
+                patientIdNumber: pIdNumber,
+                dob: report_data.patient?.dob || body.dob || null,
+                age: report_data.patient?.age || body.age || null,
+                gender: report_data.patient?.gender || body.gender || null,
+                createdAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString()
+            });
+        }
+
+        // Insert report
+        db.insert(reports).values({
+            id: reportId,
+            patientId: linkedPatientId,
+            patientName: pName,
+            modality: report_data.study?.examination || report_data.study?.modality || "",
+            urgency: report_data.urgency || "Routine",
+            reportStatus: report_data.report_footer?.report_status || "Pending",
+            reportData: JSON.stringify(report_data),
+            imageData: report_data.image_data || null,
+            createdAt: new Date().toISOString(),
+            pacsStudyUid: report_data.pacs_info?.study_uid || null,
+            pacsSeriesUid: report_data.pacs_info?.series_uid || null,
+            pacsSource: report_data.pacs_info?.source || null,
+        }).run();
+
+        return NextResponse.json({ id: reportId, patientId: linkedPatientId, success: true });
+    } catch (error) {
+        console.error("[API] Error saving report:", error);
+        return NextResponse.json({ error: "Failed to save report" }, { status: 500 });
+    }
+}

package/app/api/segmentation-config/route.ts

@@ -0,0 +1,238 @@
+import { NextRequest, NextResponse } from "next/server";
+import { sqlite } from "@/db";
+import { requireUser, requirePermission, handleAuthError } from "@/lib/security/authz";
+import { maskSecret } from "@/lib/security/secrets";
+import { safeError } from "@/lib/security/phi-redaction";
+import { auditSuccess, auditEventFromContext } from "@/lib/security/audit";
+
+// GET /api/segmentation-config — load active segmentation config
+export async function GET(req: NextRequest) {
+    try {
+        const ctx = await requireUser(req);
+        requirePermission(ctx, "settings.read");
+        const row = sqlite
+            .prepare("SELECT * FROM segmentation_configurations WHERE is_active = 1 LIMIT 1")
+            .get() as any;
+
+        if (!row) {
+            return NextResponse.json({
+                deploymentMode: "localhost",
+                providerName: "MedSAM3",
+                modelName: "",
+                modelType: "medsam3",
+                baseUrl: "http://localhost:5000",
+                healthEndpoint: "/healthz",
+                predictEndpoint: "/v1/segmentations",
+                apiSecretKey: "",
+                timeoutSeconds: 120,
+                supportsContours: true,
+                supports3D: false,
+                returnsMask: true,
+                returnsBox: true,
+                isActive: false,
+            });
+        }
+
+        return NextResponse.json({
+            id: row.id,
+            deploymentMode: row.deployment_mode,
+            providerName: row.provider_name,
+            modelName: row.model_name,
+            modelType: row.model_type || "medsam3",
+            baseUrl: row.base_url,
+            healthEndpoint: row.health_endpoint,
+            predictEndpoint: row.predict_endpoint,
+            apiSecretKey: maskSecret(row.api_secret_key),
+            hasApiKey: !!(row.api_secret_key && row.api_secret_key.length > 0),
+            timeoutSeconds: row.timeout_seconds,
+            supportsContours: !!row.supports_contours,
+            supports3D: !!row.supports_3d,
+            returnsMask: !!row.returns_mask,
+            returnsBox: !!row.returns_box,
+            isActive: !!row.is_active,
+        });
+    } catch (error: any) {
+        if (error?.statusCode) return handleAuthError(error);
+        safeError("segmentation-config GET error:", error);
+        return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+}
+
+// PUT /api/segmentation-config — save segmentation config
+export async function PUT(req: NextRequest) {
+    try {
+        const ctx = await requireUser(req);
+        requirePermission(ctx, "ai.configure");
+        const body = await req.json();
+        const {
+            deploymentMode = "localhost",
+            providerName = "MedSAM3",
+            modelName = "",
+            modelType = "medsam3",
+            baseUrl: rawBaseUrl = "http://localhost:5000",
+            healthEndpoint = "/healthz",
+            predictEndpoint = "/v1/segmentations",
+            apiSecretKey = "",
+            timeoutSeconds = 120,
+            supportsContours = true,
+            supports3D = false,
+            returnsMask = true,
+            returnsBox = true,
+            isActive = true,
+        } = body;
+
+        // Sanitize base URL: strip any trailing path segments (e.g. /v1, /api)
+        // Keep only the origin (scheme + host + port)
+        let baseUrl = rawBaseUrl.trim().replace(/\/+$/, "")
+        try {
+            const parsed = new URL(baseUrl)
+            baseUrl = parsed.origin  // strips any path like /v1
+        } catch { /* not a valid URL yet, keep as-is */ }
+
+        const now = new Date().toISOString();
+
+        // Check if a config already exists
+        const existing = sqlite
+            .prepare("SELECT id FROM segmentation_configurations LIMIT 1")
+            .get() as any;
+
+        if (existing) {
+            sqlite.prepare(`
+                UPDATE segmentation_configurations SET
+                    deployment_mode = ?, provider_name = ?, model_name = ?,
+                    model_type = ?,
+                    base_url = ?, health_endpoint = ?, predict_endpoint = ?,
+                    api_secret_key = ?, timeout_seconds = ?,
+                    supports_contours = ?, supports_3d = ?,
+                    returns_mask = ?, returns_box = ?,
+                    is_active = ?, updated_at = ?
+                WHERE id = ?
+            `).run(
+                deploymentMode, providerName, modelName,
+                modelType,
+                baseUrl, healthEndpoint, predictEndpoint,
+                apiSecretKey || null, timeoutSeconds,
+                supportsContours ? 1 : 0, supports3D ? 1 : 0,
+                returnsMask ? 1 : 0, returnsBox ? 1 : 0,
+                isActive ? 1 : 0, now,
+                existing.id
+            );
+        } else {
+            const id = `segconfig_${Date.now()}`;
+            sqlite.prepare(`
+                INSERT INTO segmentation_configurations
+                (id, deployment_mode, provider_name, model_name, model_type, base_url, health_endpoint, predict_endpoint,
+                 api_secret_key, timeout_seconds, supports_contours, supports_3d, returns_mask, returns_box,
+                 is_active, created_at, updated_at)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run(
+                id, deploymentMode, providerName, modelName,
+                modelType,
+                baseUrl, healthEndpoint, predictEndpoint,
+                apiSecretKey || null, timeoutSeconds,
+                supportsContours ? 1 : 0, supports3D ? 1 : 0,
+                returnsMask ? 1 : 0, returnsBox ? 1 : 0,
+                isActive ? 1 : 0, now, now
+            );
+        }
+
+        await auditSuccess(auditEventFromContext(ctx, "settings.update", "ai", {
+            metadata: { providerName, modelName },
+        }));
+
+        return NextResponse.json({ success: true });
+    } catch (error: any) {
+        if (error?.statusCode) return handleAuthError(error);
+        safeError("segmentation-config PUT error:", error);
+        return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+}
+
+// POST /api/segmentation-config — test connectivity to segmentation backend
+export async function POST(req: NextRequest) {
+    try {
+        const ctx = await requireUser(req);
+        requirePermission(ctx, "ai.configure");
+        const body = await req.json();
+        const { baseUrl, healthEndpoint, apiSecretKey, timeoutSeconds = 15 } = body;
+
+        if (!baseUrl) {
+            return NextResponse.json({ success: false, error: "Base URL is required." });
+        }
+
+        // Sanitize: strip trailing slashes and any accidental sub-paths (e.g. /v1)
+        let cleanBase = baseUrl.trim().replace(/\/+$/, "")
+        try {
+            const parsed = new URL(cleanBase)
+            cleanBase = parsed.origin  // keeps only scheme+host+port
+        } catch { /* keep as-is */ }
+
+        const url = `${cleanBase}${healthEndpoint || "/healthz"}`;
+
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), (timeoutSeconds || 15) * 1000);
+
+        try {
+            const headers: Record<string, string> = { "Content-Type": "application/json" };
+            if (apiSecretKey) {
+                headers["Authorization"] = `Bearer ${apiSecretKey}`;
+            }
+
+            const response = await fetch(url, {
+                method: "GET",
+                headers,
+                signal: controller.signal,
+            });
+
+            clearTimeout(timeout);
+
+            if (response.ok) {
+                const data = await response.json().catch(() => ({}));
+                
+                // Fetch available models to populate UI (ignoring errors)
+                let availableModels: string[] = [];
+                try {
+                    // Try the OpenAI /v1/models route structure MedSAM3 uses
+                    const modelsRes = await fetch(`${cleanBase}/v1/models`, { 
+                        method: "GET", headers, signal: AbortSignal.timeout(5000) 
+                    });
+                    if (modelsRes.ok) {
+                        const mData = await modelsRes.json();
+                        if (Array.isArray(mData)) {
+                            availableModels = mData.map((m: any) => typeof m === "string" ? m : m.id || m.name || String(m));
+                        } else if (mData?.data) {
+                            availableModels = mData.data.map((m: any) => typeof m === "string" ? m : m.id || m.name || String(m));
+                        }
+                    }
+                } catch { /* non-fatal if models fail to fetch */ }
+
+                return NextResponse.json({
+                    success: true,
+                    message: `Connected successfully to ${url}`,
+                    details: data,
+                    availableModels: availableModels.filter(Boolean),
+                });
+            } else {
+                const text = await response.text().catch(() => "");
+                return NextResponse.json({
+                    success: false,
+                    error: `HTTP ${response.status}: ${text.slice(0, 200)}`,
+                });
+            }
+        } catch (fetchErr: any) {
+            clearTimeout(timeout);
+            if (fetchErr.name === "AbortError") {
+                return NextResponse.json({
+                    success: false,
+                    error: `Connection timed out after ${timeoutSeconds}s`,
+                });
+            }
+            return NextResponse.json({
+                success: false,
+                error: `Connection failed: ${fetchErr.message}`,
+            });
+        }
+    } catch (error: any) {
+        return NextResponse.json({ success: false, error: error.message });
+    }
+}

package/app/api/settings/route.ts

@@ -0,0 +1,245 @@
+import { NextRequest, NextResponse } from "next/server";
+import { db } from "@/db";
+import { config, profile, appearance, security, users, sessions } from "@/db/schema";
+import { eq } from "drizzle-orm";
+import { cookies } from "next/headers";
+
+// GET /api/settings?type=config|profile|appearance|users
+export async function GET(request: NextRequest) {
+    const type = request.nextUrl.searchParams.get("type");
+
+    try {
+        switch (type) {
+            case "config": {
+                const row = db.select().from(config).where(eq(config.id, 1)).get();
+                if (!row) {
+                    return NextResponse.json({
+                        n8nWebhookUrl: "",
+                        supabaseUrl: "",
+                        supabaseAnonKey: "",
+                        pacsOrthancUrl: "",
+                        pacsAuthType: "none",
+                        pacsUsername: "",
+                        pacsPassword: "",
+                        pacsBearerToken: "",
+                        pacsAeTitle: "",
+                    });
+                }
+                return NextResponse.json({
+                    n8nWebhookUrl: row.n8nWebhookUrl || "",
+                    supabaseUrl: row.supabaseUrl || "",
+                    supabaseAnonKey: row.supabaseAnonKey || "",
+                    pacsOrthancUrl: row.pacsOrthancUrl || "",
+                    pacsAuthType: row.pacsAuthType || "none",
+                    pacsUsername: row.pacsUsername || "",
+                    pacsPassword: row.pacsPassword || "",
+                    pacsBearerToken: row.pacsBearerToken || "",
+                    pacsAeTitle: row.pacsAeTitle || "",
+                });
+            }
+            case "profile": {
+                const row = db.select().from(profile).where(eq(profile.id, 1)).get();
+                if (!row) {
+                    return NextResponse.json({
+                        fullName: "",
+                        role: "",
+                        hospitalName: "",
+                        department: "",
+                    });
+                }
+                return NextResponse.json({
+                    fullName: row.fullName || "",
+                    role: row.role || "",
+                    hospitalName: row.hospitalName || "",
+                    department: row.department || "",
+                });
+            }
+            case "appearance": {
+                const row = db.select().from(appearance).where(eq(appearance.id, 1)).get();
+                if (!row) {
+                    return NextResponse.json({
+                        theme: "dark",
+                        template: "standard",
+                        hospitalName: "",
+                        logo: "",
+                    });
+                }
+                return NextResponse.json({
+                    theme: row.theme || "dark",
+                    template: row.template || "standard",
+                    hospitalName: row.hospitalName || "",
+                    logo: row.logo || "",
+                });
+            }
+
+            case "security": {
+                const row = db.select().from(security).where(eq(security.id, 1)).get();
+                if (!row) {
+                    return NextResponse.json({
+                        appLockEnabled: true,
+                        defaultUserId: null,
+                        updatedBy: null,
+                        updatedAt: null,
+                        updatedByName: null,
+                    });
+                }
+                // Get the name of who last changed it
+                let updatedByName = null;
+                if (row.updatedBy) {
+                    const updater = db.select({ fullName: users.fullName }).from(users).where(eq(users.id, row.updatedBy)).get();
+                    updatedByName = updater?.fullName || null;
+                }
+                return NextResponse.json({
+                    appLockEnabled: row.appLockEnabled ?? true,
+                    defaultUserId: row.defaultUserId || null,
+                    updatedBy: row.updatedBy || null,
+                    updatedAt: row.updatedAt || null,
+                    updatedByName,
+                });
+            }
+
+            default:
+                return NextResponse.json({ error: "Invalid type. Use: config, profile, appearance, security, or users" }, { status: 400 });
+        }
+    } catch (error) {
+        console.error("[API] Error reading settings:", error);
+        return NextResponse.json({ error: "Failed to read settings" }, { status: 500 });
+    }
+}
+
+// PUT /api/settings — Upsert settings
+export async function PUT(request: NextRequest) {
+    try {
+        const body = await request.json();
+        const { type, data } = body;
+
+        switch (type) {
+            case "config": {
+                const exists = db.select().from(config).where(eq(config.id, 1)).get();
+                if (exists) {
+                    db.update(config).set({
+                        n8nWebhookUrl: data.n8nWebhookUrl || "",
+                        supabaseUrl: data.supabaseUrl || "",
+                        supabaseAnonKey: data.supabaseAnonKey || "",
+                        pacsOrthancUrl: data.pacsOrthancUrl || "",
+                        pacsAuthType: data.pacsAuthType || "none",
+                        pacsUsername: data.pacsUsername || "",
+                        pacsPassword: data.pacsPassword || "",
+                        pacsBearerToken: data.pacsBearerToken || "",
+                        pacsAeTitle: data.pacsAeTitle || "",
+                    }).where(eq(config.id, 1)).run();
+                } else {
+                    db.insert(config).values({
+                        id: 1,
+                        n8nWebhookUrl: data.n8nWebhookUrl || "",
+                        supabaseUrl: data.supabaseUrl || "",
+                        supabaseAnonKey: data.supabaseAnonKey || "",
+                        pacsOrthancUrl: data.pacsOrthancUrl || "",
+                        pacsAuthType: data.pacsAuthType || "none",
+                        pacsUsername: data.pacsUsername || "",
+                        pacsPassword: data.pacsPassword || "",
+                        pacsBearerToken: data.pacsBearerToken || "",
+                        pacsAeTitle: data.pacsAeTitle || "",
+                    }).run();
+                }
+                break;
+            }
+            case "profile": {
+                const exists = db.select().from(profile).where(eq(profile.id, 1)).get();
+                if (exists) {
+                    db.update(profile).set({
+                        fullName: data.fullName || "",
+                        role: data.role || "",
+                        hospitalName: data.hospitalName || "",
+                        department: data.department || "",
+                    }).where(eq(profile.id, 1)).run();
+                } else {
+                    db.insert(profile).values({
+                        id: 1,
+                        fullName: data.fullName || "",
+                        role: data.role || "",
+                        hospitalName: data.hospitalName || "",
+                        department: data.department || "",
+                    }).run();
+                }
+                break;
+            }
+            case "appearance": {
+                const exists = db.select().from(appearance).where(eq(appearance.id, 1)).get();
+                if (exists) {
+                    db.update(appearance).set({
+                        theme: data.theme || "dark",
+                        template: data.template || "standard",
+                        hospitalName: data.hospitalName || "",
+                        logo: data.logo || "",
+                    }).where(eq(appearance.id, 1)).run();
+                } else {
+                    db.insert(appearance).values({
+                        id: 1,
+                        theme: data.theme || "dark",
+                        template: data.template || "standard",
+                        hospitalName: data.hospitalName || "",
+                        logo: data.logo || "",
+                    }).run();
+                }
+                break;
+            }
+
+            case "security": {
+                // Admin-only: verify the current user is an admin
+                const cookieStore = await cookies();
+                const sessionId = cookieStore.get('omnirad_session_id')?.value;
+                if (!sessionId) {
+                    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+                }
+                const sessionList = db.select().from(sessions).where(eq(sessions.id, sessionId)).all();
+                const session = sessionList[0];
+                if (!session || session.expiresAt * 1000 < Date.now()) {
+                    return NextResponse.json({ error: "Session expired" }, { status: 401 });
+                }
+                const currentUser = db.select().from(users).where(eq(users.id, session.userId)).get();
+                if (!currentUser || currentUser.role !== 'Admin') {
+                    return NextResponse.json({ error: "Only administrators can change security settings" }, { status: 403 });
+                }
+
+                const appLockEnabled = data.appLockEnabled ?? true;
+                const defaultUserId = data.defaultUserId || null;
+                const secExists = db.select().from(security).where(eq(security.id, 1)).get();
+                const secData = {
+                    appLockEnabled,
+                    defaultUserId,
+                    updatedBy: currentUser.id,
+                    updatedAt: new Date().toISOString(),
+                };
+                if (secExists) {
+                    db.update(security).set(secData).where(eq(security.id, 1)).run();
+                } else {
+                    db.insert(security).values({ id: 1, ...secData }).run();
+                }
+
+                // Set or clear the middleware signal cookie
+                if (!appLockEnabled) {
+                    cookieStore.set('omnirad_app_unlocked', 'true', {
+                        httpOnly: false,
+                        secure: process.env.NODE_ENV === 'production',
+                        sameSite: 'lax',
+                        path: '/',
+                        maxAge: 60 * 60 * 24 * 365, // 1 year
+                    });
+                } else {
+                    cookieStore.delete('omnirad_app_unlocked');
+                }
+
+                break;
+            }
+
+            default:
+                return NextResponse.json({ error: "Invalid type" }, { status: 400 });
+        }
+
+        return NextResponse.json({ success: true });
+    } catch (error) {
+        console.error("[API] Error saving settings:", error);
+        return NextResponse.json({ error: "Failed to save settings" }, { status: 500 });
+    }
+}