evaldoc 1.0.0

package/functions/src/safety.js

@@ -0,0 +1,188 @@
+const { analyzeMedicalSafety } = require('./ner');
+
+// NER entity types that indicate personally identifiable information.
+// dslim/bert-base-NER produces PER, LOC, ORG, MISC; medical models may
+// produce PERSON, LOCATION, etc.  We normalise to lowercase and check
+// against this set.
+const PII_ENTITY_TYPES = new Set([
+  'per', 'person',           // person names
+  'loc', 'location',         // locations (addresses, cities)
+  'org', 'organization',     // organisations (hospitals, clinics)
+  'id', 'medical_record',    // medical record numbers (future models)
+  'norp'                     // nationalities / religious / political groups
+]);
+
+/**
+ * Check whether any NER entities correspond to PII.
+ * @param {Array} entities – array returned by extractMedicalEntities
+ * @returns {boolean}
+ */
+function entitiesContainPII(entities) {
+  if (!Array.isArray(entities) || entities.length === 0) return false;
+  return entities.some(e => {
+    const type = (e.type || '').toLowerCase().replace(/^[bi]-/, '');
+    return PII_ENTITY_TYPES.has(type);
+  });
+}
+
+// Input blocking: patterns that should never be submitted BY users (e.g., demanding a prescription)
+const INPUT_BLOCKED = [
+  /\bprescribe me\b/i,
+  /\bgive me a diagnosis\b/i,
+  /\bwrite me a prescription\b/i,
+  /\boff[-\s]?label\b/i,
+  /\bimage shows|looks like\b/i,
+  /\brecommend.*(?:medication|treatment|drug|medicine)\b/i,
+  /\bbest (?:treatment|medication|drug|medicine) for\b/i,
+  /\bwhat (?:should i|do i) take for\b/i,
+  /\bhow many (?:tablets?|pills?|capsules?)\b/i,
+  /\binterpret (?:my|this|the) (?:x-?ray|scan|mri|ct|image|lab|result)\b/i
+];
+
+// Output blocking: patterns that indicate the AI is making a definitive clinical statement.
+// Uses negative look-behind / surrounding context to allow safe phrasing like
+// "I cannot diagnose" or "consult your doctor for treatment".
+const OUTPUT_BLOCKED = [
+  /\byou have (?!questions|concerns|options|access|the right|a right|every right)\w+/i,
+  /\byou (?:might|may|could|probably) have\b/i,
+  /\byou are (?:suffering|diagnosed|likely)\b/i,
+  /\bthis is (?:likely|probably|most likely)\b/i,
+  /\btake \d+\s?(mg|ml|tablets?|capsules?)\b/i,
+  /\b\d+\s?(mg|ml|mcg|units?) (?:twice|three times|once|every) (?:daily|a day|per day)\b/i,
+  /\b(start|stop) (taking|using) \w+/i,
+  /\bapply \d+\s?(mg|ml|times)\b/i,
+  /\bimage shows|this looks like\b/i,
+  /\bnot approved but\b/i,
+  /\btry it for\b/i,
+  /\bi recommend you (?:take|try|use|start)\b/i,
+  /\bhere is your prescription\b/i,
+  /\blooks like (?:pneumonia|tumor|fracture|cancer)\b/i
+];
+
+const GLOBAL_REDFLAGS = [
+  /chest\s+(pain|hurts?|tightness|pressure)|trouble breathing|difficulty breathing|shortness of breath|can'?t breathe/i,
+  /seizure|fainting|stroke|sudden weakness|slurred speech/i,
+  /severe bleeding|uncontrolled bleeding/i,
+  /suicid(al|e)|self-harm|want to die|end my life|feel(s?|ing) like dying|kill myself/i,
+  /pregnan(t|cy).*(bleeding|severe pain)/i,
+  /newborn|infant.*(severe|difficulty|breathing)/i,
+  /severe allergic|anaphyla|swelling.*(face|throat|tongue)/i,
+  /unconscious|loss of consciousness|unresponsive/i,
+  /sudden vision (?:loss|change)|eye pain/i,
+  /overdose|took too (?:many|much)/i
+];
+
+const PII_PATTERNS = [
+  /\b\d{3}-\d{2}-\d{4}\b/, // SSN
+  /\b\d{10}\b/, // phone-like
+  /\b[\w.+-]+@[\w-]+\.[\w.-]+\b/, // email
+  /\b\d{1,5}\s+[A-Za-z]+(?:\s+[A-Za-z]+)*\s+(?:street|st|avenue|ave|road|rd|drive|dr|lane|ln|court|ct|blvd|boulevard|way|place|pl)\b/i, // street address (non-overlapping to avoid ReDoS)
+  /\b(?:zip|postal)\b[\s\w:.,-]{0,20}\d{5}(?:-\d{4})?\b/i, // ZIP code (context-gated to avoid false positives)
+  /\b(?:0[1-9]|1[0-2])\/(?:0[1-9]|[12]\d|3[01])\/(?:19|20)\d{2}\b/, // date of birth MM/DD/YYYY
+  /\b(?:\d{4}[-\s]?){3}\d{4}\b/ // credit card number (16 digits)
+];
+
+const PII_REDACTIONS = [
+  // Credit-card first so its 16-digit run is fully masked before narrower
+  // numeric patterns (ZIP/phone) can touch any fragment of it.
+  { pattern: /\b(?:\d{4}[-\s]?){3}\d{4}\b/g, replacement: "[redacted]" },
+  { pattern: /\b\d{3}-\d{2}-\d{4}\b/g, replacement: "[redacted]" },
+  { pattern: /\b\d{10}\b/g, replacement: "[redacted]" },
+  { pattern: /\b[\w.+-]+@[\w-]+\.[\w.-]+\b/g, replacement: "[redacted]" },
+  { pattern: /\b\d{1,5}\s+[A-Za-z]+(?:\s+[A-Za-z]+)*\s+(?:street|st|avenue|ave|road|rd|drive|dr|lane|ln|court|ct|blvd|boulevard|way|place|pl)\b/gi, replacement: "[redacted address]" },
+  { pattern: /\b(?:zip|postal)\b[\s\w:.,-]{0,20}\d{5}(?:-\d{4})?\b/gi, replacement: "[redacted]" },
+  { pattern: /\b(?:0[1-9]|1[0-2])\/(?:0[1-9]|[12]\d|3[01])\/(?:19|20)\d{2}\b/g, replacement: "[redacted DOB]" }
+];
+
+function evaluateText(text, patterns) {
+  return patterns.filter((pattern) => {
+    pattern.lastIndex = 0;
+    return pattern.test(text);
+  });
+}
+
+async function analyzeInput(message, topicConfig) {
+  const text = String(message || "");
+  const config = topicConfig || {};
+
+  const blocked = evaluateText(text, INPUT_BLOCKED);
+  const redflags = evaluateText(text, GLOBAL_REDFLAGS);
+  const topicBlocked = evaluateText(text, config.forbiddenPatterns || []);
+  const pii = evaluateText(text, PII_PATTERNS);
+
+  // Run NER analysis in parallel (graceful fallback on failure)
+  let nerAnalysis = { shouldEscalate: false, entities: [], analysis: {} };
+  try {
+    nerAnalysis = await analyzeMedicalSafety(text);
+  } catch (err) {
+    console.error('[Safety] NER analysis failed, continuing without it:', err.message);
+  }
+
+  const flags = [];
+  if (blocked.length || topicBlocked.length) flags.push("blocked_input");
+  if (redflags.length || nerAnalysis.shouldEscalate) flags.push("red_flag");
+  const nerPII = entitiesContainPII(nerAnalysis.entities);
+  if (pii.length || nerPII) flags.push("pii_detected");
+  if (nerAnalysis.entities.length > 0) flags.push("medical_entities_detected");
+
+  return {
+    blocked: blocked.length > 0 || topicBlocked.length > 0,
+    escalated: redflags.length > 0 || nerAnalysis.shouldEscalate,
+    flags,
+    entities: nerAnalysis.entities,
+    nerAnalysis: nerAnalysis.analysis
+  };
+}
+
+function analyzeOutput(text, topicConfig) {
+  const output = String(text || "");
+  const config = topicConfig || {};
+  const blocked = evaluateText(output, OUTPUT_BLOCKED);
+  const topicBlocked = evaluateText(output, config.forbiddenPatterns || []);
+
+  const flags = [];
+  if (blocked.length || topicBlocked.length) flags.push("blocked_output");
+
+  return {
+    blocked: blocked.length > 0 || topicBlocked.length > 0,
+    flags
+  };
+}
+
+function redactText(text) {
+  let result = String(text || "");
+  PII_REDACTIONS.forEach(({ pattern, replacement }) => {
+    result = result.replace(pattern, replacement);
+  });
+  return result;
+}
+
+// Locale-aware patient-facing messages. English preserves the original wording;
+// other supported locales are served from the i18n module (falling back to English).
+const { t } = require('./i18n');
+
+function refusalMessage(locale) {
+  if (!locale || locale === 'en') {
+    return "I can't help with that. For medical advice, please contact a licensed clinician.";
+  }
+  return t('refusal', locale);
+}
+
+function escalationMessage(locale) {
+  if (!locale || locale === 'en') {
+    return "Your symptoms may need urgent attention. Please seek professional care or local emergency services right away.";
+  }
+  return t('escalation', locale);
+}
+
+module.exports = {
+  analyzeInput,
+  analyzeOutput,
+  redactText,
+  refusalMessage,
+  escalationMessage,
+  INPUT_BLOCKED,
+  OUTPUT_BLOCKED,
+  GLOBAL_REDFLAGS,
+  PII_PATTERNS
+};

package/functions/src/stripe-config.js

@@ -0,0 +1,33 @@
+// Stripe Configuration
+const Stripe = require('stripe');
+
+let stripeClient = null;
+
+function hasStripeSecretKey() {
+  return Boolean(process.env.STRIPE_SECRET_KEY);
+}
+
+function getStripeClient() {
+  if (!hasStripeSecretKey()) {
+    throw new Error('STRIPE_SECRET_KEY is not configured');
+  }
+
+  if (!stripeClient) {
+    stripeClient = new Stripe(process.env.STRIPE_SECRET_KEY);
+  }
+
+  return stripeClient;
+}
+
+// Lazy proxy keeps module imports safe at startup and throws only when Stripe is used.
+const stripe = new Proxy({}, {
+  get(_target, prop) {
+    return getStripeClient()[prop];
+  }
+});
+
+module.exports = {
+  stripe,
+  hasStripeSecretKey,
+  getStripeClient
+};

package/functions/src/topics.js

@@ -0,0 +1,94 @@
+const TOPICS = {
+  medication_info_safety: {
+    title: "Medication info & safety",
+    disclaimer:
+      "Information only. Do not use this as medical advice. Contact a licensed clinician for guidance.",
+    prompt:
+      "Provide general medication information and safety warnings without dosing, diagnosis, or treatment advice.",
+    forbiddenPatterns: [
+      /\b(start|stop|change)\b.*\bmeds?\b/i,
+      /\b(dose|dosage|tablets?)\b/i,
+      /\d+\s*(mg|ml)\b/i
+    ],
+    escalationTriggers: [
+      /chest pain|trouble breathing|seizure|fainting/i,
+      /suicid(al|e)|self-harm/i
+    ]
+  },
+  appointments_preparation: {
+    title: "Appointment preparation",
+    disclaimer:
+      "General preparation info only. For urgent concerns, seek professional care.",
+    prompt:
+      "Explain how to prepare for an appointment with non-medical logistics and common questions.",
+    forbiddenPatterns: [/\bdiagnos(e|is)|treat(ment)?\b/i],
+    escalationTriggers: []
+  },
+  general_health_info: {
+    title: "General health info",
+    disclaimer:
+      "General health information only. This is not medical advice.",
+    prompt:
+      "Provide general health education without diagnosis, treatment, or dosing.",
+    forbiddenPatterns: [/\bdiagnos(e|is)|treat(ment)?\b/i],
+    escalationTriggers: [
+      /chest pain|trouble breathing|severe bleeding|stroke/i,
+      /pregnan(t|cy).*(bleeding|severe pain)/i
+    ]
+  },
+  clinic_services_hours: {
+    title: "Clinic services & hours",
+    disclaimer:
+      "Clinic info only. For emergencies, call local emergency services.",
+    prompt:
+      "Answer questions about clinic services, hours, and location.",
+    forbiddenPatterns: [/\bdiagnos(e|is)|treat(ment)?\b/i],
+    escalationTriggers: []
+  },
+  insurance_billing_faq: {
+    title: "Insurance & billing",
+    disclaimer:
+      "General billing info only. Contact the clinic for account-specific questions.",
+    prompt:
+      "Provide general insurance and billing explanations without accessing accounts.",
+    forbiddenPatterns: [/\b(ssn|social security|card number)\b/i],
+    escalationTriggers: []
+  },
+  post_procedure_guidance: {
+    title: "Post-procedure guidance",
+    disclaimer:
+      "General guidance only. If you have concerning symptoms, seek care right away.",
+    prompt:
+      "Provide non-personalized, general post-procedure care tips without dosing or treatment advice.",
+    forbiddenPatterns: [/\b(dose|dosage|mg|ml|tablets?)\b/i],
+    escalationTriggers: [/severe pain|high fever|uncontrolled bleeding/i]
+  }
+};
+
+const TOPIC_KEYS = Object.keys(TOPICS);
+
+function inferTopic(message) {
+  const lower = String(message || "").toLowerCase();
+  if (/(appointment|schedule|visit|check-in)/.test(lower)) {
+    return "appointments_preparation";
+  }
+  if (/(hours|open|closed|locat(ion|ed)|address|parking)/.test(lower)) {
+    return "clinic_services_hours";
+  }
+  if (/(insurance|billing|copay|claim)/.test(lower)) {
+    return "insurance_billing_faq";
+  }
+  if (/(after surgery|post-op|post procedure|after procedure)/.test(lower)) {
+    return "post_procedure_guidance";
+  }
+  if (/(medicine|medication|side effect|drug)/.test(lower)) {
+    return "medication_info_safety";
+  }
+  return "general_health_info";
+}
+
+module.exports = {
+  TOPICS,
+  TOPIC_KEYS,
+  inferTopic
+};

package/functions/src/triage.js

@@ -0,0 +1,191 @@
+const OpenAI = require('openai');
+const { GoogleGenerativeAI } = require('@google/generative-ai');
+
+/**
+ * Triage Classification Module
+ *
+ * Auto-classifies conversations into:
+ *   - urgent:        Red flags, needs immediate doctor attention
+ *   - needs_review:  AI uncertain, wants doctor confirmation
+ *   - informational: AI handled it, doctor can review later
+ *   - resolved:      Patient satisfied, no action needed
+ */
+
+const TRIAGE_CATEGORIES = ['urgent', 'needs_review', 'informational', 'resolved'];
+
+const TRIAGE_SYSTEM_PROMPT = `You are a medical conversation triage classifier. Analyze the conversation and classify it into exactly ONE category.
+
+CATEGORIES:
+- "urgent": Patient mentions emergency symptoms (chest pain, breathing difficulty, severe bleeding, suicidal thoughts, seizures), or the conversation was flagged/escalated for safety reasons. Needs immediate doctor attention.
+- "needs_review": Patient asked a specific medical question the AI couldn't fully address, expressed dissatisfaction with the AI response, or the AI gave advice that a doctor should verify. Doctor should review soon.
+- "informational": Patient asked general health questions (hours, billing, how-to, wellness tips) and the AI provided a satisfactory answer. Doctor can review at leisure.
+- "resolved": Conversation has naturally concluded - patient thanked the AI, said goodbye, or indicated their question was answered. No doctor action needed.
+
+RULES:
+- If the conversation was flagged as escalated, ALWAYS classify as "urgent"
+- If the patient's last message is a question and the AI's response seems uncertain or hedging, classify as "needs_review"
+- If the conversation is only 1-2 messages and seems like a greeting or simple question, classify as "informational"
+- Default to "needs_review" when uncertain
+
+Respond with ONLY a JSON object, no other text:
+{"category": "...", "confidence": 0.0-1.0, "reason": "brief explanation"}`;
+
+/**
+ * Classify a conversation for doctor triage
+ */
+async function classifyConversation({ messages, isEscalated, currentTriage }) {
+  // If already escalated, always urgent
+  if (isEscalated) {
+    return {
+      category: 'urgent',
+      confidence: 1.0,
+      reason: 'Conversation flagged for safety escalation'
+    };
+  }
+
+  // Build a summary of recent messages (last 6)
+  const recentMessages = (messages || []).slice(-6);
+  if (recentMessages.length === 0) {
+    return {
+      category: 'informational',
+      confidence: 0.5,
+      reason: 'No messages to classify'
+    };
+  }
+
+  const conversationSummary = recentMessages.map(msg => {
+    const role = msg.role === 'user' || msg.role === 'patient' ? 'Patient' : 'AI';
+    return `${role}: ${(msg.content || msg.message || '').substring(0, 200)}`;
+  }).join('\n');
+
+  const prompt = `Classify this medical conversation:\n\n${conversationSummary}`;
+
+  try {
+    const result = await callTriageLLM(prompt);
+    const parsed = parseTriageResponse(result);
+    // Low-confidence safety net: escalate to needs_review if LLM is uncertain
+    if (parsed.confidence < 0.5 && parsed.category === 'informational') {
+      parsed.category = 'needs_review';
+      parsed.reason = `Low confidence (${parsed.confidence}): ${parsed.reason}`;
+    }
+    return parsed;
+  } catch (err) {
+    console.error('[Triage] LLM classification failed:', err.message);
+    return ruleBasedTriage(recentMessages, isEscalated);
+  }
+}
+
+/**
+ * Call LLM for triage classification - uses Gemini (fast/cheap) first, DeepSeek fallback
+ */
+async function callTriageLLM(prompt) {
+  // Try Gemini first (faster and cheaper for classification)
+  if (process.env.GEMINI_API_KEY) {
+    try {
+      const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY);
+      const model = genAI.getGenerativeModel({
+        model: 'gemini-2.5-flash',
+        systemInstruction: TRIAGE_SYSTEM_PROMPT
+      });
+
+      const result = await model.generateContent({
+        contents: [{ role: 'user', parts: [{ text: prompt }] }],
+        generationConfig: {
+          maxOutputTokens: 100,
+          temperature: 0.1
+        }
+      });
+
+      return result.response.text().trim();
+    } catch (err) {
+      console.error('[Triage] Gemini failed:', err.message);
+    }
+  }
+
+  // Fallback to DeepSeek
+  if (process.env.DEEPSEEK_API_KEY) {
+    try {
+      const client = new OpenAI({
+        apiKey: process.env.DEEPSEEK_API_KEY,
+        baseURL: 'https://api.deepseek.com'
+      });
+
+      const response = await client.chat.completions.create({
+        model: 'deepseek-chat',
+        messages: [
+          { role: 'system', content: TRIAGE_SYSTEM_PROMPT },
+          { role: 'user', content: prompt }
+        ],
+        max_tokens: 100,
+        temperature: 0.1
+      });
+
+      return response.choices[0].message.content.trim();
+    } catch (err) {
+      console.error('[Triage] DeepSeek failed:', err.message);
+    }
+  }
+
+  throw new Error('No LLM available for triage');
+}
+
+/**
+ * Parse LLM triage response
+ */
+function parseTriageResponse(response) {
+  try {
+    // Extract JSON from response (handle markdown code blocks)
+    const jsonMatch = response.match(/\{[\s\S]*?\}/);
+    if (!jsonMatch) throw new Error('No JSON found');
+
+    const parsed = JSON.parse(jsonMatch[0]);
+
+    if (!TRIAGE_CATEGORIES.includes(parsed.category)) {
+      return { category: 'needs_review', confidence: 0.5, reason: 'Invalid category from LLM' };
+    }
+
+    return {
+      category: parsed.category,
+      confidence: Math.min(1, Math.max(0, Number(parsed.confidence) || 0.5)),
+      reason: String(parsed.reason || '').substring(0, 200)
+    };
+  } catch (err) {
+    return { category: 'needs_review', confidence: 0.5, reason: 'Failed to parse LLM response' };
+  }
+}
+
+/**
+ * Rule-based triage fallback when LLM is unavailable
+ */
+function ruleBasedTriage(messages, isEscalated) {
+  if (isEscalated) {
+    return { category: 'urgent', confidence: 1.0, reason: 'Escalation flag set' };
+  }
+
+  const lastMessage = messages[messages.length - 1];
+  const text = (lastMessage.content || lastMessage.message || '').toLowerCase();
+
+  // Check for urgent keywords
+  const urgentKeywords = ['chest pain', 'breathing', 'seizure', 'suicide', 'bleeding', 'emergency', 'help me'];
+  if (urgentKeywords.some(kw => text.includes(kw))) {
+    return { category: 'urgent', confidence: 0.8, reason: 'Urgent keywords detected' };
+  }
+
+  // Check for resolved signals
+  const resolvedKeywords = ['thank', 'thanks', 'goodbye', 'bye', 'got it', 'that helps', 'perfect'];
+  if (resolvedKeywords.some(kw => text.includes(kw))) {
+    return { category: 'resolved', confidence: 0.7, reason: 'Patient satisfaction signals' };
+  }
+
+  // Check if it's a question
+  if (text.includes('?') || text.startsWith('what') || text.startsWith('how') || text.startsWith('can')) {
+    return { category: 'needs_review', confidence: 0.6, reason: 'Patient asking questions' };
+  }
+
+  return { category: 'informational', confidence: 0.5, reason: 'General conversation' };
+}
+
+module.exports = {
+  classifyConversation,
+  TRIAGE_CATEGORIES
+};

package/functions/src/utils.js

@@ -0,0 +1,28 @@
+function jsonResponse(res, status, payload) {
+  res.status(status).set("Content-Type", "application/json");
+  res.send(JSON.stringify(payload));
+}
+
+function readBody(req) {
+  if (req.body) return req.body;
+  return null;
+}
+
+function ensureJson(req, res) {
+  if (!req.is("application/json")) {
+    jsonResponse(res, 415, { error: "Expected application/json" });
+    return false;
+  }
+  return true;
+}
+
+function nowTimestamp(admin) {
+  return admin.firestore.FieldValue.serverTimestamp();
+}
+
+module.exports = {
+  jsonResponse,
+  readBody,
+  ensureJson,
+  nowTimestamp
+};