Backend API server for HelloCare - A comprehensive healthcare management platform.
Production-ready Node.js API server built with Express.js that provides authentication, medical reports management, appointment booking, AI-powered health insights, and more.
- Authentication: Patient and doctor signup/login with Firebase Auth
- Reports Management: Upload, download, and manage medical reports with OCR text extraction
- AI Features: Health summaries and personalized suggestions using Google Gemini AI
- QR Code Sharing: Secure QR code generation for sharing medical reports
- Appointments: Book and manage appointments with time slot availability
- Doctor Management: Doctor profiles, availability, and scheduling
- Payment Processing: Razorpay order creation + confirmation for appointments
- File Storage: AWS S3 integration for secure file storage
- OCR Processing: Google Cloud Vision API for text extraction from medical documents
- Node.js >= 18.0.0
- Firebase project with Firestore enabled
- AWS account with S3 access
- Google Cloud account with Vision API and Gemini API access (same project as Firebase)
-
Create Firebase Project:
- Go to Firebase Console
- Create a new project or use existing one
-
Enable Authentication:
- Go to Authentication > Sign-in method
- Enable "Email/Password" provider
-
Create Firestore Database:
- Go to Firestore Database
- Create database (start in production mode or test mode for development)
- Choose a location for your database
-
Generate Service Account Key:
- Go to Project Settings > Service Accounts
- Click "Generate New Private Key"
- Save the JSON file as
firebase-service-account.jsonin the project root - OR copy the JSON content to set as environment variable
-
Set Firestore Security Rules (for development):
rules_version = '2'; service cloud.firestore { match /databases/{database}/documents { match /{document=**} { allow read, write: if request.auth != null; } } }
-
Create S3 Bucket:
- Go to AWS S3 Console
- Click "Create bucket"
- Choose a unique bucket name (e.g.,
hellocare-reports) - Select region (e.g.,
us-east-1) - Uncheck "Block all public access" if you need public URLs, or keep private and use presigned URLs (recommended)
- Click "Create bucket"
-
Configure CORS (if needed):
- Go to bucket > Permissions > CORS
- Add CORS configuration:
[ { "AllowedHeaders": ["*"], "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"], "AllowedOrigins": ["*"], "ExposeHeaders": [] } ]
-
Create IAM User:
- Go to IAM Console
- Click "Users" > "Add users"
- Choose a username (e.g.,
hellocare-server) - Select "Access key - Programmatic access"
-
Attach Policies:
- Click "Attach existing policies directly"
- Attach the following policy:
AmazonS3FullAccess(or create custom policy with only needed permissions)
- Click "Next" and complete user creation
-
Save Credentials:
- Copy the Access Key ID and Secret Access Key
- Save them securely - you'll need them for environment variables
-
Enable Cloud Vision API:
- Go to Google Cloud Console
- Select your Firebase project (same project ID)
- Navigate to "APIs & Services" > "Library"
- Search for "Cloud Vision API"
- Click "Enable"
-
Verify Service Account Permissions:
- Go to "IAM & Admin" > "Service Accounts"
- Find your Firebase service account (usually
firebase-adminsdk-xxxxx@project-id.iam.gserviceaccount.com) - Ensure it has "Cloud Vision API User" role (or "Editor" role which includes it)
- If not, click "Edit" and add the "Cloud Vision API User" role
Note: The same Firebase service account credentials used for Firebase Admin SDK will be used for Google Cloud Vision API. No additional API keys or credentials are needed.
- Get API Key:
- Go to Google AI Studio
- Sign in with your Google account
- Click "Create API Key"
- Copy the API key
- Note: API keys are free to use with usage limits. For production, consider setting up billing.
-
Copy Environment Template:
cp .env.example .env
-
Update
.envfile with your credentials:# Server Configuration PORT=3000 NODE_ENV=development # Firebase Admin SDK # Option 1: Path to service account JSON file FIREBASE_SERVICE_ACCOUNT_PATH=./firebase-service-account.json # Option 2: Direct JSON (alternative to file path) # FIREBASE_SERVICE_ACCOUNT_JSON={"type":"service_account","project_id":"..."} # AWS Configuration AWS_ACCESS_KEY_ID=your_aws_access_key_id AWS_SECRET_ACCESS_KEY=your_aws_secret_access_key AWS_REGION=us-east-1 # S3 Configuration S3_BUCKET_NAME=hellocare-reports # Razorpay RAZORPAY_KEY_ID=your_razorpay_key_id RAZORPAY_KEY_SECRET=your_razorpay_key_secret # Google Gemini API GEMINI_API_KEY=your_gemini_api_key # CORS Configuration CORS_ORIGIN=http://localhost:3000,https://yourdomain.com
-
Place Firebase Service Account JSON:
- If using
FIREBASE_SERVICE_ACCOUNT_PATH, placefirebase-service-account.jsonin the project root - Ensure the file is in
.gitignore(it should be by default)
- If using
-
Clone the repository (if not already cloned)
-
Install dependencies:
cd HelloCare-Server npm install -
Configure environment variables (see above)
npm start
# or
npm run devThe server will start on http://localhost:3000
NODE_ENV=production npm start# Build image
docker build -t hellocare-server .
# Run container
docker run -p 3000:3000 --env-file .env hellocare-serverdocker-compose up --buildNote: Update docker-compose.yml to include environment variables or use an .env file.
Base URL: https://hellocare.p1ng.me/v1 (production) or http://localhost:3000/v1 (development)
POST /v1/auth/patient/signup- Patient signupPOST /v1/auth/patient/login- Patient loginPOST /v1/auth/doctor/signup- Doctor signupPOST /v1/auth/doctor/login- Doctor login
POST /v1/reports/upload-url- Get S3 upload URLPOST /v1/reports- Submit report metadataGET /v1/reports- Get user reports (with filters)GET /v1/reports/:reportId- Get report detailsGET /v1/reports/:reportId/download-url- Get download URLPOST /v1/reports/export- Export reports as ZIPPOST /v1/reports/qr/generate- Generate QR code for reportsPOST /v1/reports/qr/validate- Validate QR tokenGET /v1/reports/qr/:qrToken- Get reports via QR token (doctor access)
GET /v1/ai/summary- Get AI health summaryGET /v1/ai/suggestions- Get AI suggestions (optionally for specific report)
GET /v1/doctors- Get all doctors (with filters)GET /v1/doctors/:doctorId- Get doctor detailsPUT /v1/doctors/:doctorId/availability- Update doctor availabilityGET /v1/doctors/:doctorId/slots- Get available time slots
POST /v1/appointments- Book appointmentGET /v1/appointments/patient- Get patient appointmentsGET /v1/appointments/doctor- Get doctor appointmentsGET /v1/appointments/:appointmentId- Get appointment detailsPUT /v1/appointments/:appointmentId/status- Update appointment statusPUT /v1/appointments/:appointmentId/notes- Add doctor notesDELETE /v1/appointments/:appointmentId- Cancel appointment
POST /v1/payment/process- Create Razorpay order for an appointmentPOST /v1/payment/confirm- Verify Razorpay payment signature and mark appointment paid
GET /health- Server health check
For detailed API documentation, see API_DOCUMENTATION.md in the project root.
| Variable | Description | Required | Default |
|---|---|---|---|
PORT |
Server port | No | 3000 |
NODE_ENV |
Environment mode | No | development |
FIREBASE_SERVICE_ACCOUNT_PATH |
Path to Firebase service account JSON | Yes* | - |
FIREBASE_SERVICE_ACCOUNT_JSON |
Firebase service account JSON string | Yes* | - |
AWS_ACCESS_KEY_ID |
AWS access key ID | Yes | - |
AWS_SECRET_ACCESS_KEY |
AWS secret access key | Yes | - |
AWS_REGION |
AWS region | Yes | - |
S3_BUCKET_NAME |
S3 bucket name | Yes | - |
RAZORPAY_KEY_ID |
Razorpay API key ID | Yes (payments) | - |
RAZORPAY_KEY_SECRET |
Razorpay API key secret | Yes (payments) | - |
GEMINI_API_KEY |
Google Gemini API key | Yes | - |
-
Create Order
curl -X POST http://localhost:3000/v1/payment/process \ -H "Authorization: Bearer <FIREBASE_ID_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "appointmentId": "APPOINTMENT_DOC_ID", "amount": 499, "currency": "INR" }'
- Response includes
orderIdandkeyId. Use them on the client to open Razorpay Checkout.
- Response includes
-
Confirm Payment
After the client receivesrazorpay_order_id,razorpay_payment_id, andrazorpay_signaturefrom Razorpay Checkout:curl -X POST http://localhost:3000/v1/payment/confirm \ -H "Authorization: Bearer <FIREBASE_ID_TOKEN>" \ -H "Content-Type: application/json" \ -d '{ "orderId": "razorpay_order_id", "paymentId": "razorpay_payment_id", "signature": "razorpay_signature" }'
- On success the appointment status becomes
confirmedandpaymentStatusbecomespaid. Apayments/{orderId}document keeps an audit trail. |CORS_ORIGIN| CORS allowed origins (comma-separated) | No |*|
- On success the appointment status becomes
*Either FIREBASE_SERVICE_ACCOUNT_PATH or FIREBASE_SERVICE_ACCOUNT_JSON is required.
HelloCare-Server/
├── config/
│ └── firebase.js # Firebase Admin SDK configuration
├── middleware/
│ ├── auth.js # Authentication middleware
│ └── errorHandler.js # Error handling middleware
├── routes/
│ ├── auth.js # Authentication routes
│ ├── reports.js # Report routes
│ ├── ai.js # AI feature routes
│ ├── doctors.js # Doctor routes
│ ├── appointments.js # Appointment routes
│ └── payment.js # Payment routes
├── services/
│ ├── firebase.js # Firestore helper functions
│ ├── s3.js # S3 file operations
│ ├── ocr.js # OCR text extraction
│ ├── ai.js # AI summary/suggestions
│ └── qr.js # QR code generation/validation
├── utils/ # Utility functions
├── server.js # Main server file
├── package.json
├── .env.example # Environment variables template
└── README.md
- Ensure service account JSON has correct permissions
- Verify Firestore is enabled in Firebase Console
- Check that authentication is enabled
- Verify IAM user has correct permissions (S3)
- Check that S3 bucket exists and is accessible
- Ensure AWS region is correct
- Ensure Cloud Vision API is enabled in Google Cloud Console
- Verify Firebase service account has "Cloud Vision API User" role
- Check that you're using the same Google Cloud project as Firebase
- Verify billing is enabled (required for Vision API usage)
- Verify API key is correct
- Check API quota/limits in Google AI Studio
- Ensure API key has access to Gemini Pro model
- Never commit
.envfile orfirebase-service-account.jsonto version control - Use environment variables for all sensitive credentials
- In production, use AWS IAM roles instead of access keys when possible
- Configure CORS appropriately for production
- Use HTTPS in production
- Implement rate limiting for production (not included in this version)
ISC