[HCW-home] Authentication & Access Control Enhancements

[gorg16]

Ticket Contents

Description

This task focuses on enhancing the authentication, onboarding, and profile management experiences for both practitioners and patients in the HCW-home platform. It introduces terms acceptance workflows, profile customization, and access recovery mechanisms. These features are essential to ensure secure access, compliance, and personalized communication for end users.

Goals

• Implement a terms acceptance workflow for practitioners during login, storing the timestamp of acceptance.
• Implement a terms acceptance workflow for patients before they join a consultation session.
• Create a practitioner profile page with editable fields: contact information, preferred languages, and specialties.
• Add a notification preferences section to the practitioner profile, allowing users to choose between SMS and WhatsApp, and specify their preferred number.
• Build a feature for patients to recover consultation access using email or phone, which sends them a new magic link.
• Ensure all endpoints related to these features are protected with appropriate authentication and role checks.

Expected Outcome

• Practitioners are prompted to accept the latest terms of service if they haven’t already, and this acceptance is recorded and stored.
• Patients are required to accept the terms of service before accessing any consultation, and their acceptance is also logged.
• Practitioners can access a profile page where they can view and update their personal details, such as contact information, languages, and specialties.
• Notification preferences are configurable by practitioners, allowing them to choose between SMS and WhatsApp and specify their preferred contact number.
• Patients can recover access to their consultation sessions by entering their email or phone and receiving a new magic link.
• All user flows are secured with proper authentication and role-based access.
• The UI follows best practices for usability and accessibility using Angular Material components.

Acceptance Criteria

No response

Implementation Details

• Terms Acceptance (Practitioners):
  On successful login, check if the practitioner has accepted the latest terms of service. If not, redirect them to a terms acceptance page before granting access to the app. Store the timestamp and terms version in the database.

• Terms Acceptance (Patients):
  When a patient attempts to join a consultation via magic link, verify if they’ve accepted the current terms. If not, prompt them to accept before proceeding. Persist acceptance details in the backend.

• Practitioner Profile Page:
  Implement a new page in the Angular frontend (latest version) that displays and allows editing of practitioner profile details. Use Angular Material components such as form fields, chips, and dropdowns. Editable fields should include:

  • Contact information
  • Preferred languages (multi-select)
  • Specialties (using tag/chip input)

• Notification Preferences:
  Extend the practitioner entity in the backend to store preferred notification channel (sms or whatsapp) and contact number. In the Angular UI, provide toggle buttons and input fields to set preferences.

• Consultation Access Recovery (Patients):
  Build a recovery form where patients can enter their registered email or phone number. Backend should validate the request, generate a new consultation magic link, and send it via the appropriate channel (SMS or email).

• Security:
  All APIs and frontend routes related to profile and preferences should be secured using role-based guards.

• Tech Stack:

  • Frontend: Angular (latest) with Angular Material
  • Backend: NestJS with TypeORM/PostgreSQL
  • Messaging: Integrated SMS/WhatsApp providers

Referenced Issues

#4, #5, #9,
#14, #21, #30,
#32, #35

Mockups/Wireframes

No response

Product Name

HCW

Organisation Name

C4GT

Domain

No response

Tech Skills Needed

Angular

Organizational Mentor

• @Tobiask-iabsis
• @olivierb2
• @gorg16

Angel Mentor

No response

Complexity

High

Category

Frontend

[ChayanDass]

@gorg16, Hi sir, I'm very interested in contributing to this project. I’ve worked extensively with NestJS and have hands-on experience implementing OIDC-based authentication and RBAC systems using Auth0.

Looking forward to your guidance!
thank you!

[gorg16]

@ChayanDass Thanks for sharing your experience with NestJS—it's really valuable for our project! To get all the details and engage in deeper discussions, please join our channel at:

https://matrix.to/#/#hcw-home:iabsis.com

We look forward to having you onboard and diving into the project with you.

[iamsyg]

Hey @gorg16

I came across the HCW-home project and I’d love to contribute! I have solid experience working with Angular (latest) and NestJS, and this project’s stack and direction really align with my skills.

Would love to connect and see how I can get involved!

[alphacrat]

Hello @olivierb2 @gorg16,

I’m interested in contributing to the [HCW-home] Authentication & Access Control Enhancements project. I’m a full-time backend engineer at Ovvy.ai with strong experience in NestJS, TypeORM, and role-based authentication systems.

I’ve reviewed the project scope and sub-issues, and I’m confident I can add value—especially in implementing secure backend features like terms acceptance workflows, profile management, and consultation recovery.

Please let me know how I can start contributing effectively.

Thanks!
Bismoy Das