tr]:last:border-b-0",
+ className
+ )}
+ {...props}
+ />
+ )
+}
+
+function TableRow({ className, ...props }: React.ComponentProps<"tr">) {
+ return (
+ [role=checkbox]]:translate-y-[2px]",
+ className
+ )}
+ {...props}
+ />
+ )
+}
+
+function TableCell({ className, ...props }: React.ComponentProps<"td">) {
+ return (
+ [role=checkbox]]:translate-y-[2px]",
+ className
+ )}
+ {...props}
+ />
+ )
+}
+
+function TableCaption({
+ className,
+ ...props
+}: React.ComponentProps<"caption">) {
+ return (
+
+
+const Toaster = ({ ...props }: ToasterProps) => {
+ return (
+ ) {
+ return (
+ ) {
+ return (
+
+
+ )
+}
+
+function TooltipTrigger({
+ ...props
+}: React.ComponentProps) {
+ return ) {
+ return (
+
+
+ {children}
+
+
+ )
+}
+
+export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider }
diff --git a/python/rag/healthcare-support-portal/frontend/app/components/users/UserForm.tsx b/python/rag/healthcare-support-portal/frontend/app/components/users/UserForm.tsx
new file mode 100644
index 00000000..3d1e3961
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/components/users/UserForm.tsx
@@ -0,0 +1,160 @@
+import { useForm, getFormProps, getInputProps, getSelectProps } from '@conform-to/react';
+import { parseWithZod } from '@conform-to/zod';
+import { z } from 'zod';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select';
+import { Alert, AlertDescription } from '@/components/ui/alert';
+import { AlertCircle, Save, UserPlus } from 'lucide-react';
+import type { User } from '@/lib/types';
+
+const userSchema = z.object({
+ username: z.string().min(3, 'Username must be at least 3 characters'),
+ email: z.string().email('Invalid email address'),
+ password: z.string().min(8, 'Password must be at least 8 characters').optional(),
+ role: z.enum(['doctor', 'nurse', 'admin']),
+ department: z.enum(['cardiology', 'neurology', 'pediatrics', 'oncology', 'emergency', 'endocrinology', 'general']),
+});
+
+interface UserFormProps {
+ user?: User;
+ isEdit?: boolean;
+ error?: string;
+ departments?: string[];
+ roles?: string[];
+}
+
+export function UserForm({ user, isEdit = false, error, departments, roles }: UserFormProps) {
+ const [form, fields] = useForm({
+ defaultValue: {
+ username: user?.username || '',
+ email: user?.email || '',
+ role: user?.role || 'nurse',
+ department: user?.department || 'general',
+ password: '',
+ },
+ onValidate({ formData }) {
+ return parseWithZod(formData, { schema: userSchema });
+ },
+ });
+
+ const defaultDepartments = [
+ 'cardiology', 'neurology', 'pediatrics', 'oncology',
+ 'emergency', 'endocrinology', 'obgyn', 'general'
+ ];
+
+ const defaultRoles = ['doctor', 'nurse', 'admin'];
+
+ const departmentList = departments || defaultDepartments;
+ const roleList = roles || defaultRoles;
+
+ return (
+
+
+
+
+
+ {isEdit
+ ? 'Update user account information and permissions'
+ : 'Add a new user to the Healthcare Support Portal'}
+
+
+
+ {error && (
+
+ {error}
+
+ )}
+
+
+
+
+ );
+}
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/api.client.ts b/python/rag/healthcare-support-portal/frontend/app/lib/api.client.ts
new file mode 100644
index 00000000..d2cdd7f7
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/api.client.ts
@@ -0,0 +1,50 @@
+import axios from 'axios';
+
+const API_BASE_URL = 'http://localhost';
+
+export const clientApi = {
+ async uploadDocument(formData: FormData, token: string) {
+ const response = await axios.post(`${API_BASE_URL}:8003/api/v1/documents/upload`, formData, {
+ headers: {
+ Authorization: `Bearer ${token}`,
+ 'Content-Type': 'multipart/form-data'
+ }
+ });
+ return response.data;
+ },
+
+ async searchDocuments(token: string, searchData: any) {
+ const response = await axios.post(`${API_BASE_URL}:8003/api/v1/chat/search`, searchData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async askQuestion(token: string, questionData: any) {
+ const response = await axios.post(`${API_BASE_URL}:8003/api/v1/chat/ask`, questionData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getPatients(token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8002/api/v1/patients/`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getDocuments(token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8003/api/v1/documents/`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getCurrentUser(token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8001/api/v1/auth/me`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ }
+};
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/api.server.ts b/python/rag/healthcare-support-portal/frontend/app/lib/api.server.ts
new file mode 100644
index 00000000..44201fe5
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/api.server.ts
@@ -0,0 +1,173 @@
+import axios from 'axios';
+
+const API_BASE_URL = 'http://localhost';
+
+export const serverApi = {
+ async login(credentials: { username: string; password: string }) {
+ // Create form data as the backend expects (username/password fields)
+ const formData = new URLSearchParams();
+ formData.append('username', credentials.username);
+ formData.append('password', credentials.password);
+
+ const response = await axios.post(`${API_BASE_URL}:8001/api/v1/auth/login`, formData, {
+ headers: {
+ 'Content-Type': 'application/x-www-form-urlencoded'
+ }
+ });
+ return response.data;
+ },
+
+ async getCurrentUser(token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8001/api/v1/auth/me`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getPatients(token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8002/api/v1/patients/`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getPatient(patientId: number, token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8002/api/v1/patients/${patientId}`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getDocuments(token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8003/api/v1/documents/`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getDocument(documentId: number, token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8003/api/v1/documents/${documentId}`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async createPatient(token: string, patientData: any) {
+ const response = await axios.post(`${API_BASE_URL}:8002/api/v1/patients/`, patientData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async updatePatient(patientId: number, patientData: any, token: string) {
+ const response = await axios.put(`${API_BASE_URL}:8002/api/v1/patients/${patientId}`, patientData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async deletePatient(token: string, patientId: string) {
+ await axios.delete(`${API_BASE_URL}:8002/api/v1/patients/${patientId}`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ },
+
+ async createDocument(documentData: any, token: string) {
+ const response = await axios.post(`${API_BASE_URL}:8003/api/v1/documents/`, documentData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async updateDocument(token: string, documentId: string, documentData: any) {
+ const response = await axios.put(`${API_BASE_URL}:8003/api/v1/documents/${documentId}`, documentData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async deleteDocument(token: string, documentId: string) {
+ await axios.delete(`${API_BASE_URL}:8003/api/v1/documents/${documentId}`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ },
+
+ async getAllEmbeddingStatuses(token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8003/api/v1/documents/embedding-statuses`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getEmbeddingStatus(documentId: number, token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8003/api/v1/documents/${documentId}/embedding-status`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async regenerateEmbeddings(documentId: number, token: string) {
+ const response = await axios.post(`${API_BASE_URL}:8003/api/v1/documents/${documentId}/regenerate-embeddings`, {}, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async uploadDocument(formData: FormData, token: string) {
+ const response = await axios.post(`${API_BASE_URL}:8003/api/v1/documents/upload`, formData, {
+ headers: {
+ Authorization: `Bearer ${token}`,
+ 'Content-Type': 'multipart/form-data'
+ }
+ });
+ return response.data;
+ },
+
+ async searchDocuments(token: string, searchData: any) {
+ const response = await axios.post(`${API_BASE_URL}:8003/api/v1/chat/search`, searchData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async askQuestion(token: string, questionData: any) {
+ const response = await axios.post(`${API_BASE_URL}:8003/api/v1/chat/ask`, questionData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getUsers(token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8001/api/v1/users/`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async getUser(userId: string, token: string) {
+ const response = await axios.get(`${API_BASE_URL}:8001/api/v1/users/${userId}`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async createUser(token: string, userData: any) {
+ const response = await axios.post(`${API_BASE_URL}:8001/api/v1/users/`, userData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async updateUser(userId: number, userData: any, token: string) {
+ const response = await axios.put(`${API_BASE_URL}:8001/api/v1/users/${userId}`, userData, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ return response.data;
+ },
+
+ async deleteUser(token: string, userId: string) {
+ await axios.delete(`${API_BASE_URL}:8001/api/v1/users/${userId}`, {
+ headers: { Authorization: `Bearer ${token}` }
+ });
+ }
+};
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/api.ts b/python/rag/healthcare-support-portal/frontend/app/lib/api.ts
new file mode 100644
index 00000000..52a4d8df
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/api.ts
@@ -0,0 +1,340 @@
+import axios from 'axios';
+import type { AxiosInstance, AxiosRequestConfig, AxiosResponse } from 'axios';
+import type {
+ User,
+ LoginRequest,
+ RegisterRequest,
+ AuthResponse,
+ Patient,
+ PatientCreate,
+ PatientUpdate,
+ Document,
+ DocumentCreate,
+ DocumentUpdate,
+ ChatRequest,
+ ChatResponse,
+ SearchRequest,
+ SearchResponse,
+ ApiError
+} from './types';
+
+class ApiClient {
+ private authApi: AxiosInstance;
+ private patientApi: AxiosInstance;
+ private ragApi: AxiosInstance;
+
+ constructor() {
+ const baseURL = import.meta.env.VITE_API_BASE_URL;
+ const authPort = import.meta.env.VITE_AUTH_SERVICE_PORT;
+ const patientPort = import.meta.env.VITE_PATIENT_SERVICE_PORT;
+ const ragPort = import.meta.env.VITE_RAG_SERVICE_PORT;
+
+ // Auth Service API
+ this.authApi = axios.create({
+ baseURL: `${baseURL}:${authPort}/api/v1`,
+ headers: {
+ 'Content-Type': 'application/json',
+ },
+ });
+
+ // Patient Service API
+ this.patientApi = axios.create({
+ baseURL: `${baseURL}:${patientPort}/api/v1`,
+ headers: {
+ 'Content-Type': 'application/json',
+ },
+ });
+
+ // RAG Service API
+ this.ragApi = axios.create({
+ baseURL: `${baseURL}:${ragPort}/api/v1`,
+ headers: {
+ 'Content-Type': 'application/json',
+ },
+ });
+
+ // Add request interceptors to include auth tokens
+ this.setupInterceptors();
+ }
+
+ private setupInterceptors() {
+ const requestInterceptor = (config: any) => {
+ const token = localStorage.getItem('authToken');
+ if (token && config.headers) {
+ config.headers.Authorization = `Bearer ${token}`;
+ }
+ return config;
+ };
+
+ const responseInterceptor = (response: AxiosResponse) => response;
+
+ const errorInterceptor = (error: any) => {
+ if (error.response?.status === 401) {
+ // Token expired or invalid, clear auth and redirect to login
+ localStorage.removeItem('authToken');
+ localStorage.removeItem('user');
+ window.location.href = '/login';
+ }
+ return Promise.reject(error);
+ };
+
+ // Apply interceptors to all API instances
+ [this.authApi, this.patientApi, this.ragApi].forEach(api => {
+ api.interceptors.request.use(requestInterceptor);
+ api.interceptors.response.use(responseInterceptor, errorInterceptor);
+ });
+ }
+
+ // Authentication Methods
+ async login(credentials: LoginRequest): Promise {
+ try {
+ const formData = new FormData();
+ formData.append('username', credentials.username);
+ formData.append('password', credentials.password);
+
+ const response = await this.authApi.post('/auth/login', formData, {
+ headers: {
+ 'Content-Type': 'application/x-www-form-urlencoded',
+ },
+ });
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async register(userData: RegisterRequest): Promise {
+ try {
+ const response = await this.authApi.post('/auth/register', userData);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async getCurrentUser(): Promise {
+ try {
+ const response = await this.authApi.get('/auth/me');
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async refreshToken(): Promise {
+ try {
+ const response = await this.authApi.post('/auth/refresh');
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async getUsers(): Promise {
+ try {
+ const response = await this.authApi.get('/users/');
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ // Patient Methods
+ async getPatients(): Promise {
+ try {
+ const response = await this.patientApi.get('/patients/');
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async getPatient(id: number): Promise {
+ try {
+ const response = await this.patientApi.get(`/patients/${id}`);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async createPatient(patientData: PatientCreate): Promise {
+ try {
+ const response = await this.patientApi.post('/patients/', patientData);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async updatePatient(id: number, patientData: PatientUpdate): Promise {
+ try {
+ const response = await this.patientApi.put(`/patients/${id}`, patientData);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async deletePatient(id: number): Promise {
+ try {
+ await this.patientApi.delete(`/patients/${id}`);
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ // Document Methods
+ async getDocuments(): Promise {
+ try {
+ const response = await this.ragApi.get('/documents/');
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async getDocument(id: number): Promise {
+ try {
+ const response = await this.ragApi.get(`/documents/${id}`);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async createDocument(documentData: DocumentCreate): Promise {
+ try {
+ const response = await this.ragApi.post('/documents/', documentData);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async updateDocument(id: number, documentData: DocumentUpdate): Promise {
+ try {
+ const response = await this.ragApi.put(`/documents/${id}`, documentData);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async deleteDocument(id: number): Promise {
+ try {
+ await this.ragApi.delete(`/documents/${id}`);
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ // Chat and RAG Methods
+ async searchDocuments(searchRequest: SearchRequest): Promise {
+ try {
+ const response = await this.ragApi.post('/chat/search', searchRequest);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async askQuestion(chatRequest: ChatRequest): Promise {
+ try {
+ const response = await this.ragApi.post('/chat/ask', chatRequest);
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async getConversationHistory(): Promise {
+ try {
+ const response = await this.ragApi.get('/chat/conversation-history');
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ async submitFeedback(responseId: string, rating: number, feedback?: string): Promise {
+ try {
+ const response = await this.ragApi.post('/chat/feedback', {
+ response_id: responseId,
+ rating,
+ feedback
+ });
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ // File Upload Method
+ async uploadFile(file: File, documentData: Partial): Promise {
+ try {
+ const formData = new FormData();
+ formData.append('file', file);
+
+ // Add document metadata
+ Object.entries(documentData).forEach(([key, value]) => {
+ if (value !== undefined) {
+ formData.append(key, value.toString());
+ }
+ });
+
+ const response = await this.ragApi.post('/documents/upload', formData, {
+ headers: {
+ 'Content-Type': 'multipart/form-data',
+ },
+ });
+ return response.data;
+ } catch (error: any) {
+ throw this.handleError(error);
+ }
+ }
+
+ // Health Check Methods
+ async healthCheck(): Promise<{ [service: string]: any }> {
+ const results: { [service: string]: any } = {};
+
+ try {
+ const authHealth = await this.authApi.get('/health');
+ results.auth = authHealth.data;
+ } catch (error: any) {
+ results.auth = { status: 'unhealthy', error: error.message };
+ }
+
+ try {
+ const patientHealth = await this.patientApi.get('/health');
+ results.patient = patientHealth.data;
+ } catch (error: any) {
+ results.patient = { status: 'unhealthy', error: error.message };
+ }
+
+ try {
+ const ragHealth = await this.ragApi.get('/health');
+ results.rag = ragHealth.data;
+ } catch (error: any) {
+ results.rag = { status: 'unhealthy', error: error.message };
+ }
+
+ return results;
+ }
+
+ private handleError(error: any): never {
+ const apiError: ApiError = {
+ detail: error.response?.data?.detail || error.message || 'An error occurred',
+ status_code: error.response?.status || 500,
+ };
+ throw apiError;
+ }
+}
+
+// Create singleton instance
+export const api = new ApiClient();
+
+// Export individual service APIs for direct access if needed
+export const authApi = (api as any).authApi;
+export const patientApi = (api as any).patientApi;
+export const ragApi = (api as any).ragApi;
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/auth.tsx b/python/rag/healthcare-support-portal/frontend/app/lib/auth.tsx
new file mode 100644
index 00000000..c6709a00
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/auth.tsx
@@ -0,0 +1,246 @@
+import React, { createContext, useContext, useEffect, useState } from 'react';
+import type { ReactNode } from 'react';
+import type { User, LoginRequest, RegisterRequest, AuthContext } from './types';
+import { api } from './api';
+
+// Create Auth Context
+const AuthContextInstance = createContext(undefined);
+
+// Auth Provider Component
+interface AuthProviderProps {
+ children: ReactNode;
+}
+
+export function AuthProvider({ children }: AuthProviderProps) {
+ const [user, setUser] = useState(null);
+ const [token, setToken] = useState(null);
+ const [isLoading, setIsLoading] = useState(true);
+
+ // Initialize auth state from localStorage
+ useEffect(() => {
+ const initializeAuth = async () => {
+ try {
+ const savedToken = localStorage.getItem('authToken');
+ const savedUser = localStorage.getItem('user');
+
+ if (savedToken && savedUser) {
+ setToken(savedToken);
+ setUser(JSON.parse(savedUser));
+
+ // Verify token is still valid
+ try {
+ const currentUser = await api.getCurrentUser();
+ setUser(currentUser);
+ localStorage.setItem('user', JSON.stringify(currentUser));
+ } catch (error) {
+ // Token is invalid, clear auth
+ localStorage.removeItem('authToken');
+ localStorage.removeItem('user');
+ setToken(null);
+ setUser(null);
+ }
+ }
+ } catch (error) {
+ console.error('Error initializing auth:', error);
+ } finally {
+ setIsLoading(false);
+ }
+ };
+
+ initializeAuth();
+ }, []);
+
+ const login = async (credentials: LoginRequest) => {
+ try {
+ setIsLoading(true);
+ const authResponse = await api.login(credentials);
+ const token = authResponse.access_token;
+
+ // Store token
+ localStorage.setItem('authToken', token);
+ setToken(token);
+
+ // Get user information
+ const user = await api.getCurrentUser();
+ localStorage.setItem('user', JSON.stringify(user));
+ setUser(user);
+ } catch (error) {
+ throw error;
+ } finally {
+ setIsLoading(false);
+ }
+ };
+
+ const register = async (data: RegisterRequest) => {
+ try {
+ setIsLoading(true);
+ const user = await api.register(data);
+
+ // Auto-login after registration
+ await login({
+ username: data.username,
+ password: data.password
+ });
+ } catch (error) {
+ throw error;
+ } finally {
+ setIsLoading(false);
+ }
+ };
+
+ const logout = () => {
+ localStorage.removeItem('authToken');
+ localStorage.removeItem('user');
+ setToken(null);
+ setUser(null);
+ };
+
+ const refreshToken = async () => {
+ try {
+ const authResponse = await api.refreshToken();
+ const newToken = authResponse.access_token;
+
+ localStorage.setItem('authToken', newToken);
+ setToken(newToken);
+
+ // Update user information
+ const user = await api.getCurrentUser();
+ localStorage.setItem('user', JSON.stringify(user));
+ setUser(user);
+ } catch (error) {
+ // If refresh fails, logout user
+ logout();
+ throw error;
+ }
+ };
+
+ const value: AuthContext = {
+ user,
+ token,
+ login,
+ register,
+ logout,
+ refreshToken,
+ isLoading,
+ isAuthenticated: !!token && !!user,
+ };
+
+ return (
+
+ {children}
+
+ );
+}
+
+// Hook to use auth context
+export function useAuth(): AuthContext {
+ const context = useContext(AuthContextInstance);
+ if (context === undefined) {
+ throw new Error('useAuth must be used within an AuthProvider');
+ }
+ return context;
+}
+
+// Helper functions for role-based access
+export function hasRole(user: User | null, roles: string[]): boolean {
+ if (!user) return false;
+ return roles.includes(user.role);
+}
+
+export function canAccessDepartment(user: User | null, department: string): boolean {
+ if (!user) return false;
+ if (user.role === 'admin') return true;
+ return user.department === department;
+}
+
+export function canManagePatients(user: User | null): boolean {
+ if (!user) return false;
+ return ['doctor', 'admin'].includes(user.role);
+}
+
+export function canViewSensitiveDocuments(user: User | null): boolean {
+ if (!user) return false;
+ return ['doctor', 'admin'].includes(user.role);
+}
+
+export function canCreateDocuments(user: User | null): boolean {
+ if (!user) return false;
+ return ['doctor', 'nurse', 'admin'].includes(user.role);
+}
+
+export function getUserDisplayName(user: User | null): string {
+ if (!user) return 'Unknown User';
+
+ const roleMap = {
+ doctor: 'Dr.',
+ nurse: 'Nurse',
+ admin: 'Admin'
+ };
+
+ const prefix = roleMap[user.role] || '';
+ return prefix ? `${prefix} ${user.username}` : user.username;
+}
+
+export function getRoleDisplayName(role: string): string {
+ const roleMap = {
+ doctor: 'Doctor',
+ nurse: 'Nurse',
+ admin: 'Administrator'
+ };
+
+ return roleMap[role as keyof typeof roleMap] || role;
+}
+
+export function getDepartmentDisplayName(department: string): string {
+ const departmentMap = {
+ cardiology: 'Cardiology',
+ neurology: 'Neurology',
+ pediatrics: 'Pediatrics',
+ oncology: 'Oncology',
+ emergency: 'Emergency Medicine',
+ endocrinology: 'Endocrinology',
+ general: 'General Medicine'
+ };
+
+ return departmentMap[department as keyof typeof departmentMap] || department;
+}
+
+// Token expiration checker
+export function isTokenExpired(token: string): boolean {
+ try {
+ const payload = JSON.parse(atob(token.split('.')[1]));
+ const currentTime = Date.now() / 1000;
+ return payload.exp < currentTime;
+ } catch (error) {
+ return true;
+ }
+}
+
+// Auto token refresh setup
+export function setupTokenRefresh() {
+ const token = localStorage.getItem('authToken');
+ if (!token) return;
+
+ try {
+ const payload = JSON.parse(atob(token.split('.')[1]));
+ const expirationTime = payload.exp * 1000;
+ const currentTime = Date.now();
+ const timeUntilExpiration = expirationTime - currentTime;
+
+ // Refresh token 5 minutes before expiration
+ const refreshTime = Math.max(timeUntilExpiration - 5 * 60 * 1000, 0);
+
+ if (refreshTime > 0) {
+ setTimeout(() => {
+ api.refreshToken().catch(() => {
+ // If refresh fails, logout user
+ localStorage.removeItem('authToken');
+ localStorage.removeItem('user');
+ window.location.href = '/login';
+ });
+ }, refreshTime);
+ }
+ } catch (error) {
+ console.error('Error setting up token refresh:', error);
+ }
+}
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/schemas.ts b/python/rag/healthcare-support-portal/frontend/app/lib/schemas.ts
new file mode 100644
index 00000000..c50a99d7
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/schemas.ts
@@ -0,0 +1,92 @@
+import { z } from 'zod';
+
+export const loginSchema = z.object({
+ username: z.string().min(1, 'Username is required'),
+ password: z.string().min(1, 'Password is required'),
+});
+
+export const userCreateSchema = z.object({
+ username: z.string().min(3, 'Username must be at least 3 characters'),
+ email: z.string().email('Invalid email address'),
+ password: z.string().min(8, 'Password must be at least 8 characters'),
+ role: z.enum(['doctor', 'nurse', 'admin']),
+ department: z.enum(['cardiology', 'neurology', 'pediatrics', 'oncology', 'emergency', 'endocrinology', 'obgyn', 'general']),
+});
+
+export const userUpdateSchema = userCreateSchema.partial().omit({ password: true });
+
+export const patientCreateSchema = z.object({
+ name: z.string().min(1, 'Name is required'),
+ date_of_birth: z.string().optional(),
+ medical_record_number: z.string().min(1, 'Medical record number is required'),
+ department: z.enum(['cardiology', 'neurology', 'pediatrics', 'oncology', 'emergency', 'endocrinology', 'obgyn', 'general']),
+ assigned_doctor_id: z.string().optional().transform(val => {
+ if (!val || val === '' || val === 'none') return undefined;
+ const num = parseInt(val);
+ return isNaN(num) ? undefined : num;
+ }),
+});
+
+export const patientUpdateSchema = patientCreateSchema.partial();
+
+export const documentCreateSchema = z.object({
+ title: z.string().min(1, 'Title is required'),
+ content: z.string().min(1, 'Content is required'),
+ document_type: z.enum(['protocol', 'policy', 'guideline', 'research', 'report', 'medical_record']),
+ patient_id: z.string().optional().transform(val => {
+ if (!val || val === '' || val === 'none') return undefined;
+ const num = parseInt(val);
+ return isNaN(num) ? undefined : num;
+ }),
+ department: z.enum(['cardiology', 'neurology', 'pediatrics', 'oncology', 'emergency', 'endocrinology', 'obgyn', 'general']),
+ is_sensitive: z.string().transform(val => val === 'true').default('false'),
+});
+
+export const documentUpdateSchema = documentCreateSchema.partial();
+
+// Chat/RAG Schemas
+export const chatMessageSchema = z.object({
+ message: z.string()
+ .min(1, 'Message is required')
+ .max(1000, 'Message must be less than 1000 characters'),
+});
+
+export const chatRequestSchema = z.object({
+ message: z.string()
+ .min(1, 'Message is required')
+ .max(1000, 'Message must be less than 1000 characters'),
+ context_department: z.string().optional(),
+ max_results: z.number()
+ .int()
+ .min(1)
+ .max(10)
+ .optional()
+ .default(5),
+});
+
+// Search Schema
+export const searchRequestSchema = z.object({
+ query: z.string()
+ .min(1, 'Search query is required')
+ .max(200, 'Search query must be less than 200 characters'),
+ department: z.string().optional(),
+ document_type: z.string().optional(),
+ limit: z.number()
+ .int()
+ .min(1)
+ .max(50)
+ .optional()
+ .default(10),
+});
+
+// Type exports
+export type LoginInput = z.infer;
+export type UserCreateInput = z.infer;
+export type UserUpdateInput = z.infer;
+export type PatientCreateInput = z.infer;
+export type PatientUpdateInput = z.infer;
+export type DocumentCreateInput = z.infer;
+export type DocumentUpdateInput = z.infer;
+export type ChatMessageInput = z.infer;
+export type ChatRequestInput = z.infer;
+export type SearchRequestInput = z.infer;
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/types.ts b/python/rag/healthcare-support-portal/frontend/app/lib/types.ts
new file mode 100644
index 00000000..c10ba623
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/types.ts
@@ -0,0 +1,228 @@
+// User and Authentication Types
+export interface User {
+ id: number;
+ username: string;
+ email: string;
+ role: 'doctor' | 'nurse' | 'admin';
+ department: string;
+ is_active: boolean;
+ created_at: string;
+}
+
+export interface LoginRequest {
+ username: string;
+ password: string;
+}
+
+export interface RegisterRequest {
+ username: string;
+ email: string;
+ password: string;
+ role: 'doctor' | 'nurse' | 'admin';
+ department: string;
+}
+
+export interface AuthResponse {
+ access_token: string;
+ token_type: string;
+}
+
+export interface AuthContext {
+ user: User | null;
+ token: string | null;
+ login: (credentials: LoginRequest) => Promise;
+ register: (data: RegisterRequest) => Promise;
+ logout: () => void;
+ refreshToken: () => Promise;
+ isLoading: boolean;
+ isAuthenticated: boolean;
+}
+
+// Patient Types
+export interface Patient {
+ id: number;
+ name: string;
+ date_of_birth: string | null;
+ medical_record_number: string;
+ department: string;
+ assigned_doctor_id: number | null;
+ is_active: boolean;
+ created_at: string;
+ assigned_doctor?: User;
+}
+
+export interface PatientCreate {
+ name: string;
+ date_of_birth?: string;
+ medical_record_number: string;
+ department: string;
+ assigned_doctor_id?: number;
+}
+
+export interface PatientUpdate extends Partial {
+ is_active?: boolean;
+}
+
+// Document Types
+export interface Document {
+ id: number;
+ title: string;
+ content: string;
+ document_type: string;
+ patient_id: number | null;
+ department: string;
+ created_by_id: number;
+ is_sensitive: boolean;
+ created_at: string;
+ patient?: Patient;
+ created_by?: User;
+}
+
+export interface DocumentCreate {
+ title: string;
+ content: string;
+ document_type: string;
+ patient_id?: number;
+ department: string;
+ is_sensitive?: boolean;
+}
+
+export interface DocumentUpdate extends Partial {}
+
+// Chat and RAG Types
+export interface ChatMessage {
+ id: string;
+ type: 'user' | 'assistant' | 'system';
+ content: string;
+ timestamp: string;
+ sources?: SearchResult[];
+ token_count?: number;
+}
+
+export interface ChatRequest {
+ message: string;
+ context_patient_id?: number;
+ context_department?: string;
+ max_results?: number;
+}
+
+export interface ChatResponse {
+ response: string;
+ sources: SearchResult[];
+ token_count: number;
+ context_used: boolean;
+}
+
+export interface SearchRequest {
+ query: string;
+ document_types?: string[];
+ department?: string;
+ limit?: number;
+}
+
+export interface SearchResponse {
+ results: SearchResult[];
+ total_results: number;
+}
+
+export interface SearchResult {
+ id: number;
+ title: string;
+ content_chunk: string;
+ document_type: string;
+ department: string;
+ similarity_score: number;
+ created_at: string;
+}
+
+// API Response Types
+export interface ApiResponse {
+ data: T;
+ message?: string;
+ status: number;
+}
+
+export interface ApiError {
+ detail: string;
+ status_code: number;
+}
+
+export interface PaginatedResponse {
+ items: T[];
+ total: number;
+ page: number;
+ per_page: number;
+ pages: number;
+}
+
+// Form Types
+export interface FormField {
+ label: string;
+ name: string;
+ type: 'text' | 'email' | 'password' | 'select' | 'textarea' | 'date' | 'checkbox';
+ placeholder?: string;
+ required?: boolean;
+ options?: { label: string; value: string }[];
+ validation?: any; // Zod schema
+}
+
+// UI Component Types
+export interface NavItem {
+ label: string;
+ href: string;
+ icon?: any;
+ roles?: string[];
+ children?: NavItem[];
+}
+
+export interface TableColumn {
+ key: keyof T;
+ label: string;
+ sortable?: boolean;
+ render?: (value: any, item: T) => React.ReactNode;
+}
+
+export interface AlertProps {
+ type: 'success' | 'error' | 'warning' | 'info';
+ title?: string;
+ message: string;
+ dismissible?: boolean;
+}
+
+// Utility Types
+export type Role = 'doctor' | 'nurse' | 'admin';
+
+export type Department =
+ | 'cardiology'
+ | 'neurology'
+ | 'pediatrics'
+ | 'oncology'
+ | 'emergency'
+ | 'endocrinology'
+ | 'obgyn'
+ | 'general';
+
+export type DocumentType =
+ | 'medical_record'
+ | 'protocol'
+ | 'policy'
+ | 'guideline'
+ | 'research'
+ | 'report';
+
+export type Status = 'active' | 'inactive' | 'pending' | 'urgent';
+
+// Environment Variables
+export interface ImportMetaEnv {
+ readonly VITE_API_BASE_URL: string;
+ readonly VITE_AUTH_SERVICE_PORT: string;
+ readonly VITE_PATIENT_SERVICE_PORT: string;
+ readonly VITE_RAG_SERVICE_PORT: string;
+ readonly VITE_APP_NAME: string;
+ readonly VITE_APP_VERSION: string;
+ readonly VITE_DEBUG: string;
+}
+
+export interface ImportMeta {
+ readonly env: ImportMetaEnv;
+}
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/utils.ts b/python/rag/healthcare-support-portal/frontend/app/lib/utils.ts
new file mode 100644
index 00000000..db2ea2fd
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/utils.ts
@@ -0,0 +1,124 @@
+import { type ClassValue, clsx } from "clsx"
+import { twMerge } from "tailwind-merge"
+
+export function cn(...inputs: ClassValue[]) {
+ return twMerge(clsx(inputs))
+}
+
+export function formatDate(date: string | Date): string {
+ const d = new Date(date)
+ return d.toLocaleDateString('en-US', {
+ year: 'numeric',
+ month: 'short',
+ day: 'numeric'
+ })
+}
+
+export function formatDateTime(date: string | Date): string {
+ const d = new Date(date)
+ return d.toLocaleString('en-US', {
+ year: 'numeric',
+ month: 'short',
+ day: 'numeric',
+ hour: '2-digit',
+ minute: '2-digit'
+ })
+}
+
+export function getRoleColor(role: string): string {
+ switch (role.toLowerCase()) {
+ case 'doctor':
+ return 'text-blue-600 bg-blue-50 border-blue-200'
+ case 'nurse':
+ return 'text-green-600 bg-green-50 border-green-200'
+ case 'admin':
+ return 'text-purple-600 bg-purple-50 border-purple-200'
+ default:
+ return 'text-gray-600 bg-gray-50 border-gray-200'
+ }
+}
+
+export function getDepartmentColor(department: string): string {
+ switch (department.toLowerCase()) {
+ case 'cardiology':
+ return 'border-red-500'
+ case 'neurology':
+ return 'border-purple-500'
+ case 'pediatrics':
+ return 'border-yellow-500'
+ case 'oncology':
+ return 'border-pink-500'
+ case 'emergency':
+ return 'border-orange-500'
+ case 'endocrinology':
+ return 'border-teal-500'
+ default:
+ return 'border-blue-500'
+ }
+}
+
+export function getStatusColor(status: string): string {
+ switch (status.toLowerCase()) {
+ case 'active':
+ return 'text-green-600 bg-green-50 border-green-200'
+ case 'inactive':
+ return 'text-gray-600 bg-gray-50 border-gray-200'
+ case 'pending':
+ return 'text-yellow-600 bg-yellow-50 border-yellow-200'
+ case 'urgent':
+ return 'text-red-600 bg-red-50 border-red-200'
+ default:
+ return 'text-gray-600 bg-gray-50 border-gray-200'
+ }
+}
+
+export function truncateText(text: string, maxLength: number): string {
+ if (text.length <= maxLength) return text
+ return text.slice(0, maxLength) + '...'
+}
+
+export function generateInitials(name: string): string {
+ return name
+ .split(' ')
+ .map(word => word.charAt(0))
+ .join('')
+ .toUpperCase()
+ .slice(0, 2)
+}
+
+export function validateEmail(email: string): boolean {
+ const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+ return emailRegex.test(email)
+}
+
+export function debounce any>(
+ func: T,
+ wait: number
+): (...args: Parameters) => void {
+ let timeout: NodeJS.Timeout | null = null
+
+ return (...args: Parameters) => {
+ if (timeout) clearTimeout(timeout)
+ timeout = setTimeout(() => func(...args), wait)
+ }
+}
+
+export function formatFileSize(bytes: number): string {
+ if (bytes === 0) return '0 Bytes'
+
+ const k = 1024
+ const sizes = ['Bytes', 'KB', 'MB', 'GB']
+ const i = Math.floor(Math.log(bytes) / Math.log(k))
+
+ return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i]
+}
+
+export function isValidMRN(mrn: string): boolean {
+ // Basic MRN validation - adjust pattern as needed
+ const mrnRegex = /^MRN-\d{4}-\d{3}$/
+ return mrnRegex.test(mrn)
+}
+
+export function sanitizeInput(input: string): string {
+ return input.trim().replace(/[<>]/g, '')
+}
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/utils/action-utils.ts b/python/rag/healthcare-support-portal/frontend/app/lib/utils/action-utils.ts
new file mode 100644
index 00000000..d3f9df14
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/utils/action-utils.ts
@@ -0,0 +1,62 @@
+import { parseWithZod } from '@conform-to/zod';
+import { redirect } from 'react-router';
+import { json } from './loader-utils';
+
+export async function handleFormSubmission(
+ request: Request,
+ schema: any,
+ handler: (data: any) => Promise
+) {
+ try {
+ const formData = await request.formData();
+ const submission = parseWithZod(formData, { schema });
+
+ if (submission.status !== 'success') {
+ return json({
+ submission: submission.reply(),
+ }, { status: 400 });
+ }
+
+ return await handler(submission.value);
+ } catch (error) {
+ console.error('Form submission error:', error);
+ return json({
+ submission: {
+ formErrors: ['An unexpected error occurred. Please try again.'],
+ },
+ }, { status: 500 });
+ }
+}
+
+export function setAuthCookies(response: Response, token: string, user: any): Response {
+ // Set HTTP-only cookies for authentication
+ const headers = new Headers(response.headers);
+
+ // Set auth token cookie
+ headers.append('Set-Cookie', `authToken=${token}; HttpOnly; Path=/; SameSite=Strict; Max-Age=1800`);
+
+ // Set user info cookie (for client-side access)
+ headers.append('Set-Cookie', `userInfo=${JSON.stringify(user)}; Path=/; SameSite=Strict; Max-Age=1800`);
+
+ return new Response(response.body, {
+ status: response.status,
+ statusText: response.statusText,
+ headers,
+ });
+}
+
+export function clearAuthCookies(): Response {
+ const headers = new Headers();
+
+ // Clear auth cookies
+ headers.append('Set-Cookie', 'authToken=; HttpOnly; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT');
+ headers.append('Set-Cookie', 'userInfo=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT');
+
+ return new Response(null, {
+ status: 302,
+ headers: {
+ ...Object.fromEntries(headers.entries()),
+ Location: '/login',
+ },
+ });
+}
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/lib/utils/loader-utils.ts b/python/rag/healthcare-support-portal/frontend/app/lib/utils/loader-utils.ts
new file mode 100644
index 00000000..b11bffaa
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/lib/utils/loader-utils.ts
@@ -0,0 +1,82 @@
+import { redirect } from 'react-router';
+import { serverApi } from '@/lib/api.server';
+
+export interface User {
+ id: number;
+ username: string;
+ email: string;
+ role: string;
+ department: string;
+ is_active: boolean;
+ created_at: string;
+}
+
+export async function getCurrentUser(request: Request): Promise {
+ try {
+ // Get auth token from cookies
+ const cookieHeader = request.headers.get('Cookie');
+ const token = cookieHeader?.match(/authToken=([^;]+)/)?.[1];
+
+ if (!token) {
+ return null;
+ }
+
+ // Verify token by calling auth service
+ const user = await serverApi.getCurrentUser(token);
+ return user;
+ } catch (error) {
+ console.error('Failed to get current user:', error);
+ return null;
+ }
+}
+
+export function json(data: any, init?: ResponseInit) {
+ return new Response(JSON.stringify(data), {
+ headers: {
+ 'Content-Type': 'application/json',
+ ...init?.headers,
+ },
+ ...init,
+ });
+}
+
+export function getAuthToken(request: Request): string | null {
+ const cookieHeader = request.headers.get('Cookie');
+ return cookieHeader?.match(/authToken=([^;]+)/)?.[1] || null;
+}
+
+export async function requireAuth(request: Request): Promise {
+ const user = await getCurrentUser(request);
+
+ if (!user) {
+ throw new Response('Authentication required', {
+ status: 401,
+ statusText: 'Unauthorized'
+ });
+ }
+
+ return user;
+}
+
+export function handleApiError(error: any): Response {
+ console.error('API Error:', error);
+
+ // If it's already a Response, return it
+ if (error instanceof Response) {
+ return error;
+ }
+
+ // If it's an error with status, create appropriate response
+ if (error?.status) {
+ return new Response(error.message || 'API Error', {
+ status: error.status,
+ statusText: error.statusText || 'Error'
+ });
+ }
+
+ // Default error response
+ return new Response(
+ error?.message || 'An unexpected error occurred',
+ { status: 500, statusText: 'Internal Server Error' }
+ );
+}
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/root.tsx b/python/rag/healthcare-support-portal/frontend/app/root.tsx
new file mode 100644
index 00000000..914ca72d
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/root.tsx
@@ -0,0 +1,76 @@
+import {
+ isRouteErrorResponse,
+ Links,
+ Meta,
+ Outlet,
+ Scripts,
+ ScrollRestoration,
+} from "react-router";
+import type { LinksFunction } from "react-router";
+
+import type { Route } from "./+types/root";
+import "./styles/globals.css";
+
+export const links: LinksFunction = () => [
+ { rel: "preconnect", href: "https://fonts.googleapis.com" },
+ {
+ rel: "preconnect",
+ href: "https://fonts.gstatic.com",
+ crossOrigin: "anonymous",
+ },
+ {
+ rel: "stylesheet",
+ href: "https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900&display=swap",
+ },
+];
+
+export function Layout({ children }: { children: React.ReactNode }) {
+ return (
+
+
+
+ {message}
+ {details}
+ {stack && (
+
+ {stack}
+
+ )}
+
+ );
+}
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/routes.ts b/python/rag/healthcare-support-portal/frontend/app/routes.ts
new file mode 100644
index 00000000..8e292484
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/routes.ts
@@ -0,0 +1,22 @@
+import { type RouteConfig, route, index, layout } from "@react-router/dev/routes";
+
+export default [
+ layout("routes/_layout.tsx", [
+ index("routes/_index.tsx"),
+ route("login", "routes/login.tsx"),
+ route("demo-login", "routes/demo-login.tsx"),
+ route("logout", "routes/logout.tsx"),
+ route("patients", "routes/patients/index.tsx"),
+ route("patients/new", "routes/patients/new.tsx"),
+ route("patients/:id", "routes/patients/patient.tsx"),
+ route("patients/:id/edit", "routes/patients/$id.edit.tsx"),
+ route("chat", "routes/chat.tsx"),
+ route("documents", "routes/documents.tsx"),
+ route("documents/new", "routes/documents/new.tsx"),
+ route("documents/:id", "routes/documents/$id.tsx"),
+ route("users", "routes/users/index.tsx"),
+ route("users/new", "routes/users/new.tsx"),
+ route("users/:id/edit", "routes/users/$id.edit.tsx"),
+ route("settings", "routes/settings.tsx"),
+ ]),
+] satisfies RouteConfig;
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/routes/_index.tsx b/python/rag/healthcare-support-portal/frontend/app/routes/_index.tsx
new file mode 100644
index 00000000..600f8a9a
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/routes/_index.tsx
@@ -0,0 +1,459 @@
+import { useState, useEffect } from 'react';
+import { Link, useLoaderData } from 'react-router';
+import {
+ Users,
+ FileText,
+ MessageCircle,
+ Activity,
+ Plus,
+ Eye,
+ TrendingUp,
+ Calendar,
+ Bell,
+ Search
+} from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Badge } from '@/components/ui/badge';
+import { formatDateTime, formatDate } from '@/lib/utils';
+import { getCurrentUser, handleApiError } from '@/lib/utils/loader-utils';
+import { serverApi } from '@/lib/api.server';
+import type { User, Patient, Document } from '@/lib/types';
+import type { LoaderFunctionArgs } from 'react-router';
+
+interface DashboardData {
+ user: User;
+ patients: Patient[];
+ documents: Document[];
+ recentDocuments: Document[];
+ myPatients: Patient[];
+ departmentStats: {
+ totalPatients: number;
+ totalDocuments: number;
+ activePatients: number;
+ sensitiveDocuments: number;
+ };
+}
+
+// Loader function - fetch dashboard data
+export async function loader({ request }: LoaderFunctionArgs) {
+ try {
+ // Get current user - layout already ensures authentication
+ const user = await getCurrentUser(request);
+ if (!user) {
+ console.error('[Dashboard] No user found in loader - layout auth may have failed');
+ throw new Response('Authentication required', { status: 401 });
+ }
+
+ // Get auth token from cookies
+ const cookieHeader = request.headers.get('Cookie');
+ const token = cookieHeader?.match(/authToken=([^;]+)/)?.[1];
+
+ if (!token) {
+ console.error('[Dashboard] No auth token found');
+ throw new Response('Authentication required', { status: 401 });
+ }
+
+ console.log(`[Dashboard] Loading dashboard for ${user.username}`);
+
+ // Load data concurrently based on user role
+ const [patients, documents] = await Promise.all([
+ serverApi.getPatients(token).catch(error => {
+ console.error('[Dashboard] Failed to load patients:', error);
+ return [];
+ }),
+ serverApi.getDocuments(token).catch(error => {
+ console.error('[Dashboard] Failed to load documents:', error);
+ return [];
+ })
+ ]);
+
+ // Process data for dashboard
+ const myPatients = user.role === 'doctor'
+ ? patients.filter((p: Patient) => p.assigned_doctor_id === user.id)
+ : patients.filter((p: Patient) => p.department === user.department);
+
+ const recentDocuments = documents
+ .sort((a: Document, b: Document) => new Date(b.created_at).getTime() - new Date(a.created_at).getTime())
+ .slice(0, 5);
+
+ const departmentStats = {
+ totalPatients: patients.length,
+ totalDocuments: documents.length,
+ activePatients: patients.filter((p: Patient) => p.is_active).length,
+ sensitiveDocuments: documents.filter((d: Document) => d.is_sensitive).length,
+ };
+
+ console.log(`[Dashboard] Loaded ${patients.length} patients, ${documents.length} documents`);
+
+ return {
+ user,
+ patients,
+ documents,
+ recentDocuments,
+ myPatients,
+ departmentStats
+ };
+ } catch (error) {
+ console.error('[Dashboard] Loader error:', error);
+ throw handleApiError(error);
+ }
+}
+
+export default function Dashboard() {
+ const { user, patients, documents, recentDocuments, myPatients, departmentStats } = useLoaderData();
+ const [currentTime, setCurrentTime] = useState(new Date());
+
+ // Update current time every minute
+ useEffect(() => {
+ const timer = setInterval(() => setCurrentTime(new Date()), 60000);
+ return () => clearInterval(timer);
+ }, []);
+
+ const getGreeting = () => {
+ const hour = currentTime.getHours();
+ if (hour < 12) return 'Good morning';
+ if (hour < 17) return 'Good afternoon';
+ return 'Good evening';
+ };
+
+ const getRoleTitle = (role: string) => {
+ switch (role) {
+ case 'doctor': return 'Dr.';
+ case 'nurse': return 'Nurse';
+ case 'admin': return 'Administrator';
+ default: return '';
+ }
+ };
+
+ const formatDisplayName = (username: string, role: string) => {
+ // Handle known demo users
+ if (username === 'dr_smith') return 'Smith';
+ if (username === 'nurse_johnson') return 'Johnson';
+ if (username === 'admin_wilson') return 'Wilson';
+
+ // Remove role prefixes to avoid duplication (dr_, nurse_, admin_)
+ let cleanUsername = username;
+ if (username.startsWith('dr_')) {
+ cleanUsername = username.substring(3); // Remove 'dr_'
+ } else if (username.startsWith('nurse_')) {
+ cleanUsername = username.substring(6); // Remove 'nurse_'
+ } else if (username.startsWith('admin_')) {
+ cleanUsername = username.substring(6); // Remove 'admin_'
+ }
+
+ // For other usernames, extract last part after underscore and capitalize
+ const parts = cleanUsername.split('_');
+ if (parts.length > 1) {
+ const lastName = parts[parts.length - 1];
+ return lastName.charAt(0).toUpperCase() + lastName.slice(1);
+ }
+
+ // Fallback: capitalize the clean username
+ return cleanUsername.charAt(0).toUpperCase() + cleanUsername.slice(1);
+ };
+
+ const getDocumentIcon = (type: string) => {
+ switch (type) {
+ case 'protocol': return '📋';
+ case 'policy': return '📜';
+ case 'guideline': return '📖';
+ case 'research': return '🔬';
+ case 'report': return '📊';
+ case 'medical_record': return '📝';
+ default: return '📄';
+ }
+ };
+
+ return (
+
+ {/* Header */}
+
+
+
+ {getGreeting()}, {getRoleTitle(user.role)} {formatDisplayName(user.username, user.role)}
+
+
+ {formatDateTime(currentTime.toISOString())} • {user.department} Department
+
+
+
+
+
+
+
+
+
+
+ {/* Quick Stats */}
+
+
+
+
+
+
+
+
+ {user.role === 'doctor' ? 'My Patients' : 'Department Patients'}
+
+
+ {user.role === 'doctor' ? myPatients.length : departmentStats.activePatients}
+
+
+
+
+
+
+
+
+
+
+
+
Documents
+
+ {departmentStats.totalDocuments}
+
+
+
+
+
+
+
+
+
+
+
Active Cases
+
+ {departmentStats.activePatients}
+
+
+
+
+
+
+
+
+
+
+
+
Sensitive Docs
+
+ {departmentStats.sensitiveDocuments}
+
+
+
+
+
+
+
+ {/* Recent Documents */}
+
+
+
+
+
+ Latest documents in your department
+
+
+
+ {recentDocuments.length === 0 ? (
+
+
+
No documents yet
+
Get started by creating your first document.
+
+
+
+
+
+ {recentDocuments.map((doc) => (
+
+
+ {getDocumentIcon(doc.document_type)}
+
+
+
+ {doc.title}
+
+
+
+ {doc.document_type.replace('_', ' ')}
+
+ {doc.is_sensitive && (
+
+ Sensitive
+
+ )}
+
+
+ {formatDate(doc.created_at)}
+
+
+
+
+
+ ))}
+
+
+
+
+
+
+
+ {/* My Patients or Department Patients */}
+
+
+
+
+
+ {user.role === 'doctor'
+ ? 'Patients assigned to you'
+ : `Patients in ${user.department} department`
+ }
+
+
+
+ {myPatients.length === 0 ? (
+
+
+
No patients yet
+
+ {user.role === 'doctor'
+ ? 'No patients are currently assigned to you.'
+ : 'No patients in your department yet.'
+ }
+
+ {['doctor', 'admin'].includes(user.role) && (
+
+
+
+
+ )}
+
+ {myPatients.slice(0, 5).map((patient) => (
+
+
+
+
+
+ {patient.name}
+
+
+ {patient.medical_record_number}
+
+ {patient.date_of_birth && (
+
+ DOB: {formatDate(patient.date_of_birth)}
+
+ )}
+
+
+
+
+ ))}
+
+
+
+
+
+
+
+
+ {/* Quick Actions */}
+
+
+
+
+
+ Common tasks for healthcare professionals
+
+
+
+
+
+ AI Chat
+
+
+
+
+ New Document
+
+
+
+ {['doctor', 'admin'].includes(user.role) && (
+
+ Add Patient
+
+
+ )}
+
+
+ Search Docs
+
+
+
+
+
();
+
+ // Render layout for authenticated users
+ if (user && !isPublicRoute) {
+ return (
+
+ );
+ }
+
+ // Render auth pages without navigation
+ return (
+
+
+ );
+}
+
+export default function Layout() {
+ return (
+
+
+ );
+}
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/frontend/app/routes/chat.tsx b/python/rag/healthcare-support-portal/frontend/app/routes/chat.tsx
new file mode 100644
index 00000000..6807f0e8
--- /dev/null
+++ b/python/rag/healthcare-support-portal/frontend/app/routes/chat.tsx
@@ -0,0 +1,365 @@
+import { useState, useRef, useEffect } from 'react';
+import { Send, MessageSquare, Loader2, FileText, User as UserIcon, Bot } from 'lucide-react';
+import { useLoaderData, useFetcher, Form } from 'react-router';
+import { useForm, getFormProps, getInputProps } from '@conform-to/react';
+import { parseWithZod } from '@conform-to/zod';
+import ReactMarkdown from 'react-markdown';
+import remarkGfm from 'remark-gfm';
+import rehypeHighlight from 'rehype-highlight';
+import rehypeSanitize from 'rehype-sanitize';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
+import { Badge } from '@/components/ui/badge';
+import { formatDateTime } from '@/lib/utils';
+import { requireAuth, handleApiError } from '@/lib/utils/loader-utils';
+import { handleFormSubmission } from '@/lib/utils/action-utils';
+import { serverApi } from '@/lib/api.server';
+import { chatMessageSchema } from '@/lib/schemas';
+import type { ChatMessage, ChatRequest, User } from '@/lib/types';
+import type { LoaderFunctionArgs, ActionFunctionArgs } from 'react-router';
+
+interface ChatData {
+ user: User;
+}
+
+// Loader function - handle authentication
+export async function loader({ request }: LoaderFunctionArgs) {
+ try {
+ // Require authentication
+ const user = await requireAuth(request);
+
+ return {
+ user
+ };
+ } catch (error) {
+ throw handleApiError(error);
+ }
+}
+
+// Action function - handle message submissions
+export async function action({ request }: ActionFunctionArgs) {
+ const user = await requireAuth(request);
+ const cookieHeader = request.headers.get('Cookie');
+ const token = cookieHeader?.match(/authToken=([^;]+)/)?.[1];
+
+ if (!token) {
+ throw new Response('Authentication required', { status: 401 });
+ }
+
+ return handleFormSubmission(request, chatMessageSchema, async (data) => {
+ const chatRequest: ChatRequest = {
+ message: data.message,
+ context_department: user.department,
+ max_results: 5
+ };
+
+ const response = await serverApi.askQuestion(token, chatRequest);
+
+ // Return the response for the fetcher
+ return Response.json({
+ success: true,
+ response: response.response,
+ sources: response.sources,
+ token_count: response.token_count
+ });
+ });
+}
+
+export default function Chat() {
+ const { user } = useLoaderData();
+ const fetcher = useFetcher();
+ const [messages, setMessages] = useState([]);
+ const messagesEndRef = useRef(null);
+ const [form, fields] = useForm({
+ onValidate({ formData }) {
+ return parseWithZod(formData, { schema: chatMessageSchema });
+ }
+ });
+
+ const isLoading = fetcher.state === 'submitting';
+
+ const scrollToBottom = () => {
+ messagesEndRef.current?.scrollIntoView({ behavior: 'smooth' });
+ };
+
+ useEffect(() => {
+ scrollToBottom();
+ }, [messages]);
+
+ useEffect(() => {
+ // Add welcome message
+ const welcomeMessage: ChatMessage = {
+ id: 'welcome',
+ type: 'system',
+ content: `Welcome to the Healthcare Support Portal Chat Assistant! I'm here to help you with medical information, protocols, and answer questions based on your available documents. How can I assist you today?`,
+ timestamp: new Date().toISOString()
+ };
+ setMessages([welcomeMessage]);
+ }, []);
+
+ useEffect(() => {
+ // Handle fetcher response
+ if (fetcher.data && fetcher.state === 'idle') {
+ if (fetcher.data.success) {
+ const assistantMessage: ChatMessage = {
+ id: (Date.now() + 1).toString(),
+ type: 'assistant',
+ content: fetcher.data.response,
+ timestamp: new Date().toISOString(),
+ sources: fetcher.data.sources,
+ token_count: fetcher.data.token_count
+ };
+ setMessages(prev => [...prev, assistantMessage]);
+ } else {
+ const errorMessage: ChatMessage = {
+ id: (Date.now() + 1).toString(),
+ type: 'assistant',
+ content: `I apologize, but I encountered an error while processing your request. Please try again later.`,
+ timestamp: new Date().toISOString()
+ };
+ setMessages(prev => [...prev, errorMessage]);
+ }
+ }
+ }, [fetcher.data, fetcher.state]);
+
+ const handleSendMessage = (formData: FormData) => {
+ const message = formData.get('message') as string;
+ if (!message?.trim() || isLoading) return;
+
+ const userMessage: ChatMessage = {
+ id: Date.now().toString(),
+ type: 'user',
+ content: message.trim(),
+ timestamp: new Date().toISOString()
+ };
+
+ setMessages(prev => [...prev, userMessage]);
+
+ // Submit via fetcher
+ fetcher.submit(formData, { method: 'post' });
+
+ // Reset form
+ form.reset();
+ };
+
+ const renderMessage = (message: ChatMessage) => {
+ switch (message.type) {
+ case 'user':
+ return (
+
+
+
+ {message.content}
+
+
+
+
+
+
+
+
+
+ {message.content}
+
+
+ {message.sources && message.sources.length > 0 && (
+
+
Sources:
+
+ {message.sources.slice(0, 3).map((source, idx) => (
+
+ {source.title}
+
+ ))}
+
+
+ )}
+ {message.token_count && (
+
+ {message.token_count} tokens used
+
+ )}
+
+
+
+
+ {message.content}
+
+
+ {/* Header */}
+
+
+
+
+ Chat Assistant
+
+
+ Get AI-powered assistance with medical information and protocols
+
+
+
+
+ Context: {user.department}
+
+
+
+
+
+ {/* Chat Container */}
+
+
+
+ Healthcare AI Assistant
+
+
+ Ask questions about medical protocols, patient care, or search through available documents
+
+
+
+
+ {/* Messages Area */}
+
+ {messages.length === 1 && (
+
+ {renderMessage(messages[0])}
+
+
+ Try asking about:
+
+
+ {suggestedQuestions.map((question, idx) => (
+ {
+ const messageInput = document.querySelector('input[name="message"]') as HTMLInputElement;
+ if (messageInput) {
+ messageInput.value = question;
+ messageInput.focus();
+ }
+ }}
+ className="block w-full text-left p-2 text-sm text-gray-600 hover:bg-gray-50 rounded border"
+ >
+ {question}
+
+ ))}
+
+
+
+ )}
+
+ {messages.length > 1 && messages.slice(1).map((message) => (
+
+ {renderMessage(message)}
+
+ ))}
+
+ {isLoading && (
+
+ )}
+
+
+
{
+ e.preventDefault();
+ const formData = new FormData(e.currentTarget);
+ handleSendMessage(formData);
+ }}
+ className="flex space-x-2"
+ >
+
+ {isLoading ? (
+
+
+
+
+
+ {/* Info Panel */}
+
+
+
+
How it works:
+
+ • Ask questions in natural language
+ • The AI searches through authorized documents in your department
+ • Responses are tailored to your role as a {user.role}
+ • Sources are provided when available
+
+
+
+
(null);
+
+ const handleLogin = (user: DemoUser) => {
+ setSelectedUser(user);
+ const formData = new FormData();
+ formData.append('username', user.username);
+ formData.append('password', user.password);
+
+ fetcher.submit(formData, {
+ method: 'post',
+ action: '/login'
+ });
+ };
+
+ const isLoggingIn = fetcher.state === 'submitting';
+
+ return (
+
+
+ {/* Header */}
+
+
+
+ Healthcare Support Portal
+
+
+ Choose a demo user role to explore the system. Each role has different permissions
+ and access to various documents and features.
+
+
+
+ {/* Demo Users Grid */}
+
+ {DEMO_USERS.map((user) => {
+ const IconComponent = user.icon;
+ const isSelected = selectedUser?.username === user.username;
+ const isCurrentUserLoggingIn = isLoggingIn && isSelected;
+
+ return (
+
!isLoggingIn && handleLogin(user)}
+ >
+
+
+ {user.username}
+ {user.description}
+
+
+
+
+
+ {user.role}
+
+
+
+
+
+
+ Department: {user.department}
+
+
+
Permissions:
+
+ {user.permissions.map((permission, idx) => (
+
+
+ ))}
+
+
{
+ e.stopPropagation();
+ handleLogin(user);
+ }}
+ >
+ {isCurrentUserLoggingIn ? (
+ <>
+
+ Logging in...
+
+ ) : (
+ <>
+
+
+
+ );
+ })}
+
+
+ {/* Features Overview */}
+
+
+
+
+
+ Test how the AI assistant responds differently based on user permissions
+
+
+
+
+
+
What you can test:
+
+ • Document access based on user role
+ • Department-specific information retrieval
+ • Permission-based search results
+ • Context-aware responses
+
+
+
+
Try asking:
+
+ • "What are the emergency protocols?"
+ • "Show me cardiology guidelines"
+ • "What documents can I access?"
+ • "Help me with patient care procedures"
+
+
+
+
+
+ {/* Info Alert */}
+
+
+ Demo Mode: All demo users share the same password: secure_password.
+ This allows you to quickly switch between different user roles to test permissions and see how the RAG system
+ provides different responses based on user access levels.
+
+
+
+
;
+ patients: Patient[];
+}
+
+// Loader function - fetch documents data
+export async function loader({ request }: LoaderFunctionArgs) {
+ try {
+ // Require authentication
+ const user = await requireAuth(request);
+
+ // Get auth token from cookies
+ const cookieHeader = request.headers.get('Cookie');
+ const token = cookieHeader?.match(/authToken=([^;]+)/)?.[1];
+
+ if (!token) {
+ throw new Response('Authentication required', { status: 401 });
+ }
+
+ // Load documents, embedding statuses, and patients
+ const [documents, embeddingStatuses, patients] = await Promise.all([
+ serverApi.getDocuments(token),
+ serverApi.getAllEmbeddingStatuses(token),
+ serverApi.getPatients(token)
+ ]);
+
+ return {
+ user,
+ documents,
+ embeddingStatuses,
+ patients
+ };
+ } catch (error) {
+ throw handleApiError(error);
+ }
+}
+
+// Action function - handle document creation and embedding regeneration
+export async function action({ request }: ActionFunctionArgs) {
+ const user = await requireAuth(request);
+ const cookieHeader = request.headers.get('Cookie');
+ const token = cookieHeader?.match(/authToken=([^;]+)/)?.[1];
+
+ if (!token) {
+ throw new Response('Authentication required', { status: 401 });
+ }
+
+ const formData = await request.formData();
+ const action = formData.get('action');
+
+ // Handle embedding regeneration
+ if (action === 'regenerate') {
+ const documentId = parseInt(formData.get('documentId') as string);
+
+ try {
+ const result = await serverApi.regenerateEmbeddings(documentId, token);
+ return Response.json({
+ success: true,
+ documentId,
+ ...result
+ });
+ } catch (error) {
+ return Response.json({
+ success: false,
+ error: error instanceof Error ? error.message : 'Failed to regenerate embeddings'
+ }, { status: 500 });
+ }
+ }
+
+ // Handle document deletion
+ if (action === 'delete') {
+ const documentId = formData.get('documentId') as string;
+
+ // Check if user has permission to delete documents (doctors and admins only)
+ if (!['doctor', 'admin'].includes(user.role)) {
+ return Response.json({
+ success: false,
+ error: 'Access denied. Only doctors and administrators can delete documents.'
+ }, { status: 403 });
+ }
+
+ try {
+ await serverApi.deleteDocument(token, documentId);
+ return Response.json({
+ success: true,
+ message: 'Document deleted successfully'
+ });
+ } catch (error) {
+ return Response.json({
+ success: false,
+ error: error instanceof Error ? error.message : 'Failed to delete document'
+ }, { status: 500 });
+ }
+ }
+
+ // Handle document creation
+ return handleFormSubmission(request, documentCreateSchema, async (data) => {
+ // Add user context to document data
+ const documentData = {
+ ...data,
+ department: data.department || user.department, // Use user's department as default
+ };
+
+ await serverApi.createDocument(documentData, token);
+ return Response.json({ success: true, message: 'Document created successfully' });
+ });
+}
+
+export default function Documents() {
+ const { user, documents, embeddingStatuses: initialEmbeddingStatuses, patients } = useLoaderData();
+ const fetcher = useFetcher();
+ const [filteredDocuments, setFilteredDocuments] = useState(documents);
+ const [searchTerm, setSearchTerm] = useState('');
+ const [typeFilter, setTypeFilter] = useState('all');
+ const [departmentFilter, setDepartmentFilter] = useState('all');
+ const [embeddingStatuses, setEmbeddingStatuses] = useState>(initialEmbeddingStatuses);
+
+ useEffect(() => {
+ filterDocuments();
+ }, [documents, searchTerm, typeFilter, departmentFilter]);
+
+ // Handle fetcher response for embedding regeneration
+ useEffect(() => {
+ if (fetcher.data && fetcher.state === 'idle' && fetcher.data.success && fetcher.data.documentId) {
+ setEmbeddingStatuses(prev => ({
+ ...prev,
+ [fetcher.data.documentId]: {
+ has_embeddings: true,
+ embedding_count: fetcher.data.chunks_created || 0
+ }
+ }));
+ }
+ }, [fetcher.data, fetcher.state]);
+
+ const filterDocuments = () => {
+ let filtered = documents;
+
+ // Search filter
+ if (searchTerm) {
+ filtered = filtered.filter(doc =>
+ doc.title.toLowerCase().includes(searchTerm.toLowerCase()) ||
+ doc.content.toLowerCase().includes(searchTerm.toLowerCase())
+ );
+ }
+
+ // Type filter
+ if (typeFilter !== 'all') {
+ filtered = filtered.filter(doc => doc.document_type === typeFilter);
+ }
+
+ // Department filter
+ if (departmentFilter !== 'all') {
+ filtered = filtered.filter(doc => doc.department === departmentFilter);
+ }
+
+ setFilteredDocuments(filtered);
+ };
+
+ const documentTypes = Array.from(new Set(documents.map(d => d.document_type))).sort();
+ const departments = Array.from(new Set(documents.map(d => d.department))).sort();
+
+ const getDocumentIcon = (type: string) => {
+ switch (type) {
+ case 'protocol':
+ return '📋';
+ case 'policy':
+ return '📜';
+ case 'guideline':
+ return '📖';
+ case 'research':
+ return '🔬';
+ case 'report':
+ return '📊';
+ case 'medical_record':
+ return '📝';
+ default:
+ return '📄';
+ }
+ };
+
+ const handleRegenerateEmbeddings = async (documentId: number) => {
+ // Use fetcher to handle the regeneration
+ const formData = new FormData();
+ formData.append('action', 'regenerate');
+ formData.append('documentId', documentId.toString());
+
+ fetcher.submit(formData, { method: 'post' });
+ };
+
+ const handleDeleteDocument = async (documentId: number, documentTitle: string) => {
+ if (window.confirm(`Are you sure you want to delete "${documentTitle}"? This action cannot be undone.`)) {
+ const formData = new FormData();
+ formData.append('action', 'delete');
+ formData.append('documentId', documentId.toString());
+
+ fetcher.submit(formData, { method: 'post' });
+ }
+ };
+
+
+ return (
+
+ {/* Header */}
+
+
+
+ Documents
+
+
+ Access medical documents, protocols, and policies
+
+
+
+
{
+ const uploadSection = document.querySelector('[data-upload-section]');
+ uploadSection?.scrollIntoView({ behavior: 'smooth' });
+ }}
+ >
+
+
+
+
+
+
+ {/* Filters */}
+
+
+
+
+
+
setTypeFilter(e.target.value)}
+ className="h-10 px-3 py-2 border border-input bg-background rounded-md text-sm ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
+ >
+ All Types
+ {documentTypes.map(type => (
+
+ {type.replace('_', ' ')}
+
+ ))}
+
+
setDepartmentFilter(e.target.value)}
+ className="h-10 px-3 py-2 border border-input bg-background rounded-md text-sm ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
+ >
+ All Departments
+ {departments.map(dept => (
+
+ {dept}
+
+ ))}
+
+
+ {filteredDocuments.length} documents
+
+
+
+
+ {/* Documents Grid */}
+ {filteredDocuments.length === 0 ? (
+
+
+ No documents found
+
+ {documents.length === 0
+ ? "Get started by uploading your first document."
+ : "Try adjusting your search or filter criteria."
+ }
+
+ {documents.length === 0 && (
+
+ )}
+
+
+ ) : (
+
+ {filteredDocuments.map((document) => (
+
+
+
+
+
+ {getDocumentIcon(document.document_type)}
+
+
+
+ {document.title}
+
+
+
+ {document.document_type.replace('_', ' ')}
+
+ {document.is_sensitive && (
+
+
+ )}
+
+
+ handleRegenerateEmbeddings(document.id)}
+ canRegenerate={user?.role === 'admin' || user?.role === 'doctor' || user?.role === 'nurse'}
+ />
+
+
+
+
+
+
+
+ {truncateText(document.content, 120)}
+
+
+
+
+ Department: {document.department}
+
+
+ Created: {formatDateTime(document.created_at)}
+
+ {document.created_by && (
+
+ By: {document.created_by.username}
+
+ )}
+
+
+
+
+
+
+
+ {(user?.role === 'doctor' || user?.role === 'admin') && (
+ handleDeleteDocument(document.id, document.title)}
+ className="text-red-600 hover:text-red-700 hover:bg-red-50"
+ >
+
+ )}
+
+
+
+ ))}
+
+ )}
+
+ {/* Quick Stats */}
+
+
+
+
+
+ {documents.length}
+
+
Total Documents
+
+
+
+
+
+
+
+ {documents.filter(d => d.department === user?.department).length}
+
+
My Department
+
+
+
+
+
+
+
+ {documents.filter(d => d.is_sensitive).length}
+
+
Sensitive
+
+
+
+
+
+
+
+ {documentTypes.length}
+
+
Document Types
+
+
+
+
+ {/* Document Upload */}
+
+
+
();
+ const fetcher = useFetcher();
+
+ const handleDeleteDocument = () => {
+ if (window.confirm(`Are you sure you want to delete "${doc.title}"? This action cannot be undone.`)) {
+ const formData = new FormData();
+ formData.append('action', 'delete');
+
+ fetcher.submit(formData, { method: 'post' });
+ }
+ };
+
+ const getDocumentIcon = (type: string) => {
+ switch (type) {
+ case 'protocol': return '📋';
+ case 'policy': return '📜';
+ case 'guideline': return '📖';
+ case 'research': return '🔬';
+ case 'report': return '📊';
+ case 'medical_record': return '📝';
+ default: return '📄';
+ }
+ };
+
+ const handleDownload = () => {
+ // Create a blob with the document content
+ const blob = new Blob([doc.content], { type: 'text/plain' });
+ const url = URL.createObjectURL(blob);
+
+ // Create a temporary link and trigger download
+ const link = document.createElement('a');
+ link.href = url;
+ link.download = `${doc.title}.txt`;
+ document.body.appendChild(link);
+ link.click();
+
+ // Cleanup
+ document.body.removeChild(link);
+ URL.revokeObjectURL(url);
+ };
+
+ return (
+
+ {/* Header */}
+
+
+
+
+
+
+
+ {getDocumentIcon(doc.document_type)}
+
+
+
+ {doc.title}
+
+
+
+ {doc.document_type.replace('_', ' ')}
+
+ {doc.is_sensitive && (
+
+
+ )}
+
+
+
+
+
+
+
+
+ {(user?.role === 'admin' || doc.created_by_id === user?.id) && (
+
+
+ )}
+ {(user?.role === 'doctor' || user?.role === 'admin') && (
+
+
+ )}
+
+
+
+
+ {/* Main Content */}
+
+ {/* Document Content */}
+
+
+ Document Content
+
+ Full content of the document
+
+
+
+
+
+
+
+ {/* AI Embedding Status */}
+ {embeddingStatus && (
+
+
+ AI Processing Status
+
+ Vector embedding status for AI-powered search and chat
+
+
+
+
+
+ )}
+
+
+ {/* Sidebar */}
+
+ {/* Document Information */}
+
+
+ Document Details
+
+
+
+
+
Type
+
+ {doc.document_type.replace('_', ' ')}
+
+
+
+
+
Department
+
+
+
+
+
+
Created
+
+
+
+
+ {doc.created_by && (
+
+
Created By
+
+
+
+ )}
+
+
+
Sensitivity
+
+ {doc.is_sensitive ? (
+
+
+ ) : (
+
+
+ )}
+
+
+
+
+
+
+ {/* Associated Patient */}
+ {doc.patient && (
+
+
+ Associated Patient
+
+
+
+
+
+
+
+ {doc.patient.name}
+
+
+ MRN: {doc.patient.medical_record_number}
+
+
+ {doc.patient.department}
+
+
+
+
+
+
+
+
+ )}
+
+ {/* Quick Actions */}
+
+
+ Quick Actions
+
+
+
+
+
+ng.
+ {(user?.role === 'admin' || doc.created_by_id === user?.id) && (
+
+
+ )}
+ {(user?.role === 'doctor' || user?.role === 'admin') && (
+
+
+ )}
+
+
+
+
+
+
+
();
+
+ return (
+
+ {/* Header */}
+
+
+
+ Create New Document
+
+
+ Add a new document to the Healthcare Support Portal with AI-powered features
+
+
+
+
+ {/* Document Form */}
+
+
+
+ {/* Logo and Title */}
+
+
+
+ Healthcare Support Portal
+
+
+ Sign in to your account to continue
+
+
+
+ {/* Login Form */}
+
+
+ Sign In
+
+ Enter your credentials to access the healthcare portal
+
+
+
+
+
+
+
+
+
+
+ Need access?
+
+
+
+
+
+
+
+ Contact your system administrator to request access to the Healthcare Support Portal.
+
+
+
+
+
+
+ {/* Demo Login Link */}
+
+
+
+
+
+
Quick Demo Access
+
+ Try different user roles and see how permissions affect the RAG chat assistant
+
+
+
+
+
+
+
+
+ {/* Demo Credentials */}
+
+
+ Manual Demo Credentials
+
+
Doctor: dr_smith / secure_password
+
Nurse: nurse_johnson / secure_password
+
Admin: admin_wilson / secure_password
+
+
+
+
();
+
+ return (
+
+ {/* Header */}
+
+
+
+ Edit Patient: {patient.name}
+
+
+ Update patient information and assignments
+
+
+
+
+ {/* Patient Form */}
+
+
();
+ const [filteredPatients, setFilteredPatients] = useState(patients);
+ const [searchTerm, setSearchTerm] = useState('');
+ const [departmentFilter, setDepartmentFilter] = useState('all');
+
+ useEffect(() => {
+ filterPatients();
+ }, [patients, searchTerm, departmentFilter]);
+
+ const filterPatients = () => {
+ let filtered = patients;
+
+ // Search filter
+ if (searchTerm) {
+ filtered = filtered.filter(patient =>
+ patient.name.toLowerCase().includes(searchTerm.toLowerCase()) ||
+ patient.medical_record_number.toLowerCase().includes(searchTerm.toLowerCase())
+ );
+ }
+
+ // Department filter
+ if (departmentFilter !== 'all') {
+ filtered = filtered.filter(patient => patient.department === departmentFilter);
+ }
+
+ setFilteredPatients(filtered);
+ };
+
+ const departments = Array.from(new Set(patients.map(p => p.department))).sort();
+
+
+ return (
+
+ {/* Header */}
+
+
+
+ Patients
+
+
+ Manage patient records and assignments
+
+
+
+
+
+
+
+
+ {/* Filters */}
+
+
+
+
+
+
setDepartmentFilter(e.target.value)}
+ className="h-10 px-3 py-2 border border-input bg-background rounded-md text-sm ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
+ >
+ All Departments
+ {departments.map(dept => (
+
+ {dept}
+
+ ))}
+
+
+ {filteredPatients.length} patients
+
+
+
+
+ {/* Patients Grid */}
+ {filteredPatients.length === 0 ? (
+
+
+ No patients found
+
+ {patients.length === 0
+ ? "Get started by adding your first patient."
+ : "Try adjusting your search or filter criteria."
+ }
+
+ {patients.length === 0 && (
+
+
+
+
+
+ ) : (
+
+ {filteredPatients.map((patient) => (
+
+
+
+
+
+
+
+ {patient.name}
+
+ MRN: {patient.medical_record_number}
+
+
+
+
+ {patient.is_active ? 'Active' : 'Inactive'}
+
+
+
+
+
+
+
+
+ {patient.assigned_doctor && (
+
+
+ )}
+
+
+
+
+
+
+
+
+ ))}
+
+ )}
+
+ {/* Quick Stats */}
+
+
+
+
+
+ {patients.filter(p => p.is_active).length}
+
+
Active Patients
+
+
+
+
+
+
+ {patients.filter(p => p.assigned_doctor_id === user?.id).length}
+
+
My Patients
+
+
+
+
+
+
+ {patients.filter(p => p.department === user?.department).length}
+
+
Department
+
+
+
+
+
+
+ {departments.length}
+
+
Departments
+
+
+
+
();
+
+ return (
+
+ {/* Header */}
+
+
+
+ Add New Patient
+
+
+ Create a new patient record for the Healthcare Support Portal
+
+
+
+
+ {/* Patient Form */}
+
+
();
+
+
+ return (
+
+ {/* Header */}
+
+
+
+
+
+
+ {patient.name}
+
+
+ Medical Record Number: {patient.medical_record_number}
+
+
+
+
+
+ {patient.is_active ? 'Active' : 'Inactive'}
+
+
+
+
+
+
+
+ {/* Main Content */}
+
+ {/* Patient Information */}
+
+
+ Patient Information
+
+ Basic patient details and demographics
+
+
+
+
+
+
Full Name
+ {patient.name}
+
+
+
+
Medical Record Number
+ {patient.medical_record_number}
+
+
+
+
Date of Birth
+
+
+
+
+
+
Department
+
+
+
+
+
+
Status
+
+
+ {patient.is_active ? 'Active' : 'Inactive'}
+
+
+
+
+
+
Created
+
+ {formatDateTime(patient.created_at)}
+
+
+
+
+
+
+ {/* Medical History */}
+
+
+ Medical History
+
+ Patient's medical history and records
+
+
+
+
+
+
+ No medical history available
+
+
+ Medical history and records will appear here once added.
+
+
+
+
+
+
+ {/* Recent Activity */}
+
+
+ Recent Activity
+
+ Recent updates and changes to this patient record
+
+
+
+
+
+
+
+
+ Patient record created
+
+
+ {formatDateTime(patient.created_at)}
+
+
+
+
+ {patient.assigned_doctor && (
+
+
+
+
+ Assigned to Dr. {patient.assigned_doctor.username}
+
+
+ {patient.assigned_doctor.department} department
+
+
+
+ )}
+
+
+
+
+ {/* Sidebar */}
+
+ {/* Assigned Doctor */}
+ {patient.assigned_doctor && (
+
+
+ Assigned Doctor
+
+
+
+
+
+
+
+ Dr. {patient.assigned_doctor.username}
+
+
+ {patient.assigned_doctor.department}
+
+
+ Doctor
+
+
+
+
+
+
+
+
+
+ )}
+
+ {/* Quick Actions */}
+
+
+ Quick Actions
+
+
+
+
+
+
+
+
+
+
+
+
+
+ {/* Patient Stats */}
+
+
+ Patient Summary
+
+
+
+
+ Status
+
+ {patient.is_active ? 'Active' : 'Inactive'}
+
+
+
+ Department
+ {patient.department}
+
+
+ Records
+ 0
+
+
+ Last Visit
+ N/A
+
+
+
+
+
+
();
+
+ const settingsSections = [
+ {
+ id: 'users',
+ title: 'User Management',
+ description: 'Manage user accounts, roles, and permissions',
+ icon: Users,
+ color: 'bg-blue-500',
+ items: [
+ { label: 'Total Users', value: stats.totalUsers },
+ { label: 'Active Users', value: stats.activeUsers },
+ { label: 'Pending Registrations', value: '3' }
+ ]
+ },
+ {
+ id: 'system',
+ title: 'System Configuration',
+ description: 'Configure departments, roles, and system settings',
+ icon: SettingsIcon,
+ color: 'bg-green-500',
+ items: [
+ { label: 'Departments', value: departments.length },
+ { label: 'User Roles', value: roles.length },
+ { label: 'System Uptime', value: stats.systemUptime }
+ ]
+ },
+ {
+ id: 'security',
+ title: 'Security & Access',
+ description: 'Manage authentication and authorization policies',
+ icon: Shield,
+ color: 'bg-red-500',
+ items: [
+ { label: 'Active Sessions', value: '24' },
+ { label: 'Failed Login Attempts (24h)', value: '2' },
+ { label: 'Password Policy', value: 'Strong' }
+ ]
+ },
+ {
+ id: 'data',
+ title: 'Data Management',
+ description: 'Manage patient data, documents, and backups',
+ icon: Database,
+ color: 'bg-purple-500',
+ items: [
+ { label: 'Total Patients', value: stats.totalPatients },
+ { label: 'Total Documents', value: stats.totalDocuments },
+ { label: 'Last Backup', value: '2 hours ago' }
+ ]
+ }
+ ];
+
+ const systemServices = [
+ { name: 'Auth Service', status: 'healthy', port: '8001' },
+ { name: 'Patient Service', status: 'healthy', port: '8002' },
+ { name: 'RAG Service', status: 'healthy', port: '8003' },
+ { name: 'Database', status: 'healthy', port: '5432' },
+ { name: 'Oso Dev Server', status: 'healthy', port: '8080' }
+ ];
+
+ return (
+
+ {/* Header */}
+
+
+
+ System Settings
+
+
+ Manage system configuration and administrative settings
+
+
+
+
+
+
+
+
+ {/* Settings Sections */}
+
+ {settingsSections.map((section) => (
+
+
+
+
+
+
+ {section.title}
+ {section.description}
+
+
+
+
+ {section.items.map((item, index) => (
+
+ {item.label}
+ {item.value}
+
+ ))}
+
+
+ Configure {section.title}
+
+
+
+
+ ))}
+
+
+ {/* System Services Status */}
+
+
+ Service Status
+
+ Current status of healthcare portal microservices
+
+
+
+
+ {systemServices.map((service) => (
+
+
+
+ {service.status === 'healthy' ? (
+
+ ) : (
+
+ )}
+
+ {service.name}
+
+
+
+
+ :{service.port}
+
+
+ ))}
+
+
+
+ {/* Configuration Options */}
+
+ {/* Departments Configuration */}
+
+
+ Departments
+
+ Available departments in the healthcare system
+
+
+
+
+ {departments.map((dept) => (
+
+ {dept}
+
+ Active
+
+
+ ))}
+
+
+ Manage Departments
+
+
+
+
+
+ {/* Roles Configuration */}
+
+
+ User Roles
+
+ Available user roles and their permissions
+
+
+
+
+ {roles.map((role) => (
+
+
+ {role === 'doctor' &&
}
+ {role === 'nurse' &&
}
+ {role === 'admin' &&
}
+
{role}
+
+
+ {role}
+
+
+ ))}
+
+
+ Configure Permissions
+
+
+
+
+
+
+ {/* Quick Actions */}
+
+
+ Quick Actions
+
+ Common administrative tasks and system operations
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
();
+
+ return (
+
+ {/* Header */}
+
+
+
+ Edit User: {user.username}
+
+
+ Update user account information and permissions
+
+
+
+
+ {/* User Form */}
+
+
();
+ const [filteredUsers, setFilteredUsers] = useState(users);
+ const [searchTerm, setSearchTerm] = useState('');
+ const [roleFilter, setRoleFilter] = useState('all');
+ const [departmentFilter, setDepartmentFilter] = useState('all');
+
+ useEffect(() => {
+ filterUsers();
+ }, [users, searchTerm, roleFilter, departmentFilter]);
+
+ const filterUsers = () => {
+ let filtered = users;
+
+ // Search filter
+ if (searchTerm) {
+ filtered = filtered.filter(user =>
+ user.username.toLowerCase().includes(searchTerm.toLowerCase()) ||
+ user.email.toLowerCase().includes(searchTerm.toLowerCase())
+ );
+ }
+
+ // Role filter
+ if (roleFilter !== 'all') {
+ filtered = filtered.filter(user => user.role === roleFilter);
+ }
+
+ // Department filter
+ if (departmentFilter !== 'all') {
+ filtered = filtered.filter(user => user.department === departmentFilter);
+ }
+
+ setFilteredUsers(filtered);
+ };
+
+ const departments = Array.from(new Set(users.map(u => u.department))).sort();
+ const roles = Array.from(new Set(users.map(u => u.role))).sort();
+
+ const getRoleBadgeVariant = (role: string) => {
+ switch(role) {
+ case 'admin': return 'destructive';
+ case 'doctor': return 'default';
+ case 'nurse': return 'secondary';
+ default: return 'outline';
+ }
+ };
+
+ const getRoleIcon = (role: string) => {
+ switch(role) {
+ case 'admin': return
+ {/* Header */}
+
+
+
+ User Management
+
+
+ Manage user accounts and permissions
+
+
+
+
+
+ {/* Filters */}
+
+
+
+
+
+
setRoleFilter(e.target.value)}
+ className="h-10 px-3 py-2 border border-input bg-background rounded-md text-sm ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
+ >
+ All Roles
+ {roles.map(role => (
+
+ {role.charAt(0).toUpperCase() + role.slice(1)}
+
+ ))}
+
+
setDepartmentFilter(e.target.value)}
+ className="h-10 px-3 py-2 border border-input bg-background rounded-md text-sm ring-offset-background focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
+ >
+ All Departments
+ {departments.map(dept => (
+
+ {dept.charAt(0).toUpperCase() + dept.slice(1)}
+
+ ))}
+
+
+ {filteredUsers.length} users
+
+
+
+
+ {/* Users Table */}
+
+
+ Users
+
+ A list of all users in the Healthcare Support Portal
+
+
+
+ {filteredUsers.length === 0 ? (
+
+
+
No users found
+
+ {users.length === 0
+ ? "Get started by adding your first user."
+ : "Try adjusting your search or filter criteria."
+ }
+
+ {users.length === 0 && (
+
+ )}
+
+
+
+ User
+ Role
+ Department
+ Status
+ Created
+ Actions
+
+
+
+ {filteredUsers.map((user) => (
+
+
+
+ {user.username}
+
+
+
+
+
+
+
+ {getRoleIcon(user.role)}
+ {user.role}
+
+
+
+
+
+
+
+
+
+ {user.is_active ? 'Active' : 'Inactive'}
+
+
+
+ {formatDateTime(user.created_at)}
+
+
+
+
+
+
+
+
+ Actions
+
+
+
+ Deactivate User
+
+
+
+
+
+ ))}
+
+
+ )}
+
+
+
+ {/* Quick Stats */}
+
+
+
+
+
+ {users.filter(u => u.is_active).length}
+
+
Active Users
+
+
+
+
+
+
+ {users.filter(u => u.role === 'admin').length}
+
+
Administrators
+
+
+
+
+
+
+ {users.filter(u => u.role === 'doctor').length}
+
+
Doctors
+
+
+
+
+
+
+ {users.filter(u => u.role === 'nurse').length}
+
+
Nurses
+
+
+
+
();
+
+ return (
+
+ {/* Header */}
+
+
+
+ Add New User
+
+
+ Create a new user account for the Healthcare Support Portal
+
+
+
+
+ {/* User Form */}
+
+
/versions. When using multiple version
+# directories, initial revisions must be specified with --version-path.
+# The path separator used here should be the separator specified by "path_separator"
+# below.
+# version_locations = %(here)s/bar:%(here)s/bat:%(here)s/alembic/versions
+
+# path_separator; This indicates what character is used to split lists of file
+# paths, including version_locations and prepend_sys_path within configparser
+# files such as alembic.ini.
+# The default rendered in new alembic.ini files is "os", which uses os.pathsep
+# to provide os-dependent path splitting.
+#
+# Note that in order to support legacy alembic.ini files, this default does NOT
+# take place if path_separator is not present in alembic.ini. If this
+# option is omitted entirely, fallback logic is as follows:
+#
+# 1. Parsing of the version_locations option falls back to using the legacy
+# "version_path_separator" key, which if absent then falls back to the legacy
+# behavior of splitting on spaces and/or commas.
+# 2. Parsing of the prepend_sys_path option falls back to the legacy
+# behavior of splitting on spaces, commas, or colons.
+#
+# Valid values for path_separator are:
+#
+# path_separator = :
+# path_separator = ;
+# path_separator = space
+# path_separator = newline
+#
+# Use os.pathsep. Default configuration used for new projects.
+path_separator = os
+
+# set to 'true' to search source files recursively
+# in each "version_locations" directory
+# new in Alembic version 1.10
+# recursive_version_locations = false
+
+# the output encoding used when revision files
+# are written from script.py.mako
+# output_encoding = utf-8
+
+# database URL. This is consumed by the user-maintained env.py script only.
+# other means of configuring database URLs may be customized within the env.py
+# file.
+# sqlalchemy.url will be set from environment variable in env.py
+# sqlalchemy.url = postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare
+
+
+[post_write_hooks]
+# post_write_hooks defines scripts or Python functions that are run
+# on newly generated revision scripts. See the documentation for further
+# detail and examples
+
+# format using "black" - use the console_scripts runner, against the "black" entrypoint
+# hooks = black
+# black.type = console_scripts
+# black.entrypoint = black
+# black.options = -l 79 REVISION_SCRIPT_FILENAME
+
+# lint with attempts to fix using "ruff" - use the module runner, against the "ruff" module
+# hooks = ruff
+# ruff.type = module
+# ruff.module = ruff
+# ruff.options = check --fix REVISION_SCRIPT_FILENAME
+
+# Alternatively, use the exec runner to execute a binary found on your PATH
+# hooks = ruff
+# ruff.type = exec
+# ruff.executable = ruff
+# ruff.options = check --fix REVISION_SCRIPT_FILENAME
+
+# Logging configuration. This is also consumed by the user-maintained
+# env.py script only.
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARNING
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARNING
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S
diff --git a/python/rag/healthcare-support-portal/packages/common/alembic/README b/python/rag/healthcare-support-portal/packages/common/alembic/README
new file mode 100644
index 00000000..98e4f9c4
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/alembic/README
@@ -0,0 +1 @@
+Generic single-database configuration.
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/packages/common/alembic/env.py b/python/rag/healthcare-support-portal/packages/common/alembic/env.py
new file mode 100644
index 00000000..3b7f72c4
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/alembic/env.py
@@ -0,0 +1,114 @@
+import os
+from logging.config import fileConfig
+
+from alembic import context
+from sqlalchemy import engine_from_config, pool, text
+
+# this is the Alembic Config object, which provides
+# access to the values within the .ini file in use.
+config = context.config
+
+# Interpret the config file for Python logging.
+# This line sets up loggers basically.
+if config.config_file_name is not None:
+ fileConfig(config.config_file_name)
+
+# Import models to ensure they're registered with SQLAlchemy
+# This is crucial for autogenerate to work
+from common.models import Base
+
+# Set the target metadata for autogenerate support
+target_metadata = Base.metadata
+
+# Get database URL from environment variable or use default
+DATABASE_URL = os.getenv("DATABASE_URL", "postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare")
+
+# Override the ini file's sqlalchemy.url with environment variable
+config.set_main_option("sqlalchemy.url", DATABASE_URL)
+
+# Define naming conventions for constraints
+# This ensures consistent naming across migrations
+naming_convention = {
+ "ix": "ix_%(column_0_label)s",
+ "uq": "uq_%(table_name)s_%(column_0_name)s",
+ "ck": "ck_%(table_name)s_%(constraint_name)s",
+ "fk": "fk_%(table_name)s_%(column_0_name)s_%(referred_table_name)s",
+ "pk": "pk_%(table_name)s",
+}
+
+target_metadata.naming_convention = naming_convention
+
+
+def include_object(object, name, type_, reflected, compare_to):
+ """Filter out system objects from migrations"""
+ # Skip any PostgreSQL internal schemas
+ if type_ == "schema":
+ return name not in ["information_schema", "pg_catalog", "pg_toast"]
+ return True
+
+
+def run_migrations_offline() -> None:
+ """Run migrations in 'offline' mode.
+
+ This configures the context with just a URL
+ and not an Engine, though an Engine is acceptable
+ here as well. By skipping the Engine creation
+ we don't even need a DBAPI to be available.
+
+ Calls to context.execute() here emit the given string to the
+ script output.
+
+ """
+ url = config.get_main_option("sqlalchemy.url")
+ context.configure(
+ url=url,
+ target_metadata=target_metadata,
+ literal_binds=True,
+ dialect_opts={"paramstyle": "named"},
+ include_object=include_object,
+ compare_type=True,
+ compare_server_default=True,
+ )
+
+ with context.begin_transaction():
+ context.run_migrations()
+
+
+def run_migrations_online() -> None:
+ """Run migrations in 'online' mode.
+
+ In this scenario we need to create an Engine
+ and associate a connection with the context.
+
+ """
+ configuration = config.get_section(config.config_ini_section)
+ configuration["sqlalchemy.url"] = DATABASE_URL
+
+ connectable = engine_from_config(
+ configuration,
+ prefix="sqlalchemy.",
+ poolclass=pool.NullPool,
+ )
+
+ with connectable.connect() as connection:
+ # Enable pgvector extension if not exists
+ # This needs to be done before migrations run
+ connection.execute(text("CREATE EXTENSION IF NOT EXISTS vector"))
+ connection.commit()
+
+ context.configure(
+ connection=connection,
+ target_metadata=target_metadata,
+ include_object=include_object,
+ compare_type=True,
+ compare_server_default=True,
+ )
+
+ with context.begin_transaction():
+ context.run_migrations()
+
+
+if context.is_offline_mode():
+ run_migrations_offline()
+else:
+ run_migrations_online()
diff --git a/python/rag/healthcare-support-portal/packages/common/alembic/script.py.mako b/python/rag/healthcare-support-portal/packages/common/alembic/script.py.mako
new file mode 100644
index 00000000..11016301
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/alembic/script.py.mako
@@ -0,0 +1,28 @@
+"""${message}
+
+Revision ID: ${up_revision}
+Revises: ${down_revision | comma,n}
+Create Date: ${create_date}
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+${imports if imports else ""}
+
+# revision identifiers, used by Alembic.
+revision: str = ${repr(up_revision)}
+down_revision: Union[str, Sequence[str], None] = ${repr(down_revision)}
+branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)}
+depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)}
+
+
+def upgrade() -> None:
+ """Upgrade schema."""
+ ${upgrades if upgrades else "pass"}
+
+
+def downgrade() -> None:
+ """Downgrade schema."""
+ ${downgrades if downgrades else "pass"}
diff --git a/python/rag/healthcare-support-portal/packages/common/alembic/versions/20250808_1321-fc1dc9787b9f_initial_schema_with_users_patients_.py b/python/rag/healthcare-support-portal/packages/common/alembic/versions/20250808_1321-fc1dc9787b9f_initial_schema_with_users_patients_.py
new file mode 100644
index 00000000..66b93db3
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/alembic/versions/20250808_1321-fc1dc9787b9f_initial_schema_with_users_patients_.py
@@ -0,0 +1,141 @@
+"""Initial schema with users, patients, documents, and embeddings
+
+Revision ID: fc1dc9787b9f
+Revises:
+Create Date: 2025-08-08 13:21:35.737581
+
+"""
+
+from collections.abc import Sequence
+
+import pgvector.sqlalchemy
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "fc1dc9787b9f"
+down_revision: str | Sequence[str] | None = None
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+ """Upgrade schema."""
+ # ### commands auto generated by Alembic - please adjust! ###
+ op.create_table(
+ "users",
+ sa.Column("id", sa.Integer(), nullable=False),
+ sa.Column("username", sa.String(length=50), nullable=False),
+ sa.Column("email", sa.String(length=100), nullable=False),
+ sa.Column("hashed_password", sa.String(length=255), nullable=False),
+ sa.Column("role", sa.String(length=50), nullable=False),
+ sa.Column("department", sa.String(length=100), nullable=True),
+ sa.Column("is_active", sa.Boolean(), nullable=True),
+ sa.Column(
+ "created_at",
+ sa.DateTime(timezone=True),
+ server_default=sa.text("now()"),
+ nullable=True,
+ ),
+ sa.PrimaryKeyConstraint("id"),
+ )
+ op.create_index(op.f("ix_users_email"), "users", ["email"], unique=True)
+ op.create_index(op.f("ix_users_id"), "users", ["id"], unique=False)
+ op.create_index(op.f("ix_users_username"), "users", ["username"], unique=True)
+ op.create_table(
+ "patients",
+ sa.Column("id", sa.Integer(), nullable=False),
+ sa.Column("name", sa.String(length=100), nullable=False),
+ sa.Column("date_of_birth", sa.DateTime(), nullable=True),
+ sa.Column("medical_record_number", sa.String(length=50), nullable=True),
+ sa.Column("department", sa.String(length=100), nullable=True),
+ sa.Column("assigned_doctor_id", sa.Integer(), nullable=True),
+ sa.Column("is_active", sa.Boolean(), nullable=True),
+ sa.Column(
+ "created_at",
+ sa.DateTime(timezone=True),
+ server_default=sa.text("now()"),
+ nullable=True,
+ ),
+ sa.ForeignKeyConstraint(
+ ["assigned_doctor_id"],
+ ["users.id"],
+ ),
+ sa.PrimaryKeyConstraint("id"),
+ )
+ op.create_index(op.f("ix_patients_id"), "patients", ["id"], unique=False)
+ op.create_index(
+ op.f("ix_patients_medical_record_number"),
+ "patients",
+ ["medical_record_number"],
+ unique=True,
+ )
+ op.create_table(
+ "documents",
+ sa.Column("id", sa.Integer(), nullable=False),
+ sa.Column("title", sa.String(length=200), nullable=False),
+ sa.Column("content", sa.Text(), nullable=False),
+ sa.Column("document_type", sa.String(length=50), nullable=True),
+ sa.Column("patient_id", sa.Integer(), nullable=True),
+ sa.Column("department", sa.String(length=100), nullable=True),
+ sa.Column("created_by_id", sa.Integer(), nullable=True),
+ sa.Column("is_sensitive", sa.Boolean(), nullable=True),
+ sa.Column(
+ "created_at",
+ sa.DateTime(timezone=True),
+ server_default=sa.text("now()"),
+ nullable=True,
+ ),
+ sa.ForeignKeyConstraint(
+ ["created_by_id"],
+ ["users.id"],
+ ),
+ sa.ForeignKeyConstraint(
+ ["patient_id"],
+ ["patients.id"],
+ ),
+ sa.PrimaryKeyConstraint("id"),
+ )
+ op.create_index(op.f("ix_documents_id"), "documents", ["id"], unique=False)
+ op.create_table(
+ "embeddings",
+ sa.Column("id", sa.Integer(), nullable=False),
+ sa.Column("document_id", sa.Integer(), nullable=False),
+ sa.Column("content_chunk", sa.Text(), nullable=False),
+ sa.Column(
+ "embedding_vector",
+ pgvector.sqlalchemy.vector.VECTOR(dim=1536),
+ nullable=True,
+ ),
+ sa.Column("chunk_index", sa.Integer(), nullable=True),
+ sa.Column(
+ "created_at",
+ sa.DateTime(timezone=True),
+ server_default=sa.text("now()"),
+ nullable=True,
+ ),
+ sa.ForeignKeyConstraint(
+ ["document_id"],
+ ["documents.id"],
+ ),
+ sa.PrimaryKeyConstraint("id"),
+ )
+ op.create_index(op.f("ix_embeddings_id"), "embeddings", ["id"], unique=False)
+ # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+ """Downgrade schema."""
+ # ### commands auto generated by Alembic - please adjust! ###
+ op.drop_index(op.f("ix_embeddings_id"), table_name="embeddings")
+ op.drop_table("embeddings")
+ op.drop_index(op.f("ix_documents_id"), table_name="documents")
+ op.drop_table("documents")
+ op.drop_index(op.f("ix_patients_medical_record_number"), table_name="patients")
+ op.drop_index(op.f("ix_patients_id"), table_name="patients")
+ op.drop_table("patients")
+ op.drop_index(op.f("ix_users_username"), table_name="users")
+ op.drop_index(op.f("ix_users_id"), table_name="users")
+ op.drop_index(op.f("ix_users_email"), table_name="users")
+ op.drop_table("users")
+ # ### end Alembic commands ###
diff --git a/python/rag/healthcare-support-portal/packages/common/pyproject.toml b/python/rag/healthcare-support-portal/packages/common/pyproject.toml
new file mode 100644
index 00000000..aaa4c476
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/pyproject.toml
@@ -0,0 +1,30 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "common"
+version = "0.1.0"
+description = "Shared models, utilities, and policies for Healthcare Support Portal"
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = [
+ "fastapi>=0.104.0",
+ "sqlalchemy>=2.0.0",
+ "psycopg2-binary>=2.9.0",
+ "oso-cloud",
+ "sqlalchemy-oso-cloud",
+ "pydantic>=2.0.0",
+ "pydantic-settings>=2.0.0",
+ "passlib[bcrypt]>=1.7.4",
+ "bcrypt>=4.0.0,<5.0.0",
+ "python-jose[cryptography]>=3.3.0",
+ "pgvector>=0.2.0",
+ "alembic>=1.16.0",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/common"]
+
+[tool.hatch.build]
+include = ["src/common"]
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/__init__.py b/python/rag/healthcare-support-portal/packages/common/src/common/__init__.py
new file mode 100644
index 00000000..066f74f5
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/__init__.py
@@ -0,0 +1,22 @@
+"""
+Common package for Healthcare Support Portal
+Shared models, database utilities, and policies
+"""
+
+from .auth import create_access_token, get_current_user, verify_password
+from .db import SessionLocal, engine, get_db
+from .models import Base, Document, Embedding, Patient, User
+
+__all__ = [
+ "Base",
+ "User",
+ "Patient",
+ "Document",
+ "Embedding",
+ "get_db",
+ "engine",
+ "SessionLocal",
+ "get_current_user",
+ "create_access_token",
+ "verify_password",
+]
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/auth.py b/python/rag/healthcare-support-portal/packages/common/src/common/auth.py
new file mode 100644
index 00000000..efc23337
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/auth.py
@@ -0,0 +1,86 @@
+import os
+from datetime import datetime, timedelta
+
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from jose import JWTError, jwt
+from passlib.context import CryptContext
+from sqlalchemy.orm import Session
+
+from .db import get_db
+from .models import User
+
+# Security configuration
+SECRET_KEY = os.getenv("SECRET_KEY", "your-secret-key-here")
+ALGORITHM = "HS256"
+ACCESS_TOKEN_EXPIRE_MINUTES = 30
+
+# Password hashing
+pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+# HTTP Bearer token scheme
+security = HTTPBearer()
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+ """Verify a plain password against a hashed password."""
+ return pwd_context.verify(plain_password, hashed_password)
+
+
+def get_password_hash(password: str) -> str:
+ """Hash a password."""
+ return pwd_context.hash(password)
+
+
+def create_access_token(data: dict, expires_delta: timedelta | None = None):
+ """Create a JWT access token."""
+ to_encode = data.copy()
+ if expires_delta:
+ expire = datetime.utcnow() + expires_delta
+ else:
+ expire = datetime.utcnow() + timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
+
+ to_encode.update({"exp": expire})
+ encoded_jwt = jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
+ return encoded_jwt
+
+
+def get_current_user(
+ credentials: HTTPAuthorizationCredentials = Depends(security),
+ db: Session = Depends(get_db),
+) -> User:
+ """Get the current authenticated user from JWT token."""
+ credentials_exception = HTTPException(
+ status_code=status.HTTP_401_UNAUTHORIZED,
+ detail="Could not validate credentials",
+ headers={"WWW-Authenticate": "Bearer"},
+ )
+
+ try:
+ payload = jwt.decode(credentials.credentials, SECRET_KEY, algorithms=[ALGORITHM])
+ username: str = payload.get("sub")
+ if username is None:
+ raise credentials_exception
+ except JWTError:
+ raise credentials_exception
+
+ user = db.query(User).filter(User.username == username).first()
+ if user is None:
+ raise credentials_exception
+
+ return user
+
+
+# Development mode authentication bypass
+def get_current_user_dev(
+ db: Session = Depends(get_db),
+) -> User:
+ """Development mode - automatically authenticate as dr_smith for testing."""
+ # This should only be used in development
+ user = db.query(User).filter(User.username == "dr_smith").first()
+ if not user:
+ raise HTTPException(
+ status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+ detail="Development user 'dr_smith' not found in database",
+ )
+ return user
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/db.py b/python/rag/healthcare-support-portal/packages/common/src/common/db.py
new file mode 100644
index 00000000..431dbbdb
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/db.py
@@ -0,0 +1,22 @@
+import os
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker
+
+# Database configuration
+DATABASE_URL = os.getenv("DATABASE_URL", "postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare")
+
+# Create engine
+engine = create_engine(DATABASE_URL, echo=True)
+
+# Create SessionLocal class
+SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+
+
+# Dependency to get database session
+def get_db():
+ db = SessionLocal()
+ try:
+ yield db
+ finally:
+ db.close()
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/migration_check.py b/python/rag/healthcare-support-portal/packages/common/src/common/migration_check.py
new file mode 100644
index 00000000..39a7e5bf
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/migration_check.py
@@ -0,0 +1,99 @@
+"""
+Migration verification utilities for services.
+Ensures database migrations are up-to-date before service startup.
+"""
+
+import os
+import sys
+from pathlib import Path
+
+from alembic.config import Config
+from alembic.runtime.migration import MigrationContext
+from alembic.script import ScriptDirectory
+from sqlalchemy import create_engine
+
+
+def get_alembic_config() -> Config:
+ """Get Alembic configuration from the common package."""
+ # Find the alembic.ini file in the common package
+ common_dir = Path(__file__).parent.parent.parent # Go up to packages/common
+ alembic_ini = common_dir / "alembic.ini"
+
+ if not alembic_ini.exists():
+ raise FileNotFoundError(f"alembic.ini not found at {alembic_ini}. " "Please ensure Alembic is properly initialized.")
+
+ config = Config(str(alembic_ini))
+
+ # Set the script location to absolute path
+ script_location = common_dir / "alembic"
+ config.set_main_option("script_location", str(script_location))
+
+ return config
+
+
+def verify_migrations_current(database_url: str = None) -> bool:
+ """
+ Verify that database migrations are up to date.
+
+ Args:
+ database_url: Database connection URL. If None, uses DATABASE_URL env var.
+
+ Returns:
+ True if migrations are current, False otherwise.
+ """
+ if database_url is None:
+ database_url = os.getenv(
+ "DATABASE_URL",
+ "postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare",
+ )
+
+ try:
+ # Create engine and get current database revision
+ engine = create_engine(database_url)
+
+ with engine.connect() as connection:
+ context = MigrationContext.configure(connection)
+ current_rev = context.get_current_revision()
+
+ # Get the head revision from Alembic scripts
+ config = get_alembic_config()
+ script = ScriptDirectory.from_config(config)
+ head_rev = script.get_current_head()
+
+ if current_rev != head_rev:
+ print("❌ Database migrations are out of date!")
+ print(f" Current revision: {current_rev or 'None (no migrations applied)'}")
+ print(f" Head revision: {head_rev}")
+ print("")
+ print(" To fix this, run one of the following:")
+ print(" 1. Docker Compose: docker-compose run migrate")
+ print(" 2. Manual: cd packages/common && uv run alembic upgrade head")
+ print("")
+ return False
+
+ print(f"✅ Database migrations are up to date (revision: {current_rev})")
+ return True
+
+ except Exception as e:
+ print(f"❌ Error checking migration status: {e}")
+ print(" This might indicate:")
+ print(" 1. Database is not accessible")
+ print(" 2. Migrations have not been initialized")
+ print(" 3. Database connection issues")
+ return False
+
+
+def require_migrations_current(database_url: str = None) -> None:
+ """
+ Require migrations to be current, exit if not.
+
+ This should be called at service startup to ensure
+ the database schema is up to date.
+
+ Args:
+ database_url: Database connection URL. If None, uses DATABASE_URL env var.
+ """
+ if not verify_migrations_current(database_url):
+ print("🛑 Service startup aborted due to outdated migrations.")
+ print(" Please run migrations before starting the service.")
+ sys.exit(1)
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/models.py b/python/rag/healthcare-support-portal/packages/common/src/common/models.py
new file mode 100644
index 00000000..2a4aa403
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/models.py
@@ -0,0 +1,85 @@
+from pgvector.sqlalchemy import Vector
+from sqlalchemy import Boolean, Column, DateTime, ForeignKey, Integer, String, Text
+from sqlalchemy.orm import declarative_base, relationship
+from sqlalchemy.sql import func
+from sqlalchemy_oso_cloud.oso import Resource
+
+Base = declarative_base()
+
+
+class User(Base, Resource):
+ __tablename__ = "users"
+
+ # OSO Cloud type identifier
+ type = "User"
+
+ id = Column(Integer, primary_key=True, index=True)
+ username = Column(String(50), unique=True, index=True, nullable=False)
+ email = Column(String(100), unique=True, index=True, nullable=False)
+ hashed_password = Column(String(255), nullable=False)
+ role = Column(String(50), nullable=False) # doctor, nurse, admin
+ department = Column(String(100))
+ is_active = Column(Boolean, default=True)
+ created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+ # Relationships
+ assigned_patients = relationship("Patient", back_populates="assigned_doctor")
+
+
+class Patient(Base, Resource):
+ __tablename__ = "patients"
+
+ # OSO Cloud type identifier
+ type = "Patient"
+
+ id = Column(Integer, primary_key=True, index=True)
+ name = Column(String(100), nullable=False)
+ date_of_birth = Column(DateTime)
+ medical_record_number = Column(String(50), unique=True, index=True)
+ department = Column(String(100))
+ assigned_doctor_id = Column(Integer, ForeignKey("users.id"))
+ is_active = Column(Boolean, default=True)
+ created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+ # Relationships
+ assigned_doctor = relationship("User", back_populates="assigned_patients")
+ documents = relationship("Document", back_populates="patient")
+
+
+class Document(Base, Resource):
+ __tablename__ = "documents"
+
+ # OSO Cloud type identifier
+ type = "Document"
+
+ id = Column(Integer, primary_key=True, index=True)
+ title = Column(String(200), nullable=False)
+ content = Column(Text, nullable=False)
+ document_type = Column(String(50)) # medical_record, protocol, policy, etc.
+ patient_id = Column(Integer, ForeignKey("patients.id"), nullable=True)
+ department = Column(String(100))
+ created_by_id = Column(Integer, ForeignKey("users.id"))
+ is_sensitive = Column(Boolean, default=False)
+ created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+ # Relationships
+ patient = relationship("Patient", back_populates="documents")
+ created_by = relationship("User")
+ embeddings = relationship("Embedding", back_populates="document")
+
+
+class Embedding(Base, Resource):
+ __tablename__ = "embeddings"
+
+ # OSO Cloud type identifier
+ type = "Embedding"
+
+ id = Column(Integer, primary_key=True, index=True)
+ document_id = Column(Integer, ForeignKey("documents.id"), nullable=False)
+ content_chunk = Column(Text, nullable=False)
+ embedding_vector = Column(Vector(1536)) # OpenAI embedding dimension
+ chunk_index = Column(Integer, default=0)
+ created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+ # Relationships
+ document = relationship("Document", back_populates="embeddings")
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/oso_sync.py b/python/rag/healthcare-support-portal/packages/common/src/common/oso_sync.py
new file mode 100644
index 00000000..59a4519f
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/oso_sync.py
@@ -0,0 +1,440 @@
+"""
+OSO Cloud Fact Synchronization Utilities
+Manages authorization facts in OSO Cloud to keep them in sync with database state.
+"""
+
+import logging
+
+try:
+ from oso_cloud import Value
+except ImportError:
+ print("Warning: oso_cloud not installed. OSO fact synchronization will be disabled.")
+ Value = None
+
+from .db import SessionLocal
+from .models import Document, Embedding, Patient, User
+
+logger = logging.getLogger(__name__)
+
+
+def get_oso_client():
+ """Get the OSO client instance from sqlalchemy-oso-cloud."""
+ if Value is None:
+ raise ImportError("oso_cloud is not available")
+
+ try:
+ from sqlalchemy_oso_cloud import get_oso
+
+ return get_oso()
+ except ImportError as e:
+ logger.error(f"Failed to import OSO client: {e}")
+ raise
+ except Exception as e:
+ logger.error(f"Failed to get OSO client: {e}")
+ raise
+
+
+def sync_admin_global_access(user: User) -> bool:
+ """
+ Sync global admin access facts for an admin user.
+ Creates has_role facts for admin access to all resources.
+ """
+ if user.role != "admin":
+ logger.warning(f"User {user.id} is not an admin, skipping global access sync")
+ return False
+
+ try:
+ oso = get_oso_client()
+ db = SessionLocal()
+
+ try:
+ with oso.batch() as tx:
+ user_value = Value("User", str(user.id))
+
+ # Admin access to all patients
+ patients = db.query(Patient).filter(Patient.is_active).all()
+ for patient in patients:
+ tx.insert(
+ (
+ "has_role",
+ user_value,
+ "admin",
+ Value("Patient", str(patient.id)),
+ )
+ )
+
+ # Admin access to all documents
+ documents = db.query(Document).all()
+ for doc in documents:
+ tx.insert(
+ (
+ "has_role",
+ user_value,
+ "admin",
+ Value("Document", str(doc.id)),
+ )
+ )
+
+ # Admin access to all embeddings
+ embeddings = db.query(Embedding).all()
+ for embed in embeddings:
+ tx.insert(
+ (
+ "has_role",
+ user_value,
+ "admin",
+ Value("Embedding", str(embed.id)),
+ )
+ )
+
+ # Admin access to all users
+ users = db.query(User).filter(User.is_active).all()
+ for other_user in users:
+ tx.insert(
+ (
+ "has_role",
+ user_value,
+ "admin",
+ Value("User", str(other_user.id)),
+ )
+ )
+
+ logger.info(f"Synced global admin access for user {user.id}")
+ return True
+
+ finally:
+ db.close()
+
+ except Exception as e:
+ logger.error(f"Failed to sync global admin access for user {user.id}: {e}")
+ return False
+
+
+def remove_admin_global_access(user: User) -> bool:
+ """Remove all admin access facts for a user."""
+ try:
+ oso = get_oso_client()
+
+ with oso.batch() as tx:
+ user_value = Value("User", str(user.id))
+ # Remove all admin roles for this user
+ tx.delete(("has_role", user_value, "admin", None))
+
+ logger.info(f"Removed all admin access for user {user.id}")
+ return True
+
+ except Exception as e:
+ logger.error(f"Failed to remove admin access for user {user.id}: {e}")
+ return False
+
+
+def sync_patient_access(patient: Patient) -> bool:
+ """
+ Sync patient access facts based on doctor assignment and department.
+ Creates assigned_doctor and department_nurse facts.
+ """
+ try:
+ oso = get_oso_client()
+ db = SessionLocal()
+
+ try:
+ with oso.batch() as tx:
+ patient_value = Value("Patient", str(patient.id))
+
+ # Doctor assignment fact
+ if patient.assigned_doctor_id:
+ doctor_value = Value("User", str(patient.assigned_doctor_id))
+ tx.insert(("has_role", doctor_value, "assigned_doctor", patient_value))
+
+ # Department nurse facts - all nurses in the patient's department
+ if patient.department:
+ nurses = (
+ db.query(User)
+ .filter(
+ User.role == "nurse",
+ User.department == patient.department,
+ User.is_active,
+ )
+ .all()
+ )
+
+ for nurse in nurses:
+ nurse_value = Value("User", str(nurse.id))
+ tx.insert(("has_role", nurse_value, "department_nurse", patient_value))
+
+ # Admin access facts for all admins
+ admins = db.query(User).filter(User.role == "admin", User.is_active).all()
+
+ for admin in admins:
+ admin_value = Value("User", str(admin.id))
+ tx.insert(("has_role", admin_value, "admin", patient_value))
+
+ logger.info(f"Synced patient access for patient {patient.id}")
+ return True
+
+ finally:
+ db.close()
+
+ except Exception as e:
+ logger.error(f"Failed to sync patient access for patient {patient.id}: {e}")
+ return False
+
+
+def remove_patient_access(patient_id: int) -> bool:
+ """Remove all access facts for a patient."""
+ try:
+ oso = get_oso_client()
+
+ with oso.batch() as tx:
+ patient_value = Value("Patient", str(patient_id))
+ # Remove all roles for this patient
+ tx.delete(("has_role", None, None, patient_value))
+
+ logger.info(f"Removed all access facts for patient {patient_id}")
+ return True
+
+ except Exception as e:
+ logger.error(f"Failed to remove patient access facts for patient {patient_id}: {e}")
+ return False
+
+
+def sync_document_access(document: Document) -> bool:
+ """
+ Sync document access facts based on ownership, patient relationships, and department.
+ """
+ try:
+ oso = get_oso_client()
+ db = SessionLocal()
+
+ try:
+ with oso.batch() as tx:
+ doc_value = Value("Document", str(document.id))
+
+ # Owner fact - document creator has full control
+ if document.created_by_id:
+ owner_value = Value("User", str(document.created_by_id))
+ tx.insert(("has_role", owner_value, "owner", doc_value))
+
+ # Patient doctor fact - if document is linked to a patient
+ if document.patient_id:
+ patient = db.query(Patient).filter(Patient.id == document.patient_id).first()
+ if patient and patient.assigned_doctor_id:
+ doctor_value = Value("User", str(patient.assigned_doctor_id))
+ tx.insert(("has_role", doctor_value, "patient_doctor", doc_value))
+
+ # Department staff fact - for non-sensitive documents
+ if document.department and not document.is_sensitive:
+ dept_users = db.query(User).filter(User.department == document.department, User.is_active).all()
+
+ for user in dept_users:
+ user_value = Value("User", str(user.id))
+ tx.insert(("has_role", user_value, "department_staff", doc_value))
+
+ # Admin access facts for all admins
+ admins = db.query(User).filter(User.role == "admin", User.is_active).all()
+
+ for admin in admins:
+ admin_value = Value("User", str(admin.id))
+ tx.insert(("has_role", admin_value, "admin", doc_value))
+
+ logger.info(f"Synced document access for document {document.id}")
+ return True
+
+ finally:
+ db.close()
+
+ except Exception as e:
+ logger.error(f"Failed to sync document access for document {document.id}: {e}")
+ return False
+
+
+def remove_document_access(document_id: int) -> bool:
+ """Remove all access facts for a document."""
+ try:
+ oso = get_oso_client()
+
+ with oso.batch() as tx:
+ doc_value = Value("Document", str(document_id))
+ # Remove all roles for this document
+ tx.delete(("has_role", None, None, doc_value))
+
+ logger.info(f"Removed all access facts for document {document_id}")
+ return True
+
+ except Exception as e:
+ logger.error(f"Failed to remove document access facts for document {document_id}: {e}")
+ return False
+
+
+def sync_embedding_access(embedding: Embedding) -> bool:
+ """
+ Sync embedding access facts - only admins can access embeddings.
+ """
+ try:
+ oso = get_oso_client()
+ db = SessionLocal()
+
+ try:
+ with oso.batch() as tx:
+ embed_value = Value("Embedding", str(embedding.id))
+
+ # Admin access facts for all admins
+ admins = db.query(User).filter(User.role == "admin", User.is_active).all()
+
+ for admin in admins:
+ admin_value = Value("User", str(admin.id))
+ tx.insert(("has_role", admin_value, "admin", embed_value))
+
+ logger.info(f"Synced embedding access for embedding {embedding.id}")
+ return True
+
+ finally:
+ db.close()
+
+ except Exception as e:
+ logger.error(f"Failed to sync embedding access for embedding {embedding.id}: {e}")
+ return False
+
+
+def remove_embedding_access(embedding_id: int) -> bool:
+ """Remove all access facts for an embedding."""
+ try:
+ oso = get_oso_client()
+
+ with oso.batch() as tx:
+ embed_value = Value("Embedding", str(embedding_id))
+ # Remove all roles for this embedding
+ tx.delete(("has_role", None, None, embed_value))
+
+ logger.info(f"Removed all access facts for embedding {embedding_id}")
+ return True
+
+ except Exception as e:
+ logger.error(f"Failed to remove embedding access facts for embedding {embedding_id}: {e}")
+ return False
+
+
+def sync_user_role_change(user: User, old_role: str | None = None) -> bool:
+ """
+ Handle user role changes - remove old role facts and add new ones.
+ """
+ try:
+ oso = get_oso_client()
+
+ # If user was previously an admin, remove global access
+ if old_role == "admin" and user.role != "admin":
+ remove_admin_global_access(user)
+
+ # If user became an admin, add global access
+ if user.role == "admin" and old_role != "admin":
+ sync_admin_global_access(user)
+
+ # Resync all patient access (for department nurse changes)
+ db = SessionLocal()
+ try:
+ patients = db.query(Patient).filter(Patient.is_active).all()
+ for patient in patients:
+ # Remove old nurse access for this user
+ user_value = Value("User", str(user.id))
+ patient_value = Value("Patient", str(patient.id))
+
+ oso.delete(("has_role", user_value, "department_nurse", patient_value))
+
+ # Add new nurse access if applicable
+ if user.role == "nurse" and patient.department == user.department:
+ oso.insert(("has_role", user_value, "department_nurse", patient_value))
+ finally:
+ db.close()
+
+ logger.info(f"Synced role change for user {user.id}: {old_role} -> {user.role}")
+ return True
+
+ except Exception as e:
+ logger.error(f"Failed to sync role change for user {user.id}: {e}")
+ return False
+
+
+def sync_department_change(user: User, old_department: str | None = None) -> bool:
+ """
+ Handle user department changes - update department-based access.
+ """
+ try:
+ oso = get_oso_client()
+ db = SessionLocal()
+
+ try:
+ user_value = Value("User", str(user.id))
+
+ # Remove old department nurse access
+ if old_department and user.role == "nurse":
+ old_patients = db.query(Patient).filter(Patient.department == old_department, Patient.is_active).all()
+
+ with oso.batch() as tx:
+ for patient in old_patients:
+ patient_value = Value("Patient", str(patient.id))
+ tx.delete(("has_role", user_value, "department_nurse", patient_value))
+
+ # Add new department nurse access
+ if user.department and user.role == "nurse":
+ new_patients = db.query(Patient).filter(Patient.department == user.department, Patient.is_active).all()
+
+ with oso.batch() as tx:
+ for patient in new_patients:
+ patient_value = Value("Patient", str(patient.id))
+ tx.insert(("has_role", user_value, "department_nurse", patient_value))
+
+ finally:
+ db.close()
+
+ logger.info(f"Synced department change for user {user.id}: {old_department} -> {user.department}")
+ return True
+
+ except Exception as e:
+ logger.error(f"Failed to sync department change for user {user.id}: {e}")
+ return False
+
+
+def full_resync() -> bool:
+ """
+ Perform a complete resynchronization of all facts.
+ Useful for initial setup or recovery from sync issues.
+ """
+ try:
+ db = SessionLocal()
+
+ try:
+ logger.info("Starting full fact resynchronization...")
+
+ # Clear all existing facts (be very careful with this!)
+ # oso.delete(("has_role", None, None, None)) # Uncomment if needed
+
+ # Sync all users
+ users = db.query(User).filter(User.is_active).all()
+ for user in users:
+ if user.role == "admin":
+ sync_admin_global_access(user)
+
+ # Sync all patients
+ patients = db.query(Patient).filter(Patient.is_active).all()
+ for patient in patients:
+ sync_patient_access(patient)
+
+ # Sync all documents
+ documents = db.query(Document).all()
+ for document in documents:
+ sync_document_access(document)
+
+ # Sync all embeddings
+ embeddings = db.query(Embedding).all()
+ for embedding in embeddings:
+ sync_embedding_access(embedding)
+
+ logger.info("Full fact resynchronization completed successfully")
+ return True
+
+ finally:
+ db.close()
+
+ except Exception as e:
+ logger.error(f"Failed during full resynchronization: {e}")
+ return False
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/schemas.py b/python/rag/healthcare-support-portal/packages/common/src/common/schemas.py
new file mode 100644
index 00000000..36cc2318
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/schemas.py
@@ -0,0 +1,77 @@
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict
+
+
+# User schemas
+class UserBase(BaseModel):
+ username: str
+ email: str
+ role: str
+ department: str | None = None
+
+
+class UserCreate(UserBase):
+ password: str
+
+
+class UserResponse(UserBase):
+ model_config = ConfigDict(from_attributes=True)
+
+ id: int
+ is_active: bool
+ created_at: datetime
+
+
+# Patient schemas
+class PatientBase(BaseModel):
+ name: str
+ medical_record_number: str
+ department: str | None = None
+
+
+class PatientCreate(PatientBase):
+ date_of_birth: str | None = None # ISO date string format YYYY-MM-DD
+ assigned_doctor_id: int | None = None
+
+
+class PatientResponse(PatientBase):
+ model_config = ConfigDict(from_attributes=True)
+
+ id: int
+ date_of_birth: datetime | None = None
+ assigned_doctor_id: int | None
+ is_active: bool
+ created_at: datetime
+
+
+# Document schemas
+class DocumentBase(BaseModel):
+ title: str
+ content: str
+ document_type: str
+ department: str | None = None
+ is_sensitive: bool = False
+
+
+class DocumentCreate(DocumentBase):
+ patient_id: int | None = None
+
+
+class DocumentResponse(DocumentBase):
+ model_config = ConfigDict(from_attributes=True)
+
+ id: int
+ patient_id: int | None
+ created_by_id: int
+ created_at: datetime
+
+
+# Token schemas
+class Token(BaseModel):
+ access_token: str
+ token_type: str
+
+
+class TokenData(BaseModel):
+ username: str | None = None
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/seed_data.py b/python/rag/healthcare-support-portal/packages/common/src/common/seed_data.py
new file mode 100644
index 00000000..109c4bf8
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/seed_data.py
@@ -0,0 +1,560 @@
+#!/usr/bin/env python3
+"""
+Database seeding script for Healthcare Support Portal
+Creates demo users, patients, and documents for development and demonstration.
+
+This script is idempotent - safe to run multiple times without creating duplicates.
+"""
+
+import sys
+import time
+
+import requests
+from sqlalchemy.orm import Session
+
+from .auth import get_password_hash
+from .db import SessionLocal
+from .models import Document, Patient, User
+from .oso_sync import (
+ sync_admin_global_access,
+ sync_patient_access,
+)
+
+# Service URLs - update these based on your environment
+AUTH_SERVICE_URL = "http://localhost:8001"
+PATIENT_SERVICE_URL = "http://localhost:8002"
+RAG_SERVICE_URL = "http://localhost:8003"
+
+
+def wait_for_services():
+ """Wait for services to be available before seeding"""
+ services = [
+ (AUTH_SERVICE_URL, "Auth Service"),
+ (PATIENT_SERVICE_URL, "Patient Service"),
+ (RAG_SERVICE_URL, "RAG Service"),
+ ]
+
+ for url, name in services:
+ for attempt in range(30): # Wait up to 30 seconds
+ try:
+ response = requests.get(f"{url}/health", timeout=2)
+ if response.status_code == 200:
+ print(f"✅ {name} is ready")
+ break
+ except requests.RequestException:
+ if attempt < 29:
+ print(f"⏳ Waiting for {name}... (attempt {attempt + 1})")
+ time.sleep(1)
+ else:
+ print(f"❌ {name} is not available after 30 seconds")
+ return False
+ return True
+
+
+def get_admin_token(db: Session) -> str:
+ """Get admin token for API calls"""
+ # First, create admin user directly in database (bootstrap)
+ admin_user = db.query(User).filter(User.username == "admin_wilson").first()
+ if not admin_user:
+ # Create admin user directly for bootstrapping
+ hashed_password = get_password_hash("secure_password")
+ admin_user = User(
+ username="admin_wilson",
+ email="jennifer.wilson@hospital.com",
+ hashed_password=hashed_password,
+ role="admin",
+ department="administration",
+ is_active=True,
+ )
+ db.add(admin_user)
+ db.commit()
+ db.refresh(admin_user)
+
+ # Sync OSO facts for admin user
+ try:
+ sync_admin_global_access(admin_user)
+ print(f"🔐 Created bootstrap admin user: {admin_user.username}")
+ except Exception as e:
+ print(f"⚠️ Failed to sync OSO facts for bootstrap admin: {e}")
+
+ # Get auth token
+ try:
+ response = requests.post(
+ f"{AUTH_SERVICE_URL}/api/v1/auth/login",
+ data={"username": "admin_wilson", "password": "secure_password"},
+ )
+ response.raise_for_status()
+ token_data = response.json()
+ return token_data["access_token"]
+ except Exception as e:
+ print(f"❌ Failed to get admin token: {e}")
+ return None
+
+
+def seed_users(db: Session, admin_token: str) -> dict[str, User]:
+ """Create demo users using API calls."""
+ created_users = {}
+
+ # Admin user is already created during bootstrap, just get it
+ admin_user = db.query(User).filter(User.username == "admin_wilson").first()
+ if admin_user:
+ created_users["admin_wilson"] = admin_user
+ print("✅ Using bootstrap admin user: admin_wilson")
+
+ demo_users = [
+ {
+ "username": "dr_smith",
+ "email": "sarah.smith@hospital.com",
+ "password": "secure_password",
+ "role": "doctor",
+ "department": "cardiology",
+ "full_name": "Dr. Sarah Smith",
+ },
+ {
+ "username": "nurse_johnson",
+ "email": "michael.johnson@hospital.com",
+ "password": "secure_password",
+ "role": "nurse",
+ "department": "emergency",
+ "full_name": "Nurse Michael Johnson",
+ },
+ ]
+
+ headers = {"Authorization": f"Bearer {admin_token}"}
+
+ for user_data in demo_users:
+ # Check if user already exists
+ existing_user = db.query(User).filter(User.username == user_data["username"]).first()
+ if existing_user:
+ print(f"✅ User '{user_data['username']}' already exists, skipping")
+ created_users[user_data["username"]] = existing_user
+ continue
+
+ # Create user via API
+ try:
+ response = requests.post(
+ f"{AUTH_SERVICE_URL}/api/v1/users/",
+ json={
+ "username": user_data["username"],
+ "email": user_data["email"],
+ "password": user_data["password"],
+ "role": user_data["role"],
+ "department": user_data["department"],
+ },
+ headers=headers,
+ )
+
+ if response.status_code == 200:
+ user_response = response.json()
+ # Get user from database
+ new_user = db.query(User).filter(User.id == user_response["id"]).first()
+ created_users[user_data["username"]] = new_user
+ print(f"✅ Created user via API: {user_data['full_name']} ({user_data['username']})")
+ else:
+ print(f"⚠️ Failed to create user {user_data['username']}: {response.text}")
+
+ except Exception as e:
+ print(f"⚠️ Error creating user {user_data['username']}: {e}")
+
+ return created_users
+
+
+def seed_patients(db: Session, users: dict[str, User], admin_token: str) -> list[Patient]:
+ """Create demo patients via API if they don't exist."""
+ created_patients = []
+
+ # Get the doctor user
+ doctor = users.get("dr_smith")
+ if not doctor:
+ print("⚠️ Doctor user not found, skipping patient creation")
+ return created_patients
+
+ demo_patients = [
+ {
+ "name": "John Anderson",
+ "medical_record_number": "MRN-2024-001",
+ "department": "cardiology",
+ "date_of_birth": "1965-03-15",
+ "assigned_doctor_id": doctor.id,
+ },
+ {
+ "name": "Maria Rodriguez",
+ "medical_record_number": "MRN-2024-002",
+ "department": "cardiology",
+ "date_of_birth": "1978-08-22",
+ "assigned_doctor_id": doctor.id,
+ },
+ {
+ "name": "Robert Chen",
+ "medical_record_number": "MRN-2024-003",
+ "department": "cardiology",
+ "date_of_birth": "1952-11-08",
+ "assigned_doctor_id": doctor.id,
+ },
+ ]
+
+ headers = {"Authorization": f"Bearer {admin_token}"}
+
+ for patient_data in demo_patients:
+ # Check if patient already exists
+ existing_patient = db.query(Patient).filter(Patient.medical_record_number == patient_data["medical_record_number"]).first()
+ if existing_patient:
+ print(f"✅ Patient '{patient_data['name']}' (MRN: {patient_data['medical_record_number']}) already exists, skipping")
+ created_patients.append(existing_patient)
+
+ # Sync OSO facts for existing patients (in case they weren't synced before)
+ try:
+ sync_patient_access(existing_patient)
+ print(f"🔐 Synced access facts for existing patient {patient_data['name']}")
+ except Exception as e:
+ print(f"⚠️ Failed to sync OSO facts for existing patient {patient_data['name']}: {e}")
+ continue
+
+ # Create patient via Patient Service API
+ try:
+ response = requests.post(
+ f"{PATIENT_SERVICE_URL}/api/v1/patients/",
+ json={
+ "name": patient_data["name"],
+ "medical_record_number": patient_data["medical_record_number"],
+ "department": patient_data["department"],
+ "date_of_birth": patient_data["date_of_birth"],
+ "assigned_doctor_id": patient_data["assigned_doctor_id"],
+ },
+ headers=headers,
+ )
+
+ if response.status_code == 200:
+ patient_response = response.json()
+ # Get patient from database
+ new_patient = db.query(Patient).filter(Patient.id == patient_response["id"]).first()
+ created_patients.append(new_patient)
+ print(f"✅ Created patient via API (with OSO facts): {patient_data['name']} (MRN: {patient_data['medical_record_number']})")
+ else:
+ print(f"⚠️ Failed to create patient {patient_data['name']}: {response.text}")
+
+ except Exception as e:
+ print(f"⚠️ Error creating patient {patient_data['name']}: {e}")
+
+ return created_patients
+
+
+def seed_documents(db: Session, users: dict[str, User], patients: list[Patient], admin_token: str) -> list[Document]:
+ """Create demo documents if they don't exist."""
+ created_documents = []
+
+ # Get the doctor user
+ doctor = users.get("dr_smith")
+ if not doctor:
+ print("⚠️ Doctor user not found, skipping document creation")
+ return created_documents
+
+ demo_documents = [
+ {
+ "title": "Cardiology Department Protocols",
+ "content": """# Cardiology Department Standard Operating Procedures
+
+## Patient Assessment Protocols
+1. Initial cardiac risk assessment for all new patients
+2. ECG interpretation guidelines and red flags
+3. Chest pain evaluation protocols
+4. Heart failure management guidelines
+
+## Diagnostic Procedures
+- Echocardiogram ordering criteria
+- Stress test indications and contraindications
+- Cardiac catheterization preparation protocols
+- Post-procedure monitoring requirements
+
+## Medication Management
+- ACE inhibitor dosing and monitoring
+- Beta-blocker titration protocols
+- Anticoagulation management
+- Drug interaction guidelines
+
+## Emergency Procedures
+- Code Blue response protocols
+- Cardiac arrest management
+- Acute MI treatment pathways
+- Arrhythmia management protocols
+
+Last updated: January 2024""",
+ "document_type": "protocol",
+ "department": "cardiology",
+ "is_sensitive": False,
+ },
+ {
+ "title": "Hypertension Management Guidelines",
+ "content": """# Hypertension Management Guidelines
+
+## Classification
+- Normal: <120/80 mmHg
+- Elevated: 120-129/<80 mmHg
+- Stage 1: 130-139/80-89 mmHg
+- Stage 2: ≥140/≥90 mmHg
+- Crisis: >180/>120 mmHg
+
+## Initial Assessment
+1. Confirm diagnosis with multiple readings
+2. Assess for secondary causes
+3. Evaluate cardiovascular risk factors
+4. Screen for target organ damage
+
+## Treatment Approach
+### Lifestyle Modifications
+- DASH diet implementation
+- Sodium restriction (<2.3g/day)
+- Weight management (BMI <25)
+- Regular aerobic exercise (150 min/week)
+- Alcohol moderation
+- Smoking cessation
+
+### Pharmacological Treatment
+First-line agents:
+- ACE inhibitors or ARBs
+- Calcium channel blockers
+- Thiazide diuretics
+
+## Monitoring
+- BP checks every 2-4 weeks during titration
+- Annual lab work (creatinine, potassium)
+- Yearly cardiovascular risk assessment
+
+Target: <130/80 mmHg for most patients""",
+ "document_type": "guideline",
+ "department": "cardiology",
+ "is_sensitive": False,
+ },
+ {
+ "title": "Heart Failure Patient Education",
+ "content": """# Heart Failure: Patient Education Guide
+
+## What is Heart Failure?
+Heart failure occurs when your heart cannot pump blood effectively to meet your body's needs. This doesn't mean your heart has stopped working, but rather that it needs support to work better.
+
+## Common Symptoms
+- Shortness of breath (especially when lying down)
+- Fatigue and weakness
+- Swelling in legs, ankles, or feet
+- Rapid or irregular heartbeat
+- Persistent cough or wheezing
+- Weight gain from fluid retention
+
+## Daily Management
+### Medications
+- Take all medications as prescribed
+- Never skip doses
+- Know your medications and their purposes
+- Report side effects to your healthcare team
+
+### Diet and Fluid Management
+- Limit sodium intake (less than 2 grams daily)
+- Monitor fluid intake as directed
+- Weigh yourself daily at the same time
+- Call if weight increases by 2-3 pounds in one day
+
+### Activity Guidelines
+- Stay active within your limits
+- Pace yourself and rest when needed
+- Avoid sudden increases in activity
+- Participate in cardiac rehabilitation if recommended
+
+## When to Call Your Doctor
+- Weight gain of 2-3 pounds in one day
+- Increased shortness of breath
+- New or worsening swelling
+- Chest pain or discomfort
+- Dizziness or fainting
+- Any concerns about your condition
+
+Remember: You are an important part of your healthcare team!""",
+ "document_type": "education",
+ "department": "cardiology",
+ "is_sensitive": False,
+ },
+ ]
+
+ headers = {"Authorization": f"Bearer {admin_token}"}
+
+ for doc_data in demo_documents:
+ # Check if document already exists (by title)
+ existing_doc = db.query(Document).filter(Document.title == doc_data["title"]).first()
+ if existing_doc:
+ print(f"✅ Document '{doc_data['title']}' already exists, skipping")
+ created_documents.append(existing_doc)
+ continue
+
+ # Create document via RAG service API (this will automatically generate embeddings!)
+ try:
+ response = requests.post(
+ f"{RAG_SERVICE_URL}/api/v1/documents/",
+ json={
+ "title": doc_data["title"],
+ "content": doc_data["content"],
+ "document_type": doc_data["document_type"],
+ "department": doc_data["department"],
+ "is_sensitive": doc_data["is_sensitive"],
+ },
+ headers=headers,
+ )
+
+ if response.status_code == 200:
+ doc_response = response.json()
+ # Get document from database
+ new_document = db.query(Document).filter(Document.id == doc_response["id"]).first()
+ created_documents.append(new_document)
+ print(f"✅ Created document via RAG API (with embeddings): {doc_data['title']}")
+ else:
+ print(f"⚠️ Failed to create document {doc_data['title']}: {response.text}")
+
+ except Exception as e:
+ print(f"⚠️ Error creating document {doc_data['title']}: {e}")
+
+ # Create patient-specific documents
+ if patients:
+ patient_docs = [
+ {
+ "title": f"Medical History - {patients[0].name}",
+ "content": f"""# Medical History for {patients[0].name}
+MRN: {patients[0].medical_record_number}
+
+## Chief Complaint
+Routine cardiac follow-up for hypertension and coronary artery disease.
+
+## History of Present Illness
+67-year-old male with history of hypertension, hyperlipidemia, and prior MI in 2020. Currently stable on optimal medical therapy. Reports good exercise tolerance and no chest pain.
+
+## Past Medical History
+- Hypertension (2015)
+- Hyperlipidemia (2016)
+- ST-elevation myocardial infarction (2020)
+- Percutaneous coronary intervention with drug-eluting stent to LAD (2020)
+
+## Current Medications
+- Metoprolol succinate 50mg daily
+- Lisinopril 10mg daily
+- Atorvastatin 80mg daily
+- Aspirin 81mg daily
+- Clopidogrel 75mg daily
+
+## Allergies
+No known drug allergies
+
+## Social History
+Former smoker (quit 2020), occasional alcohol use, married, retired electrician.
+
+## Assessment and Plan
+Stable coronary artery disease. Continue current medications. Next follow-up in 6 months with stress test if symptoms develop.""",
+ "document_type": "medical_record",
+ "patient_id": patients[0].id,
+ "is_sensitive": True,
+ }
+ ]
+
+ for doc_data in patient_docs:
+ # Check if patient document already exists
+ existing_doc = (
+ db.query(Document)
+ .filter(
+ Document.title == doc_data["title"],
+ Document.patient_id == doc_data["patient_id"],
+ )
+ .first()
+ )
+ if existing_doc:
+ print(f"✅ Patient document '{doc_data['title']}' already exists, skipping")
+ created_documents.append(existing_doc)
+ continue
+
+ # Create patient document via RAG service API (with embeddings!)
+ try:
+ response = requests.post(
+ f"{RAG_SERVICE_URL}/api/v1/documents/",
+ json={
+ "title": doc_data["title"],
+ "content": doc_data["content"],
+ "document_type": doc_data["document_type"],
+ "department": "cardiology",
+ "patient_id": doc_data["patient_id"],
+ "is_sensitive": doc_data["is_sensitive"],
+ },
+ headers=headers,
+ )
+
+ if response.status_code == 200:
+ doc_response = response.json()
+ # Get document from database
+ new_document = db.query(Document).filter(Document.id == doc_response["id"]).first()
+ created_documents.append(new_document)
+ print(f"✅ Created patient document via RAG API (with embeddings): {doc_data['title']}")
+ else:
+ print(f"⚠️ Failed to create patient document {doc_data['title']}: {response.text}")
+
+ except Exception as e:
+ print(f"⚠️ Error creating patient document {doc_data['title']}: {e}")
+
+ return created_documents
+
+
+def main() -> None:
+ """Main seeding function."""
+ print("🌱 Healthcare Support Portal - Database Seeding")
+ print("=" * 50)
+
+ try:
+ # Note: Database migrations should be run before seeding
+ print("📊 Database migrations should already be applied")
+ print(" If not, run: docker-compose run migrate")
+
+ # Create database session
+ db = SessionLocal()
+
+ try:
+ # Wait for services to be available
+ print("\n⏳ Waiting for services to be ready...")
+ if not wait_for_services():
+ print("❌ Services not available, exiting...")
+ return
+
+ # Get admin token for API calls
+ print("\n🔑 Getting admin authentication token...")
+ admin_token = get_admin_token(db)
+ if not admin_token:
+ print("❌ Could not get admin token, exiting...")
+ return
+
+ # Seed users via API
+ print("\n👥 Seeding demo users via API...")
+ users = seed_users(db, admin_token)
+
+ # Seed patients via Patient API
+ print("\n🏥 Seeding demo patients via API...")
+ patients = seed_patients(db, users, admin_token)
+
+ # Seed documents via RAG API (this will generate embeddings!)
+ print("\n📄 Seeding demo documents via RAG API...")
+ documents = seed_documents(db, users, patients, admin_token)
+
+ print("\n" + "=" * 50)
+ print("🎉 Seeding completed successfully!")
+ print(f" Users created/verified: {len(users)}")
+ print(f" Patients created/verified: {len(patients)}")
+ print(f" Documents created/verified: {len(documents)}")
+ print(" 📊 Documents created via RAG API include vector embeddings for chat!")
+ print("\n🔐 Demo Login Credentials:")
+ print(" Doctor: dr_smith / secure_password")
+ print(" Nurse: nurse_johnson / secure_password")
+ print(" Admin: admin_wilson / secure_password")
+ print("\n🌐 Access the application at: http://localhost:3000")
+ print("💬 Try the chat feature - it should now find relevant documents!")
+
+ finally:
+ db.close()
+
+ except Exception as e:
+ print(f"\n❌ Seeding failed: {str(e)}")
+ sys.exit(1)
+
+
+if __name__ == "__main__":
+ main()
diff --git a/python/rag/healthcare-support-portal/packages/common/src/common/sync_oso_facts.py b/python/rag/healthcare-support-portal/packages/common/src/common/sync_oso_facts.py
new file mode 100644
index 00000000..4e7075ab
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/common/src/common/sync_oso_facts.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""
+Standalone script to synchronize OSO facts with database state.
+This script initializes sqlalchemy-oso-cloud and syncs authorization facts.
+"""
+
+import os
+import sys
+
+import sqlalchemy_oso_cloud
+from sqlalchemy.orm import Session
+
+from .db import SessionLocal
+from .models import Base, Document, Embedding, Patient, User
+from .oso_sync import (
+ sync_admin_global_access,
+ sync_document_access,
+ sync_embedding_access,
+ sync_patient_access,
+)
+
+
+def initialize_oso() -> None:
+ """Initialize SQLAlchemy OSO Cloud connection."""
+ # OSO configuration - same as in the services
+ oso_url = os.getenv("OSO_URL", "http://localhost:8080")
+ oso_auth = os.getenv("OSO_AUTH", "e_0123456789_12345_osotesttoken01xiIn")
+
+ # Initialize SQLAlchemy Oso Cloud with registry and server settings
+ sqlalchemy_oso_cloud.init(Base.registry, url=oso_url, api_key=oso_auth)
+
+ print(f"✅ Initialized OSO Cloud connection: {oso_url}")
+
+
+def sync_all_facts() -> None:
+ """Synchronize all authorization facts with OSO Cloud."""
+ db: Session = SessionLocal()
+
+ try:
+ print("🔐 Starting comprehensive OSO fact synchronization...")
+
+ # Sync admin users first
+ print("\n👑 Syncing admin user facts...")
+ admin_users = db.query(User).filter(User.role == "admin", User.is_active).all()
+ for admin in admin_users:
+ try:
+ sync_admin_global_access(admin)
+ print(f"✅ Synced global admin access for {admin.username}")
+ except Exception as e:
+ print(f"❌ Failed to sync admin access for {admin.username}: {e}")
+
+ # Sync all patients
+ print("\n🏥 Syncing patient facts...")
+ patients = db.query(Patient).filter(Patient.is_active).all()
+ for patient in patients:
+ try:
+ sync_patient_access(patient)
+ print(f"✅ Synced patient access for {patient.name}")
+ except Exception as e:
+ print(f"❌ Failed to sync patient access for {patient.name}: {e}")
+
+ # Sync all documents
+ print("\n📄 Syncing document facts...")
+ documents = db.query(Document).all()
+ for document in documents:
+ try:
+ sync_document_access(document)
+ print(f"✅ Synced document access for '{document.title}'")
+ except Exception as e:
+ print(f"❌ Failed to sync document access for '{document.title}': {e}")
+
+ # Sync all embeddings
+ print("\n🧮 Syncing embedding facts...")
+ embeddings = db.query(Embedding).all()
+ for embedding in embeddings:
+ try:
+ sync_embedding_access(embedding)
+ print(f"✅ Synced embedding access for embedding {embedding.id}")
+ except Exception as e:
+ print(f"❌ Failed to sync embedding access for embedding {embedding.id}: {e}")
+
+ print("\n🎉 OSO fact synchronization completed!")
+ print(f" Admin users: {len(admin_users)}")
+ print(f" Patients: {len(patients)}")
+ print(f" Documents: {len(documents)}")
+ print(f" Embeddings: {len(embeddings)}")
+
+ finally:
+ db.close()
+
+
+def main() -> None:
+ """Main function."""
+ print("🔐 OSO Cloud Fact Synchronization")
+ print("=" * 50)
+
+ try:
+ # Initialize OSO Cloud connection
+ initialize_oso()
+
+ # Synchronize all facts
+ sync_all_facts()
+
+ print("\n✅ All facts synchronized successfully!")
+
+ except Exception as e:
+ print(f"\n❌ Fact synchronization failed: {str(e)}")
+ sys.exit(1)
+
+
+if __name__ == "__main__":
+ main()
diff --git a/python/rag/healthcare-support-portal/packages/patient/.env.example b/python/rag/healthcare-support-portal/packages/patient/.env.example
new file mode 100644
index 00000000..4d8fad67
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/.env.example
@@ -0,0 +1,6 @@
+# Patient Service Environment Variables
+DEBUG=true
+SECRET_KEY=change-me-in-production
+DATABASE_URL=postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare
+OSO_URL=http://localhost:8080
+OSO_AUTH=e_0123456789_12345_osotesttoken01xiIn
diff --git a/python/rag/healthcare-support-portal/packages/patient/.gitignore b/python/rag/healthcare-support-portal/packages/patient/.gitignore
new file mode 100644
index 00000000..cb43b4dc
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/.gitignore
@@ -0,0 +1,7 @@
+# Patient Service Specific
+.env
+*.log
+logs/
+.pytest_cache/
+__pycache__/
+*.pyc
diff --git a/python/rag/healthcare-support-portal/packages/patient/README.md b/python/rag/healthcare-support-portal/packages/patient/README.md
new file mode 100644
index 00000000..e7e8292c
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/README.md
@@ -0,0 +1,299 @@
+# Patient Service
+
+The Patient Service manages patient records and information for the Healthcare Support Portal. It provides CRUD operations with comprehensive role-based authorization using Oso policies.
+
+## Features
+
+- **Patient CRUD:** Create, read, update, and delete patient records
+- **Authorization:** Role-based access control with Oso policies
+- **Department Filtering:** Search patients by department
+- **Doctor Assignment:** Assign and manage doctor-patient relationships
+- **Soft Delete:** Deactivate patients instead of hard deletion
+- **Pagination:** Efficient handling of large patient lists
+- **Medical Record Validation:** Ensure unique medical record numbers
+
+## Quick Start
+
+### Prerequisites
+
+- Python 3.8+
+- PostgreSQL with the Healthcare Support Portal database
+- uv package manager
+- Authentication Service running (for JWT validation)
+
+### Installation
+
+```bash
+# From project root
+uv sync
+
+# Or from package directory
+cd packages/patient
+uv sync
+```
+
+### Environment Variables
+
+Create a `.env` file or set these environment variables:
+
+```env
+DEBUG=true
+SECRET_KEY=your-secret-key-here
+DATABASE_URL=postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare
+```
+
+### Running the Service
+
+```bash
+# Set PYTHONPATH and run
+export PYTHONPATH="../common/src:$PYTHONPATH"
+uv run uvicorn src.patient_service.main:app --reload --port 8002
+
+# Or use the run script from package directory
+cd packages/patient
+./run.sh
+```
+
+The service will be available at http://localhost:8002
+
+### API Documentation
+
+Interactive API docs are available at:
+- Swagger UI: http://localhost:8002/docs
+- ReDoc: http://localhost:8002/redoc
+
+## API Endpoints
+
+### Patient Management
+
+| Method | Endpoint | Description | Auth Required | Roles |
+|--------|----------|-------------|---------------|-------|
+| GET | `/api/v1/patients/` | List patients (authorized) | Yes | doctor, nurse, admin |
+| GET | `/api/v1/patients/{patient_id}` | Get specific patient | Yes | assigned doctor, dept nurse, admin |
+| POST | `/api/v1/patients/` | Create new patient | Yes | doctor, admin |
+| PUT | `/api/v1/patients/{patient_id}` | Update patient | Yes | assigned doctor, admin |
+| DELETE | `/api/v1/patients/{patient_id}` | Soft delete patient | Yes | assigned doctor, admin |
+| GET | `/api/v1/patients/search/by-department/{dept}` | Search by department | Yes | dept nurse, admin |
+
+### Health Check
+
+| Method | Endpoint | Description | Auth Required |
+|--------|----------|-------------|---------------|
+| GET | `/health` | Service health check | No |
+| GET | `/` | Service info | No |
+
+## Example Usage
+
+### Get Your JWT Token First
+
+```bash
+# Login via auth service
+curl -X POST "http://localhost:8001/api/v1/auth/login" \
+ -H "Content-Type: application/x-www-form-urlencoded" \
+ -d "username=dr_smith&password=secure_password"
+```
+
+### Create a New Patient
+
+```bash
+curl -X POST "http://localhost:8002/api/v1/patients/" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "name": "John Doe",
+ "medical_record_number": "MRN-2024-001",
+ "department": "cardiology",
+ "assigned_doctor_id": 1
+ }'
+```
+
+### List Patients (with pagination)
+
+```bash
+curl -X GET "http://localhost:8002/api/v1/patients/?skip=0&limit=10" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN"
+```
+
+### Get Specific Patient
+
+```bash
+curl -X GET "http://localhost:8002/api/v1/patients/1" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN"
+```
+
+### Update Patient
+
+```bash
+curl -X PUT "http://localhost:8002/api/v1/patients/1" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "name": "John Doe",
+ "medical_record_number": "MRN-2024-001",
+ "department": "cardiology",
+ "assigned_doctor_id": 2
+ }'
+```
+
+### Search Patients by Department
+
+```bash
+curl -X GET "http://localhost:8002/api/v1/patients/search/by-department/cardiology?skip=0&limit=10" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN"
+```
+
+## Authorization Rules
+
+The service implements comprehensive authorization using Oso policies:
+
+### Doctor Access
+- **Read:** Only assigned patients
+- **Write:** Only assigned patients
+- **Create:** Can create new patients
+
+### Nurse Access
+- **Read:** Patients in their department (non-sensitive)
+- **Write:** No write access
+- **Create:** No create access
+
+### Admin Access
+- **Read:** All patients
+- **Write:** All patients
+- **Create:** Can create new patients
+
+## Data Models
+
+### Patient Schema
+
+```json
+{
+ "id": 1,
+ "name": "John Doe",
+ "medical_record_number": "MRN-2024-001",
+ "department": "cardiology",
+ "assigned_doctor_id": 1,
+ "is_active": true,
+ "created_at": "2024-01-15T10:00:00Z"
+}
+```
+
+### Required Fields
+- `name`: Patient's full name
+- `medical_record_number`: Unique identifier (must be unique)
+
+### Optional Fields
+- `department`: Medical department
+- `assigned_doctor_id`: ID of assigned doctor
+- `date_of_birth`: Patient's birth date
+
+## Query Parameters
+
+### Pagination
+- `skip`: Number of records to skip (default: 0)
+- `limit`: Maximum records to return (default: 100, max: 1000)
+
+### Filtering
+- `department`: Filter by department name
+
+## Development
+
+### Project Structure
+
+```
+src/patient_service/
+├── __init__.py
+├── main.py # FastAPI application
+├── config.py # Configuration settings
+└── routers/
+ ├── __init__.py
+ └── patients.py # Patient management endpoints
+```
+
+### Dependencies
+
+Key dependencies include:
+- FastAPI: Web framework
+- SQLAlchemy: ORM for database operations
+- Oso: Authorization framework
+- sqlalchemy-oso: SQLAlchemy integration for Oso
+- common: Shared models and utilities
+
+### Testing
+
+```bash
+# Test imports
+uv run python -c "from common.models import Patient; print('Import successful!')"
+
+# Test database connection
+uv run python -c "from common.db import create_tables; create_tables(); print('DB connection successful!')"
+```
+
+## Error Handling
+
+The service returns standard HTTP status codes:
+
+- `200`: Success
+- `201`: Created
+- `400`: Bad Request (validation errors)
+- `401`: Unauthorized (invalid/missing token)
+- `403`: Forbidden (insufficient permissions)
+- `404`: Not Found (patient doesn't exist)
+- `422`: Unprocessable Entity (invalid data)
+- `500`: Internal Server Error
+
+### Common Error Responses
+
+```json
+{
+ "detail": "Not authorized to access this patient"
+}
+```
+
+```json
+{
+ "detail": "Patient with this medical record number already exists"
+}
+```
+
+## Performance Considerations
+
+- Pagination is enforced to prevent large result sets
+- Database indexes on frequently queried fields
+- Oso authorization queries are optimized at the database level
+- Soft delete preserves data integrity
+
+## Security Features
+
+- JWT token validation on all protected endpoints
+- Role-based authorization with Oso policies
+- Input validation and sanitization
+- Medical record number uniqueness enforcement
+- Audit trail through created_at timestamps
+
+## Integration
+
+This service integrates with:
+- **Auth Service:** JWT token validation and user information
+- **RAG Service:** Patient-specific document access
+- **Common Package:** Shared models, database, and utilities
+
+## Troubleshooting
+
+### Common Issues
+
+1. **Authorization errors:** Ensure user has correct role and department
+2. **Database errors:** Check PostgreSQL connection and table creation
+3. **Import errors:** Verify PYTHONPATH includes `../common/src`
+4. **Token errors:** Ensure auth service is running and SECRET_KEY matches
+
+### Debug Mode
+
+Set `DEBUG=true` for detailed error messages and SQL query logging.
+
+## Contributing
+
+1. Follow existing code patterns and structure
+2. Add appropriate authorization checks for new endpoints
+3. Update Oso policies for new access patterns
+4. Include comprehensive error handling
+5. Update this README for new features
diff --git a/python/rag/healthcare-support-portal/packages/patient/pyproject.toml b/python/rag/healthcare-support-portal/packages/patient/pyproject.toml
new file mode 100644
index 00000000..6e881b0c
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/pyproject.toml
@@ -0,0 +1,25 @@
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "patient"
+version = "0.1.0"
+description = "Patient management service for Healthcare Support Portal"
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = [
+ "fastapi>=0.104.0",
+ "uvicorn[standard]>=0.24.0",
+ "pydantic>=2.0.0",
+ "pydantic-settings>=2.0.0",
+ "sqlalchemy>=2.0.0",
+ "common",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/patient_service"]
+
+[tool.uv.sources]
+common = { workspace = true }
diff --git a/python/rag/healthcare-support-portal/packages/patient/run.sh b/python/rag/healthcare-support-portal/packages/patient/run.sh
new file mode 100755
index 00000000..5e49e501
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/run.sh
@@ -0,0 +1,67 @@
+#!/bin/bash
+# packages/patient/run.sh
+
+# Exit on any error
+set -e
+
+# Function to check if a command exists
+command_exists() {
+ command -v "$1" >/dev/null 2>&1
+}
+
+# Load .env file if it exists
+if [ -f .env ]; then
+ echo "Loading environment variables from .env file..."
+ set -o allexport
+ source .env
+ set +o allexport
+else
+ echo "⚠️ Warning: No .env file found. Using defaults."
+fi
+
+# Set PYTHONPATH to include common package
+export PYTHONPATH="../common/src:$PYTHONPATH"
+
+# Set default environment variables if not already set
+export SECRET_KEY="${SECRET_KEY:-your-secret-key-here}"
+export DATABASE_URL="${DATABASE_URL:-postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare}"
+export DEBUG="${DEBUG:-true}"
+export HOST="${HOST:-0.0.0.0}"
+export PORT="${PORT:-8002}"
+
+echo "🏥 Starting Patient Service on port $PORT..."
+echo "📊 Debug mode: $DEBUG"
+echo "🔑 Using SECRET_KEY: ${SECRET_KEY:0:10}..."
+echo "🗄️ Database: ${DATABASE_URL%%@*}@***"
+
+# Check for uv command
+UV_CMD="uv"
+if [ -f "/opt/homebrew/bin/uv" ]; then
+ UV_CMD="/opt/homebrew/bin/uv"
+fi
+
+if ! command_exists "$UV_CMD"; then
+ echo "❌ uv package manager not found. Please install uv and try again."
+ echo " Installation: curl -LsSf https://astral.sh/uv/install.sh | sh"
+ exit 1
+fi
+
+# Check if port is available
+if command_exists lsof; then
+ if lsof -i :$PORT -sTCP:LISTEN -t >/dev/null 2>&1; then
+ echo "❌ Port $PORT is already in use. Please stop the service using this port."
+ exit 1
+ fi
+fi
+
+# Check essential environment variables
+if [ "$SECRET_KEY" = "your-secret-key-here" ] || [ "$SECRET_KEY" = "change-me-in-production" ]; then
+ echo "⚠️ WARNING: Using default SECRET_KEY. This is insecure for production!"
+fi
+
+# Run the patient service
+echo "🚀 Starting uvicorn server..."
+if ! $UV_CMD run uvicorn src.patient_service.main:app --reload --host $HOST --port $PORT; then
+ echo "❌ Failed to start Patient Service"
+ exit 1
+fi
diff --git a/python/rag/healthcare-support-portal/packages/patient/src/patient_service/__init__.py b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/__init__.py
new file mode 100644
index 00000000..7ed4e7de
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/__init__.py
@@ -0,0 +1,6 @@
+"""
+Patient Service for Healthcare Support Portal
+Handles patient management with role-based access control
+"""
+
+__version__ = "0.1.0"
diff --git a/python/rag/healthcare-support-portal/packages/patient/src/patient_service/config.py b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/config.py
new file mode 100644
index 00000000..da3a3796
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/config.py
@@ -0,0 +1,29 @@
+import os
+
+from pydantic_settings import BaseSettings
+
+
+class Settings(BaseSettings):
+ app_name: str = "Healthcare Support Portal - Patient Service"
+ debug: bool = os.getenv("DEBUG", "False").lower() == "true"
+ host: str = "0.0.0.0"
+ port: int = 8002
+
+ # Database
+ database_url: str = os.getenv(
+ "DATABASE_URL",
+ "postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare",
+ )
+
+ # JWT
+ secret_key: str = os.getenv("SECRET_KEY", "your-secret-key-here")
+
+ # Oso Configuration
+ oso_url: str = os.getenv("OSO_URL", "http://localhost:8080")
+ oso_auth: str = os.getenv("OSO_AUTH", "e_0123456789_12345_osotesttoken01xiIn")
+
+ class Config:
+ env_file = ".env"
+
+
+settings = Settings()
diff --git a/python/rag/healthcare-support-portal/packages/patient/src/patient_service/main.py b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/main.py
new file mode 100644
index 00000000..616bc9f5
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/main.py
@@ -0,0 +1,60 @@
+import sys
+from pathlib import Path
+
+# Add the common package to Python path
+common_path = Path(__file__).parent.parent.parent.parent / "common" / "src"
+sys.path.insert(0, str(common_path))
+
+import sqlalchemy_oso_cloud
+from common.migration_check import require_migrations_current
+from common.models import Base
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+
+from .config import settings
+from .routers import patients
+
+# Initialize SQLAlchemy Oso Cloud with registry and server settings
+sqlalchemy_oso_cloud.init(Base.registry, url=settings.oso_url, api_key=settings.oso_auth)
+
+# Create FastAPI app
+app = FastAPI(
+ title=settings.app_name,
+ description="Patient management service with role-based access control",
+ version="0.1.0",
+ debug=settings.debug,
+)
+
+# Add CORS middleware
+app.add_middleware(
+ CORSMiddleware,
+ allow_origins=["*"], # Configure appropriately for production
+ allow_credentials=True,
+ allow_methods=["*"],
+ allow_headers=["*"],
+)
+
+# Include routers
+app.include_router(patients.router, prefix="/api/v1/patients", tags=["Patients"])
+
+
+@app.on_event("startup")
+async def startup_event():
+ """Verify migrations and start service"""
+ # Verify database migrations are current
+ require_migrations_current()
+ print(f"🚀 {settings.app_name} started on port {settings.port}")
+
+
+@app.get("/")
+async def root():
+ return {"service": "patient_service", "status": "healthy", "version": "0.1.0"}
+
+
+@app.get("/health")
+async def health_check():
+ return {"status": "healthy"}
+
+
+# Make Oso Cloud instance available to routes
+app.state.oso_sqlalchemy = sqlalchemy_oso_cloud
diff --git a/python/rag/healthcare-support-portal/packages/patient/src/patient_service/routers/__init__.py b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/routers/__init__.py
new file mode 100644
index 00000000..5bb3dc22
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/routers/__init__.py
@@ -0,0 +1 @@
+# Router package initialization
diff --git a/python/rag/healthcare-support-portal/packages/patient/src/patient_service/routers/patients.py b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/routers/patients.py
new file mode 100644
index 00000000..f5668c96
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/patient/src/patient_service/routers/patients.py
@@ -0,0 +1,284 @@
+import sys
+from pathlib import Path
+
+# Add the common package to Python path
+common_path = Path(__file__).parent.parent.parent.parent.parent / "common" / "src"
+sys.path.insert(0, str(common_path))
+
+
+from common.auth import get_current_user
+from common.db import get_db
+from common.models import Patient, User
+from common.oso_sync import remove_patient_access, sync_patient_access
+from common.schemas import PatientCreate, PatientResponse
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
+from sqlalchemy.orm import Session
+from sqlalchemy_oso_cloud import authorized, get_oso
+
+router = APIRouter()
+
+
+@router.get("/", response_model=list[PatientResponse])
+async def list_patients(
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+ skip: int = Query(0, ge=0),
+ limit: int = Query(100, ge=1, le=1000),
+ department: str | None = Query(None),
+):
+ """
+ List patients with Oso authorization filtering
+ """
+ # Use Oso Cloud to filter patients the current user can read
+ query = db.query(Patient).options(authorized(current_user, "read", Patient))
+
+ # Apply optional department filter
+ if department:
+ query = query.filter(Patient.department == department)
+
+ # Apply pagination
+ patients = query.offset(skip).limit(limit).all()
+
+ return patients
+
+
+@router.get("/{patient_id}", response_model=PatientResponse)
+async def get_patient(
+ patient_id: int,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Get specific patient with Oso authorization
+ """
+ oso = get_oso()
+
+ # Get the patient
+ patient = db.query(Patient).filter(Patient.id == patient_id).first()
+ if not patient:
+ raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Patient not found")
+
+ # Check if current user is authorized to read this patient
+ if not oso.authorize(current_user, "read", patient):
+ raise HTTPException(
+ status_code=status.HTTP_403_FORBIDDEN,
+ detail="Not authorized to access this patient",
+ )
+
+ return patient
+
+
+@router.post("/", response_model=PatientResponse)
+async def create_patient(
+ patient_data: PatientCreate,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Create a new patient
+ """
+ # Check if medical record number already exists
+ existing_patient = db.query(Patient).filter(Patient.medical_record_number == patient_data.medical_record_number).first()
+
+ if existing_patient:
+ raise HTTPException(
+ status_code=status.HTTP_400_BAD_REQUEST,
+ detail="Patient with this medical record number already exists",
+ )
+
+ # Create new patient
+ # Parse date_of_birth if provided
+ date_of_birth = None
+ if patient_data.date_of_birth:
+ try:
+ from datetime import datetime
+
+ date_of_birth = datetime.fromisoformat(patient_data.date_of_birth)
+ except ValueError:
+ raise HTTPException(
+ status_code=status.HTTP_400_BAD_REQUEST,
+ detail="Invalid date_of_birth format. Use YYYY-MM-DD",
+ )
+
+ db_patient = Patient(
+ name=patient_data.name,
+ medical_record_number=patient_data.medical_record_number,
+ department=patient_data.department,
+ date_of_birth=date_of_birth,
+ assigned_doctor_id=patient_data.assigned_doctor_id,
+ is_active=True,
+ )
+
+ # Check if user is authorized to write/create patients
+ # For creation, we'll check against a dummy patient object or use role-based logic
+ if current_user.role not in ["doctor", "admin"]:
+ raise HTTPException(
+ status_code=status.HTTP_403_FORBIDDEN,
+ detail="Not authorized to create patients",
+ )
+
+ # If assigning to a doctor, ensure it's valid
+ if patient_data.assigned_doctor_id:
+ doctor = db.query(User).filter(User.id == patient_data.assigned_doctor_id, User.role == "doctor").first()
+ if not doctor:
+ raise HTTPException(
+ status_code=status.HTTP_400_BAD_REQUEST,
+ detail="Invalid doctor assignment",
+ )
+
+ db.add(db_patient)
+ db.commit()
+ db.refresh(db_patient)
+
+ # Sync OSO facts for new patient
+ try:
+ sync_patient_access(db_patient)
+ except Exception as e:
+ print(f"Warning: Failed to sync OSO facts for new patient {db_patient.id}: {e}")
+
+ return db_patient
+
+
+@router.put("/{patient_id}", response_model=PatientResponse)
+async def update_patient(
+ patient_id: int,
+ patient_update: PatientCreate,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Update patient with Oso authorization
+ """
+ oso = get_oso()
+
+ # Get the patient
+ patient = db.query(Patient).filter(Patient.id == patient_id).first()
+ if not patient:
+ raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Patient not found")
+
+ # Check if current user is authorized to write this patient
+ if not oso.authorize(current_user, "write", patient):
+ raise HTTPException(
+ status_code=status.HTTP_403_FORBIDDEN,
+ detail="Not authorized to update this patient",
+ )
+
+ # Check for medical record number conflicts (if changed)
+ if patient_update.medical_record_number != patient.medical_record_number:
+ existing_patient = (
+ db.query(Patient)
+ .filter(
+ Patient.medical_record_number == patient_update.medical_record_number,
+ Patient.id != patient_id,
+ )
+ .first()
+ )
+
+ if existing_patient:
+ raise HTTPException(
+ status_code=status.HTTP_400_BAD_REQUEST,
+ detail="Patient with this medical record number already exists",
+ )
+
+ # Parse date_of_birth if provided
+ date_of_birth = None
+ if patient_update.date_of_birth:
+ try:
+ from datetime import datetime
+
+ date_of_birth = datetime.fromisoformat(patient_update.date_of_birth)
+ except ValueError:
+ raise HTTPException(
+ status_code=status.HTTP_400_BAD_REQUEST,
+ detail="Invalid date_of_birth format. Use YYYY-MM-DD",
+ )
+
+ # Track changes for OSO sync
+ old_assigned_doctor_id = patient.assigned_doctor_id
+ old_department = patient.department
+
+ # Update patient fields
+ patient.name = patient_update.name
+ patient.medical_record_number = patient_update.medical_record_number
+ patient.department = patient_update.department
+ patient.date_of_birth = date_of_birth
+ patient.assigned_doctor_id = patient_update.assigned_doctor_id
+
+ db.commit()
+ db.refresh(patient)
+
+ # Sync OSO facts if assignments changed
+ try:
+ if old_assigned_doctor_id != patient.assigned_doctor_id or old_department != patient.department:
+ # Resync all patient access facts
+ sync_patient_access(patient)
+ except Exception as e:
+ print(f"Warning: Failed to sync OSO facts for updated patient {patient.id}: {e}")
+
+ return patient
+
+
+@router.delete("/{patient_id}")
+async def delete_patient(
+ patient_id: int,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Soft delete patient (set is_active to False)
+ """
+ oso = get_oso()
+
+ # Get the patient
+ patient = db.query(Patient).filter(Patient.id == patient_id).first()
+ if not patient:
+ raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Patient not found")
+
+ # Check if current user is authorized to write this patient
+ if not oso.authorize(current_user, "write", patient):
+ raise HTTPException(
+ status_code=status.HTTP_403_FORBIDDEN,
+ detail="Not authorized to delete this patient",
+ )
+
+ # Soft delete (set is_active to False)
+ patient.is_active = False
+ db.commit()
+
+ # Remove OSO facts for deactivated patient
+ try:
+ remove_patient_access(patient.id)
+ except Exception as e:
+ print(f"Warning: Failed to remove OSO facts for deactivated patient {patient.id}: {e}")
+
+ return {"message": "Patient deactivated successfully"}
+
+
+@router.get("/search/by-department/{department}", response_model=list[PatientResponse])
+async def search_patients_by_department(
+ department: str,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+ skip: int = Query(0, ge=0),
+ limit: int = Query(100, ge=1, le=1000),
+):
+ """
+ Search patients by department with authorization
+ """
+ # Use Oso Cloud to filter patients the current user can read
+ patients = (
+ db.query(Patient)
+ .options(*authorized(current_user, "read", Patient))
+ .filter(Patient.department == department, Patient.is_active)
+ .offset(skip)
+ .limit(limit)
+ .all()
+ )
+
+ return patients
diff --git a/python/rag/healthcare-support-portal/packages/rag/.env.example b/python/rag/healthcare-support-portal/packages/rag/.env.example
new file mode 100644
index 00000000..b47293d5
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/.env.example
@@ -0,0 +1,23 @@
+# RAG Service Environment Variables
+DEBUG=true
+SECRET_KEY=change-me-in-production
+DATABASE_URL=postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare
+OSO_URL=http://localhost:8080
+OSO_AUTH=e_0123456789_12345_osotesttoken01xiIn
+OPENAI_API_KEY=sk-your-openai-api-key-here
+EMBEDDING_MODEL=text-embedding-3-small
+CHAT_MODEL=gpt-4o-mini
+
+# Galileo 2.0 Observability Configuration
+# Get your API key from: https://app.galileo.ai/sign-up
+GALILEO_API_KEY=your-galileo-api-key-here
+# Project name in your Galileo console
+GALILEO_PROJECT_NAME=healthcare-rag
+# Environment tag: development, staging, production
+GALILEO_ENVIRONMENT=development
+# Galileo console URL (for reference)
+GALILEO_CONSOLE_URL=https://app.galileo.ai
+
+# Logging Configuration
+LOG_LEVEL=INFO
+LOG_FORMAT=json
diff --git a/python/rag/healthcare-support-portal/packages/rag/.gitignore b/python/rag/healthcare-support-portal/packages/rag/.gitignore
new file mode 100644
index 00000000..a0516f58
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/.gitignore
@@ -0,0 +1,9 @@
+# RAG Service Specific
+.env
+*.log
+logs/
+.pytest_cache/
+__pycache__/
+*.pyc
+uploads/
+.openai_cache/
diff --git a/python/rag/healthcare-support-portal/packages/rag/RAG_GUIDE.md b/python/rag/healthcare-support-portal/packages/rag/RAG_GUIDE.md
new file mode 100644
index 00000000..fdb35069
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/RAG_GUIDE.md
@@ -0,0 +1,280 @@
+# 🧠 RAG Application:
+
+## 🎯 **What is RAG and Why It Matters**
+
+**RAG (Retrieval-Augmented Generation)** is a powerful AI technique that combines the best of both worlds:
+
+1. **🔍 Retrieval**: Find relevant information from your knowledge base
+2. **🤖 Generation**: Use AI to create intelligent, contextual responses
+
+### **Why RAG is Revolutionary**
+
+Traditional AI models have limitations:
+- ❌ **Knowledge cutoff**: They only know what they were trained on
+- ❌ **Hallucinations**: They can make up false information
+- ❌ **No source attribution**: You can't verify where information comes from
+
+RAG solves these problems by:
+- ✅ **Always up-to-date**: Uses your current documents and data
+- ✅ **Factual responses**: Grounded in real information from your knowledge base
+- ✅ **Source transparency**: Shows you exactly which documents were used
+- ✅ **Customizable**: Tailored to your specific domain and use case
+
+## 🏗️ **Your RAG System Architecture**
+
+Your RAG application follows a sophisticated, production-ready architecture:
+
+```
+┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
+│ User Query │───▶│ Vector Search │───▶│ AI Generation │
+└─────────────────┘ └─────────────────┘ └─────────────────┘
+ │ │
+ ▼ ▼
+ ┌─────────────────┐ ┌─────────────────┐
+ │ Document Store │ │ Context-Aware │
+ │ (pgvector) │ │ Response │
+ └─────────────────┘ └─────────────────┘
+```
+
+### **🔍 Step 1: Document Processing**
+```
+Upload Document → Text Extraction → Chunking → Embedding Generation → Vector Storage
+```
+
+### **🔍 Step 2: Query Processing**
+```
+User Question → Query Embedding → Similarity Search → Context Retrieval
+```
+
+### **🤖 Step 3: Response Generation**
+```
+Retrieved Context + User Role + Question → OpenAI GPT → Contextual Response
+```
+
+## 🚀 **How to Use Your RAG System**
+
+### **1. 📚 Document Management**
+
+#### **Uploading Documents**
+```bash
+# Upload a document via API
+curl -X POST "http://localhost:8003/api/v1/documents/upload" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN" \
+ -F "file=@medical_guidelines.pdf" \
+ -F "title=Medical Guidelines 2024" \
+ -F "document_type=guidelines" \
+ -F "department=cardiology"
+```
+
+#### **Document Types Supported**
+- **PDF files**: Medical reports, guidelines, research papers
+- **Text files**: Notes, procedures, policies
+- **Word documents**: Clinical documentation
+
+#### **Automatic Processing**
+When you upload a document, the system automatically:
+1. **Extracts text** from the document
+2. **Chunks the content** into manageable pieces (1000 tokens with 200 token overlap)
+3. **Generates embeddings** using OpenAI's `text-embedding-3-small`
+4. **Stores vectors** in PostgreSQL with pgvector
+5. **Applies authorization** rules based on user roles
+
+### **2. 🔍 Searching Documents**
+
+#### **Vector Similarity Search**
+```bash
+# Search for relevant documents
+curl -X POST "http://localhost:8003/api/v1/chat/search" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "query": "heart attack symptoms",
+ "document_types": ["guidelines", "research"],
+ "department": "cardiology",
+ "limit": 10
+ }'
+```
+
+#### **Search Features**
+- **Semantic search**: Finds documents even if they don't contain exact keywords
+- **Department filtering**: Search within specific departments
+- **Document type filtering**: Filter by guidelines, research, procedures, etc.
+- **Similarity threshold**: Configurable relevance scoring
+
+### **3. 🤖 AI-Powered Q&A**
+
+#### **Asking Questions**
+```bash
+# Ask a question and get AI-powered response
+curl -X POST "http://localhost:8003/api/v1/chat/ask" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN" \
+ -H "Content-Type: application/json" \
+ -d '{
+ "message": "What are the latest treatment guidelines for diabetes?",
+ "context_patient_id": 123,
+ "context_department": "endocrinology",
+ "max_results": 5
+ }'
+```
+
+#### **Response Features**
+- **Context-aware**: Uses relevant documents to inform responses
+- **Role-based**: Tailored responses for doctors, nurses, and administrators
+- **Source attribution**: Shows which documents were used
+- **Fallback handling**: Graceful responses when no relevant context is found
+
+## 🎯 **Role-Based RAG Experience**
+
+### **👨⚕️ Doctor Experience**
+```python
+# Doctors get professional medical responses
+system_prompt = """You are an AI assistant helping a doctor in a healthcare setting.
+Provide accurate, professional medical information based on the provided context.
+Always remind users to verify information and consult current medical guidelines."""
+```
+
+**Example Doctor Query**: "What are the contraindications for prescribing metformin?"
+**RAG Response**: Uses latest medical guidelines and research papers to provide evidence-based information.
+
+### **👩⚕️ Nurse Experience**
+```python
+# Nurses get practical care information
+system_prompt = """You are an AI assistant helping a nurse in a healthcare setting.
+Provide practical, relevant information for nursing care based on the provided context.
+Focus on procedures, patient care, and safety protocols."""
+```
+
+**Example Nurse Query**: "How do I properly administer insulin to a patient?"
+**RAG Response**: Uses nursing procedures and safety guidelines for step-by-step instructions.
+
+### **👨💼 Administrator Experience**
+```python
+# Administrators get policy and procedure information
+system_prompt = """You are an AI assistant helping a healthcare administrator.
+Provide information about policies, procedures, and administrative matters based on the provided context."""
+```
+
+**Example Admin Query**: "What are the HIPAA compliance requirements for patient data?"
+**RAG Response**: Uses policy documents and compliance guidelines.
+
+## 🔐 **Security & Authorization**
+
+### **Oso Authorization System**
+Your RAG system uses Oso for fine-grained access control:
+
+```python
+# Example authorization rules
+allow(user: User, "read", document: Document) if
+ user.role == "admin" or
+ user.department == document.department or
+ document.patient_id in user.assigned_patients;
+```
+
+### **Access Control Features**
+- **Role-based access**: Different permissions for doctors, nurses, admins
+- **Department isolation**: Users only see documents from their department
+- **Patient-specific access**: Doctors only see documents for their assigned patients
+- **Sensitive document handling**: Special handling for confidential information
+
+## 📊 **Monitoring & Analytics**
+
+### **Embedding Status Tracking**
+```bash
+# Check embedding status for all documents
+curl -X GET "http://localhost:8003/api/v1/documents/embedding-statuses" \
+ -H "Authorization: Bearer YOUR_JWT_TOKEN"
+```
+
+### **Performance Metrics**
+- **Retrieval accuracy**: How well the system finds relevant documents
+- **Response quality**: User satisfaction with AI responses
+- **Processing time**: How quickly documents are processed and queries are answered
+
+## 🛠️ **Configuration & Customization**
+
+### **Environment Variables**
+```env
+# Core RAG Configuration
+EMBEDDING_MODEL=text-embedding-3-small
+CHAT_MODEL=gpt-4o-mini
+CHUNK_SIZE=1000
+CHUNK_OVERLAP=200
+MAX_CONTEXT_LENGTH=8000
+SIMILARITY_THRESHOLD=0.7
+MAX_RESULTS=5
+```
+
+### **Customizing Chunking Strategy**
+```python
+# Adjust chunk size based on document type
+if document_type == "research_paper":
+ chunk_size = 1500 # Longer chunks for detailed content
+elif document_type == "procedure":
+ chunk_size = 500 # Shorter chunks for step-by-step procedures
+```
+
+### **Similarity Threshold Tuning**
+```python
+# Adjust based on your use case
+if user_role == "doctor":
+ similarity_threshold = 0.8 # Higher threshold for medical accuracy
+elif user_role == "nurse":
+ similarity_threshold = 0.6 # Lower threshold for broader context
+```
+
+## 🚀 **Best Practices**
+
+### **1. Document Organization**
+- **Use descriptive titles**: "Cardiology Guidelines 2024" vs "Document1"
+- **Categorize properly**: Assign correct document types and departments
+- **Keep content clean**: Remove formatting artifacts before upload
+
+### **2. Query Optimization**
+- **Be specific**: "diabetes type 2 treatment guidelines" vs "diabetes"
+- **Use context**: Specify patient or department when relevant
+- **Iterate**: Refine queries based on initial results
+
+### **3. System Maintenance**
+- **Monitor embedding status**: Ensure all documents are properly embedded
+- **Regular updates**: Keep documents current and relevant
+- **Performance monitoring**: Track query performance and user satisfaction
+
+## 🔧 **Troubleshooting**
+
+### **Common Issues**
+
+#### **No Relevant Results**
+- **Check similarity threshold**: Lower it to get more results
+- **Verify document content**: Ensure documents contain relevant information
+- **Review chunking**: Documents might be chunked inappropriately
+
+#### **Slow Response Times**
+- **Check embedding status**: Ensure all documents are embedded
+- **Optimize queries**: Use more specific search terms
+- **Monitor database performance**: Check pgvector index performance
+
+#### **Authorization Errors**
+- **Verify user permissions**: Check user role and department assignments
+- **Review Oso policies**: Ensure authorization rules are correct
+- **Check document metadata**: Verify department and patient assignments
+
+## 🎯 **Next Steps**
+
+Your RAG system is already production-ready! Here are some ways to enhance it further:
+
+1. **📈 Add Analytics**: Track usage patterns and response quality
+2. **🔄 Conversation Memory**: Remember previous interactions for better context
+3. **🎯 Personalization**: Learn user preferences and adapt responses
+4. **🚀 Performance Optimization**: Add caching and batch processing
+5. **🔍 Advanced Search**: Implement hybrid search (vector + keyword)
+
+## 📚 **Additional Resources**
+
+- **API Documentation**: http://localhost:8003/docs
+- **RAG Research**: Papers on retrieval-augmented generation
+- **OpenAI Documentation**: Embedding and chat completion APIs
+- **pgvector Documentation**: Vector similarity search in PostgreSQL
+
+---
+
+**Your RAG system is a powerful tool that combines the best of AI with your organization's knowledge. Use it wisely, and it will become an invaluable asset for your healthcare team!** 🏥✨
diff --git a/python/rag/healthcare-support-portal/packages/rag/README.md b/python/rag/healthcare-support-portal/packages/rag/README.md
new file mode 100644
index 00000000..d51f9705
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/README.md
@@ -0,0 +1,39 @@
+# RAG Service
+
+AI-powered document search and question answering service for the Healthcare Support Portal.
+
+## Features
+
+- Document embedding generation using OpenAI
+- Vector similarity search with pgvector
+- Context-aware AI responses
+- Role-based access control with Oso
+- Galileo observability integration
+
+## API Endpoints
+
+- `POST /api/v1/chat/ask` - Ask AI questions with RAG context
+- `POST /api/v1/chat/search` - Search documents by similarity
+- `POST /api/v1/documents/upload` - Upload and process documents
+- `GET /api/v1/documents/` - List authorized documents
+
+## Configuration
+
+Configure the service using environment variables in `.env`:
+
+- `OPENAI_API_KEY` - Required for embeddings and chat
+- `GALILEO_API_KEY` - Optional for observability
+- `DATABASE_URL` - PostgreSQL connection string
+- `OSO_URL` - Oso authorization server URL
+
+## Running
+
+```bash
+uv run uvicorn src.rag_service.main:app --reload --host 0.0.0.0 --port 8003
+```
+
+Or use the provided script:
+
+```bash
+./run.sh
+```
diff --git a/python/rag/healthcare-support-portal/packages/rag/pyproject.toml b/python/rag/healthcare-support-portal/packages/rag/pyproject.toml
new file mode 100644
index 00000000..15ef21f9
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/pyproject.toml
@@ -0,0 +1,34 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "rag"
+version = "0.1.0"
+description = "RAG service for Healthcare Support Portal"
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = [
+ "fastapi>=0.104.0",
+ "uvicorn[standard]>=0.24.0",
+ "pydantic>=2.0.0",
+ "pydantic-settings>=2.0.0",
+ "sqlalchemy>=2.0.0",
+ "pgvector>=0.2.0",
+ "openai>=1.0.0",
+ "tiktoken>=0.5.0",
+ "numpy>=1.24.0",
+ "python-multipart>=0.0.6",
+ "python-dotenv>=1.0.0",
+ "packaging>=21.0",
+ "common",
+ "galileo>=1.15.1",
+ "structlog>=23.0.0",
+ "rich>=13.0.0",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/rag_service"]
+
+[tool.uv.sources]
+common = { workspace = true }
diff --git a/python/rag/healthcare-support-portal/packages/rag/run.sh b/python/rag/healthcare-support-portal/packages/rag/run.sh
new file mode 100755
index 00000000..a97d7e77
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/run.sh
@@ -0,0 +1,89 @@
+#!/bin/bash
+# packages/rag/run.sh
+
+# Exit on any error
+set -e
+
+# Function to check if a command exists
+command_exists() {
+ command -v "$1" >/dev/null 2>&1
+}
+
+# Load .env file if it exists
+if [ -f .env ]; then
+ echo "Loading environment variables from .env file..."
+ set -o allexport
+ source .env
+ set +o allexport
+else
+ echo "⚠️ Warning: No .env file found. Using defaults."
+fi
+
+# Set PYTHONPATH to include common package
+export PYTHONPATH="../common/src:$PYTHONPATH"
+
+# Set default environment variables if not already set
+export SECRET_KEY="${SECRET_KEY:-your-secret-key-here}"
+export DATABASE_URL="${DATABASE_URL:-postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare}"
+export DEBUG="${DEBUG:-true}"
+export HOST="${HOST:-0.0.0.0}"
+export PORT="${PORT:-8003}"
+
+# OpenAI Configuration
+export OPENAI_API_KEY="${OPENAI_API_KEY:-}"
+export EMBEDDING_MODEL="${EMBEDDING_MODEL:-text-embedding-3-small}"
+export CHAT_MODEL="${CHAT_MODEL:-gpt-4o-mini}"
+
+# RAG Configuration
+export CHUNK_SIZE="${CHUNK_SIZE:-1000}"
+export CHUNK_OVERLAP="${CHUNK_OVERLAP:-200}"
+export MAX_CONTEXT_LENGTH="${MAX_CONTEXT_LENGTH:-8000}"
+export SIMILARITY_THRESHOLD="${SIMILARITY_THRESHOLD:-0.7}"
+export MAX_RESULTS="${MAX_RESULTS:-5}"
+
+echo "🤖 Starting RAG Service on port $PORT..."
+echo "📊 Debug mode: $DEBUG"
+echo "🔑 Using SECRET_KEY: ${SECRET_KEY:0:10}..."
+echo "🗄️ Database: ${DATABASE_URL%%@*}@***"
+echo "🧠 OpenAI API Key: ${OPENAI_API_KEY:0:10}${OPENAI_API_KEY:10:1}..."
+echo "📝 Embedding Model: $EMBEDDING_MODEL"
+echo "💬 Chat Model: $CHAT_MODEL"
+echo "🔍 Similarity Threshold: $SIMILARITY_THRESHOLD"
+
+# Check if OpenAI API key is set
+if [ -z "$OPENAI_API_KEY" ]; then
+ echo "⚠️ WARNING: OPENAI_API_KEY is not set. RAG functionality will not work."
+ echo " Please set your OpenAI API key in the .env file or environment variables."
+fi
+
+# Check for uv command
+UV_CMD="uv"
+if [ -f "/opt/homebrew/bin/uv" ]; then
+ UV_CMD="/opt/homebrew/bin/uv"
+fi
+
+if ! command_exists "$UV_CMD"; then
+ echo "❌ uv package manager not found. Please install uv and try again."
+ echo " Installation: curl -LsSf https://astral.sh/uv/install.sh | sh"
+ exit 1
+fi
+
+# Check if port is available
+if command_exists lsof; then
+ if lsof -i :$PORT -sTCP:LISTEN -t >/dev/null 2>&1; then
+ echo "❌ Port $PORT is already in use. Please stop the service using this port."
+ exit 1
+ fi
+fi
+
+# Check essential environment variables
+if [ "$SECRET_KEY" = "your-secret-key-here" ] || [ "$SECRET_KEY" = "change-me-in-production" ]; then
+ echo "⚠️ WARNING: Using default SECRET_KEY. This is insecure for production!"
+fi
+
+# Run the RAG service
+echo "🚀 Starting uvicorn server..."
+if ! $UV_CMD run uvicorn src.rag_service.main:app --reload --host $HOST --port $PORT; then
+ echo "❌ Failed to start RAG Service"
+ exit 1
+fi
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/__init__.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/__init__.py
new file mode 100644
index 00000000..38058a03
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/__init__.py
@@ -0,0 +1,6 @@
+"""
+RAG Service for Healthcare Support Portal
+Handles document management, embeddings, and AI-powered responses
+"""
+
+__version__ = "0.1.0"
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/config.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/config.py
new file mode 100644
index 00000000..eebb9321
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/config.py
@@ -0,0 +1,57 @@
+import os
+
+from dotenv import load_dotenv
+from pydantic_settings import BaseSettings
+
+load_dotenv()
+
+
+class Settings(BaseSettings):
+ app_name: str = "Healthcare Support Portal - RAG Service"
+ debug: bool = os.getenv("DEBUG", "False").lower() == "true"
+ host: str = "0.0.0.0"
+ port: int = 8003
+
+ # Database
+ database_url: str = os.getenv(
+ "DATABASE_URL",
+ "postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare",
+ )
+
+ # JWT
+ secret_key: str = os.getenv("SECRET_KEY", "your-secret-key-here")
+
+ # OpenAI
+ openai_api_key: str = os.getenv("OPENAI_API_KEY", "")
+ embedding_model: str = "text-embedding-3-small"
+ chat_model: str = "gpt-4o-mini"
+
+ # RAG Configuration
+ chunk_size: int = 1000
+ chunk_overlap: int = 200
+ max_context_length: int = 8000
+ similarity_threshold: float = 0.3
+ max_results: int = 5
+
+ # Oso Configuration
+ oso_url: str = os.getenv("OSO_URL", "http://localhost:8080")
+ oso_auth: str = os.getenv("OSO_AUTH", "e_0123456789_12345_osotesttoken01xiIn")
+
+ # Galileo 2.0 Observability Configuration
+ galileo_enabled: bool = os.getenv("GALILEO_ENABLED", "true").lower() == "true"
+ galileo_api_key: str = os.getenv("GALILEO_API_KEY", "")
+ galileo_project_name: str = os.getenv("GALILEO_PROJECT_NAME", "healthcare-rag")
+ galileo_environment: str = os.getenv("GALILEO_ENVIRONMENT", "development")
+
+ # Logging Configuration
+ log_level: str = os.getenv("LOG_LEVEL", "INFO")
+ log_format: str = os.getenv("LOG_FORMAT", "json") # json or console
+
+ class Config:
+ env_file = ".env"
+ # Explicitly ignore extra fields to prevent OpenTelemetry/Prometheus
+ # env vars from being loaded
+ extra = "ignore"
+
+
+settings = Settings()
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/main.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/main.py
new file mode 100644
index 00000000..25427fbb
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/main.py
@@ -0,0 +1,104 @@
+import sys
+from pathlib import Path
+
+# Add the common package to Python path
+common_path = Path(__file__).parent.parent.parent.parent / "common" / "src"
+sys.path.insert(0, str(common_path))
+
+import sqlalchemy_oso_cloud
+from common.migration_check import require_migrations_current
+from common.models import Base
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from galileo.openai import openai
+
+from .config import settings
+from .observability import initialize_observability, ObservabilityMiddleware, logger
+from .routers import chat, documents
+
+# Set OpenAI API key
+openai.api_key = settings.openai_api_key
+
+# Initialize SQLAlchemy Oso Cloud with registry and server settings
+# Add error handling for development environments where OSO might not be available
+try:
+ sqlalchemy_oso_cloud.init(Base.registry, url=settings.oso_url, api_key=settings.oso_auth)
+ print(f"✅ OSO Cloud initialized: {settings.oso_url}")
+except Exception as e:
+ print(f"⚠️ OSO Cloud initialization failed: {e}")
+ print("🔧 Authorization will be disabled - use for development only!")
+ # You may want to set a flag here to disable authorization checks
+
+# Create FastAPI app
+app = FastAPI(
+ title=settings.app_name,
+ description="RAG service with vector search and AI-powered responses",
+ version="0.1.0",
+ debug=settings.debug,
+)
+
+# Add observability middleware
+app.add_middleware(ObservabilityMiddleware)
+
+# Add CORS middleware
+app.add_middleware(
+ CORSMiddleware,
+ allow_origins=["*"], # Configure appropriately for production
+ allow_credentials=True,
+ allow_methods=["*"],
+ allow_headers=["*"],
+)
+
+# Include routers
+app.include_router(documents.router, prefix="/api/v1/documents", tags=["Documents"])
+app.include_router(chat.router, prefix="/api/v1/chat", tags=["Chat"])
+
+
+@app.on_event("startup")
+async def startup_event():
+ """Verify migrations and start service"""
+ try:
+ # Initialize observability components
+ initialize_observability()
+
+ # Verify database migrations are current
+ require_migrations_current()
+
+ logger.info(f"🚀 {settings.app_name} started successfully", port=settings.port, galileo_enabled=settings.galileo_enabled)
+
+ except Exception as e:
+ logger.error(f"Failed to start {settings.app_name}", error=str(e))
+ raise
+
+
+@app.get("/")
+async def root():
+ return {
+ "service": "rag_service",
+ "status": "healthy",
+ "version": "0.1.0",
+ "observability": {"galileo_enabled": settings.galileo_enabled},
+ }
+
+
+@app.get("/health")
+async def health_check():
+ return {"status": "healthy"}
+
+
+@app.get("/observability")
+async def observability_status():
+ """Get observability configuration status"""
+ return {
+ "galileo": {
+ "enabled": settings.galileo_enabled,
+ "project": settings.galileo_project_name,
+ "environment": settings.galileo_environment,
+ },
+ "logging": {"level": settings.log_level, "format": settings.log_format},
+ }
+
+
+# Make Oso Cloud instance and settings available to routes
+app.state.oso_sqlalchemy = sqlalchemy_oso_cloud
+app.state.settings = settings
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/observability.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/observability.py
new file mode 100644
index 00000000..7ffaa39b
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/observability.py
@@ -0,0 +1,553 @@
+"""
+Observability module for RAG service using Galileo 2.0 and structured logging.
+"""
+
+import time
+import uuid
+from contextlib import asynccontextmanager
+from typing import Any, Dict, Optional
+
+import structlog
+from fastapi import Request
+
+# Import Galileo modules correctly
+from galileo import GalileoLogger, galileo_context
+import os
+
+from .config import settings
+
+# Initialize structured logging
+structlog.configure(
+ processors=[
+ structlog.stdlib.filter_by_level,
+ structlog.stdlib.add_logger_name,
+ structlog.stdlib.add_log_level,
+ structlog.stdlib.PositionalArgumentsFormatter(),
+ structlog.processors.TimeStamper(fmt="iso"),
+ structlog.processors.StackInfoRenderer(),
+ structlog.processors.format_exc_info,
+ structlog.processors.UnicodeDecoder(),
+ structlog.processors.JSONRenderer() if settings.log_format == "json" else structlog.dev.ConsoleRenderer(),
+ ],
+ context_class=dict,
+ logger_factory=structlog.stdlib.LoggerFactory(),
+ wrapper_class=structlog.stdlib.BoundLogger,
+ cache_logger_on_first_use=True,
+)
+
+logger = structlog.get_logger(__name__)
+
+# Galileo logging enabled flag
+galileo_enabled: bool = False
+galileo_logger: GalileoLogger = None
+
+
+def initialize_observability():
+ """Initialize all observability components."""
+ global galileo_enabled, galileo_logger
+
+ logger.info("Initializing observability components")
+
+ # Read Galileo configuration from settings
+ galileo_api_key = settings.galileo_api_key
+ galileo_project_name = settings.galileo_project_name
+
+ # Initialize Galileo logging if enabled and API key is provided
+ if settings.galileo_enabled and galileo_api_key and galileo_api_key.strip():
+ try:
+ # Set Galileo environment variables for the modern API
+ os.environ["GALILEO_API_KEY"] = galileo_api_key
+ os.environ["GALILEO_PROJECT_NAME"] = galileo_project_name
+ os.environ["GALILEO_ENVIRONMENT"] = settings.galileo_environment
+
+ # Initialize GalileoLogger
+ galileo_logger = GalileoLogger(project=galileo_project_name, log_stream="rag-service")
+
+ galileo_enabled = True
+ logger.info(
+ "Galileo logging initialized successfully",
+ project=galileo_project_name,
+ environment=settings.galileo_environment,
+ )
+ except Exception as e:
+ logger.error("Failed to initialize Galileo logging", error=str(e))
+ galileo_enabled = False
+ galileo_logger = None
+ else:
+ logger.info("Galileo observability disabled or API key not configured")
+ galileo_enabled = False
+ galileo_logger = None
+
+
+@asynccontextmanager
+async def rag_query_context(query_type: str, user_role: str, department: str = None, query_id: str = None):
+ """Context manager for RAG query observability."""
+ if query_id is None:
+ query_id = str(uuid.uuid4())
+
+ start_time = time.time()
+ trace = None
+
+ try:
+ # Log query start
+ logger.info("RAG query started", query_type=query_type, user_role=user_role, department=department, query_id=query_id)
+
+ # Start Galileo trace if enabled
+ if galileo_enabled and galileo_logger:
+ try:
+ # Start a session if not already started
+ session_id = galileo_logger.start_session(name=f"RAG-{query_type}", external_id=query_id)
+
+ # Start a trace
+ trace = galileo_logger.start_trace(
+ input=f"RAG {query_type} query",
+ name=f"RAG Query - {query_type}",
+ tags=[query_type, user_role, department] if department else [query_type, user_role],
+ metadata={
+ "query_type": query_type,
+ "user_role": user_role,
+ "department": department,
+ "query_id": query_id,
+ },
+ )
+ except Exception as e:
+ logger.warning("Failed to start Galileo trace", error=str(e))
+
+ yield query_id
+
+ except Exception as e:
+ # Log error
+ logger.error(
+ "RAG query failed",
+ query_type=query_type,
+ user_role=user_role,
+ department=department,
+ query_id=query_id,
+ error=str(e),
+ )
+
+ # Add error information to Galileo trace if enabled
+ if galileo_enabled and galileo_logger and trace:
+ try:
+ # Add an agent span to capture the error
+ galileo_logger.add_agent_span(
+ input=f"RAG {query_type} query",
+ output=f"Error: {str(e)}",
+ name=f"RAG Error - {query_type}",
+ metadata={"error_type": type(e).__name__, "error": str(e)},
+ tags=["error", query_type],
+ )
+ except Exception as galileo_error:
+ logger.warning("Failed to log error to Galileo", error=str(galileo_error))
+
+ raise
+
+ finally:
+ # Calculate duration
+ duration = time.time() - start_time
+ duration_ns = int(duration * 1_000_000_000)
+
+ # Log query completion
+ logger.info(
+ "RAG query completed",
+ query_type=query_type,
+ user_role=user_role,
+ department=department,
+ query_id=query_id,
+ duration=duration,
+ )
+
+ # Conclude Galileo trace if enabled
+ if galileo_enabled and galileo_logger and trace:
+ try:
+ galileo_logger.conclude(output="RAG query completed", duration_ns=duration_ns)
+ galileo_logger.flush()
+ except Exception as galileo_error:
+ logger.warning("Failed to conclude Galileo trace", error=str(galileo_error))
+
+
+@asynccontextmanager
+async def embedding_generation_context(model: str, chunk_count: int, operation_id: str = None):
+ """Context manager for embedding generation observability."""
+ if operation_id is None:
+ operation_id = str(uuid.uuid4())
+
+ start_time = time.time()
+
+ try:
+ logger.info("Embedding generation started", model=model, chunk_count=chunk_count, operation_id=operation_id)
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="embedding_generation_started",
+ event_data={
+ "model": model,
+ "chunk_count": chunk_count,
+ "operation_id": operation_id,
+ "timestamp": start_time,
+ },
+ )
+
+ yield operation_id
+
+ except Exception as e:
+ logger.error("Embedding generation failed", model=model, chunk_count=chunk_count, operation_id=operation_id, error=str(e))
+
+ # Log error to Galileo
+ log_galileo_event(
+ event_type="embedding_generation_failed",
+ event_data={
+ "model": model,
+ "chunk_count": chunk_count,
+ "operation_id": operation_id,
+ "error": str(e),
+ "error_type": type(e).__name__,
+ "timestamp": time.time(),
+ },
+ )
+
+ raise
+
+ finally:
+ duration = time.time() - start_time
+
+ logger.info(
+ "Embedding generation completed",
+ model=model,
+ chunk_count=chunk_count,
+ operation_id=operation_id,
+ duration=duration,
+ )
+
+ # Log completion to Galileo
+ log_galileo_event(
+ event_type="embedding_generation_completed",
+ event_data={
+ "model": model,
+ "chunk_count": chunk_count,
+ "operation_id": operation_id,
+ "duration": duration,
+ "timestamp": time.time(),
+ },
+ )
+
+
+@asynccontextmanager
+async def vector_search_context(result_count: int, similarity_threshold: float, search_id: str = None):
+ """Context manager for vector search observability."""
+ if search_id is None:
+ search_id = str(uuid.uuid4())
+
+ start_time = time.time()
+
+ try:
+ logger.info(
+ "Vector search started",
+ result_count=result_count,
+ similarity_threshold=similarity_threshold,
+ search_id=search_id,
+ )
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="vector_search_started",
+ event_data={
+ "result_count": result_count,
+ "similarity_threshold": similarity_threshold,
+ "search_id": search_id,
+ "timestamp": start_time,
+ },
+ )
+
+ yield search_id
+
+ except Exception as e:
+ logger.error(
+ "Vector search failed",
+ result_count=result_count,
+ similarity_threshold=similarity_threshold,
+ search_id=search_id,
+ error=str(e),
+ )
+
+ # Log error to Galileo
+ log_galileo_event(
+ event_type="vector_search_failed",
+ event_data={
+ "result_count": result_count,
+ "similarity_threshold": similarity_threshold,
+ "search_id": search_id,
+ "error": str(e),
+ "error_type": type(e).__name__,
+ "timestamp": time.time(),
+ },
+ )
+
+ raise
+
+ finally:
+ duration = time.time() - start_time
+
+ logger.info(
+ "Vector search completed",
+ result_count=result_count,
+ similarity_threshold=similarity_threshold,
+ search_id=search_id,
+ duration=duration,
+ )
+
+ # Log completion to Galileo
+ log_galileo_event(
+ event_type="vector_search_completed",
+ event_data={
+ "result_count": result_count,
+ "similarity_threshold": similarity_threshold,
+ "search_id": search_id,
+ "duration": duration,
+ "timestamp": time.time(),
+ },
+ )
+
+
+@asynccontextmanager
+async def ai_response_context(model: str, token_count: int, response_id: str = None):
+ """Context manager for AI response generation observability."""
+ if response_id is None:
+ response_id = str(uuid.uuid4())
+
+ start_time = time.time()
+
+ try:
+ logger.info("AI response generation started", model=model, token_count=token_count, response_id=response_id)
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="ai_response_generation_started",
+ event_data={
+ "model": model,
+ "token_count": token_count,
+ "response_id": response_id,
+ "timestamp": start_time,
+ },
+ )
+
+ yield response_id
+
+ except Exception as e:
+ logger.error("AI response generation failed", model=model, token_count=token_count, response_id=response_id, error=str(e))
+
+ # Log error to Galileo
+ log_galileo_event(
+ event_type="ai_response_generation_failed",
+ event_data={
+ "model": model,
+ "token_count": token_count,
+ "response_id": response_id,
+ "error": str(e),
+ "error_type": type(e).__name__,
+ "timestamp": time.time(),
+ },
+ )
+
+ raise
+
+ finally:
+ duration = time.time() - start_time
+
+ logger.info(
+ "AI response generation completed",
+ model=model,
+ token_count=token_count,
+ response_id=response_id,
+ duration=duration,
+ )
+
+ # Log completion to Galileo
+ log_galileo_event(
+ event_type="ai_response_generation_completed",
+ event_data={
+ "model": model,
+ "token_count": token_count,
+ "response_id": response_id,
+ "duration": duration,
+ "timestamp": time.time(),
+ },
+ )
+
+
+def log_llm_call(
+ input_text: str,
+ output_text: str,
+ model: str,
+ num_input_tokens: int = None,
+ num_output_tokens: int = None,
+ total_tokens: int = None,
+ duration_ns: int = None,
+ temperature: float = None,
+):
+ """Log an LLM call to Galileo."""
+ if galileo_enabled and galileo_logger:
+ try:
+ galileo_logger.add_llm_span(
+ input=input_text,
+ output=output_text,
+ model=model,
+ name=f"LLM Call - {model}",
+ num_input_tokens=num_input_tokens,
+ num_output_tokens=num_output_tokens,
+ total_tokens=total_tokens,
+ duration_ns=duration_ns,
+ temperature=temperature,
+ tags=["llm", str(model)],
+ metadata={
+ "model": str(model),
+ "temperature": str(temperature) if temperature else "0.7",
+ "input_tokens": str(num_input_tokens) if num_input_tokens else "unknown",
+ "output_tokens": str(num_output_tokens) if num_output_tokens else "unknown",
+ "total_tokens": str(total_tokens) if total_tokens else "unknown",
+ },
+ )
+ logger.debug("LLM call logged to Galileo", model=model)
+ except Exception as e:
+ logger.warning("Failed to log LLM call to Galileo", error=str(e))
+
+
+def log_retriever_call(query: str, documents: list, duration_ns: int = None):
+ """Log a retriever call to Galileo."""
+ if galileo_enabled and galileo_logger:
+ try:
+ galileo_logger.add_retriever_span(
+ input=query,
+ output=documents,
+ name="Document Retrieval",
+ duration_ns=duration_ns,
+ tags=["retriever", "rag"],
+ metadata={
+ "query": str(query),
+ "document_count": str(len(documents)) if documents else "0",
+ "duration_ms": str(duration_ns / 1_000_000) if duration_ns else "unknown",
+ },
+ )
+ logger.debug("Retriever call logged to Galileo", doc_count=len(documents) if documents else 0)
+ except Exception as e:
+ logger.warning("Failed to log retriever call to Galileo", error=str(e))
+
+
+def log_document_upload(document_type: str, department: str, file_size: int, document_id: int):
+ """Log document upload metrics."""
+ logger.info(
+ "Document uploaded",
+ document_type=document_type,
+ department=department,
+ file_size=file_size,
+ document_id=document_id,
+ )
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="document_uploaded",
+ event_data={
+ "document_type": document_type,
+ "department": department,
+ "file_size": file_size,
+ "document_id": document_id,
+ "timestamp": time.time(),
+ },
+ )
+
+
+def log_embeddings_stored(document_id: int, chunk_count: int):
+ """Log embeddings storage metrics."""
+ logger.info("Embeddings stored", document_id=document_id, chunk_count=chunk_count)
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="embeddings_stored",
+ event_data={"document_id": document_id, "chunk_count": chunk_count, "timestamp": time.time()},
+ )
+
+
+def log_galileo_event(event_type: str, event_data: Dict[str, Any], user_id: str = None, session_id: str = None):
+ """Log event to Galileo using the GalileoLogger."""
+ if galileo_enabled and galileo_logger:
+ try:
+ # Create a workflow span for general events
+ message = event_data.get("query", event_data.get("message", f"{event_type} event"))
+
+ # Add a workflow span to capture the event
+ # Convert all metadata values to strings for Galileo validation
+ metadata = {
+ "event_type": str(event_type),
+ "user_id": str(user_id) if user_id else "unknown",
+ "session_id": str(session_id or str(uuid.uuid4())),
+ "timestamp": str(time.time()),
+ }
+
+ # Convert event_data values to strings
+ for key, value in event_data.items():
+ metadata[key] = str(value) if value is not None else "null"
+
+ galileo_logger.add_workflow_span(
+ input=message,
+ output=f"Event: {event_type}",
+ name=event_type,
+ metadata=metadata,
+ tags=[event_type, "event"],
+ )
+
+ logger.debug("Event logged to Galileo", event_type=event_type, user_id=user_id, session_id=session_id)
+ except Exception as e:
+ logger.error("Failed to log event to Galileo", event_type=event_type, error=str(e))
+
+
+class ObservabilityMiddleware:
+ """FastAPI middleware for observability."""
+
+ def __init__(self, app):
+ self.app = app
+
+ async def __call__(self, scope, receive, send):
+ if scope["type"] == "http":
+ request = Request(scope, receive)
+
+ start_time = time.time()
+
+ try:
+ await self.app(scope, receive, send)
+ except Exception as e:
+ # Log error to Galileo
+ log_galileo_event(
+ event_type="http_request_failed",
+ event_data={
+ "method": request.method,
+ "path": request.url.path,
+ "error": str(e),
+ "error_type": type(e).__name__,
+ "timestamp": time.time(),
+ },
+ )
+ raise
+ finally:
+ duration = time.time() - start_time
+
+ logger.info(
+ "HTTP request completed",
+ method=request.method,
+ path=request.url.path,
+ duration=duration,
+ status_code=getattr(scope, "status_code", 500),
+ )
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="http_request_completed",
+ event_data={
+ "method": request.method,
+ "path": request.url.path,
+ "duration": duration,
+ "status_code": getattr(scope, "status_code", 500),
+ "timestamp": time.time(),
+ },
+ )
+ else:
+ await self.app(scope, receive, send)
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/__init__.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/__init__.py
new file mode 100644
index 00000000..5bb3dc22
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/__init__.py
@@ -0,0 +1 @@
+# Router package initialization
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/chat.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/chat.py
new file mode 100644
index 00000000..0b34ce77
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/chat.py
@@ -0,0 +1,425 @@
+import sys
+from pathlib import Path
+
+# Add the common package to Python path
+common_path = Path(__file__).parent.parent.parent.parent.parent / "common" / "src"
+sys.path.insert(0, str(common_path))
+
+
+from galileo.openai import openai
+from common.auth import get_current_user
+from common.db import get_db
+from common.models import Document, User
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from pydantic import BaseModel
+from sqlalchemy.orm import Session
+from sqlalchemy_oso_cloud import authorized
+
+from ..utils.embeddings import combine_chunks_for_context, similarity_search
+from ..utils.text_processing import calculate_token_count
+from ..observability import rag_query_context, vector_search_context, ai_response_context, log_galileo_event, logger
+
+router = APIRouter()
+
+
+# Request/Response Models
+class ChatRequest(BaseModel):
+ message: str
+ context_patient_id: int | None = None
+ context_department: str | None = None
+ max_results: int | None = 5
+
+
+class ChatResponse(BaseModel):
+ response: str
+ sources: list[dict]
+ token_count: int
+ context_used: bool
+
+
+class SearchRequest(BaseModel):
+ query: str
+ document_types: list[str] | None = None
+ department: str | None = None
+ limit: int | None = 10
+
+
+class SearchResponse(BaseModel):
+ results: list[dict]
+ total_results: int
+
+
+@router.post("/search", response_model=SearchResponse)
+async def search_documents(
+ search_request: SearchRequest,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Search documents using vector similarity
+ """
+ settings = request.app.state.settings
+
+ async with rag_query_context(query_type="search", user_role=current_user.role, department=search_request.department) as query_id:
+
+ # Get authorized documents query with OSO fallback
+ try:
+ authorized_query = db.query(Document).options(authorized(current_user, "read", Document))
+ except Exception as oso_error:
+ logger.warning(
+ "OSO authorization failed in search, falling back to basic query",
+ query_id=query_id,
+ error=str(oso_error),
+ user_role=current_user.role,
+ )
+ # Fallback to basic role-based filtering
+ authorized_query = db.query(Document)
+ if current_user.role != "admin":
+ authorized_query = authorized_query.filter(Document.department == current_user.department)
+
+ # Apply filters
+ if search_request.document_types:
+ authorized_query = authorized_query.filter(Document.document_type.in_(search_request.document_types))
+
+ if search_request.department:
+ authorized_query = authorized_query.filter(Document.department == search_request.department)
+
+ # Get authorized document IDs
+ authorized_docs = authorized_query.all()
+ authorized_doc_ids = [doc.id for doc in authorized_docs]
+
+ if not authorized_doc_ids:
+ logger.info(
+ "No authorized documents found for search",
+ query_id=query_id,
+ user_role=current_user.role,
+ department=search_request.department,
+ )
+ return SearchResponse(results=[], total_results=0)
+
+ # Perform similarity search with observability
+ async with vector_search_context(
+ result_count=search_request.limit or settings.max_results,
+ similarity_threshold=settings.similarity_threshold,
+ ) as search_id:
+
+ results = await similarity_search(
+ query_text=search_request.query,
+ db=db,
+ limit=search_request.limit or settings.max_results,
+ similarity_threshold=settings.similarity_threshold,
+ document_ids=authorized_doc_ids,
+ )
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="document_search",
+ event_data={
+ "query": search_request.query,
+ "document_types": search_request.document_types,
+ "department": search_request.department,
+ "results_count": len(results),
+ "authorized_docs_count": len(authorized_doc_ids),
+ "search_id": search_id,
+ },
+ user_id=str(current_user.id),
+ session_id=query_id,
+ )
+
+ logger.info(
+ "Document search completed",
+ query_id=query_id,
+ search_id=search_id,
+ results_count=len(results),
+ user_role=current_user.role,
+ )
+
+ return SearchResponse(results=results, total_results=len(results))
+
+
+@router.post("/ask", response_model=ChatResponse)
+async def ask_question(
+ chat_request: ChatRequest,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Ask a question and get an AI-powered response with RAG
+ """
+ settings = request.app.state.settings
+
+ async with rag_query_context(query_type="ask", user_role=current_user.role, department=chat_request.context_department) as query_id:
+
+ # Get authorized documents for context with OSO fallback
+ try:
+ authorized_query = db.query(Document).options(authorized(current_user, "read", Document))
+ except Exception as oso_error:
+ logger.warning(
+ "OSO authorization failed in ask question, falling back to basic query",
+ query_id=query_id,
+ error=str(oso_error),
+ user_role=current_user.role,
+ )
+ # Fallback to basic role-based filtering
+ authorized_query = db.query(Document)
+ if current_user.role != "admin":
+ authorized_query = authorized_query.filter(Document.department == current_user.department)
+
+ # Apply context filters if provided
+ if chat_request.context_patient_id:
+ authorized_query = authorized_query.filter(Document.patient_id == chat_request.context_patient_id)
+
+ if chat_request.context_department:
+ authorized_query = authorized_query.filter(Document.department == chat_request.context_department)
+
+ # Get authorized document IDs
+ authorized_docs = authorized_query.all()
+ authorized_doc_ids = [doc.id for doc in authorized_docs]
+
+ sources = []
+ context_used = False
+
+ if authorized_doc_ids:
+ # Perform similarity search with observability
+ async with vector_search_context(
+ result_count=chat_request.max_results or settings.max_results,
+ similarity_threshold=settings.similarity_threshold,
+ ) as search_id:
+
+ search_results = await similarity_search(
+ query_text=chat_request.message,
+ db=db,
+ limit=chat_request.max_results or settings.max_results,
+ similarity_threshold=settings.similarity_threshold,
+ document_ids=authorized_doc_ids,
+ )
+
+ sources = search_results
+ context_used = len(search_results) > 0
+
+ logger.info(
+ "Vector search completed for AI question",
+ query_id=query_id,
+ search_id=search_id,
+ sources_count=len(sources),
+ context_used=context_used,
+ )
+
+ # Generate AI response with observability
+ try:
+ token_count = calculate_token_count(chat_request.message)
+
+ async with ai_response_context(model=settings.chat_model, token_count=token_count) as response_id:
+
+ ai_response = await generate_ai_response(
+ question=chat_request.message,
+ context_results=sources,
+ user_role=current_user.role,
+ settings=settings,
+ )
+
+ final_token_count = calculate_token_count(ai_response)
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="ai_question_answered",
+ event_data={
+ "question": chat_request.message,
+ "context_used": context_used,
+ "sources_count": len(sources),
+ "response_length": len(ai_response),
+ "input_tokens": token_count,
+ "output_tokens": final_token_count,
+ "model": settings.chat_model,
+ "response_id": response_id,
+ },
+ user_id=str(current_user.id),
+ session_id=query_id,
+ )
+
+ logger.info(
+ "AI question answered successfully",
+ query_id=query_id,
+ response_id=response_id,
+ context_used=context_used,
+ sources_count=len(sources),
+ user_role=current_user.role,
+ )
+
+ return ChatResponse(
+ response=ai_response,
+ sources=sources,
+ token_count=final_token_count,
+ context_used=context_used,
+ )
+
+ except Exception as e:
+ logger.error("Failed to generate AI response", query_id=query_id, error=str(e), user_role=current_user.role)
+
+ # Log error to Galileo
+ log_galileo_event(
+ event_type="ai_response_error",
+ event_data={"question": chat_request.message, "error": str(e), "error_type": type(e).__name__},
+ user_id=str(current_user.id),
+ session_id=query_id,
+ )
+
+ raise HTTPException(
+ status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+ detail=f"Error generating response: {str(e)}",
+ )
+
+
+async def generate_ai_response(question: str, context_results: list[dict], user_role: str, settings) -> str:
+ """
+ Generate AI response using OpenAI with RAG context
+ """
+ # Prepare context from search results
+ context = ""
+ if context_results:
+ context = combine_chunks_for_context(context_results, max_tokens=settings.max_context_length)
+
+ # Create system prompt based on user role
+ system_prompts = {
+ "doctor": """You are an AI assistant helping a doctor in a healthcare setting.
+ Provide accurate, professional medical information based on the provided context.
+ Always remind users to verify information and consult current medical guidelines.""",
+ "nurse": """You are an AI assistant helping a nurse in a healthcare setting.
+ Provide practical, relevant information for nursing care based on the provided context.
+ Focus on procedures, patient care, and safety protocols.""",
+ "admin": """You are an AI assistant helping a healthcare administrator.
+ Provide information about policies, procedures, and administrative matters based on the provided context.""",
+ }
+
+ system_prompt = system_prompts.get(user_role, system_prompts["admin"])
+
+ # Prepare messages
+ messages = [
+ {"role": "system", "content": system_prompt},
+ ]
+
+ if context:
+ messages.append(
+ {
+ "role": "system",
+ "content": f"Use the following context to answer the user's question:\n\n{context}",
+ }
+ )
+
+ messages.append({"role": "user", "content": question})
+
+ # Generate response using OpenAI (Galileo instrumented)
+ import time
+
+ start_time = time.time()
+
+ try:
+ client = openai.OpenAI(api_key=settings.openai_api_key)
+ response = client.chat.completions.create(
+ model=settings.chat_model,
+ messages=messages,
+ # max_tokens=1000,
+ temperature=0.7,
+ )
+
+ ai_response = response.choices[0].message.content
+
+ # Calculate duration and tokens
+ duration_ns = int((time.time() - start_time) * 1_000_000_000)
+ input_tokens = response.usage.prompt_tokens if hasattr(response, "usage") else None
+ output_tokens = response.usage.completion_tokens if hasattr(response, "usage") else None
+ total_tokens = response.usage.total_tokens if hasattr(response, "usage") else None
+
+ # Log LLM call to Galileo
+ try:
+ from ..observability import log_llm_call
+
+ # Create full input context for logging
+ full_input = "\n\n".join([msg["content"] for msg in messages])
+
+ log_llm_call(
+ input_text=full_input,
+ output_text=ai_response,
+ model=settings.chat_model,
+ num_input_tokens=input_tokens,
+ num_output_tokens=output_tokens,
+ total_tokens=total_tokens,
+ duration_ns=duration_ns,
+ temperature=0.7,
+ )
+ except Exception as log_error:
+ print(f"Warning: Failed to log LLM call to Galileo: {log_error}")
+
+ # Add disclaimer if no context was used
+ if not context:
+ ai_response += (
+ "\n\n*Note: This response was generated without specific document context. Please verify information with current medical guidelines.*"
+ )
+
+ return ai_response
+
+ except Exception as e:
+ error_msg = f"I apologize, but I'm unable to generate a response at this time. Error: {str(e)}"
+
+ # Log error to Galileo
+ try:
+ from ..observability import log_llm_call
+
+ duration_ns = int((time.time() - start_time) * 1_000_000_000)
+ full_input = "\n\n".join([msg["content"] for msg in messages])
+
+ log_llm_call(
+ input_text=full_input,
+ output_text=error_msg,
+ model=settings.chat_model,
+ duration_ns=duration_ns,
+ temperature=0.7,
+ )
+ except Exception as log_error:
+ print(f"Warning: Failed to log LLM error to Galileo: {log_error}")
+
+ return error_msg
+
+
+@router.get("/conversation-history")
+async def get_conversation_history(current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+ """
+ Get conversation history for the current user
+ Note: In a full implementation, you'd store conversation history in the database
+ """
+ # Placeholder - would implement conversation storage
+ return {
+ "message": "Conversation history feature not yet implemented",
+ "user_id": current_user.id,
+ }
+
+
+@router.post("/feedback")
+async def submit_feedback(
+ response_id: str,
+ rating: int,
+ feedback: str | None = None,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Submit feedback on AI responses
+ Note: In a full implementation, you'd store feedback in the database
+ """
+ # Log feedback to Galileo
+ log_galileo_event(
+ event_type="ai_response_feedback",
+ event_data={"response_id": response_id, "rating": rating, "feedback": feedback},
+ user_id=str(current_user.id),
+ )
+
+ logger.info("AI response feedback submitted", response_id=response_id, rating=rating, user_role=current_user.role)
+
+ # Placeholder - would implement feedback storage
+ return {
+ "message": "Thank you for your feedback",
+ "response_id": response_id,
+ "rating": rating,
+ }
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/documents.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/documents.py
new file mode 100644
index 00000000..4f4c96dd
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/routers/documents.py
@@ -0,0 +1,522 @@
+import sys
+from pathlib import Path
+
+# Add the common package to Python path
+common_path = Path(__file__).parent.parent.parent.parent.parent / "common" / "src"
+sys.path.insert(0, str(common_path))
+
+
+from common.auth import get_current_user
+from common.db import get_db
+from common.models import Document, User
+from common.oso_sync import remove_document_access, sync_document_access
+from common.schemas import DocumentCreate, DocumentResponse
+from fastapi import (
+ APIRouter,
+ Depends,
+ File,
+ HTTPException,
+ Query,
+ Request,
+ UploadFile,
+ status,
+)
+from sqlalchemy.orm import Session
+from sqlalchemy_oso_cloud import authorized, get_oso
+
+from ..utils.embeddings import (
+ get_embedding_status,
+ regenerate_document_embeddings,
+ store_document_embeddings,
+)
+from ..utils.text_processing import chunk_text, clean_text
+from ..observability import (
+ embedding_generation_context,
+ log_document_upload,
+ log_embeddings_stored,
+ log_galileo_event,
+ logger,
+)
+
+router = APIRouter()
+
+
+@router.get("/", response_model=list[DocumentResponse])
+async def list_documents(
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+ skip: int = Query(0, ge=0),
+ limit: int = Query(100, ge=1, le=1000),
+ document_type: str | None = Query(None),
+ department: str | None = Query(None),
+):
+ """
+ List documents with Oso authorization filtering
+ """
+ # Use Oso Cloud to filter documents the current user can read
+ # Add error handling for development when OSO is not available
+ try:
+ query = db.query(Document).options(authorized(current_user, "read", Document))
+ except Exception as oso_error:
+ logger.warning("OSO authorization failed, falling back to basic query", error=str(oso_error), user_role=current_user.role)
+ # In development, fallback to showing documents based on role/department
+ query = db.query(Document)
+ if current_user.role != "admin":
+ # Non-admins only see documents from their department
+ query = query.filter(Document.department == current_user.department)
+
+ # Apply optional filters
+ if document_type:
+ query = query.filter(Document.document_type == document_type)
+
+ if department:
+ query = query.filter(Document.department == department)
+
+ # Apply pagination
+ documents = query.offset(skip).limit(limit).all()
+
+ logger.info(
+ "Documents listed",
+ user_role=current_user.role,
+ document_type=document_type,
+ department=department,
+ count=len(documents),
+ skip=skip,
+ limit=limit,
+ )
+
+ return documents
+
+
+@router.get("/embedding-statuses")
+async def get_all_embedding_statuses(
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Get embedding status for all documents the user can access
+ """
+ # Use Oso Cloud to filter documents the current user can read
+ # Add error handling for development when OSO is not available
+ try:
+ authorized_documents = db.query(Document).options(authorized(current_user, "read", Document)).all()
+ except Exception as oso_error:
+ logger.warning(
+ "OSO authorization failed in embedding statuses, falling back to basic query",
+ error=str(oso_error),
+ user_role=current_user.role,
+ )
+ # In development, fallback to showing documents based on role/department
+ if current_user.role == "admin":
+ authorized_documents = db.query(Document).all()
+ else:
+ authorized_documents = db.query(Document).filter(Document.department == current_user.department).all()
+
+ statuses = {}
+ for document in authorized_documents:
+ embedding_status = await get_embedding_status(document.id, db)
+ statuses[document.id] = embedding_status
+
+ logger.info(
+ "Embedding statuses retrieved",
+ user_role=current_user.role,
+ documents_count=len(authorized_documents),
+ statuses_count=len(statuses),
+ )
+
+ return statuses
+
+
+@router.get("/{document_id}", response_model=DocumentResponse)
+async def get_document(
+ document_id: int,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Get specific document with Oso authorization
+ """
+ oso = get_oso()
+
+ # Get the document
+ document = db.query(Document).filter(Document.id == document_id).first()
+
+ if not document:
+ logger.warning("Document not found", document_id=document_id, user_role=current_user.role)
+ raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Document not found")
+
+ # Check authorization with OSO fallback
+ try:
+ oso.authorize(current_user, "read", document)
+ except Exception as e:
+ logger.warning(
+ "OSO authorization failed for document access, checking basic authorization",
+ document_id=document_id,
+ user_role=current_user.role,
+ error=str(e),
+ )
+ # Fallback authorization logic for development
+ if current_user.role == "admin":
+ # Admins can access any document
+ pass
+ elif current_user.department == document.department:
+ # Users can access documents from their department
+ pass
+ else:
+ # Access denied
+ raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied - document not in your department")
+
+ logger.info(
+ "Document accessed",
+ document_id=document_id,
+ user_role=current_user.role,
+ document_type=document.document_type,
+ department=document.department,
+ )
+
+ return document
+
+
+@router.post("/", response_model=DocumentResponse)
+async def create_document(
+ document_data: DocumentCreate,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Create a new document
+ """
+ # Create document
+ document = Document(
+ title=document_data.title,
+ content=document_data.content,
+ document_type=document_data.document_type,
+ department=document_data.department,
+ is_sensitive=document_data.is_sensitive,
+ created_by_id=current_user.id,
+ )
+
+ db.add(document)
+ db.commit()
+ db.refresh(document)
+
+ # Sync Oso facts
+ sync_document_access(document)
+
+ # Log document creation
+ log_galileo_event(
+ event_type="document_created",
+ event_data={
+ "document_id": document.id,
+ "title": document.title,
+ "document_type": document.document_type,
+ "department": document.department,
+ "is_sensitive": document.is_sensitive,
+ "content_length": len(document.content),
+ },
+ user_id=str(current_user.id),
+ )
+
+ logger.info(
+ "Document created",
+ document_id=document.id,
+ user_role=current_user.role,
+ document_type=document.document_type,
+ department=document.department,
+ )
+
+ return document
+
+
+@router.post("/upload")
+async def upload_document(
+ file: UploadFile = File(...),
+ title: str = None,
+ document_type: str = None,
+ department: str = None,
+ is_sensitive: bool = False,
+ request: Request = None,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Upload and process a document file
+ """
+ settings = request.app.state.settings
+
+ # Read file content
+ content = await file.read()
+ file_size = len(content)
+
+ # Clean and process text
+ text_content = clean_text(content.decode("utf-8"))
+
+ # Use filename as title if not provided
+ if not title:
+ title = file.filename
+
+ # Create document
+ document = Document(
+ title=title,
+ content=text_content,
+ document_type=document_type or "unknown",
+ department=department or current_user.department,
+ is_sensitive=is_sensitive,
+ created_by_id=current_user.id,
+ )
+
+ db.add(document)
+ db.commit()
+ db.refresh(document)
+
+ # Sync Oso facts
+ sync_document_access(document)
+
+ # Log document upload
+ log_document_upload(
+ document_type=document.document_type,
+ department=document.department,
+ file_size=file_size,
+ document_id=document.id,
+ )
+
+ # Generate embeddings with observability
+ try:
+ chunks = chunk_text(
+ text_content,
+ chunk_size=settings.chunk_size,
+ chunk_overlap=settings.chunk_overlap,
+ )
+
+ async with embedding_generation_context(model=settings.embedding_model, chunk_count=len(chunks)) as operation_id:
+
+ success = await store_document_embeddings(
+ document=document,
+ chunks=chunks,
+ db=db,
+ model=settings.embedding_model,
+ )
+
+ if success:
+ log_embeddings_stored(document_id=document.id, chunk_count=len(chunks))
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="document_uploaded_with_embeddings",
+ event_data={
+ "document_id": document.id,
+ "title": document.title,
+ "document_type": document.document_type,
+ "department": document.department,
+ "file_size": file_size,
+ "chunks_count": len(chunks),
+ "embedding_model": settings.embedding_model,
+ "operation_id": operation_id,
+ },
+ user_id=str(current_user.id),
+ )
+
+ logger.info(
+ "Document uploaded and embeddings generated successfully",
+ document_id=document.id,
+ user_role=current_user.role,
+ chunks_count=len(chunks),
+ operation_id=operation_id,
+ )
+
+ return {
+ "message": "Document uploaded and processed successfully",
+ "document_id": document.id,
+ "chunks_created": len(chunks),
+ "embedding_status": "completed",
+ }
+ else:
+ logger.error(
+ "Failed to generate embeddings for uploaded document",
+ document_id=document.id,
+ user_role=current_user.role,
+ )
+
+ return {
+ "message": "Document uploaded but embedding generation failed",
+ "document_id": document.id,
+ "embedding_status": "failed",
+ }
+
+ except Exception as e:
+ logger.error("Error processing uploaded document", document_id=document.id, user_role=current_user.role, error=str(e))
+
+ # Log error to Galileo
+ log_galileo_event(
+ event_type="document_upload_error",
+ event_data={
+ "document_id": document.id,
+ "title": document.title,
+ "error": str(e),
+ "error_type": type(e).__name__,
+ },
+ user_id=str(current_user.id),
+ )
+
+ raise HTTPException(
+ status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+ detail=f"Error processing document: {str(e)}",
+ )
+
+
+@router.post("/{document_id}/regenerate-embeddings")
+async def regenerate_embeddings(
+ document_id: int,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Regenerate embeddings for a document
+ """
+ settings = request.app.state.settings
+
+ # Get document
+ document = db.query(Document).filter(Document.id == document_id).first()
+
+ if not document:
+ logger.warning("Document not found for embedding regeneration", document_id=document_id, user_role=current_user.role)
+ raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Document not found")
+
+ # Check authorization
+ try:
+ oso = get_oso()
+ oso.authorize(current_user, "read", document)
+ except Exception as e:
+ logger.warning(
+ "Unauthorized embedding regeneration attempt",
+ document_id=document_id,
+ user_role=current_user.role,
+ error=str(e),
+ )
+ raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied")
+
+ # Regenerate embeddings with observability
+ try:
+ chunks = chunk_text(
+ document.content,
+ chunk_size=settings.chunk_size,
+ chunk_overlap=settings.chunk_overlap,
+ )
+
+ async with embedding_generation_context(model=settings.embedding_model, chunk_count=len(chunks)) as operation_id:
+
+ result = await regenerate_document_embeddings(
+ document=document,
+ db=db,
+ model=settings.embedding_model,
+ )
+
+ if result["success"]:
+ log_embeddings_stored(document_id=document.id, chunk_count=len(chunks))
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="embeddings_regenerated",
+ event_data={
+ "document_id": document.id,
+ "title": document.title,
+ "chunks_count": len(chunks),
+ "embedding_model": settings.embedding_model,
+ "operation_id": operation_id,
+ },
+ user_id=str(current_user.id),
+ )
+
+ logger.info(
+ "Document embeddings regenerated successfully",
+ document_id=document.id,
+ user_role=current_user.role,
+ chunks_count=len(chunks),
+ operation_id=operation_id,
+ )
+
+ return result
+ else:
+ logger.error(
+ "Failed to regenerate document embeddings",
+ document_id=document.id,
+ user_role=current_user.role,
+ error=result["message"],
+ )
+
+ return result
+
+ except Exception as e:
+ logger.error("Error regenerating document embeddings", document_id=document_id, user_role=current_user.role, error=str(e))
+
+ # Log error to Galileo
+ log_galileo_event(
+ event_type="embedding_regeneration_error",
+ event_data={"document_id": document_id, "error": str(e), "error_type": type(e).__name__},
+ user_id=str(current_user.id),
+ )
+
+ raise HTTPException(
+ status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+ detail=f"Error regenerating embeddings: {str(e)}",
+ )
+
+
+@router.delete("/{document_id}")
+async def delete_document(
+ document_id: int,
+ request: Request,
+ current_user: User = Depends(get_current_user),
+ db: Session = Depends(get_db),
+):
+ """
+ Delete a document
+ """
+ # Get document
+ document = db.query(Document).filter(Document.id == document_id).first()
+
+ if not document:
+ logger.warning("Document not found for deletion", document_id=document_id, user_role=current_user.role)
+ raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Document not found")
+
+ # Check authorization
+ try:
+ oso = get_oso()
+ oso.authorize(current_user, "delete", document)
+ except Exception as e:
+ logger.warning("Unauthorized document deletion attempt", document_id=document_id, user_role=current_user.role, error=str(e))
+ raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied")
+
+ # Remove Oso facts
+ remove_document_access(document)
+
+ # Delete document
+ db.delete(document)
+ db.commit()
+
+ # Log to Galileo
+ log_galileo_event(
+ event_type="document_deleted",
+ event_data={
+ "document_id": document_id,
+ "title": document.title,
+ "document_type": document.document_type,
+ "department": document.department,
+ },
+ user_id=str(current_user.id),
+ )
+
+ logger.info(
+ "Document deleted",
+ document_id=document_id,
+ user_role=current_user.role,
+ document_type=document.document_type,
+ department=document.department,
+ )
+
+ return {"message": "Document deleted successfully"}
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/__init__.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/__init__.py
new file mode 100644
index 00000000..84095a64
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/__init__.py
@@ -0,0 +1 @@
+# Utils package initialization
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/embeddings.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/embeddings.py
new file mode 100644
index 00000000..53f08872
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/embeddings.py
@@ -0,0 +1,265 @@
+import sys
+from pathlib import Path
+
+# Add the common package to Python path
+common_path = Path(__file__).parent.parent.parent.parent.parent / "common" / "src"
+sys.path.insert(0, str(common_path))
+
+from galileo.openai import openai
+from common.models import Document, Embedding
+from common.oso_sync import sync_embedding_access
+from sqlalchemy import text
+from sqlalchemy.orm import Session
+
+
+async def generate_embedding(text: str, model: str = "text-embedding-3-small") -> list[float]:
+ """Generate embedding for a given text using OpenAI (Galileo instrumented)."""
+ try:
+ # Import settings to get API key
+ from ..config import settings
+
+ client = openai.OpenAI(api_key=settings.openai_api_key)
+ response = client.embeddings.create(input=text, model=model)
+ return response.data[0].embedding
+ except Exception as e:
+ print(f"Error generating embedding: {e}")
+ return []
+
+
+async def store_document_embeddings(
+ document: Document,
+ chunks: list[str],
+ db: Session,
+ model: str = "text-embedding-3-small",
+) -> bool:
+ """Generate and store embeddings for document chunks."""
+ try:
+ for i, chunk in enumerate(chunks):
+ # Generate embedding
+ embedding_vector = await generate_embedding(chunk, model)
+
+ if not embedding_vector:
+ continue
+
+ # Create embedding record
+ db_embedding = Embedding(
+ document_id=document.id,
+ content_chunk=chunk,
+ embedding_vector=embedding_vector,
+ chunk_index=i,
+ )
+
+ db.add(db_embedding)
+ db.commit()
+ db.refresh(db_embedding)
+
+ # Sync OSO facts for new embedding
+ try:
+ sync_embedding_access(db_embedding)
+ except Exception as e:
+ print(f"Warning: Failed to sync OSO facts for embedding {db_embedding.id}: {e}")
+
+ return True
+
+ except Exception as e:
+ print(f"Error storing embeddings: {e}")
+ db.rollback()
+ return False
+
+
+async def similarity_search(
+ query_text: str,
+ db: Session,
+ limit: int = 5,
+ similarity_threshold: float = 0.1,
+ document_ids: list[int] | None = None,
+) -> list[dict]:
+ """
+ Perform similarity search using pgvector.
+ """
+ import time
+
+ start_time = time.time()
+
+ try:
+ # Generate query embedding
+ query_embedding = await generate_embedding(query_text)
+
+ if not query_embedding:
+ return []
+
+ # Build SQL query for similarity search
+ base_query = """
+ SELECT
+ e.id,
+ e.document_id,
+ e.content_chunk,
+ e.chunk_index,
+ d.title,
+ d.document_type,
+ d.department,
+ d.is_sensitive,
+ 1 - (e.embedding_vector <=> :query_vector) as similarity
+ FROM embeddings e
+ JOIN documents d ON e.document_id = d.id
+ WHERE 1 - (e.embedding_vector <=> :query_vector) > :threshold
+ """
+
+ # Convert query embedding to proper format for pgvector
+ params = {
+ "query_vector": str(query_embedding),
+ "threshold": similarity_threshold,
+ }
+
+ # Add document ID filter if provided
+ if document_ids:
+ placeholders = ",".join([f":doc_id_{i}" for i in range(len(document_ids))])
+ base_query += f" AND e.document_id IN ({placeholders})"
+ for i, doc_id in enumerate(document_ids):
+ params[f"doc_id_{i}"] = doc_id
+
+ base_query += " ORDER BY similarity DESC LIMIT :limit"
+ params["limit"] = limit
+
+ # Execute query with proper parameter binding
+ result = db.execute(text(base_query), params)
+ rows = result.fetchall()
+
+ # Convert to list of dictionaries
+ results = []
+ for row in rows:
+ results.append(
+ {
+ # Frontend-compatible field names
+ "id": row[1], # document_id → id
+ "title": row[4], # document_title → title
+ "content_chunk": row[2],
+ "document_type": row[5],
+ "department": row[6],
+ "similarity_score": float(row[8]), # similarity → similarity_score
+ "created_at": "", # Will be populated by document data if needed
+ # Keep internal fields for backend processing
+ "embedding_id": row[0],
+ "document_id": row[1], # Keep for internal use
+ "chunk_index": row[3],
+ "document_title": row[4], # Keep for internal use
+ "is_sensitive": row[7],
+ "similarity": float(row[8]), # Keep for internal use
+ }
+ )
+
+ # Log retriever call to Galileo
+ try:
+ from ..observability import log_retriever_call
+
+ duration_ns = int((time.time() - start_time) * 1_000_000_000)
+
+ # Format results for Galileo logging
+ formatted_results = []
+ for result in results:
+ formatted_results.append(
+ {
+ "document_title": result["title"],
+ "content_chunk": (result["content_chunk"][:200] + "..." if len(result["content_chunk"]) > 200 else result["content_chunk"]),
+ "similarity_score": result["similarity_score"],
+ "document_type": result["document_type"],
+ "department": result["department"],
+ }
+ )
+
+ log_retriever_call(query=query_text, documents=formatted_results, duration_ns=duration_ns)
+ except Exception as log_error:
+ print(f"Warning: Failed to log retriever call to Galileo: {log_error}")
+
+ return results
+
+ except Exception as e:
+ print(f"Error in similarity search: {e}")
+ return []
+
+
+async def regenerate_document_embeddings(document: Document, db: Session, model: str = "text-embedding-3-small") -> dict:
+ """
+ Regenerate embeddings for an existing document.
+ Returns status dict with success and message.
+ """
+ try:
+ from ..utils.text_processing import chunk_text
+
+ # Delete existing embeddings for this document
+ db.query(Embedding).filter(Embedding.document_id == document.id).delete()
+ db.commit()
+
+ # Create new chunks from document content
+ chunks = chunk_text(
+ document.content,
+ chunk_size=500, # Default chunk size
+ chunk_overlap=50, # Default overlap
+ )
+
+ # Generate and store new embeddings
+ success = await store_document_embeddings(document, chunks, db, model)
+
+ if success:
+ return {
+ "success": True,
+ "message": f"Successfully regenerated {len(chunks)} embeddings for document {document.id}",
+ "chunks_created": len(chunks),
+ }
+ else:
+ return {
+ "success": False,
+ "message": f"Failed to regenerate embeddings for document {document.id}",
+ "chunks_created": 0,
+ }
+
+ except Exception as e:
+ print(f"Error regenerating embeddings for document {document.id}: {e}")
+ db.rollback()
+ return {"success": False, "message": f"Error: {str(e)}", "chunks_created": 0}
+
+
+async def get_embedding_status(document_id: int, db: Session) -> dict:
+ """
+ Get embedding status for a document.
+ """
+ try:
+ embedding_count = db.query(Embedding).filter(Embedding.document_id == document_id).count()
+
+ return {
+ "document_id": document_id,
+ "has_embeddings": embedding_count > 0,
+ "embedding_count": embedding_count,
+ }
+ except Exception as e:
+ print(f"Error getting embedding status for document {document_id}: {e}")
+ return {
+ "document_id": document_id,
+ "has_embeddings": False,
+ "embedding_count": 0,
+ "error": str(e),
+ }
+
+
+def combine_chunks_for_context(search_results: list[dict], max_tokens: int = 6000) -> str:
+ """
+ Combine relevant chunks into context for RAG, respecting token limits.
+ """
+ context_parts = []
+ current_tokens = 0
+
+ for result in search_results:
+ chunk = result["content_chunk"]
+ title = result["document_title"]
+
+ # Simple token estimation (more accurate would use tiktoken)
+ chunk_tokens = len(chunk.split()) * 1.3 # Rough estimation
+
+ if current_tokens + chunk_tokens > max_tokens:
+ break
+
+ context_part = f"Document: {title}\nContent: {chunk}\n---\n"
+ context_parts.append(context_part)
+ current_tokens += chunk_tokens
+
+ return "\n".join(context_parts)
diff --git a/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/text_processing.py b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/text_processing.py
new file mode 100644
index 00000000..9ad896fd
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/src/rag_service/utils/text_processing.py
@@ -0,0 +1,72 @@
+import re
+
+import tiktoken
+
+
+def clean_text(text: str) -> str:
+ """Clean and normalize text content."""
+ # Remove extra whitespace
+ text = re.sub(r"\s+", " ", text)
+ # Remove special characters but keep medical terminology
+ text = re.sub(r"[^\w\s\-\.\,\:\;\(\)\/]", "", text)
+ return text.strip()
+
+
+def chunk_text(text: str, chunk_size: int = 1000, chunk_overlap: int = 200) -> list[str]:
+ """
+ Split text into overlapping chunks for better context preservation.
+ """
+ # Initialize tokenizer
+ encoding = tiktoken.get_encoding("cl100k_base")
+
+ # Tokenize the text
+ tokens = encoding.encode(text)
+
+ chunks = []
+ start = 0
+
+ while start < len(tokens):
+ # Define the end of the current chunk
+ end = start + chunk_size
+
+ # Extract chunk tokens
+ chunk_tokens = tokens[start:end]
+
+ # Decode back to text
+ chunk_text = encoding.decode(chunk_tokens)
+
+ chunks.append(chunk_text.strip())
+
+ # Move start position with overlap
+ start = end - chunk_overlap
+
+ # Break if we've processed all tokens
+ if end >= len(tokens):
+ break
+
+ return chunks
+
+
+def extract_keywords(text: str) -> list[str]:
+ """Extract potential medical keywords from text."""
+ # Simple keyword extraction - in production, use more sophisticated NLP
+ medical_patterns = [
+ r"\b[A-Z][a-z]+\s+[A-Z][a-z]+\b", # Proper nouns (conditions, medications)
+ r"\b\d+\s*mg\b", # Dosages
+ r"\b\d+\s*ml\b", # Volumes
+ r"\bICD[-\s]?\d+\b", # ICD codes
+ r"\bCPT[-\s]?\d+\b", # CPT codes
+ ]
+
+ keywords = []
+ for pattern in medical_patterns:
+ matches = re.findall(pattern, text, re.IGNORECASE)
+ keywords.extend(matches)
+
+ return list(set(keywords)) # Remove duplicates
+
+
+def calculate_token_count(text: str) -> int:
+ """Calculate the number of tokens in a text."""
+ encoding = tiktoken.get_encoding("cl100k_base")
+ return len(encoding.encode(text))
diff --git a/python/rag/healthcare-support-portal/packages/rag/test_config.py b/python/rag/healthcare-support-portal/packages/rag/test_config.py
new file mode 100644
index 00000000..66ff1cee
--- /dev/null
+++ b/python/rag/healthcare-support-portal/packages/rag/test_config.py
@@ -0,0 +1,226 @@
+#!/usr/bin/env python3
+"""
+Configuration Test Script for Healthcare RAG Service
+
+This script tests that all required environment variables and API keys
+are properly configured for the RAG service.
+
+Usage:
+ uv run python test_config.py
+"""
+
+import os
+import sys
+from typing import Dict, Any
+
+from dotenv import load_dotenv
+
+load_dotenv()
+
+
+def test_environment_variables() -> Dict[str, Any]:
+ """Test that all required environment variables are set."""
+ results = {}
+
+ # Required variables
+ required_vars = {
+ "DATABASE_URL": "PostgreSQL database connection string",
+ "SECRET_KEY": "JWT signing key",
+ "OPENAI_API_KEY": "OpenAI API key for embeddings and chat",
+ }
+
+ # Optional variables with defaults
+ optional_vars = {
+ "DEBUG": "Debug mode (default: false)",
+ "EMBEDDING_MODEL": "OpenAI embedding model (default: text-embedding-3-small)",
+ "CHAT_MODEL": "OpenAI chat model (default: gpt-4o-mini)",
+ "GALILEO_API_KEY": "Galileo API key for observability",
+ "GALILEO_PROJECT_NAME": "Galileo project name (default: healthcare-rag)",
+ "GALILEO_ENVIRONMENT": "Galileo environment tag (default: development)",
+ "CHUNK_SIZE": "Document chunk size (default: 1000)",
+ "SIMILARITY_THRESHOLD": "Vector search threshold (default: 0.7)",
+ }
+
+ print("🔍 Testing Environment Variables...")
+ print("=" * 50)
+
+ # Test required variables
+ all_required_present = True
+ for var, description in required_vars.items():
+ value = os.getenv(var)
+ if value:
+ if var == "OPENAI_API_KEY":
+ # Don't expose the full key
+ display_value = f"{value[:8]}...{value[-4:]}" if len(value) > 12 else "[HIDDEN]"
+ else:
+ display_value = f"{value[:20]}..." if len(value) > 20 else value
+ print(f"✅ {var}: {display_value}")
+ results[var] = {"status": "OK", "value": value}
+ else:
+ print(f"❌ {var}: NOT SET ({description})")
+ results[var] = {"status": "MISSING", "value": None}
+ all_required_present = False
+
+ print()
+
+ # Test optional variables
+ for var, description in optional_vars.items():
+ value = os.getenv(var)
+ if value:
+ if "API_KEY" in var:
+ display_value = f"{value[:8]}...{value[-4:]}" if len(value) > 12 else "[HIDDEN]"
+ else:
+ display_value = value
+ print(f"🟡 {var}: {display_value}")
+ results[var] = {"status": "SET", "value": value}
+ else:
+ print(f"⚪ {var}: Not set ({description})")
+ results[var] = {"status": "DEFAULT", "value": None}
+
+ results["all_required_present"] = all_required_present
+ return results
+
+
+def test_openai_connection() -> bool:
+ """Test OpenAI API connection."""
+ try:
+ import openai
+ from openai import OpenAI
+
+ api_key = os.getenv("OPENAI_API_KEY")
+ if not api_key:
+ print("❌ OpenAI API key not found")
+ return False
+
+ if not api_key.startswith("sk-"):
+ print(f"❌ OpenAI API key format invalid (should start with 'sk-'): {api_key[:10]}...")
+ return False
+
+ print("⚙️ Testing OpenAI API connection...")
+ client = OpenAI(api_key=api_key)
+
+ # Test with a simple API call
+ models = client.models.list()
+ print(f"✅ OpenAI API connection successful ({len(models.data)} models available)")
+ return True
+
+ except ImportError:
+ print("❌ OpenAI package not installed. Run: uv add openai")
+ return False
+ except Exception as e:
+ print(f"❌ OpenAI API connection failed: {str(e)}")
+ return False
+
+
+def test_database_connection() -> bool:
+ """Test database connection."""
+ try:
+ from sqlalchemy import create_engine, text
+
+ db_url = os.getenv("DATABASE_URL")
+ if not db_url:
+ print("❌ DATABASE_URL not found")
+ return False
+
+ print("⚙️ Testing database connection...")
+ engine = create_engine(db_url)
+
+ with engine.connect() as conn:
+ result = conn.execute(text("SELECT version()"))
+ version = result.fetchone()[0]
+ print(f"✅ Database connection successful")
+ print(f" PostgreSQL version: {version.split(',')[0]}")
+
+ # Check for pgvector extension
+ result = conn.execute(text("SELECT EXISTS(SELECT 1 FROM pg_extension WHERE extname = 'vector')"))
+ has_vector = result.fetchone()[0]
+ if has_vector:
+ print(f"✅ pgvector extension is installed")
+ else:
+ print(f"⚠️ pgvector extension not found (required for embeddings)")
+
+ return True
+
+ except ImportError as e:
+ print(f"❌ Database packages not installed: {e}")
+ return False
+ except Exception as e:
+ print(f"❌ Database connection failed: {str(e)}")
+ return False
+
+
+def test_galileo_connection() -> bool:
+ """Test Galileo API connection."""
+ try:
+ api_key = os.getenv("GALILEO_API_KEY")
+ if not api_key or api_key == "your-galileo-api-key-here":
+ print("⚠️ Galileo API key not configured (using default placeholder)")
+ print(" Get your API key from: https://app.galileo.ai/sign-up")
+ return True # Don't fail the config test, just warn
+
+ # For now, just check that the key exists
+ # A full test would require the galileo package and network call
+ print(f"✅ Galileo API key configured ({api_key[:8]}...)")
+
+ project = os.getenv("GALILEO_PROJECT_NAME", "healthcare-rag")
+ environment = os.getenv("GALILEO_ENVIRONMENT", "development")
+ print(f" Project: {project}")
+ print(f" Environment: {environment}")
+
+ return True
+
+ except Exception as e:
+ print(f"❌ Galileo configuration error: {str(e)}")
+ return False
+
+
+def main():
+ """Run all configuration tests."""
+ print("🏥 Healthcare RAG Configuration Test")
+ print("=" * 50)
+ print()
+
+ # Test environment variables
+ env_results = test_environment_variables()
+ env_ok = env_results["all_required_present"]
+ print()
+
+ # Test connections
+ openai_ok = test_openai_connection()
+ print()
+
+ db_ok = test_database_connection()
+ print()
+
+ galileo_ok = test_galileo_connection()
+ print()
+
+ # Summary
+ print("=" * 50)
+ print("📊 Configuration Test Summary:")
+ print(f" Environment Variables: {'✅ PASS' if env_ok else '❌ FAIL'}")
+ print(f" OpenAI Connection: {'✅ PASS' if openai_ok else '❌ FAIL'}")
+ print(f" Database Connection: {'✅ PASS' if db_ok else '❌ FAIL'}")
+ print(f" Galileo Configuration: {'✅ PASS' if galileo_ok else '❌ FAIL'}")
+ print()
+
+ if all([env_ok, openai_ok, db_ok, galileo_ok]):
+ print("🎉 All tests passed! RAG service is ready to run.")
+ sys.exit(0)
+ else:
+ print("⚠️ Some tests failed. Please fix the issues above before running the RAG service.")
+ print()
+ print("🔧 Quick fixes:")
+ if not env_ok:
+ print(" - Copy .env.example to .env and fill in your API keys")
+ if not openai_ok:
+ print(" - Get your OpenAI API key from https://platform.openai.com/api-keys")
+ if not db_ok:
+ print(" - Make sure PostgreSQL is running with: docker-compose up -d db")
+ if not galileo_ok:
+ print(" - Set GALILEO_ENABLED=false or add your Galileo API key")
+ sys.exit(1)
+
+
+if __name__ == "__main__":
+ main()
diff --git a/python/rag/healthcare-support-portal/pyproject.toml b/python/rag/healthcare-support-portal/pyproject.toml
new file mode 100644
index 00000000..785a1629
--- /dev/null
+++ b/python/rag/healthcare-support-portal/pyproject.toml
@@ -0,0 +1,82 @@
+[project]
+name = "healthcare-support-portal"
+version = "0.1.0"
+description = "Healthcare Support Portal - Microservices RAG Application"
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = [
+ "bcrypt>=4.0.0,<5.0.0",
+ "oso-cloud>=2.5.0",
+ "psycopg2-binary>=2.9.10",
+ "python-multipart>=0.0.20",
+ "sqlalchemy-oso-cloud>=0.1.0",
+]
+
+[tool.uv.workspace]
+members = [
+ "packages/common",
+ "packages/auth",
+ "packages/patient",
+ "packages/rag"
+]
+
+[dependency-groups]
+dev = [
+ "ruff>=0.12.8",
+]
+
+[tool.ruff]
+# Exclude a variety of commonly ignored directories.
+exclude = [
+ ".bzr",
+ ".direnv",
+ ".eggs",
+ ".git",
+ ".hg",
+ ".mypy_cache",
+ ".nox",
+ ".pants.d",
+ ".ruff_cache",
+ ".svn",
+ ".tox",
+ ".venv",
+ "__pypackages__",
+ "_build",
+ "buck-out",
+ "build",
+ "dist",
+ "node_modules",
+ "venv",
+ "frontend/node_modules",
+]
+
+# Same as Black.
+line-length = 88
+
+# Target Python 3.11+.
+target-version = "py311"
+
+[tool.ruff.lint]
+# Enable Pyflakes (`F`) and a subset of the pycodestyle (`E`) codes by default.
+select = ["E4", "E7", "E9", "F", "I", "UP", "B", "C4", "PIE", "SIM"]
+ignore = ["B008", "E402", "B904"] # B008: FastAPI Depends pattern; E402: imports after path manipulation; B904: Exception chaining not needed for HTTP errors
+
+# Allow fix for all enabled rules (when `--fix`) is provided.
+fixable = ["ALL"]
+unfixable = []
+
+# Allow unused variables when underscore-prefixed.
+dummy-variable-rgx = "^(_+|(_+[a-zA-Z0-9_]*[a-zA-Z0-9]+?))$"
+
+[tool.ruff.format]
+# Like Black, use double quotes for strings.
+quote-style = "double"
+
+# Like Black, indent with spaces, rather than tabs.
+indent-style = "space"
+
+# Like Black, respect magic trailing commas.
+skip-magic-trailing-comma = false
+
+# Like Black, automatically detect the appropriate line ending.
+line-ending = "auto"
diff --git a/python/rag/healthcare-support-portal/run_all.sh b/python/rag/healthcare-support-portal/run_all.sh
new file mode 100755
index 00000000..934993ff
--- /dev/null
+++ b/python/rag/healthcare-support-portal/run_all.sh
@@ -0,0 +1,207 @@
+#!/bin/bash
+# run_all.sh - Start all Healthcare Support Portal services and infrastructure
+
+# Exit on any error (but allow controlled errors)
+set -e
+
+# Function to check if a command exists
+command_exists() {
+ command -v "$1" >/dev/null 2>&1
+}
+
+echo "🏥 Healthcare Support Portal - Starting All Services"
+echo "=================================================="
+
+# Function to check if a port is available
+check_port() {
+ local port=$1
+ if lsof -i :$port -sTCP:LISTEN -t >/dev/null 2>&1; then
+ echo "❌ Port $port is already in use"
+ return 1
+ else
+ echo "✅ Port $port is available"
+ return 0
+ fi
+}
+
+# Check if required ports are available
+echo "🔍 Checking port availability..."
+check_port 8001 || exit 1
+check_port 8002 || exit 1
+check_port 8003 || exit 1
+check_port 3000 || exit 1
+
+# Special handling for port 8080 (Oso Dev Server) - informational only
+if lsof -i :8080 -sTCP:LISTEN -t >/dev/null 2>&1; then
+ echo "ℹ️ Port 8080 is in use (Oso Dev Server likely running)"
+else
+ echo "✅ Port 8080 is available"
+fi
+
+# Check prerequisites before starting services
+echo "🔍 Checking prerequisites..."
+
+# Check Docker
+if ! command_exists docker; then
+ echo "❌ Docker not found. Please install Docker and try again."
+ exit 1
+fi
+
+# Check docker-compose
+if ! command_exists docker-compose && ! docker compose version >/dev/null 2>&1; then
+ echo "❌ Docker Compose not found. Please install Docker Compose and try again."
+ exit 1
+fi
+
+# Check if frontend dependencies are installed
+echo "🔍 Checking frontend dependencies..."
+if [ ! -d "frontend/node_modules" ]; then
+ echo "⚠️ Frontend dependencies not found. Installing..."
+ if command_exists node && command_exists npm; then
+ NODE_VERSION=$(node --version | sed 's/v//')
+ if [ "$(printf '%s\n' "20.19.0" "$NODE_VERSION" | sort -V | head -n1)" = "20.19.0" ]; then
+ echo "📦 Installing frontend dependencies..."
+ cd frontend
+ if ! npm install; then
+ echo "❌ Failed to install frontend dependencies"
+ cd ..
+ exit 1
+ fi
+ cd ..
+ echo "✅ Frontend dependencies installed"
+ else
+ echo "❌ Node.js $NODE_VERSION found, but 20.19.0+ is required for frontend"
+ echo " Frontend service will not start. Please upgrade Node.js."
+ SKIP_FRONTEND=true
+ fi
+ else
+ echo "❌ Node.js or npm not found. Frontend service will not start."
+ echo " Please install Node.js 20.19.0+ and run: cd frontend && npm install"
+ SKIP_FRONTEND=true
+ fi
+else
+ echo "✅ Frontend dependencies found"
+fi
+
+echo ""
+echo "🚀 Starting services..."
+
+# Start infrastructure services if not running
+echo "🏗️ Checking infrastructure services..."
+if ! docker ps | grep -q healthcare-support-portal; then
+ echo "Starting PostgreSQL database and Oso Dev Server..."
+ docker-compose up -d db oso
+ echo "Waiting for database to be ready..."
+ sleep 8
+ echo "Running database migrations..."
+ docker-compose run --rm migrate
+ echo "✅ Database migrations completed"
+else
+ echo "✅ Infrastructure services (PostgreSQL + Oso Dev Server) are already running"
+ echo "🔍 Checking if migrations are current..."
+ docker-compose run --rm migrate
+fi
+
+# Create logs directory if it doesn't exist
+echo "📁 Creating logs directory..."
+if ! mkdir -p logs 2>/dev/null; then
+ echo "⚠️ Warning: Could not create logs directory. Output will go to console."
+ LOG_TO_FILE=false
+else
+ LOG_TO_FILE=true
+fi
+
+# Get absolute path for logs
+ROOT_DIR=$(pwd)
+
+# Start services in background using subshells to avoid directory changes
+echo "🔐 Starting Auth Service..."
+if [ "$LOG_TO_FILE" = true ]; then
+ (cd packages/auth && ./run.sh) > "$ROOT_DIR/logs/auth.log" 2>&1 &
+else
+ (cd packages/auth && ./run.sh) &
+fi
+AUTH_PID=$!
+
+echo "🏥 Starting Patient Service..."
+if [ "$LOG_TO_FILE" = true ]; then
+ (cd packages/patient && ./run.sh) > "$ROOT_DIR/logs/patient.log" 2>&1 &
+else
+ (cd packages/patient && ./run.sh) &
+fi
+PATIENT_PID=$!
+
+echo "🤖 Starting RAG Service..."
+if [ "$LOG_TO_FILE" = true ]; then
+ (cd packages/rag && ./run.sh) > "$ROOT_DIR/logs/rag.log" 2>&1 &
+else
+ (cd packages/rag && ./run.sh) &
+fi
+RAG_PID=$!
+
+# Start Frontend Service (only if dependencies are available)
+if [ "$SKIP_FRONTEND" = true ]; then
+ echo "⚠️ Skipping Frontend Service (dependencies not available)"
+ FRONTEND_PID=""
+else
+ echo "🌐 Starting Frontend Service..."
+ if [ "$LOG_TO_FILE" = true ]; then
+ (cd frontend && ./run.sh) > "$ROOT_DIR/logs/frontend.log" 2>&1 &
+ else
+ (cd frontend && ./run.sh) &
+ fi
+ FRONTEND_PID=$!
+fi
+
+echo ""
+echo "✅ Services started!"
+echo "=================================================="
+if [ "$SKIP_FRONTEND" != true ]; then
+ echo "🌐 Frontend: http://localhost:3000"
+else
+ echo "⚠️ Frontend: Not started (missing dependencies)"
+fi
+echo "🔐 Auth Service: http://localhost:8001/docs"
+echo "🏥 Patient Service: http://localhost:8002/docs"
+echo "🤖 RAG Service: http://localhost:8003/docs"
+echo "⚖️ Oso Dev Server: http://localhost:8080"
+echo ""
+echo "📋 Service PIDs:"
+if [ -n "$FRONTEND_PID" ]; then
+ echo " Frontend Service: $FRONTEND_PID"
+else
+ echo " Frontend Service: Not started"
+fi
+echo " Auth Service: $AUTH_PID"
+echo " Patient Service: $PATIENT_PID"
+echo " RAG Service: $RAG_PID"
+if [ "$LOG_TO_FILE" = true ]; then
+ echo "📄 Logs are available in the logs/ directory"
+else
+ echo "📄 Service output is displayed in console"
+fi
+echo "🛑 To stop all services, run: ./stop_all.sh"
+echo ""
+
+# Save PIDs for stopping later (create logs directory if needed for PID files)
+if [ "$LOG_TO_FILE" = true ] || mkdir -p logs 2>/dev/null; then
+ if [ -n "$FRONTEND_PID" ]; then
+ echo "$FRONTEND_PID" > logs/frontend.pid
+ fi
+ echo "$AUTH_PID" > logs/auth.pid
+ echo "$PATIENT_PID" > logs/patient.pid
+ echo "$RAG_PID" > logs/rag.pid
+else
+ echo "⚠️ Warning: Could not save PID files. You'll need to stop services manually."
+fi
+
+# Wait for user input
+echo "Press Ctrl+C to stop all services..."
+PIDS_TO_KILL="$AUTH_PID $PATIENT_PID $RAG_PID"
+if [ -n "$FRONTEND_PID" ]; then
+ PIDS_TO_KILL="$FRONTEND_PID $PIDS_TO_KILL"
+fi
+trap "echo ''; echo '🛑 Stopping all services...'; kill $PIDS_TO_KILL 2>/dev/null; exit 0" INT
+
+# Keep script running
+wait
diff --git a/python/rag/healthcare-support-portal/sample-documents/medical-history-derek-shepherd.md b/python/rag/healthcare-support-portal/sample-documents/medical-history-derek-shepherd.md
new file mode 100644
index 00000000..46a2898d
--- /dev/null
+++ b/python/rag/healthcare-support-portal/sample-documents/medical-history-derek-shepherd.md
@@ -0,0 +1,99 @@
+# Patient History Report
+
+**Patient Name:** Dr. Derek Christopher Shepherd
+**DOB:** 1966
+**Age:** 49 (at time of death, 2015)
+**Sex:** Male
+**Occupation:** Neurosurgeon (Attending, later Chief of Neurosurgery at Grey Sloan Memorial Hospital)
+**Date of Report:** Historical summary
+
+---
+
+## Chief Complaint
+No active complaints documented at time of final hospitalization.
+Final medical event: severe traumatic brain injury (TBI) following motor vehicle collision.
+
+---
+
+## History of Present Illness (HPI)
+Dr. Shepherd was involved in a high-speed car accident in 2015. He sustained significant head trauma and other injuries. Despite being conscious at the scene and initially assisting other victims, his own injuries rapidly worsened. He was transported to a local hospital without a Level I trauma center. Delay in proper neurosurgical intervention led to brain death.
+
+---
+
+## Past Medical History
+- **Gunshot wound (shoulder)** – sustained during a hostage situation at Seattle Grace Hospital. Fully recovered.
+- **Hand injury** – loss of fine motor control after a plane crash; temporary impairment, recovered after surgery and rehab.
+- **Chronic stress and insomnia** – secondary to occupational strain.
+- **No chronic conditions** documented (no diabetes, hypertension, or cardiovascular disease).
+
+---
+
+## Surgical History
+- Orthopedic repair of hand injury following plane crash (2012).
+- Minor wound management for gunshot injury.
+- No major elective surgeries.
+
+---
+
+## Medications
+- None documented for chronic use.
+- Occasional post-operative pain management (NSAIDs, opioids short-term).
+
+---
+
+## Allergies
+- No known drug allergies (NKDA).
+
+---
+
+## Family History
+- Mother: deceased.
+- Father: deceased, history of abusive behavior.
+- Sisters: Amelia Shepherd (neurosurgeon), Nancy Shepherd (OB/GYN), Kathleen Shepherd (psychiatrist), Liz Shepherd (immunologist).
+- Notable family history of substance use disorder (Amelia, opioid dependency).
+
+---
+
+## Social History
+- **Tobacco:** Denies use.
+- **Alcohol:** Moderate consumption, no history of abuse.
+- **Drugs:** Denies use.
+- **Marital Status:** Married to Dr. Meredith Grey (General Surgery).
+- **Children:** Zola (adopted), Bailey, and Ellis.
+- **Support System:** Close colleagues at Grey Sloan Memorial Hospital, particularly Dr. Miranda Bailey, Dr. Richard Webber, and Dr. Callie Torres.
+
+---
+
+## Review of Systems
+- **Neurological:** Prior transient hand motor deficits.
+- **Musculoskeletal:** Prior plane crash injuries, resolved.
+- **Psychiatric:** No formal diagnosis, though high occupational stress.
+- **Other systems:** Non-contributory.
+
+---
+
+## Physical Exam (Final Admission)
+- **General:** Male, middle-aged, unconscious post-trauma.
+- **Neuro:** Glasgow Coma Scale 3 upon deterioration; CT revealed severe brain swelling.
+- **Respiratory/Cardiac:** Initially stable, deteriorated rapidly.
+- **Extremities:** Multiple superficial injuries, none life-threatening.
+
+---
+
+## Assessment
+1. Severe traumatic brain injury with herniation.
+2. Status post motor vehicle collision.
+3. Past history of orthopedic and neurological injuries (resolved).
+
+---
+
+## Plan
+- Emergent neurosurgical evaluation was indicated but delayed.
+- Intubation and mechanical ventilation initiated.
+- Supportive care provided until declaration of brain death.
+- Organs donated per patient’s wishes.
+
+---
+
+**Physician’s Note:**
+Dr. Derek Shepherd’s death underscores the importance of timely trauma protocols and neurosurgical intervention in TBI cases. Despite a history of resilience through multiple traumatic injuries, the final event was unsurvivable due to systemic delays in care.
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/sample-documents/medical-history-gregory-house.md b/python/rag/healthcare-support-portal/sample-documents/medical-history-gregory-house.md
new file mode 100644
index 00000000..c05b1584
--- /dev/null
+++ b/python/rag/healthcare-support-portal/sample-documents/medical-history-gregory-house.md
@@ -0,0 +1,100 @@
+# Patient History Report
+
+**Patient Name:** Dr. Gregory House
+**DOB:** June 11, 1959
+**Age:** 65
+**Sex:** Male
+**Occupation:** Diagnostic Medicine Specialist (MD, Nephrology & Infectious Disease)
+**Date of Report:** September 16, 2025
+
+---
+
+## Chief Complaint
+Chronic leg pain and mobility impairment due to an infarction in the right quadriceps muscle following a misdiagnosed aneurysm.
+
+---
+
+## History of Present Illness (HPI)
+Dr. House experienced an infarction in his right thigh muscle approximately 20 years ago. Initial symptoms included severe pain and muscle necrosis, leading to partial removal of quadriceps muscle tissue. Since then, he has had chronic pain requiring long-term pain management. The condition has contributed to a dependence on a cane for mobility.
+
+---
+
+## Past Medical History
+- **Thigh Muscle Infarction** (right leg) – residual chronic pain.
+- **Chronic Pain Syndrome** – treated with long-term opioids.
+- **Vicodin Dependence** – longstanding usage with episodes of misuse.
+- **History of Depression** – secondary to chronic pain and functional limitation.
+- **Insomnia** – linked to pain and psychiatric comorbidity.
+
+---
+
+## Surgical History
+- Partial resection of necrotic right thigh muscle (circa early 2000s).
+
+---
+
+## Medications
+- **Hydrocodone/Acetaminophen (Vicodin)** – long-term use for pain management.
+- Occasional use of anti-anxiety medication and sleep aids.
+
+---
+
+## Allergies
+- **No known drug allergies (NKDA).**
+
+---
+
+## Family History
+- Father: abusive, estranged; military background.
+- Mother: emotionally distant.
+- No significant hereditary diseases reported.
+
+---
+
+## Social History
+- **Tobacco:** Denies use.
+- **Alcohol:** Social, occasional heavy episodes.
+- **Drugs:** History of opioid misuse.
+- **Occupation:** Renowned diagnostic physician at Princeton-Plainsboro Teaching Hospital (fictional).
+- **Marital Status:** Single; history of failed relationships.
+- **Support System:** Colleagues, notably Dr. James Wilson (oncology).
+
+---
+
+## Review of Systems
+- **Musculoskeletal:** Chronic right thigh pain, muscle weakness, gait impairment.
+- **Neurological:** Normal cognitive function; occasional irritability.
+- **Psychiatric:** Depression, obsessive tendencies, antisocial traits.
+- **Other systems:** Non-contributory.
+
+---
+
+## Physical Exam
+- **General:** Disheveled, often irritable but alert and oriented ×3.
+- **Gait:** Limp, uses cane.
+- **Extremities:** Atrophy and scarring on right thigh.
+- **Neuro:** Strength diminished in right lower extremity.
+- **Mood/Affect:** Blunt, sarcastic, defensive.
+
+---
+
+## Assessment
+1. Chronic right thigh pain secondary to infarction and surgical resection.
+2. Opioid dependence (Vicodin).
+3. Depression with maladaptive coping strategies.
+4. Functional limitations in mobility.
+
+---
+
+## Plan
+- Continue pain management with strict monitoring.
+- Consider referral to pain rehabilitation program.
+- Explore alternative analgesics to minimize opioid dependence.
+- Recommend psychiatric support for depression and substance use.
+- Encourage use of mobility aids and physical therapy.
+
+---
+
+**Physician’s Note:**
+Patient is resistant to psychiatric interventions and exhibits non-compliance with lifestyle recommendations. Insight into addiction is limited. Despite chronic conditions, he demonstrates exceptional diagnostic capabilities.
+
diff --git a/python/rag/healthcare-support-portal/sample-documents/policy-mindy-lahiri.md b/python/rag/healthcare-support-portal/sample-documents/policy-mindy-lahiri.md
new file mode 100644
index 00000000..f2e4ca16
--- /dev/null
+++ b/python/rag/healthcare-support-portal/sample-documents/policy-mindy-lahiri.md
@@ -0,0 +1,83 @@
+# Mindy Lahiri, M.D. – Medical Policy Handbook
+**Specialty:** Obstetrics & Gynecology
+**Location:** Shulman & Associates, NYC
+**Version:** 1.0
+**Date:** September 16, 2025
+
+---
+
+## Introduction
+Hi! I’m Dr. Mindy Lahiri, OB/GYN, lover of rom-coms, fashion, and being slightly extra.
+This medical policy handbook outlines how I practice medicine, keep patients safe, and stay fabulous at the same time.
+
+---
+
+## Philosophy of Care
+1. **Patient-Centered, Always:** Patients deserve respect, honesty, and a little charm.
+2. **Evidence-Based Medicine:** Science comes first (even if rom-com logic *sometimes* sneaks in).
+3. **Holistic Health:** Emotional wellbeing is just as important as physical health.
+4. **Boundaries:** No, I will not be your therapist. Unless you want to talk about your crush, then maybe.
+
+---
+
+## Clinical Guidelines
+
+### 1. Preventive Care
+- Annual well-woman exams.
+- Pap smears per ACOG guidelines.
+- HPV vaccination strongly encouraged.
+- Discussion of diet, exercise, and self-care routines (including *The Bachelor* if relevant).
+
+### 2. Prenatal & Obstetric Care
+- **Initial visit:** Comprehensive history, labs, ultrasound confirmation.
+- **Follow-up:** Regular monitoring every 4 weeks until 28 weeks, every 2 weeks until 36, then weekly until delivery.
+- **Labor & Delivery:** Respect for birth plans, but safety > Pinterest aesthetics.
+- **Postpartum:** Mental health screening mandatory.
+
+### 3. Gynecological Care
+- Contraceptive counseling: full spectrum, judgment-free.
+- Menstrual concerns: individualized treatment (from birth control to surgery).
+- Fertility consultations offered; referrals as needed.
+
+---
+
+## Office Policies
+
+### Appointments
+- Show up on time. I will try my best to also show up on time… emphasis on *try*.
+- Cancellations require 24-hour notice. Emergencies and celebrity sightings excused.
+
+### Communication
+- Secure messaging through clinic portal encouraged.
+- Texting me about medical results: **not allowed.**
+- Texting me about where to get the best cronuts: allowed.
+
+### Billing & Insurance
+- Standard medical billing applies.
+- Payment plans available.
+- I accept Venmo for coffee bribes, but not for surgery.
+
+---
+
+## Code of Conduct
+- Respect staff and other patients.
+- No “WebMD diagnosing” in the exam room — that’s *my* job.
+- Compliments on my outfit are always welcome but not required.
+
+---
+
+## Emergency Protocols
+- For emergencies: Call 911 or proceed to the nearest ER.
+- After-hours calls are triaged through the on-call service.
+- Do not DM me on Instagram for a medical emergency.
+
+---
+
+## Closing Statement
+This policy is designed to provide clarity, care, and maybe a little humor. At the end of the day, my patients are my priority — and if we can laugh while staying healthy, that’s the dream.
+
+**Signed,**
+*Mindy Lahiri, M.D.*
+Obstetrics & Gynecology
+Shulman & Associates
+
diff --git a/python/rag/healthcare-support-portal/sample-documents/protocol-grey-sloan-memorial.md b/python/rag/healthcare-support-portal/sample-documents/protocol-grey-sloan-memorial.md
new file mode 100644
index 00000000..06c73c07
--- /dev/null
+++ b/python/rag/healthcare-support-portal/sample-documents/protocol-grey-sloan-memorial.md
@@ -0,0 +1,66 @@
+# Grey Sloan Memorial Hospital
+**Protocol for Handling Overdramatized Events and One-in-a-Million Scenarios**
+**Version:** Drama Level 3000
+
+---
+
+## Purpose
+To provide clinicians, interns, and star-crossed lovers working at Grey Sloan Memorial with a standardized approach to handling medical events that statistically should *never* happen twice but, somehow, occur every other Thursday.
+
+---
+
+## Scope
+This protocol applies to:
+- Attending surgeons, especially those in complicated love triangles.
+- Surgical interns with suspiciously perfect hair.
+- Patients who arrive in the ER with only minutes to live but a full backstory montage ready.
+
+---
+
+## Definitions
+- **ODME (Overly Dramatized Medical Event):** A scenario where clinical probability is ignored in favor of maximum emotional payoff.
+- **1IAM (One-in-a-Million):** Medical occurrences that, by actuarial tables, should happen once per century but are standard issue at Grey Sloan.
+- **LVAD Wire Incident:** The gold standard of ethically dubious, emotionally charged, plot-driven medical choices.
+
+---
+
+## Standard Protocol
+
+### 1. Initial Response
+- All staff must immediately drop whatever ordinary case they are working on (appendectomies can wait).
+- Cue a tense music swell.
+- Ensure at least one attending is both personally invested and professionally conflicted.
+
+### 2. Triage of Overdramatized Events
+- **Meteor strikes:** Assess emotional fallout before physical injuries.
+- **Plane crashes:** Assign each attending one existential crisis per patient.
+- **Pregnant woman with simultaneous amnesia and rare tumor:** Page neuro, OB, and whichever resident is due for character growth.
+
+### 3. The LVAD Wire Rule
+- Cutting an LVAD wire is **never** recommended… unless it advances the love plot.
+- If performed:
+ - Ensure it’s done under dim lighting with maximum tears.
+ - Documentation should read: “Performed for narrative necessity.”
+
+### 4. One-in-a-Million Event Handling
+- Treat as if it’s the fiftieth time this month (because it probably is).
+- Assign at least one intern to freeze mid-surgery due to trauma flashbacks.
+- Remind everyone: Grey Sloan has no risk management department; only brooding in stairwells.
+
+### 5. Post-Event Debrief
+- Mandatory rooftop scene.
+- Minimum of three speeches containing the words *miracle*, *fate*, or *second chances*.
+- At least one character must dramatically resign but return two episodes later.
+
+---
+
+## Exception Handling
+- If multiple ODME events occur simultaneously (e.g., ferry crash + bomb in chest cavity), prioritize whichever involves more attractive guest stars.
+
+---
+
+## Closing Statement
+This protocol is designed not to save lives but to maximize Nielsen ratings and generate enough tears for at least one Emmy reel.
+
+**Approved by:**
+The Grey Sloan Memorial Committee on Plot Devices
diff --git a/python/rag/healthcare-support-portal/scripts/get_auth_token.sh b/python/rag/healthcare-support-portal/scripts/get_auth_token.sh
new file mode 100755
index 00000000..27616ce9
--- /dev/null
+++ b/python/rag/healthcare-support-portal/scripts/get_auth_token.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+# Get authentication token for dr_smith user
+# This script demonstrates the correct username format for API calls
+
+TOKEN=$(curl -s -X POST "http://localhost:8001/api/v1/auth/login" \
+ -H "Content-Type: application/x-www-form-urlencoded" \
+ -d "username=dr_smith&password=secure_password" | \
+ python3 -c "import sys, json; print(json.load(sys.stdin)['access_token'])")
+
+echo "Got auth token: ${TOKEN:0:20}..."
+
+# Export the token for use in other scripts
+export AUTH_TOKEN="$TOKEN"
+echo "Token exported as AUTH_TOKEN environment variable"
+echo "You can now use it in other curl commands like:"
+echo "curl -H \"Authorization: Bearer \$AUTH_TOKEN\" http://localhost:8002/api/v1/patients/"
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/scripts/migrate.sh b/python/rag/healthcare-support-portal/scripts/migrate.sh
new file mode 100755
index 00000000..a6fb375a
--- /dev/null
+++ b/python/rag/healthcare-support-portal/scripts/migrate.sh
@@ -0,0 +1,108 @@
+#!/bin/bash
+# scripts/migrate.sh - Run database migrations with retry logic and health checks
+
+set -e # Exit on error
+
+echo "🔄 Healthcare Support Portal - Database Migration"
+echo "================================================="
+
+# Get database URL from environment or use default
+DATABASE_URL="${DATABASE_URL:-postgresql+psycopg2://postgres:postgres@localhost:5432/healthcare}"
+
+# Extract connection details for psql
+DB_HOST=$(echo $DATABASE_URL | sed -n 's/.*@\([^:]*\).*/\1/p')
+DB_PORT=$(echo $DATABASE_URL | sed -n 's/.*:\([0-9]*\)\/.*/\1/p')
+DB_NAME=$(echo $DATABASE_URL | sed -n 's/.*\/\([^?]*\).*/\1/p')
+DB_USER=$(echo $DATABASE_URL | sed -n 's/.*\/\/\([^:]*\).*/\1/p')
+DB_PASS=$(echo $DATABASE_URL | sed -n 's/.*:\/\/[^:]*:\([^@]*\).*/\1/p')
+
+echo "📊 Database Configuration:"
+echo " Host: $DB_HOST"
+echo " Port: $DB_PORT"
+echo " Database: $DB_NAME"
+echo ""
+
+# Wait for database to be ready
+echo "⏳ Waiting for database to be ready..."
+MAX_WAIT=30
+for i in $(seq 1 $MAX_WAIT); do
+ if PGPASSWORD=$DB_PASS psql -h $DB_HOST -p $DB_PORT -U $DB_USER -d $DB_NAME -c "SELECT 1" > /dev/null 2>&1; then
+ echo "✅ Database is ready!"
+ break
+ fi
+
+ if [ $i -eq $MAX_WAIT ]; then
+ echo "❌ Database is not available after ${MAX_WAIT} seconds"
+ exit 1
+ fi
+
+ echo " Waiting for database... (attempt $i/$MAX_WAIT)"
+ sleep 1
+done
+
+# Change to common package directory where alembic.ini is located
+cd /app/packages/common || cd packages/common
+
+echo ""
+echo "🔍 Checking current migration status..."
+# Use uv from PATH (works in both Docker and local environments)
+UV_CMD="uv"
+if [ -f "/opt/homebrew/bin/uv" ]; then
+ UV_CMD="/opt/homebrew/bin/uv"
+fi
+
+if $UV_CMD run alembic current 2>/dev/null; then
+ echo " Current migration retrieved successfully"
+else
+ echo " No migrations found (fresh database)"
+fi
+
+# Run migrations with retry logic
+echo ""
+echo "🚀 Running database migrations..."
+MAX_RETRIES=3
+
+for i in $(seq 1 $MAX_RETRIES); do
+ echo " Attempt $i of $MAX_RETRIES..."
+
+ if $UV_CMD run alembic upgrade head; then
+ echo ""
+ echo "✅ Migrations completed successfully!"
+
+ # Show current migration after success
+ echo ""
+ echo "📋 Current migration status:"
+ $UV_CMD run alembic current
+
+ # After successful migration, seed demo users if needed
+ echo ""
+ echo "🌱 Seeding demo users if not present..."
+ PGPASSWORD=$DB_PASS psql -h $DB_HOST -p $DB_PORT -U $DB_USER -d $DB_NAME -c "
+ INSERT INTO users (id, username, email, hashed_password, role, department, is_active, created_at) VALUES
+ (1, 'admin_wilson', 'jennifer.wilson@hospital.com', '\$2b\$12\$gdtwLxe4YU648JwtZPX8/uAv9n5qpKZ8VFXJ1iyjqVU/HExd20IXC', 'admin', 'administration', true, NOW()),
+ (2, 'dr_smith', 'sarah.smith@hospital.com', '\$2b\$12\$xDK9vMsg6XD0wrbp9mTONeqZgViFvQGbUT9HMb2l1aU.nX5ssLnkS', 'doctor', 'cardiology', true, NOW()),
+ (3, 'nurse_johnson', 'michael.johnson@hospital.com', '\$2b\$12\$tVxonl15Y9xoKXKeBLQcX.mZO7ovvOtfRiI.vqPCqjRyuOVCmazfC', 'nurse', 'emergency', true, NOW())
+ ON CONFLICT (username) DO NOTHING;
+ " > /dev/null
+
+ # Check how many users were seeded
+ USER_COUNT=$(PGPASSWORD=$DB_PASS psql -h $DB_HOST -p $DB_PORT -U $DB_USER -d $DB_NAME -t -c "SELECT COUNT(*) FROM users;" | tr -d ' ')
+ echo " ✅ Demo users available: $USER_COUNT (admin_wilson, dr_smith, nurse_johnson)"
+ echo " 🔑 All demo passwords: secure_password"
+
+ exit 0
+ fi
+
+ if [ $i -eq $MAX_RETRIES ]; then
+ echo ""
+ echo "❌ Migration failed after $MAX_RETRIES attempts"
+ echo " Please check the error messages above and ensure:"
+ echo " 1. The database is accessible"
+ echo " 2. The database user has proper permissions"
+ echo " 3. The migration files are valid"
+ exit 1
+ fi
+
+ echo "⚠️ Migration attempt $i failed, retrying in 2 seconds..."
+ sleep 2
+done
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/scripts/test_ui_fixes.md b/python/rag/healthcare-support-portal/scripts/test_ui_fixes.md
new file mode 100644
index 00000000..1fa05bbf
--- /dev/null
+++ b/python/rag/healthcare-support-portal/scripts/test_ui_fixes.md
@@ -0,0 +1,75 @@
+# UI Fixes Test Checklist
+
+## Issues Fixed
+
+### 1. Username Display Fix ✅
+**Issue**: "Good afternoon, Dr. dr_smith" displayed in homepage
+**Fix**: Modified `_index.tsx` to use `formatDisplayName()` function
+**Test**:
+- [ ] Login as dr_smith
+- [ ] Check dashboard displays "Good afternoon, Dr. Smith" instead of "Dr. dr_smith"
+- [ ] Check other users show correct format (e.g., "Administrator Wilson")
+
+### 2. Document Upload Button Fix ✅
+**Issue**: Upload button not working - UI error on click
+**Fix**:
+- Fixed API method parameter order in `api.server.ts`
+- Added better error logging in `DocumentUpload.tsx`
+- Improved error handling with console logs
+**Test**:
+- [ ] Navigate to Documents section
+- [ ] Click on upload area or "Choose Files" button
+- [ ] Verify file selection dialog opens
+- [ ] Select a file and check upload process works
+- [ ] Check browser console for any errors
+
+### 3. Documents Section Access Fix ✅
+**Issue**: Can't access documents section - UI error
+**Fix**:
+- Verified routing in `routes.ts` is correct
+- Checked navigation permissions in `Navigation.tsx`
+- Documents section should be accessible to all authenticated users
+**Test**:
+- [ ] Login as dr_smith (doctor role)
+- [ ] Click "Documents" in navigation sidebar
+- [ ] Verify page loads without errors
+- [ ] Check page shows documents list and upload section
+
+## Test Steps
+
+1. **Start the application**:
+ ```bash
+ cd /Users/erinmikail/GitHub-Local/sdk-examples/python/rag/healthcare-support-portal
+ ./run_all.sh
+ ```
+
+2. **Wait for services to start** (check logs for "ready" messages)
+
+3. **Access the frontend**: http://localhost:3000
+
+4. **Login with test credentials**:
+ - Username: `dr_smith`
+ - Password: `secure_password`
+
+5. **Test each fix**:
+ - [ ] Check homepage greeting
+ - [ ] Navigate to Documents
+ - [ ] Test document upload
+
+## Expected Results
+
+- ✅ Homepage shows "Good afternoon, Dr. Smith" (not "Dr. dr_smith")
+- ✅ Documents section loads without errors
+- ✅ Upload button/area responds to clicks and opens file dialog
+- ✅ No JavaScript console errors
+
+## If Issues Persist
+
+1. Check browser console (F12) for JavaScript errors
+2. Check network tab for failed API calls
+3. Check backend service logs for authentication/upload errors
+4. Verify all services are running:
+ - Auth service: http://localhost:8001/health
+ - Patient service: http://localhost:8002/health
+ - RAG service: http://localhost:8003/health
+ - Frontend: http://localhost:3000
\ No newline at end of file
diff --git a/python/rag/healthcare-support-portal/setup.sh b/python/rag/healthcare-support-portal/setup.sh
new file mode 100755
index 00000000..d292a44f
--- /dev/null
+++ b/python/rag/healthcare-support-portal/setup.sh
@@ -0,0 +1,189 @@
+#!/bin/bash
+# setup.sh - Cross-platform initial setup for Healthcare Support Portal
+# Compatible with macOS, Linux, and Windows (via Git Bash or WSL)
+
+# Exit on any error
+set -e
+
+# Detect operating system
+OS="Unknown"
+case "$(uname -s)" in
+ Darwin*) OS="macOS";;
+ Linux*) OS="Linux";;
+ CYGWIN*) OS="Windows";;
+ MINGW*) OS="Windows";;
+ MSYS*) OS="Windows";;
+esac
+
+echo "🏥 Healthcare Support Portal - Initial Setup ($OS)"
+echo "================================================="
+
+# Function to check if a command exists
+command_exists() {
+ command -v "$1" >/dev/null 2>&1
+}
+
+# Function to compare version numbers
+version_ge() {
+ test "$(printf '%s\n' "$@" | sort -V | head -n 1)" != "$1"
+}
+
+# Create necessary directories
+echo "📁 Creating directories..."
+mkdir -p logs
+mkdir -p data/postgres
+
+# Check prerequisites
+echo "🔍 Checking prerequisites..."
+
+# Check Python
+if ! command_exists python3; then
+ echo "❌ Python 3 is not installed. Please install Python 3.11+ and try again."
+ exit 1
+fi
+
+PYTHON_VERSION=$(python3 --version | cut -d' ' -f2)
+if ! version_ge "$PYTHON_VERSION" "3.11.0"; then
+ echo "❌ Python $PYTHON_VERSION found, but 3.11+ is required."
+ exit 1
+fi
+echo "✅ Python $PYTHON_VERSION is compatible"
+
+# Check uv
+UV_CMD="uv"
+if [ -f "/opt/homebrew/bin/uv" ]; then
+ UV_CMD="/opt/homebrew/bin/uv"
+fi
+
+if ! command_exists "$UV_CMD"; then
+ echo "❌ uv package manager not found. Installing..."
+ if command_exists curl; then
+ curl -LsSf https://astral.sh/uv/install.sh | sh
+ export PATH="$HOME/.local/bin:$PATH"
+ UV_CMD="uv"
+ else
+ echo "❌ curl not found. Please install uv manually: https://docs.astral.sh/uv/getting-started/installation/"
+ exit 1
+ fi
+fi
+echo "✅ uv package manager found"
+
+# Set up Python environment
+echo "🐍 Setting up Python environment..."
+if ! $UV_CMD sync; then
+ echo "❌ Failed to sync Python dependencies with uv"
+ exit 1
+fi
+echo "✅ Python dependencies synced"
+
+# Copy example .env files
+echo "📋 Setting up environment files..."
+for service in auth patient rag; do
+ if [ ! -f "packages/$service/.env" ]; then
+ if [ -f "packages/$service/.env.example" ]; then
+ cp "packages/$service/.env.example" "packages/$service/.env"
+ echo "✅ Created packages/$service/.env from example"
+ fi
+ else
+ echo "⚠️ packages/$service/.env already exists, skipping"
+ fi
+done
+
+# Generate a secure SECRET_KEY
+echo "🔑 Generating secure SECRET_KEY..."
+SECRET_KEY=$($UV_CMD run python -c "import secrets; print(secrets.token_urlsafe(32))")
+
+# Update .env files with the generated SECRET_KEY
+echo "🔄 Updating .env files with generated SECRET_KEY..."
+for service in auth patient rag; do
+ if [ -f "packages/$service/.env" ]; then
+ sed -i.bak "s/SECRET_KEY=change-me-in-production/SECRET_KEY=$SECRET_KEY/" "packages/$service/.env"
+ rm "packages/$service/.env.bak" 2>/dev/null || true
+ echo "✅ Updated SECRET_KEY in packages/$service/.env"
+ fi
+done
+
+# Make scripts executable (Unix/Linux/macOS only)
+if [ "$OS" != "Windows" ]; then
+ echo "🔧 Making scripts executable..."
+ chmod +x run_all.sh
+ chmod +x stop_all.sh
+ chmod +x packages/auth/run.sh
+ chmod +x packages/patient/run.sh
+ chmod +x packages/rag/run.sh
+ chmod +x frontend/run.sh
+else
+ echo "🔧 Scripts ready (Windows detected - no chmod needed)..."
+fi
+
+# Install frontend dependencies
+echo "📦 Installing frontend dependencies..."
+
+# Check Node.js
+if ! command_exists node; then
+ echo "❌ Node.js not found. Please install Node.js 20.19.0+ from https://nodejs.org/"
+ echo " After installation, run: cd frontend && npm install"
+ echo "⚠️ Continuing with backend setup only..."
+else
+ NODE_VERSION=$(node --version | sed 's/v//')
+ if version_ge "$NODE_VERSION" "20.19.0"; then
+ echo "✅ Node.js $NODE_VERSION is compatible"
+
+ # Check npm
+ if ! command_exists npm; then
+ echo "❌ npm not found. Please reinstall Node.js or install npm separately."
+ exit 1
+ fi
+
+ # Install frontend dependencies
+ if [ -f "frontend/package.json" ]; then
+ echo "📦 Installing frontend packages with npm..."
+ cd frontend
+ if npm install; then
+ echo "✅ Frontend dependencies installed successfully"
+ else
+ echo "❌ Failed to install frontend dependencies"
+ cd ..
+ exit 1
+ fi
+ cd ..
+ else
+ echo "❌ frontend/package.json not found"
+ exit 1
+ fi
+ else
+ echo "❌ Node.js $NODE_VERSION found, but 20.19.0+ is required."
+ echo " Please upgrade Node.js and run: cd frontend && npm install"
+ echo "⚠️ Continuing with backend setup only..."
+ fi
+fi
+
+echo ""
+echo "✅ Setup complete!"
+echo ""
+echo "📝 Next steps:"
+echo "1. 🔑 Add your OpenAI API key to packages/rag/.env (REQUIRED)"
+echo " - Get your key at: https://platform.openai.com/api-keys"
+echo " - Replace '***************************' with your actual key"
+
+if [ "$OS" = "Windows" ]; then
+ echo "2. 🚀 Start all services:"
+ echo " - Using Docker: docker-compose up -d"
+ echo " - Or manually: Start each service in separate terminals"
+ echo " - Windows users: Use 'bash run_all.sh' or run services individually"
+else
+ echo "2. 🚀 Start all services: ./run_all.sh"
+fi
+
+echo "3. 🌱 Seed demo data: $UV_CMD run python -m common.seed_data"
+echo "4. 🌐 Open http://localhost:3000 in your browser"
+echo ""
+echo "🔐 Demo Login Credentials (after seeding):"
+echo " Doctor: dr_smith / secure_password"
+echo " Nurse: nurse_johnson / secure_password"
+echo " Admin: admin_wilson / secure_password"
+echo ""
+echo "📚 API Documentation will be available at:"
+echo " 🔐 Auth Service: http://localhost:8001/docs"
+echo " 🏥 Patient Service: http://localhost:8002/docs"
+echo " 🤖 RAG Service: http://localhost:8003/docs"
diff --git a/python/rag/healthcare-support-portal/stop_all.sh b/python/rag/healthcare-support-portal/stop_all.sh
new file mode 100755
index 00000000..9aef3070
--- /dev/null
+++ b/python/rag/healthcare-support-portal/stop_all.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+# stop_all.sh - Stop all Healthcare Support Portal services
+
+# Don't exit on error for this script (we want to try stopping all services)
+# set -e would cause the script to exit if one service isn't running
+
+echo "🛑 Healthcare Support Portal - Stopping All Services"
+echo "=================================================="
+
+# Function to stop a service by PID file
+stop_service() {
+ local service_name=$1
+ local pid_file="logs/${service_name}.pid"
+
+ if [ -f "$pid_file" ]; then
+ local pid=$(cat "$pid_file")
+ if kill -0 "$pid" 2>/dev/null; then
+ echo "🛑 Stopping $service_name (PID: $pid)..."
+ kill "$pid"
+ rm "$pid_file"
+ else
+ echo "⚠️ $service_name was not running (stale PID file)"
+ rm "$pid_file"
+ fi
+ else
+ echo "⚠️ No PID file found for $service_name"
+ fi
+}
+
+# Stop all services
+stop_service "auth"
+stop_service "patient"
+stop_service "rag"
+stop_service "frontend"
+
+# Also try to kill any remaining uvicorn processes for our services
+echo "🧹 Cleaning up any remaining processes..."
+if command -v pkill >/dev/null 2>&1; then
+ pkill -f "src.auth_service.main:app" 2>/dev/null || true
+ pkill -f "src.patient_service.main:app" 2>/dev/null || true
+ pkill -f "src.rag_service.main:app" 2>/dev/null || true
+ # Also kill any npm/node processes for frontend
+ pkill -f "react-router dev" 2>/dev/null || true
+else
+ echo "⚠️ pkill not available. Manual cleanup may be needed."
+fi
+
+echo ""
+echo "✅ All services stopped!"
+echo "🗄️ Database is still running. Use 'docker-compose down' to stop it."
+echo " To stop everything including database: docker-compose down"
diff --git a/python/rag/healthcare-support-portal/sync_facts.sh b/python/rag/healthcare-support-portal/sync_facts.sh
new file mode 100755
index 00000000..7bc75841
--- /dev/null
+++ b/python/rag/healthcare-support-portal/sync_facts.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+
+# Healthcare Support Portal - OSO Facts Synchronization
+# Convenience script to sync authorization facts with OSO Cloud
+
+# Exit on any error
+set -e
+
+# Function to check if a command exists
+command_exists() {
+ command -v "$1" >/dev/null 2>&1
+}
+
+echo "🔐 Healthcare Support Portal - OSO Fact Synchronization"
+echo "======================================================"
+
+# Check for uv command
+UV_CMD="uv"
+if [ -f "/opt/homebrew/bin/uv" ]; then
+ UV_CMD="/opt/homebrew/bin/uv"
+fi
+
+if ! command_exists "$UV_CMD"; then
+ echo "❌ uv package manager not found. Please install uv and try again."
+ echo " Installation: curl -LsSf https://astral.sh/uv/install.sh | sh"
+ exit 1
+fi
+
+# Check if we're in the right directory
+if [ ! -f "packages/common/src/common/sync_oso_facts.py" ] && [ ! -f "sync_oso_facts.py" ]; then
+ echo "❌ Cannot find sync_oso_facts.py script."
+ echo " Please run this from the project root directory."
+ exit 1
+fi
+
+echo "🚀 Running fact synchronization..."
+
+# Run the fact synchronization script
+if ! $UV_CMD run python -m packages.common.src.common.sync_oso_facts; then
+ echo "❌ Failed to synchronize OSO facts"
+ exit 1
+fi
+
+echo "✅ OSO facts synchronized successfully!"
diff --git a/python/rag/healthcare-support-portal/test_document.txt b/python/rag/healthcare-support-portal/test_document.txt
new file mode 100644
index 00000000..d992e45e
--- /dev/null
+++ b/python/rag/healthcare-support-portal/test_document.txt
@@ -0,0 +1,41 @@
+Healthcare Protocol: Patient Admission Guidelines
+
+OVERVIEW
+This document outlines the standard procedures for patient admission to the cardiology department.
+
+ADMISSION CRITERIA
+1. Patients presenting with chest pain lasting more than 30 minutes
+2. Abnormal ECG findings indicating cardiac abnormalities
+3. Elevated cardiac biomarkers (troponin levels above normal)
+4. Physician referral for specialized cardiac evaluation
+
+PROCEDURES
+1. Initial Assessment
+ - Vital signs monitoring every 15 minutes for first hour
+ - 12-lead ECG within 10 minutes of arrival
+ - Blood draw for cardiac enzymes and lipid panel
+
+2. Documentation Requirements
+ - Complete medical history
+ - Current medications list
+ - Emergency contact information
+ - Insurance verification
+
+3. Treatment Protocol
+ - Oxygen therapy if saturation below 94%
+ - Continuous cardiac monitoring
+ - Pain assessment using 1-10 scale
+ - Antiplatelet therapy as indicated
+
+SPECIAL CONSIDERATIONS
+- Patients with diabetes require glucose monitoring every 4 hours
+- Elderly patients (>75 years) need fall risk assessment
+- Consider cardiothoracic surgery consultation for severe cases
+
+DISCHARGE CRITERIA
+- Stable vital signs for 24 hours
+- Normal or stable cardiac enzymes
+- Patient education completed
+- Follow-up appointment scheduled
+
+This protocol should be reviewed quarterly and updated as needed based on current medical guidelines and research findings.
diff --git a/python/rag/healthcare-support-portal/validate_environment.sh b/python/rag/healthcare-support-portal/validate_environment.sh
new file mode 100755
index 00000000..ecfc3dde
--- /dev/null
+++ b/python/rag/healthcare-support-portal/validate_environment.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+#
+# Healthcare Support Portal - Environment Validation Script
+# This script checks that all required dependencies and ports are available
+#
+
+echo "🔍 Validating environment..."
+echo "=============================="
+
+# Check required software
+echo "📋 Checking required software:"
+
+python3 --version >/dev/null 2>&1 && echo "✅ Python OK" || echo "❌ Install Python 3.11+"
+node --version >/dev/null 2>&1 && echo "✅ Node.js OK" || echo "❌ Install Node.js 20.19.0+"
+docker --version >/dev/null 2>&1 && echo "✅ Docker OK" || echo "❌ Install Docker"
+git --version >/dev/null 2>&1 && echo "✅ Git OK" || echo "❌ Install Git"
+command -v uv >/dev/null 2>&1 && echo "✅ UV package manager OK" || echo "❌ Install UV package manager"
+
+echo
+echo "🔌 Checking port availability:"
+
+# Check available ports
+for port in 3000 8001 8002 8003 5432 8080; do
+ if ! lsof -i :$port > /dev/null 2>&1; then
+ echo "✅ Port $port available"
+ else
+ echo "⚠️ Port $port in use - you may need to stop other services"
+ fi
+done
+
+echo
+echo "🎉 Environment validation complete!"
+echo "If any checks failed, see the troubleshooting section in README.md"