TebbiPlus API

The backend for a role-based medical appointment platform connecting patients, doctors, clinic administrators, and system administrators. It provides secure identity flows, doctor discovery and availability, appointment lifecycle management, notifications, and administration APIs.

Frontend repository · Detailed API notes

Features

• Patient and doctor registration
• Access and refresh-token authentication
• Role-based authorization for Patient, Doctor, and Admin
• User status handling for active, pending, and blocked accounts
• Doctor profiles with specialties, consultation fees, images, and schedules
• Doctor search, filters, availability, and generated appointment slots
• Appointment booking, cancellation, and status transitions
• Patient profiles, appointment history, and medical-history records
• Admin user, specialty, appointment, and dashboard-statistics operations
• In-app notification listing, read state, deletion, and admin broadcasts
• Image upload and processing with Multer and Sharp
• Joi validation and centralized API errors
• End-to-end business-flow test script

Tech Stack

• Node.js and Express 5
• MongoDB and Mongoose
• JSON Web Tokens and bcrypt
• Joi
• Nodemailer
• Multer and Sharp
• Native Node.js test runner script using fetch

Architecture

.
├── Database/           # MongoDB connection
├── Middlewares/        # Authentication, authorization, validation, uploads
├── Models/             # Shared Mongoose models
├── Modules/            # Domain controllers, routes, and validation
│   ├── admin/
│   ├── appointment/
│   ├── doctor/
│   ├── notification/
│   ├── patient/
│   └── user/
├── Utils/              # Tokens, email, images, and notifications
├── tests/              # Full business-flow API test
├── app.js              # Express middleware and route registration
└── index.js            # Database and HTTP server startup

All API routes are mounted below /api. Authentication middleware reads a bearer access token, while authorize(...) limits domain actions by role.

Getting Started

Prerequisites

• Node.js 18+
• npm
• MongoDB locally or through MongoDB Atlas
• SMTP credentials if email delivery is enabled

Installation

git clone https://github.com/TabibPlus/Backend.git
cd Backend
npm install
cp .env.example .env

Configure .env:

Variable	Purpose	Typical local value
PORT	HTTP port	5000
NODE_ENV	Runtime mode	development
BASE_URL	Public backend origin	http://localhost:5000
MONGODB_URI	MongoDB connection URI	mongodb://127.0.0.1:27017/medical_clinic_db
JWT_SECRET	Access-token signing secret	long random value
JWT_REFRESH_SECRET	Refresh-token signing secret	different random value
JWT_EXPIRE	Access-token lifetime	15m
JWT_REFRESH_EXPIRE	Refresh-token lifetime	7d
EMAIL_SERVICE	Nodemailer service	gmail
EMAIL_USER	Sender account	provider-specific
EMAIL_PASS	Sender app password	provider-specific

Never commit real secrets.

Optionally seed a development administrator and initial specialty:

node seed.js

The seed script creates a local-only administrator (admin@test.com / Admin1234). Change or remove this account outside a disposable development environment.

Start the API:

npm run dev

The default base URL is http://localhost:5000/api.

API Overview

Domain	Base path	Examples
Identity	/api/users	register patient/doctor, login, refresh, logout, profile
Doctors	/api/doctors	profiles, specialties, availability, slots, search
Appointments	/api/appointments	book, list, cancel, update status
Patients	/api/patients	profile, history, appointments
Administration	/api/admin	users, admins, appointments, statistics
Notifications	/api/notifications	list, unread count, read/delete, broadcast

Representative routes:

POST   /api/users/register/patient
POST   /api/users/register/doctor
POST   /api/users/login
POST   /api/users/refresh
GET    /api/doctors
GET    /api/doctors/:id/available-slots
PUT    /api/doctors/availability
POST   /api/appointments
PUT    /api/appointments/:id/status
PUT    /api/appointments/:id/cancel
GET    /api/admin/dashboard/stats

See DOCUMENTATION.md, the module route files, and flow.rest for additional request details.

Verification

With MongoDB and the API running, execute the end-to-end business flow:

npm test

Override its defaults when needed:

API_URL=http://localhost:5000/api \
ADMIN_EMAIL=admin@test.com \
ADMIN_PASSWORD=Admin1234 \
npm test

The script covers registration, login, refresh tokens, role restrictions, doctor profiles and availability, appointments, administrative actions, and notifications.

Scripts

Command	Description
npm run dev	Start with Nodemon
npm start	Start with Node.js
npm test	Run the business-flow API test
npm run test:verbose	Run the same flow with stderr included

License

The package metadata declares the ISC license. No standalone license file is currently included.