QCode

## the-problem

## the-approach

• ▸five roles — Superadmin, Admin, Adminclient, Reader, Client — declared per endpoint, so the role list sits next to the handler rather than in a middleware table nobody reads
• ▸made the authorization check hit the database, not the token: the JWT carries an id, the role is re-read from the user record on every request, so a demotion takes effect immediately
• ▸modelled the code as a lifecycle, not a flag — issued, sent, given — with a date range, a per-day limit, a renewable flag and the issuer's signature on the record
• ▸consent by scan: a patient's own QR is a signed token, and an issuer scanning it adds that patient to their allowed list — the issuer's client list is that list, so access is granted by the patient, in person
• ▸every collection appends to a log with a per-day counter, so "three times a day" is an enforceable number rather than a note
• ▸products resolve against the Swiss Documedis article catalogue by article number, cached locally on first use — searched live, stored once, referenced by id from then on
• ▸delivery on two channels, email and in-app notification, with an Expo client for the patient that carries the code, the count and the alerts
• ▸an operator console on top: account oversight, catalogue import, an AVS registry import and a value-per-patient rollup over everything dispensed

type Role =
  | "Superadmin" | "Admin" | "Adminclient" | "Reader" | "Client";
 
const VerifyToken = (roles: Role[], next: Handler) =>
  async (req: Request, params: any) => {
    const token = req.headers.get("authorization")?.split(" ")[1];
    if (!token) return json({ msg: "authorization denied" }, 401);
 
    const { id } = jwt.verify(token, process.env.JWT_SECRET);
    req.user = id;
 
    // The token says who you are. What you may do is re-read from
    // the row every request, so a demotion lands on the next call
    // instead of whenever the last-issued token happens to expire.
    if (roles.length) {
      const q = { _id: id, role: { $in: roles } };
      if (!(await User.findOne(q))) return json({ msg: "denied" }, 401);
    }
    return next(req, params);
  };
 
// Declared at the endpoint, in view of the handler it guards.
export const POST = VerifyToken(["Reader"], markCodeGiven);

## the-architecture

## the-results

• ✓one record serves four roles without any of them seeing the others' view of it
• ✓the prescription carries its own history — issued by, sent, dispensed by, collected when and how often
• ✓codes reference real catalogue articles, so what's issued is what the counter dispenses
• ✓shipped web, mobile and operator console off one Next.js app