(auth) completed staff & admin authentication

Author: linasliyakath

api-gateway/src/app.ts

@@ -3,6 +3,8 @@ import cors from 'cors';
 import healthRoutes from './routes/health';
 import { patientAuthProxy } from './proxy/patient.auth.proxy';
 import { patientDataProxy } from './proxy/patient.data.proxy';
+import { staffAuthProxy } from './proxy/staff.auth.proxy';
+import { staffDataProxy } from './proxy/staff.data.proxy';
 import { authenticate } from './middlewares/auth.middleware';
 import { requirePatientSelf } from './middlewares/patient.guard';
 
@@ -15,8 +17,10 @@ app.use('/health', healthRoutes);
 
 // 🔓 PUBLIC auth (NO JWT)
 app.use('/patients/public', patientAuthProxy);
-
 // 🔐 PROTECTED patient data
 app.use('/patients', authenticate, requirePatientSelf, patientDataProxy);
 
+app.use('/staff/public', staffAuthProxy);
+app.use('/staff', authenticate, staffDataProxy);
+
 export default app;

api-gateway/src/middlewares/auth.middleware.ts

@@ -5,8 +5,14 @@ import { error } from 'node:console';
 export interface AuthenticatedRequest extends Request {
   user?: {
     sub: string;
-    role: string;
-    type: 'PATIENT' | 'STAFF';
+    type: 'PATIENT' | 'STAFF' | 'ADMIN';
+
+    // present for STAFF / PATIENT
+    role?: string;
+
+    // present for STAFF
+    job_title?: 'HEAD_STAFF' | 'STAFF';
+    department?: string;
   };
 }
 

api-gateway/src/proxy/staff.proxy.ts api-gateway/src/proxy/staff.auth.proxy.tsapi-gateway/src/proxy/staff.proxy.ts renamed to api-gateway/src/proxy/staff.auth.proxy.ts

@@ -1,9 +1,11 @@
 import { createProxyMiddleware } from 'http-proxy-middleware';
 
-export const staffProxy = createProxyMiddleware({
+export const staffAuthProxy = createProxyMiddleware({
   target: 'http://localhost:3002',
   changeOrigin: true,
+
+  // /staff/public/auth/login → /auth/login
   pathRewrite: {
-    '^/staff': '',
+    '^/staff/public': '',
   },
 });

api-gateway/src/proxy/staff.data.proxy.ts

@@ -0,0 +1,9 @@
+import { createProxyMiddleware } from 'http-proxy-middleware';
+
+export const staffDataProxy = createProxyMiddleware({
+  target: 'http://localhost:3002',
+  changeOrigin: true,
+
+  // /staff/* → /staff/*
+  pathRewrite: (path) => `/staff${path}`,
+});

docs/decisions.md

@@ -48,7 +48,7 @@ Reason:
 
 | Purpose       | Technology | Library     |
 | ------------- | ---------- | ----------- |
-| PostgreSQL    | SQL        | pg + Prisma |
+| PostgreSQL    | SQL        | pg          |
 | MongoDB       | NoSQL      | mongoose    |
 | Redis         | Cache      | ioredis     |
 | Message Queue | RabbitMQ   | amqplib     |

frontend/.gitkeep

@@ -15,11 +15,15 @@
   "packageManager": "pnpm@10.28.2",
   "dependencies": {
     "@prisma/client": "^7.3.0",
+    "bcrypt": "^6.0.0",
     "express": "^5.2.1",
+    "jsonwebtoken": "^9.0.3",
     "prisma": "^7.3.0"
   },
   "devDependencies": {
+    "@types/bcrypt": "^6.0.0",
     "@types/express": "^5.0.6",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^25.1.0",
     "dotenv": "^17.2.3",
     "tsx": "^4.21.0",

pnpm-lock.yaml

@@ -1,9 +1,14 @@
 import express from 'express';
-import healthRouter from './routes/health.js';
+import healthRouter from './routes/health';
+import authRouter from './modules/auth/auth.routes';
+import staffRouter from './modules/staff/staff.routes';
 
 const app = express();
 app.use(express.json());
 
 app.use('/health', healthRouter);
+app.use('/auth', authRouter);
+
+app.use('/staff', staffRouter);
 
 export default app;

services/staff-service/package.json

@@ -0,0 +1,14 @@
+import 'dotenv/config';
+import { Pool } from 'pg';
+
+if (!process.env.DATABASE_URL) {
+  throw new Error('DATABASE_URL is not defined for staff-service');
+}
+
+export const pool = new Pool({
+  connectionString: process.env.DATABASE_URL,
+});
+
+pool.on('connect', () => {
+  console.log('Staff Service DB connected');
+});