Backend Architecture & Authentication. - Domenicko/medical-booking-system GitHub Wiki

Backend Architecture & Authentication

1. Backend Architecture

The Medical Booking System will use a REST API architecture.

The main communication flow will be:

React Frontend → Express REST API → PostgreSQL Database

The React application will send HTTP requests to the backend API. The Express server will process these requests, apply business logic and communicate with the PostgreSQL database.

The React frontend will not connect directly to the database. All database operations will be handled by the backend.

2. Backend Technology

The backend will be developed using:

  • Node.js — runtime environment for the server
  • Express — framework for creating the REST API
  • TypeScript — type-safe development
  • PostgreSQL — relational database

The backend will be responsible for:

  • User registration and authentication
  • Managing doctor information
  • Managing available appointment slots
  • Creating and managing appointments
  • Validating incoming data
  • Communicating with the database
  • Protecting authenticated API endpoints

3. Backend Architecture Layers

The backend can be organized into several layers:

Routes

Routes define the API endpoints and HTTP methods.

Examples:

  • POST /api/auth/login
  • GET /api/doctors
  • GET /api/doctors/:id
  • POST /api/appointments

Controllers

Controllers receive HTTP requests and return HTTP responses.

For example, the appointment controller will receive a booking request and return information about the created appointment.

Services

Services contain the main business logic of the application.

For example, the appointment service can check whether a selected time slot is available before creating a booking.

Database

PostgreSQL stores application data such as:

  • Users
  • Doctors
  • Specialties
  • Appointments
  • Available time slots

4. Authentication

The application will use JWT-based authentication with HttpOnly Cookies.

JWT (JSON Web Token) will be used to identify authenticated users when they access protected API endpoints.

The authentication process will work as follows:

  1. The user registers an account.
  2. The user logs in using email and password.
  3. The backend verifies the credentials.
  4. If the credentials are correct, the backend creates a JWT.
  5. The JWT is stored in an HttpOnly cookie.
  6. The browser automatically sends the cookie with requests to the backend.
  7. Authentication middleware verifies the JWT.
  8. Protected endpoints can then identify the authenticated user.

5. Protected Endpoints

Some API endpoints should only be accessible to authenticated users.

For example:

  • POST /api/appointments — create an appointment
  • GET /api/appointments — view the user's appointments
  • DELETE /api/appointments/:id — cancel an appointment

Public endpoints can include:

  • POST /api/auth/register
  • POST /api/auth/login
  • GET /api/doctors
  • GET /api/doctors/:id

6. Why JWT with HttpOnly Cookies?

JWT is suitable for this project because it provides a simple way to authenticate users through a REST API.

Using an HttpOnly cookie prevents JavaScript running in the browser from directly reading the authentication token.

The backend will verify the token before allowing access to protected resources.

This approach also allows the React frontend and Express backend to remain separated while communicating through the REST API.

7. Security Considerations

The backend should follow several basic security practices:

  • Passwords should never be stored as plain text.
  • Passwords should be hashed before being stored in the database.
  • Authentication tokens should be protected.
  • Protected endpoints should require authentication.
  • User input should be validated.
  • Unauthorized users should not be able to access another user's appointments.
  • HTTPS should be used in production.
  • Sensitive information should not be stored directly in source code.

8. Architecture Summary

The final application architecture will be:

React Frontend ↓ Express REST API ↓ Controllers and Services ↓ PostgreSQL Database

Authentication will be handled using JWT and HttpOnly Cookies.

This architecture separates the frontend, backend and database responsibilities and allows the application to be expanded with additional features in the future.