Zlati Pediatrics - Dr. Zlatomira Manolova-Peneva
A modern, enterprise-grade appointment booking and management platform for Dr. Zlatomira Manolova-Peneva's pediatric practice.
🚀 Built With
✨ Key Features
User Experience
- Smart Booking: Real-time availability with date-range filtering and secure slot locking.
- Bilingual Interface: Full i18n support for English and Bulgarian.
- My Appointments: Patients can track history, see upcoming visits, and download iCal files.
Admin & Security
- Dynamic Dashboard: Complete overview of practice metrics and daily schedule.
- Role-Based Access: Strict separation between
PATIENT and ADMIN roles.
- Security Hardening:
- Rate limiting and session revocation backed by Upstash Redis (required in production; per-instance fallback with a circuit breaker if Redis is unreachable)
- Automated CodeQL Security Scanning
- Audit Logging for all sensitive actions
🛠️ Getting Started
Prerequisites
- Node.js 20+
- Docker & Docker Compose (optional, for full stack)
⚡ Quick Start (Docker)
The easiest way to run the entire stack (App + DB + daily Postgres backups):
docker-compose up -d
Access the application at http://localhost:3000.
💻 Local Development
-
Clone:
git clone https://github.com/CreaTiVeUK/Dr-Zlatomira-Manolova.git
cd Dr-Zlatomira-Manolova
-
Install:
npm install
-
Setup Environment:
Copy .env.example to .env and configure your database credentials.
If you want AI summaries to run through Vercel AI Gateway, set VERCEL_AI_GATEWAY_API_KEY and optionally override VERCEL_AI_GATEWAY_MODEL. Audio transcription in the current implementation still requires OPENAI_API_KEY.
-
Database:
npx prisma db push
npx prisma db seed
-
Run:
npm run dev
🔄 DevOps & CI/CD
This project features a fully automated DevOps pipeline using GitHub Actions:
1. Continuous Integration (CI)
- Testing: Vitest (Unit) and Playwright (E2E) run on every push.
- Linting: ESLint and formatting checks.
- Docs: Storybook build verification.
2. Continuous Deployment (CD)
- Container Registry: Successfully built images are pushed to GHCR.
- Automated Release: Semantic Release automatically versions the project (v1.0.0 -> v1.0.1) and generates a CHANGELOG based on commit messages.
3. Reliability
- Automated Backups: A sidecar container dumps the PostgreSQL database daily to the Compose
backups named volume. See operations and recovery for restore drills, Vercel backup requirements, and reminder monitoring.
📚 Documentation
- Component Library: Run
npm run storybook to view the UI component docs.
- Security Policy: See SECURITY.md.
🧪 Testing
| Layer | Command | What it covers |
|---|
| Unit (Vitest, jsdom/node) | npm run test | Pure logic: auth callbacks (lockout, TOTP, OAuth-linking guard, inactivity), booking overlap math & clinic hours, encryption round-trips & tamper detection, storage round-trips, rate limiting, sanitisation, session revocation fallback |
| E2E (Playwright) | npm run test:e2e | Real browser against the app + Postgres: auth flows, booking, profile, messaging, password reset |
| Security regressions | npx playwright test tests/security.spec.ts tests/security-stress.spec.ts | Logout-cookie replay, role escalation, upload content sniffing + encrypted round-trip, cancel→rebook, double-booking race, price tampering, enumeration probes |
| Registration funnel (CI only) | runs in CI as part of E2E | register → unverified login blocked → verify (token from DB) → login. The flow that locks out all new patients if email/verification breaks |
In CI the E2E suite runs against a production build (next build + next start)
with a disposable Postgres — so prod-only failures (CSP, env validation,
standalone output) surface before deploy. Local npm run test:e2e reuses your
dev server.
The dev/CI seed (prisma db seed) refuses to run against non-local database
hosts: it resets known accounts to a shared password. Set ALLOW_SEED=1 only
for disposable databases.
Developed with ❤️ for Dr. Manolova-Peneva.
