MCU Backoffice

Overview

The internal backoffice the same clinic's staff work in: patient records, the day's agenda for every doctor, visits, billing drafts and shared tasks, on a Cloudflare Worker with D1, behind Cloudflare Access. It is in use and still growing.

Stack

TypeScript, React 19, Vite, Tailwind CSS, shadcn/ui on Base UI, Cloudflare Workers, D1 (SQLite), Cloudflare Access, Playwright

What I built

• Sign-in checked on the server: the Worker verifies the Cloudflare Access token itself (RSA signature against cached keys, audience, issuer, expiry) and maps it to a staff profile provisioned in D1. A missing setting answers 503, never an open door.
• Six roles enforced by the Worker on every request: the front desk sees records and the agenda but no clinical notes, a clinician sees only patients in their active care, billing sees only the internal ledger.
• An agenda per doctor, protected against double bookings by SQLite triggers, since D1 has no exclusion constraints.
• Visits started from an appointment and attributed to the clinician. A concluded visit is never rewritten: a correction is a dated, attributed addendum.
• Concluding a visit with an amount creates a billing draft that the front desk confirms before it can be marked paid. It is an internal ledger, not a fiscal invoice.
• An append-only audit log enforced by the database, and every record kept apart per clinic.
• Security headers (CSP, HSTS, no framing), writes behind an explicit flag that stays off outside production, and CI with a build, Worker smoke tests, Playwright end-to-end tests and npm audit, with no secrets.

Key decisions

• The interface holds no patient data of its own: everything comes from the authenticated API on the same origin, so without the Worker every view stays empty.
• Authorization lives in the Worker, not in the interface: hiding a button is never the control.
• An appointment, a visit and a billing draft are separate records, so a booking that never happens leaves no clinical note and no charge.
• The patient summary keeps only what matters between visits (allergies, conditions, medication, height and weight, history) instead of permanent empty forms for vital signs.
• The ledger stops at internal drafts: it issues no fiscal invoices, makes no PDFs and takes no payments, which stay with the clinic's own authorized process.