Mediora

The API is organized by domain: authentication, doctor approval, users, schedules, appointments, chat, and feedback. Each domain has its own router, schemas, service layer, and models, so the business rules stay testable and separate from the HTTP layer.

FastAPI and Pydantic fit the async booking and chat endpoints because the request schemas double as validation and API documentation. PostgreSQL and SQLAlchemy keep appointments, schedules, and payments transactional, while Redis handles token revocation, rate limiting, and short-lived availability data. The Next.js and TypeScript clients share the same request shapes as the API, which kept the patient and doctor dashboards in sync.

Sign-up starts with an email check, sends a verification token, and only then lets the user set a password. Passwords are hashed with Argon2 and exchanged for short-lived access tokens plus refresh tokens backed by Redis. Google OAuth is supported for both the web app and a mobile client.

• Email verification and duplicate email/username checks
• Password strength rules, reset tokens, and authenticated password changes
• JWT access and refresh flow with server-side token revocation
• Role-aware access for patients, doctors, and admins

A doctor cannot accept appointments until an admin reviews their request. Applicants submit their specialty, clinic details, and documents such as a medical degree and employment certificate. Files are uploaded to Cloudinary, and the admin queue shows pending requests, waiting time, and each document before approval or rejection.

• Certification request with document uploads
• Admin approval queue with status filters and search
• Approve or reject with a reviewable history
• Wallet and earnings tracking for approved doctors

Doctors define their weekly working days, consultation hours, breaks, maximum patients per day, and time off. They can also publish one-off special schedules and leave periods. Availability checks combine the weekly schedule, exceptions, existing appointments, and service duration so a slot is never double-booked.

1async def available_slots(2    doctor_id: UUID,3    service_id: UUID,4    day: date,5) -> list[time]:6    schedule = await get_schedule(doctor_id, day)7    if schedule is None:8        return []9 10    booked = await get_booked_slots(doctor_id, day)11    duration = await get_service_duration(service_id)12    leaves = await get_leave_blocks(doctor_id, day)13 14    return [15        slot16        for slot in build_slots(schedule, duration)17        if slot not in booked18        and not overlaps(slot, duration, leaves)19    ]

Booking creates a Chargily checkout session with a 30-minute limit. A webhook settles the payment, moves the appointment into a confirmed state, and the patient is redirected back into the app. Failed or expired sessions release the slot. Doctors approve settled appointments, and either side can cancel according to the appointment state.

1. Patient selects a doctor, service, and available slot
2. Backend creates a Chargily product, price, and checkout session
3. Webhook verifies the payment and settles the appointment
4. Doctor approves the appointment or the patient cancels it

A token-authenticated WebSocket endpoint powers the chat. Clients can send messages, mark conversations as read, broadcast typing state, and keep the connection alive with ping frames. Conversation history and recent contacts are paginated over REST, and patients can leave a rating and comment after an appointment is completed.

• Send, read, typing, and ping events
• Recent contacts and paginated message history
• Feedback is tied to completed appointments
• Average rating and review counts exposed on doctor profiles