CI hardening + portal fixes

.gitignore

@@ -88,6 +88,12 @@ db.sqlite3-journal
 media/
 staticfiles/
 
+# Local HODDI datasets (kept out of git)
+securemed-backend/data/hoddi/
+
+# Local artifacts
+securemed-backend/tmp/
+
 # Python packaging / builds
 build/
 dist/

docker-compose.yml

@@ -42,6 +42,10 @@ services:
     restart: unless-stopped
     ports:
       - "8000:8000"
+    volumes:
+      - ./securemed-backend:/app
+      - backend_media:/app/media
+      - backend_static:/app/staticfiles
     environment:
       DB_ENGINE: django.db.backends.postgresql
       DB_NAME: ${DB_NAME:-securemed}
@@ -56,9 +60,7 @@ services:
       ALLOWED_HOSTS: "localhost,127.0.0.1,backend"
       SECRET_KEY: ${SECRET_KEY:-ci-secret-key}
       DEBUG: ${DEBUG:-True}
-    command: >
-      sh -c "python manage.py migrate --noinput &&
-             gunicorn config.wsgi:application --bind 0.0.0.0:8000 --workers 2"
+      DEV_SERVER: "true"
     depends_on:
       db:
         condition: service_healthy
@@ -74,6 +76,10 @@ services:
     restart: unless-stopped
     ports:
       - "3000:3000"
+    volumes:
+      - ./securemed-frontend:/app
+      - /app/node_modules
+      - /app/.next
     environment:
       BACKEND_URL: http://backend:8000
       NEXT_PUBLIC_API_URL: /api
@@ -83,3 +89,5 @@ services:
 
 volumes:
   postgres_data:
+  backend_media:
+  backend_static:

securemed-backend/apps/accounts/patients/serializers.py

@@ -26,5 +26,5 @@ class Meta:
         ]
         read_only_fields = [
             'patient_id', 'date_of_birth', 'gender', 'blood_group', 'emergency_contacts',
-            'allergies', 'chronic_conditions', 'current_medications' # Clinical data must be clinician-managed
+            'chronic_conditions' # Clinician-managed
         ]

securemed-backend/apps/clinical/diagnostics/views.py

@@ -33,13 +33,14 @@ class LabOrderViewSet(viewsets.ModelViewSet):
 
     def get_queryset(self):
         user = self.request.user
+        base = LabOrder.objects.all().order_by('-created_at', '-id')
         if hasattr(user, 'patient_profile'):
             # patient FK on LabOrder points to AUTH_USER_MODEL, not Patient
-            return LabOrder.objects.filter(patient=user)
+            return base.filter(patient=user)
         elif hasattr(user, 'doctor_profile') or user.role == 'doctor':
-            return LabOrder.objects.filter(doctor=user)
+            return base.filter(doctor=user)
         elif user.is_staff:
-            return LabOrder.objects.all()
+            return base
         return LabOrder.objects.none()
 
     def perform_create(self, serializer):
@@ -255,6 +256,8 @@ def secure_view(self, request, pk=None):
         elif hasattr(request.user, 'doctor_profile') or request.user.is_staff:
             if result.order.doctor_id not in [None, request.user.id] and not request.user.is_staff:
                 return Response({"error": "Not authorized"}, status=status.HTTP_403_FORBIDDEN)
+        elif request.user.role == 'lab_technician':
+            pass
         else:
             return Response({"error": "Not authorized"}, status=status.HTTP_403_FORBIDDEN)
 

securemed-backend/apps/clinical/records/interaction_service.py

@@ -3,10 +3,8 @@
 from typing import Dict, Iterable, List, Optional, Sequence, Tuple
 
 from django.core.cache import cache
-from django.db.models import Q
 
 from .models import (
-    DrugInteraction,
     MedicationInteractionKnowledge,
     MedicationInteractionReport,
     MedicationInteractionReportJob,
@@ -71,6 +69,22 @@ def resolve_medications_for_knowledge(medications: Sequence[str]) -> List[str]:
     return sorted(set(resolved))
 
 
+def _build_medication_display_resolver(
+    normalized_meds: Sequence[str],
+    original_inputs: Sequence[str],
+) -> Dict[str, str]:
+    original_map = {
+        normalize_medication_name(med): med
+        for med in original_inputs
+        if med
+    }
+    if not normalized_meds:
+        return original_map
+    refs = MedicationReference.objects.filter(identifier__in=normalized_meds).order_by("id")
+    display_map = {ref.identifier: ref.display_name for ref in refs}
+    return {**original_map, **display_map}
+
+
 def _get_active_medications_for_patient(patient_id: int) -> List[str]:
     rows = Prescription.objects.filter(
         medical_record__patient_id=patient_id,
@@ -127,28 +141,6 @@ def _knowledge_findings_for_combos(combo_groups: Iterable[Tuple[str, ...]]) -> L
     return findings
 
 
-def _fallback_pair_findings(pair_groups: Iterable[Tuple[str, str]]) -> List[Dict]:
-    findings: List[Dict] = []
-    for a, b in pair_groups:
-        inter = DrugInteraction.objects.filter(
-            Q(drug_a__iexact=a, drug_b__iexact=b) | Q(drug_a__iexact=b, drug_b__iexact=a)
-        ).first()
-        if inter:
-            findings.append(
-                {
-                    "finding_type": "interaction",
-                    "medications": [a, b],
-                    "combination_size": 2,
-                    "side_effect": inter.description or f"Interaction between {a} and {b}",
-                    "severity": inter.severity,
-                    "description": inter.description,
-                    "source": "SecureMed Seed",
-                    "source_reference": "",
-                }
-            )
-    return findings
-
-
 def _compute_medication_safety(medications: Sequence[str]) -> Dict:
     normalized = resolve_medications_for_knowledge(medications)
     if not normalized:
@@ -171,7 +163,6 @@ def _compute_medication_safety(medications: Sequence[str]) -> Dict:
     findings.extend(_single_drug_findings(normalized))
     findings.extend(_knowledge_findings_for_combos(triplets))
     findings.extend(_knowledge_findings_for_combos(pairs))
-    findings.extend(_fallback_pair_findings(pairs))
 
     # Deduplicate by semantic identity.
     dedup_key = set()
@@ -232,6 +223,7 @@ def bump_safety_cache_namespace() -> str:
 
 
 def evaluate_medication_safety(medications: Sequence[str]) -> Dict:
+    original_inputs = list(medications)
     normalized = resolve_medications_for_knowledge(medications)
     signature = canonical_signature(normalized)
     if not signature:
@@ -246,6 +238,20 @@ def evaluate_medication_safety(medications: Sequence[str]) -> Dict:
         return cached
 
     result = _compute_medication_safety(normalized)
+    display_resolver = _build_medication_display_resolver(
+        result.get("medications", []),
+        original_inputs,
+    )
+    if display_resolver:
+        result["medications"] = [
+            display_resolver.get(med, med)
+            for med in result.get("medications", [])
+        ]
+        for finding in result.get("findings", []):
+            finding["medications"] = [
+                display_resolver.get(med, med)
+                for med in finding.get("medications", [])
+            ]
     try:
         cache.set(key, result, SAFETY_CACHE_TTL_SECONDS)
     except Exception:
@@ -321,7 +327,7 @@ def enqueue_report_generation(
     trigger_event: str = "manual_refresh",
     candidate_medications: Optional[Sequence[str]] = None,
 ) -> MedicationInteractionReportJob:
-    from .tasks import generate_interaction_report_job
+    from django.conf import settings
 
     task_id = uuid4().hex
     candidate_meds = [normalize_medication_name(m) for m in (candidate_medications or []) if m]
@@ -333,6 +339,16 @@ def enqueue_report_generation(
         candidate_medications=candidate_meds,
         status="queued",
     )
+    if getattr(settings, "CELERY_TASK_ALWAYS_EAGER", False) or getattr(settings, "DEBUG", False):
+        try:
+            run_report_job(job.id)
+            job.refresh_from_db()
+        except Exception as exc:
+            job.status = "failed"
+            job.error_message = str(exc)
+            job.save(update_fields=["status", "error_message"])
+        return job
+    from .tasks import generate_interaction_report_job
     try:
         generate_interaction_report_job.delay(job.id)
     except Exception as exc:

securemed-backend/apps/clinical/records/management/commands/seed_hoddi_mini.py

@@ -1,90 +1,56 @@
-from django.core.management.base import BaseCommand
-
-from apps.clinical.records.interaction_service import canonical_signature, normalize_medication_name
-from apps.clinical.records.models import (
-    MedicationInteractionKnowledge,
-    MedicationReference,
-    MedicationSideEffect,
-)
-
-
-MINI_DRUGS = [
-    {"identifier": "db00945", "display": "Aspirin"},
-    {"identifier": "db00682", "display": "Warfarin"},
-    {"identifier": "db01050", "display": "Ibuprofen"},
-]
+import os
+from pathlib import Path
 
-MINI_SIDE_EFFECTS = [
-    {"med": "db00945", "effect": "Nausea", "severity": "low"},
-    {"med": "db00682", "effect": "Bleeding", "severity": "high"},
-    {"med": "db01050", "effect": "Gastric irritation", "severity": "moderate"},
-]
-
-MINI_INTERACTIONS = [
-    {
-        "meds": ["db00682", "db00945"],
-        "effect": "Increased bleeding risk",
-        "severity": "high",
-    },
-    {
-        "meds": ["db00945", "db01050"],
-        "effect": "Gastrointestinal irritation",
-        "severity": "moderate",
-    },
-    {
-        "meds": ["db00682", "db00945", "db01050"],
-        "effect": "Elevated bleeding with NSAIDs",
-        "severity": "high",
-    },
-]
-
-SOURCE_VERSION = "HODDI_MINI"
+from django.core.management.base import BaseCommand
+from django.core.management import call_command
 
 
 class Command(BaseCommand):
-    help = "Seed a minimal HODDI-like dataset for CI/E2E."
+    help = "Seed HODDI interactions from a dataset path (prefers local data/hoddi)."
 
     def handle(self, *args, **options):
-        self.stdout.write("[-] Seeding mini HODDI dataset...")
-
-        for item in MINI_DRUGS:
-            normalized = normalize_medication_name(item["display"])
-            MedicationReference.objects.get_or_create(
-                identifier=item["identifier"],
-                normalized_name=normalized,
-                defaults={
-                    "display_name": item["display"],
-                    "source": "HODDI",
-                },
-            )
-
-        for item in MINI_SIDE_EFFECTS:
-            MedicationSideEffect.objects.get_or_create(
-                medication_name=item["med"],
-                side_effect=item["effect"],
-                source_version=SOURCE_VERSION,
-                defaults={
-                    "severity": item["severity"],
-                    "description": "",
-                    "source": "HODDI",
-                },
+        candidates = [
+            os.environ.get("HODDI_DATASET_PATH"),
+            "/app/data/hoddi/HODDI_v2",
+            "/app/.data/hoddi/HODDI_v2",
+            "/tmp/HODDI/dataset/HODDI_v2",
+        ]
+        dataset_path = next((path for path in candidates if path and Path(path).exists()), None)
+        dataset_version = os.environ.get("HODDI_DATASET_VERSION", "HODDI_v2")
+        side_effect_map = os.environ.get("HODDI_SIDE_EFFECT_MAP")
+        drug_map = os.environ.get("HODDI_DRUG_MAP")
+        include_negative = os.environ.get("HODDI_INCLUDE_NEGATIVE", "").lower() in {"1", "true", "yes"}
+
+        if not dataset_path:
+            self.stdout.write(
+                self.style.WARNING(
+                    "HODDI dataset not found. Set HODDI_DATASET_PATH or place data under "
+                    "/app/data/hoddi/HODDI_v2."
+                )
             )
-
-        for item in MINI_INTERACTIONS:
-            meds = [normalize_medication_name(m) for m in item["meds"]]
-            signature = canonical_signature(meds)
-            MedicationInteractionKnowledge.objects.get_or_create(
-                combination_signature=signature,
-                side_effect=item["effect"],
-                source_version=SOURCE_VERSION,
-                defaults={
-                    "medications": meds,
-                    "combination_size": len(meds),
-                    "severity": item["severity"],
-                    "description": "",
-                    "source": "HODDI",
-                    "evidence": {},
-                },
-            )
-
-        self.stdout.write(self.style.SUCCESS("Mini HODDI seed complete."))
+            return
+
+        if not side_effect_map:
+            candidate = Path(dataset_path) / "dictionary/Side_effects_unique.csv"
+            if candidate.exists():
+                side_effect_map = str(candidate)
+        if not drug_map:
+            candidate = Path(dataset_path) / "dictionary/Drugbank_ID_SMILE_all_structure links.csv"
+            if candidate.exists():
+                drug_map = str(candidate)
+
+        kwargs = {
+            "path": dataset_path,
+            "dataset_version": dataset_version,
+            "truncate": True,
+        }
+        if side_effect_map:
+            kwargs["side_effect_map"] = side_effect_map
+        if drug_map:
+            kwargs["drug_map"] = drug_map
+        if include_negative:
+            kwargs["include_negative"] = True
+
+        self.stdout.write(self.style.WARNING("[HODDI] Importing dataset..."))
+        call_command("import_hoddi", **kwargs)
+        self.stdout.write(self.style.SUCCESS("[HODDI] Dataset import complete."))