Initial CPS-API deployment with TxAgent integration

__init__.py

@@ -1 +1,33 @@
-# This makes this directory a Python package
+from fastapi import APIRouter
+import logging
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(name)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+def get_router():
+    router = APIRouter()
+    
+    # Import sub-modules from the routes directory
+    from .routes.auth import auth
+    from .routes.patients import patients
+    from .routes.pdf import pdf
+    from .routes.appointments import router as appointments
+    from .routes.messaging import router as messaging
+    from .routes.txagent import router as txagent
+    
+    # Include sub-routers with correct prefixes
+    router.include_router(patients, tags=["patients"])  # Remove prefix since routes already have /patients
+    router.include_router(auth, prefix="/auth", tags=["auth"])
+    router.include_router(pdf, prefix="/patients", tags=["pdf"])  # Keep prefix for PDF routes
+    router.include_router(appointments, tags=["appointments"])
+    router.include_router(messaging, tags=["messaging"])
+    router.include_router(txagent, tags=["txagent"])
+    
+    return router
+
+# Export the router
+api_router = get_router()

api/routes/messaging.py

@@ -795,8 +795,14 @@ async def upload_file(
         )
     
     # Create uploads directory if it doesn't exist
-    upload_dir = Path("uploads")
-    upload_dir.mkdir(exist_ok=True)
+    try:
+        upload_dir = Path("uploads")
+        upload_dir.mkdir(exist_ok=True)
+    except PermissionError:
+        # In containerized environments, use temp directory
+        import tempfile
+        upload_dir = Path(tempfile.gettempdir()) / "uploads"
+        upload_dir.mkdir(exist_ok=True)
     
     # Create category subdirectory
     category_dir = upload_dir / file_category

api/routes/patients.py

@@ -35,7 +35,14 @@ router = APIRouter()
 # Configuration
 BASE_DIR = Path(__file__).resolve().parent.parent.parent
 SYNTHEA_DATA_DIR = BASE_DIR / "output" / "fhir"
-os.makedirs(SYNTHEA_DATA_DIR, exist_ok=True)
+try:
+    os.makedirs(SYNTHEA_DATA_DIR, exist_ok=True)
+except PermissionError:
+    # In containerized environments, we might not have write permissions
+    # Use a temporary directory instead
+    import tempfile
+    SYNTHEA_DATA_DIR = Path(tempfile.gettempdir()) / "fhir"
+    os.makedirs(SYNTHEA_DATA_DIR, exist_ok=True)
 
 # Pydantic models for update validation
 class ConditionUpdate(BaseModel):

deployment/__init__.py

@@ -0,0 +1,33 @@
+from fastapi import APIRouter
+import logging
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(name)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+def get_router():
+    router = APIRouter()
+    
+    # Import sub-modules from the routes directory
+    from .routes.auth import auth
+    from .routes.patients import patients
+    from .routes.pdf import pdf
+    from .routes.appointments import router as appointments
+    from .routes.messaging import router as messaging
+    from .routes.txagent import router as txagent
+    
+    # Include sub-routers with correct prefixes
+    router.include_router(patients, tags=["patients"])  # Remove prefix since routes already have /patients
+    router.include_router(auth, prefix="/auth", tags=["auth"])
+    router.include_router(pdf, prefix="/patients", tags=["pdf"])  # Keep prefix for PDF routes
+    router.include_router(appointments, tags=["appointments"])
+    router.include_router(messaging, tags=["messaging"])
+    router.include_router(txagent, tags=["txagent"])
+    
+    return router
+
+# Export the router
+api_router = get_router()

deployment/routes.py

@@ -0,0 +1 @@
+#

deployment/routes/appointments.py

@@ -0,0 +1,904 @@
+from fastapi import APIRouter, Depends, HTTPException, status, Query
+from typing import List, Optional
+from datetime import date, time, datetime, timedelta
+from bson import ObjectId
+from motor.motor_asyncio import AsyncIOMotorClient
+
+from core.security import get_current_user
+from db.mongo import db, patients_collection
+from models.schemas import (
+    AppointmentCreate, AppointmentUpdate, AppointmentResponse, AppointmentListResponse,
+    AppointmentStatus, AppointmentType, DoctorAvailabilityCreate, DoctorAvailabilityUpdate,
+    DoctorAvailabilityResponse, AvailableSlotsResponse, AppointmentSlot, DoctorListResponse
+)
+
+router = APIRouter(prefix="/appointments", tags=["appointments"])
+
+# --- HELPER FUNCTIONS ---
+def is_valid_object_id(id_str: str) -> bool:
+    try:
+        ObjectId(id_str)
+        return True
+    except:
+        return False
+
+def get_weekday_from_date(appointment_date: date) -> int:
+    """Convert date to weekday (0=Monday, 6=Sunday)"""
+    return appointment_date.weekday()
+
+def generate_time_slots(start_time: time, end_time: time, duration: int = 30) -> List[time]:
+    """Generate time slots between start and end time"""
+    slots = []
+    current_time = datetime.combine(date.today(), start_time)
+    end_datetime = datetime.combine(date.today(), end_time)
+    
+    while current_time < end_datetime:
+        slots.append(current_time.time())
+        current_time += timedelta(minutes=duration)
+    
+    return slots
+
+# --- PATIENT ASSIGNMENT ENDPOINT ---
+
+@router.post("/assign-patient", status_code=status.HTTP_200_OK)
+async def assign_patient_to_doctor(
+    patient_id: str,
+    doctor_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Manually assign a patient to a doctor"""
+    # Only doctors and admins can assign patients
+    if not (('doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor') or 
+            ('admin' in current_user.get('roles', []) or current_user.get('role') == 'admin')):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only doctors and admins can assign patients"
+        )
+    
+    # Validate ObjectIds
+    if not is_valid_object_id(patient_id) or not is_valid_object_id(doctor_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient_id or doctor_id"
+        )
+    
+    # Check if doctor exists and is a doctor
+    doctor = await db_client.users.find_one({"_id": ObjectId(doctor_id)})
+    if not doctor or (doctor.get('role') != 'doctor' and 'doctor' not in doctor.get('roles', [])):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Check if patient exists
+    patient = await db_client.users.find_one({"_id": ObjectId(patient_id)})
+    if not patient:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Patient not found"
+        )
+    
+    try:
+        # Check if patient already exists in patients collection
+        existing_patient = await patients_collection.find_one({
+            "fhir_id": patient.get("fhir_id") or str(patient["_id"])
+        })
+        
+        if existing_patient:
+            # Update existing patient to assign to this doctor
+            await patients_collection.update_one(
+                {"_id": existing_patient["_id"]},
+                {
+                    "$set": {
+                        "assigned_doctor_id": str(doctor_id),  # Convert to string
+                        "updated_at": datetime.now()
+                    }
+                }
+            )
+            message = f"Patient {patient.get('full_name', 'Unknown')} reassigned to doctor {doctor.get('full_name', 'Unknown')}"
+        else:
+            # Create new patient record in patients collection
+            patient_doc = {
+                "fhir_id": patient.get("fhir_id") or str(patient["_id"]),
+                "full_name": patient.get("full_name", ""),
+                "date_of_birth": patient.get("date_of_birth") or datetime.now().strftime('%Y-%m-%d'),  # Store as string
+                "gender": patient.get("gender") or "unknown",  # Provide default
+                "address": patient.get("address"),
+                "city": patient.get("city"),
+                "state": patient.get("state"),
+                "postal_code": patient.get("postal_code"),
+                "country": patient.get("country"),
+                "national_id": patient.get("national_id"),
+                "blood_type": patient.get("blood_type"),
+                "allergies": patient.get("allergies", []),
+                "chronic_conditions": patient.get("chronic_conditions", []),
+                "medications": patient.get("medications", []),
+                "emergency_contact_name": patient.get("emergency_contact_name"),
+                "emergency_contact_phone": patient.get("emergency_contact_phone"),
+                "insurance_provider": patient.get("insurance_provider"),
+                "insurance_policy_number": patient.get("insurance_policy_number"),
+                "notes": patient.get("notes", []),
+                "source": "manual",  # Manually assigned
+                "status": "active",
+                "assigned_doctor_id": str(doctor_id),  # Convert to string
+                "registration_date": datetime.now(),
+                "created_at": datetime.now(),
+                "updated_at": datetime.now()
+            }
+            await patients_collection.insert_one(patient_doc)
+            message = f"Patient {patient.get('full_name', 'Unknown')} assigned to doctor {doctor.get('full_name', 'Unknown')}"
+        
+        print(f"✅ {message}")
+        return {"message": message, "success": True}
+        
+    except Exception as e:
+        print(f"❌ Error assigning patient to doctor: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to assign patient to doctor: {str(e)}"
+        )
+
+# --- DOCTOR LIST ENDPOINT (MUST BE BEFORE PARAMETERIZED ROUTES) ---
+
+@router.get("/doctors", response_model=List[DoctorListResponse])
+async def get_doctors(
+    specialty: Optional[str] = Query(None),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get list of available doctors"""
+    # Build filter - handle both "role" (singular) and "roles" (array) fields
+    filter_query = {
+        "$or": [
+            {"roles": {"$in": ["doctor"]}},
+            {"role": "doctor"}
+        ]
+    }
+    if specialty:
+        filter_query["$and"] = [
+            {"$or": [{"roles": {"$in": ["doctor"]}}, {"role": "doctor"}]},
+            {"specialty": {"$regex": specialty, "$options": "i"}}
+        ]
+    
+    # Get doctors
+    cursor = db_client.users.find(filter_query)
+    doctors = await cursor.to_list(length=None)
+    
+    return [
+        DoctorListResponse(
+            id=str(doctor["_id"]),
+            full_name=doctor['full_name'],
+            specialty=doctor.get('specialty', ''),
+            license_number=doctor.get('license_number', ''),
+            email=doctor['email'],
+            phone=doctor.get('phone')
+        )
+        for doctor in doctors
+    ]
+
+# --- DOCTOR AVAILABILITY ENDPOINTS ---
+
+@router.post("/availability", response_model=DoctorAvailabilityResponse, status_code=status.HTTP_201_CREATED)
+async def create_doctor_availability(
+    availability_data: DoctorAvailabilityCreate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Create doctor availability"""
+    if (current_user.get('role') != 'doctor' and 'doctor' not in current_user.get('roles', [])) and 'admin' not in current_user.get('roles', []):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only doctors can set their availability"
+        )
+    
+    # Check if doctor exists
+    doctor = await db_client.users.find_one({"_id": ObjectId(availability_data.doctor_id)})
+    if not doctor:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Check if doctor is setting their own availability or admin is setting it
+    if (current_user.get('role') != 'admin' and 'admin' not in current_user.get('roles', [])) and availability_data.doctor_id != current_user["_id"]:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only set your own availability"
+        )
+    
+    # Check if availability already exists for this day
+    existing = await db_client.doctor_availability.find_one({
+        "doctor_id": ObjectId(availability_data.doctor_id),
+        "day_of_week": availability_data.day_of_week
+    })
+    
+    if existing:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Availability already exists for this day"
+        )
+    
+    # Create availability
+    availability_doc = {
+        "doctor_id": ObjectId(availability_data.doctor_id),
+        "day_of_week": availability_data.day_of_week,
+        "start_time": availability_data.start_time,
+        "end_time": availability_data.end_time,
+        "is_available": availability_data.is_available
+    }
+    
+    result = await db_client.doctor_availability.insert_one(availability_doc)
+    availability_doc["_id"] = result.inserted_id
+    
+    return DoctorAvailabilityResponse(
+        id=str(availability_doc["_id"]),
+        doctor_id=availability_data.doctor_id,
+        doctor_name=doctor['full_name'],
+        day_of_week=availability_doc["day_of_week"],
+        start_time=availability_doc["start_time"],
+        end_time=availability_doc["end_time"],
+        is_available=availability_doc["is_available"]
+    )
+
+@router.get("/availability/{doctor_id}", response_model=List[DoctorAvailabilityResponse])
+async def get_doctor_availability(
+    doctor_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get doctor availability"""
+    if not is_valid_object_id(doctor_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid doctor ID"
+        )
+    
+    # Check if doctor exists
+    doctor = await db_client.users.find_one({"_id": ObjectId(doctor_id)})
+    if not doctor:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Get availability
+    cursor = db_client.doctor_availability.find({"doctor_id": ObjectId(doctor_id)})
+    availabilities = await cursor.to_list(length=None)
+    
+    return [
+        DoctorAvailabilityResponse(
+            id=str(avail["_id"]),
+            doctor_id=doctor_id,
+            doctor_name=doctor['full_name'],
+            day_of_week=avail["day_of_week"],
+            start_time=avail["start_time"],
+            end_time=avail["end_time"],
+            is_available=avail["is_available"]
+        )
+        for avail in availabilities
+    ]
+
+# --- AVAILABLE SLOTS ENDPOINTS ---
+
+@router.get("/slots/{doctor_id}/{date}", response_model=AvailableSlotsResponse)
+async def get_available_slots(
+    doctor_id: str,
+    date: date,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get available appointment slots for a doctor on a specific date"""
+    if not is_valid_object_id(doctor_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid doctor ID"
+        )
+    
+    # Check if doctor exists
+    doctor = await db_client.users.find_one({"_id": ObjectId(doctor_id)})
+    if not doctor or (doctor.get('role') != 'doctor' and 'doctor' not in doctor.get('roles', [])):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Get doctor availability for this day
+    weekday = get_weekday_from_date(date)
+    availability = await db_client.doctor_availability.find_one({
+        "doctor_id": ObjectId(doctor_id),
+        "day_of_week": weekday,
+        "is_available": True
+    })
+    
+    if not availability:
+        return AvailableSlotsResponse(
+            doctor_id=doctor_id,
+            doctor_name=doctor['full_name'],
+            specialty=doctor.get('specialty', ''),
+            date=date,
+            slots=[]
+        )
+    
+    # Generate time slots
+    time_slots = generate_time_slots(availability["start_time"], availability["end_time"])
+    
+    # Get existing appointments for this date
+    existing_appointments = await db_client.appointments.find({
+        "doctor_id": ObjectId(doctor_id),
+        "date": date,
+        "status": {"$in": ["pending", "confirmed"]}
+    }).to_list(length=None)
+    
+    booked_times = {apt["time"] for apt in existing_appointments}
+    
+    # Create slot responses
+    slots = []
+    for slot_time in time_slots:
+        is_available = slot_time not in booked_times
+        appointment_id = None
+        if not is_available:
+            # Find the appointment ID for this slot
+            appointment = next((apt for apt in existing_appointments if apt["time"] == slot_time), None)
+            appointment_id = str(appointment["_id"]) if appointment else None
+        
+        slots.append(AppointmentSlot(
+            date=date,
+            time=slot_time,
+            is_available=is_available,
+            appointment_id=appointment_id
+        ))
+    
+    return AvailableSlotsResponse(
+        doctor_id=doctor_id,
+        doctor_name=doctor['full_name'],
+        specialty=doctor.get('specialty', ''),
+        date=date,
+        slots=slots
+    )
+
+# --- APPOINTMENT ENDPOINTS ---
+
+@router.post("/", response_model=AppointmentResponse, status_code=status.HTTP_201_CREATED)
+async def create_appointment(
+    appointment_data: AppointmentCreate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Create a new appointment"""
+    print(f"🔍 Creating appointment with data: {appointment_data}")
+    print(f"🔍 Current user: {current_user}")
+    # Check if user is a patient
+    if 'patient' not in current_user.get('roles', []) and current_user.get('role') != 'patient':
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only patients can create appointments"
+        )
+    
+    # Validate ObjectIds
+    if not is_valid_object_id(appointment_data.patient_id) or not is_valid_object_id(appointment_data.doctor_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient_id or doctor_id"
+        )
+    
+    # Check if patient exists and matches current user
+    patient = await db_client.users.find_one({"_id": ObjectId(appointment_data.patient_id)})
+    if not patient:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Patient not found"
+        )
+    
+    if patient['email'] != current_user['email']:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only create appointments for yourself"
+        )
+    
+    # Check if doctor exists and is a doctor
+    doctor = await db_client.users.find_one({"_id": ObjectId(appointment_data.doctor_id)})
+    if not doctor or (doctor.get('role') != 'doctor' and 'doctor' not in doctor.get('roles', [])):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Convert string date and time to proper objects
+    try:
+        appointment_date = datetime.strptime(appointment_data.date, '%Y-%m-%d').date()
+        appointment_time = datetime.strptime(appointment_data.time, '%H:%M:%S').time()
+        # Convert date to datetime for MongoDB compatibility
+        appointment_datetime = datetime.combine(appointment_date, appointment_time)
+    except ValueError:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid date or time format. Use YYYY-MM-DD for date and HH:MM:SS for time"
+        )
+    
+    # Check if appointment date is in the future
+    if appointment_datetime <= datetime.now():
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Appointment must be scheduled for a future date and time"
+        )
+    
+    # Check if slot is available
+    existing_appointment = await db_client.appointments.find_one({
+        "doctor_id": ObjectId(appointment_data.doctor_id),
+        "date": appointment_data.date,
+        "time": appointment_data.time,
+        "status": {"$in": ["pending", "confirmed"]}
+    })
+    
+    if existing_appointment:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="This time slot is already booked"
+        )
+    
+    # Create appointment
+    appointment_doc = {
+        "patient_id": ObjectId(appointment_data.patient_id),
+        "doctor_id": ObjectId(appointment_data.doctor_id),
+        "date": appointment_data.date,  # Store as string
+        "time": appointment_data.time,  # Store as string
+        "datetime": appointment_datetime,  # Store full datetime for easier querying
+        "type": appointment_data.type,
+        "status": AppointmentStatus.PENDING,
+        "reason": appointment_data.reason,
+        "notes": appointment_data.notes,
+        "duration": appointment_data.duration,
+        "created_at": datetime.now(),
+        "updated_at": datetime.now()
+    }
+    
+    result = await db_client.appointments.insert_one(appointment_doc)
+    appointment_doc["_id"] = result.inserted_id
+    
+    # If appointment is created with confirmed status, assign patient to doctor
+    if appointment_data.status == "confirmed":
+        try:
+            # Get patient details from users collection
+            patient = await db_client.users.find_one({"_id": ObjectId(appointment_data.patient_id)})
+            if patient:
+                # Check if patient already exists in patients collection
+                existing_patient = await patients_collection.find_one({
+                    "fhir_id": patient.get("fhir_id") or str(patient["_id"])
+                })
+                
+                if existing_patient:
+                    # Update existing patient to assign to this doctor
+                    await patients_collection.update_one(
+                        {"_id": existing_patient["_id"]},
+                        {
+                            "$set": {
+                                "assigned_doctor_id": str(appointment_data.doctor_id),  # Convert to string
+                                "updated_at": datetime.now()
+                            }
+                        }
+                    )
+                else:
+                    # Create new patient record in patients collection
+                    patient_doc = {
+                        "fhir_id": patient.get("fhir_id") or str(patient["_id"]),
+                        "full_name": patient.get("full_name", ""),
+                        "date_of_birth": patient.get("date_of_birth") or datetime.now().strftime('%Y-%m-%d'),  # Store as string
+                        "gender": patient.get("gender") or "unknown",  # Provide default
+                        "address": patient.get("address"),
+                        "city": patient.get("city"),
+                        "state": patient.get("state"),
+                        "postal_code": patient.get("postal_code"),
+                        "country": patient.get("country"),
+                        "national_id": patient.get("national_id"),
+                        "blood_type": patient.get("blood_type"),
+                        "allergies": patient.get("allergies", []),
+                        "chronic_conditions": patient.get("chronic_conditions", []),
+                        "medications": patient.get("medications", []),
+                        "emergency_contact_name": patient.get("emergency_contact_name"),
+                        "emergency_contact_phone": patient.get("emergency_contact_phone"),
+                        "insurance_provider": patient.get("insurance_provider"),
+                        "insurance_policy_number": patient.get("insurance_policy_number"),
+                        "notes": patient.get("notes", []),
+                        "source": "direct",  # Patient came through appointment booking
+                        "status": "active",
+                        "assigned_doctor_id": str(appointment_data.doctor_id),  # Convert to string
+                        "registration_date": datetime.now(),
+                        "created_at": datetime.now(),
+                        "updated_at": datetime.now()
+                    }
+                    await patients_collection.insert_one(patient_doc)
+                
+                print(f"✅ Patient {patient.get('full_name', 'Unknown')} assigned to doctor {appointment_data.doctor_id}")
+        except Exception as e:
+            print(f"⚠️ Warning: Failed to assign patient to doctor: {str(e)}")
+            # Don't fail the appointment creation if patient assignment fails
+    
+    # Return appointment with patient and doctor names
+    return AppointmentResponse(
+        id=str(appointment_doc["_id"]),
+        patient_id=appointment_data.patient_id,
+        doctor_id=appointment_data.doctor_id,
+        patient_name=patient['full_name'],
+        doctor_name=doctor['full_name'],
+        date=appointment_date,  # Convert back to date object
+        time=appointment_time,  # Convert back to time object
+        type=appointment_doc["type"],
+        status=appointment_doc["status"],
+        reason=appointment_doc["reason"],
+        notes=appointment_doc["notes"],
+        duration=appointment_doc["duration"],
+        created_at=appointment_doc["created_at"],
+        updated_at=appointment_doc["updated_at"]
+    )
+
+@router.get("/", response_model=AppointmentListResponse)
+async def get_appointments(
+    page: int = Query(1, ge=1),
+    limit: int = Query(10, ge=1, le=100),
+    status_filter: Optional[AppointmentStatus] = Query(None),
+    date_from: Optional[date] = Query(None),
+    date_to: Optional[date] = Query(None),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get appointments based on user role"""
+    skip = (page - 1) * limit
+    
+    # Build filter based on user role
+    if 'patient' in current_user.get('roles', []) or current_user.get('role') == 'patient':
+        # Patients see their own appointments
+        filter_query = {"patient_id": ObjectId(current_user["_id"])}
+    elif 'doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor':
+        # Doctors see appointments assigned to them
+        filter_query = {"doctor_id": ObjectId(current_user["_id"])}
+    elif 'admin' in current_user.get('roles', []) or current_user.get('role') == 'admin':
+        # Admins see all appointments
+        filter_query = {}
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Insufficient permissions"
+        )
+    
+    # Add status filter
+    if status_filter:
+        filter_query["status"] = status_filter
+    
+    # Add date range filter
+    if date_from or date_to:
+        date_filter = {}
+        if date_from:
+            date_filter["$gte"] = date_from
+        if date_to:
+            date_filter["$lte"] = date_to
+        filter_query["date"] = date_filter
+    
+    # Get appointments
+    cursor = db_client.appointments.find(filter_query).skip(skip).limit(limit).sort("date", -1)
+    appointments = await cursor.to_list(length=limit)
+    
+    print(f"🔍 Found {len(appointments)} appointments")
+    for i, apt in enumerate(appointments):
+        print(f"🔍 Appointment {i}: {apt}")
+    
+    # Get total count
+    total = await db_client.appointments.count_documents(filter_query)
+    
+    # Get patient and doctor names
+    appointment_responses = []
+    for apt in appointments:
+        patient = await db_client.users.find_one({"_id": apt["patient_id"]})
+        doctor = await db_client.users.find_one({"_id": apt["doctor_id"]})
+        
+        # Convert string date/time back to objects for response
+        apt_date = datetime.strptime(apt["date"], '%Y-%m-%d').date() if isinstance(apt["date"], str) else apt["date"]
+        apt_time = datetime.strptime(apt["time"], '%H:%M:%S').time() if isinstance(apt["time"], str) else apt["time"]
+        
+        appointment_responses.append(AppointmentResponse(
+            id=str(apt["_id"]),
+            patient_id=str(apt["patient_id"]),
+            doctor_id=str(apt["doctor_id"]),
+            patient_name=patient['full_name'] if patient else "Unknown Patient",
+            doctor_name=doctor['full_name'] if doctor else "Unknown Doctor",
+            date=apt_date,
+            time=apt_time,
+            type=apt.get("type", "consultation"),  # Default to consultation if missing
+            status=apt.get("status", "pending"),  # Default to pending if missing
+            reason=apt.get("reason"),
+            notes=apt.get("notes"),
+            duration=apt.get("duration", 30),
+            created_at=apt.get("created_at", datetime.now()),
+            updated_at=apt.get("updated_at", datetime.now())
+        ))
+    
+    return AppointmentListResponse(
+        appointments=appointment_responses,
+        total=total,
+        page=page,
+        limit=limit
+    )
+
+@router.get("/{appointment_id}", response_model=AppointmentResponse)
+async def get_appointment(
+    appointment_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get a specific appointment"""
+    if not is_valid_object_id(appointment_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid appointment ID"
+        )
+    
+    appointment = await db_client.appointments.find_one({"_id": ObjectId(appointment_id)})
+    if not appointment:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Appointment not found"
+        )
+    
+    # Check permissions
+    if 'patient' in current_user.get('roles', []) or current_user.get('role') == 'patient':
+        if appointment["patient_id"] != ObjectId(current_user["_id"]):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="You can only view your own appointments"
+            )
+    elif 'doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor':
+        if appointment["doctor_id"] != ObjectId(current_user["_id"]):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="You can only view appointments assigned to you"
+            )
+    elif (current_user.get('role') != 'admin' and 'admin' not in current_user.get('roles', [])):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Insufficient permissions"
+        )
+    
+    # Get patient and doctor names
+    patient = await db_client.users.find_one({"_id": appointment["patient_id"]})
+    doctor = await db_client.users.find_one({"_id": appointment["doctor_id"]})
+    
+    # Convert string date/time back to objects for response
+    apt_date = datetime.strptime(appointment["date"], '%Y-%m-%d').date() if isinstance(appointment["date"], str) else appointment["date"]
+    apt_time = datetime.strptime(appointment["time"], '%H:%M:%S').time() if isinstance(appointment["time"], str) else appointment["time"]
+    
+    return AppointmentResponse(
+        id=str(appointment["_id"]),
+        patient_id=str(appointment["patient_id"]),
+        doctor_id=str(appointment["doctor_id"]),
+        patient_name=patient['full_name'] if patient else "Unknown Patient",
+        doctor_name=doctor['full_name'] if doctor else "Unknown Doctor",
+        date=apt_date,
+        time=apt_time,
+        type=appointment.get("type", "consultation"),  # Default to consultation if missing
+        status=appointment.get("status", "pending"),  # Default to pending if missing
+        reason=appointment.get("reason"),
+        notes=appointment.get("notes"),
+        duration=appointment.get("duration", 30),
+        created_at=appointment.get("created_at", datetime.now()),
+        updated_at=appointment.get("updated_at", datetime.now())
+    )
+
+@router.put("/{appointment_id}", response_model=AppointmentResponse)
+async def update_appointment(
+    appointment_id: str,
+    appointment_data: AppointmentUpdate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Update an appointment"""
+    if not is_valid_object_id(appointment_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid appointment ID"
+        )
+    
+    appointment = await db_client.appointments.find_one({"_id": ObjectId(appointment_id)})
+    if not appointment:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Appointment not found"
+        )
+    
+    # Check permissions
+    can_update = False
+    if 'admin' in current_user.get('roles', []) or current_user.get('role') == 'admin':
+        can_update = True
+    elif 'doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor':
+        if appointment["doctor_id"] == ObjectId(current_user["_id"]):
+            can_update = True
+    elif 'patient' in current_user.get('roles', []) or current_user.get('role') == 'patient':
+        if appointment["patient_id"] == ObjectId(current_user["_id"]):
+            # Patients can only update certain fields
+            can_update = True
+    
+    if not can_update:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only update appointments you're involved with"
+        )
+    
+    # Build update data
+    update_data = {"updated_at": datetime.now()}
+    
+    if appointment_data.date is not None:
+        try:
+            # Store as string for MongoDB compatibility
+            update_data["date"] = appointment_data.date
+        except ValueError:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid date format. Use YYYY-MM-DD"
+            )
+    if appointment_data.time is not None:
+        try:
+            # Store as string for MongoDB compatibility
+            update_data["time"] = appointment_data.time
+        except ValueError:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid time format. Use HH:MM:SS"
+            )
+    if appointment_data.type is not None:
+        update_data["type"] = appointment_data.type
+    if appointment_data.reason is not None:
+        update_data["reason"] = appointment_data.reason
+    if appointment_data.notes is not None:
+        update_data["notes"] = appointment_data.notes
+    if appointment_data.duration is not None:
+        update_data["duration"] = appointment_data.duration
+    
+    # Only doctors and admins can update status
+    if appointment_data.status is not None and (('doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor') or ('admin' in current_user.get('roles', []) or current_user.get('role') == 'admin')):
+        update_data["status"] = appointment_data.status
+    
+    # Check for conflicts if date/time is being updated
+    if appointment_data.date is not None or appointment_data.time is not None:
+        new_date = update_data.get("date") or appointment["date"]
+        new_time = update_data.get("time") or appointment["time"]
+        
+        existing_appointment = await db_client.appointments.find_one({
+            "_id": {"$ne": ObjectId(appointment_id)},
+            "doctor_id": appointment["doctor_id"],
+            "date": new_date,
+            "time": new_time,
+            "status": {"$in": ["pending", "confirmed"]}
+        })
+        
+        if existing_appointment:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail="This time slot is already booked"
+            )
+    
+    # Update appointment
+    await db_client.appointments.update_one(
+        {"_id": ObjectId(appointment_id)},
+        {"$set": update_data}
+    )
+    
+    # If appointment status is being changed to confirmed, assign patient to doctor
+    if appointment_data.status == "confirmed":
+        try:
+            # Get patient details from users collection
+            patient = await db_client.users.find_one({"_id": appointment["patient_id"]})
+            if patient:
+                # Check if patient already exists in patients collection
+                existing_patient = await patients_collection.find_one({
+                    "fhir_id": patient.get("fhir_id") or str(patient["_id"])
+                })
+                
+                if existing_patient:
+                    # Update existing patient to assign to this doctor
+                    await patients_collection.update_one(
+                        {"_id": existing_patient["_id"]},
+                        {
+                            "$set": {
+                                "assigned_doctor_id": str(appointment["doctor_id"]),  # Convert to string
+                                "updated_at": datetime.now()
+                            }
+                        }
+                    )
+                else:
+                    # Create new patient record in patients collection
+                    patient_doc = {
+                        "fhir_id": patient.get("fhir_id") or str(patient["_id"]),
+                        "full_name": patient.get("full_name", ""),
+                        "date_of_birth": patient.get("date_of_birth") or datetime.now().strftime('%Y-%m-%d'),  # Store as string
+                        "gender": patient.get("gender") or "unknown",  # Provide default
+                        "address": patient.get("address"),
+                        "city": patient.get("city"),
+                        "state": patient.get("state"),
+                        "postal_code": patient.get("postal_code"),
+                        "country": patient.get("country"),
+                        "national_id": patient.get("national_id"),
+                        "blood_type": patient.get("blood_type"),
+                        "allergies": patient.get("allergies", []),
+                        "chronic_conditions": patient.get("chronic_conditions", []),
+                        "medications": patient.get("medications", []),
+                        "emergency_contact_name": patient.get("emergency_contact_name"),
+                        "emergency_contact_phone": patient.get("emergency_contact_phone"),
+                        "insurance_provider": patient.get("insurance_provider"),
+                        "insurance_policy_number": patient.get("insurance_policy_number"),
+                        "notes": patient.get("notes", []),
+                        "source": "direct",  # Patient came through appointment booking
+                        "status": "active",
+                        "assigned_doctor_id": str(appointment["doctor_id"]),  # Convert to string
+                        "registration_date": datetime.now(),
+                        "created_at": datetime.now(),
+                        "updated_at": datetime.now()
+                    }
+                    await patients_collection.insert_one(patient_doc)
+                
+                print(f"✅ Patient {patient.get('full_name', 'Unknown')} assigned to doctor {appointment['doctor_id']}")
+        except Exception as e:
+            print(f"⚠️ Warning: Failed to assign patient to doctor: {str(e)}")
+            # Don't fail the appointment update if patient assignment fails
+    
+    # Get updated appointment
+    updated_appointment = await db_client.appointments.find_one({"_id": ObjectId(appointment_id)})
+    
+    # Get patient and doctor names
+    patient = await db_client.users.find_one({"_id": updated_appointment["patient_id"]})
+    doctor = await db_client.users.find_one({"_id": updated_appointment["doctor_id"]})
+    
+    # Convert string date/time back to objects for response
+    apt_date = datetime.strptime(updated_appointment["date"], '%Y-%m-%d').date() if isinstance(updated_appointment["date"], str) else updated_appointment["date"]
+    apt_time = datetime.strptime(updated_appointment["time"], '%H:%M:%S').time() if isinstance(updated_appointment["time"], str) else updated_appointment["time"]
+    
+    return AppointmentResponse(
+        id=str(updated_appointment["_id"]),
+        patient_id=str(updated_appointment["patient_id"]),
+        doctor_id=str(updated_appointment["doctor_id"]),
+        patient_name=patient['full_name'] if patient else "Unknown Patient",
+        doctor_name=doctor['full_name'] if doctor else "Unknown Doctor",
+        date=apt_date,
+        time=apt_time,
+        type=updated_appointment.get("type", "consultation"),  # Default to consultation if missing
+        status=updated_appointment.get("status", "pending"),  # Default to pending if missing
+        reason=updated_appointment.get("reason"),
+        notes=updated_appointment.get("notes"),
+        duration=updated_appointment.get("duration", 30),
+        created_at=updated_appointment.get("created_at", datetime.now()),
+        updated_at=updated_appointment.get("updated_at", datetime.now())
+    )
+
+@router.delete("/{appointment_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_appointment(
+    appointment_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Delete an appointment"""
+    if not is_valid_object_id(appointment_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid appointment ID"
+        )
+    
+    appointment = await db_client.appointments.find_one({"_id": ObjectId(appointment_id)})
+    if not appointment:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Appointment not found"
+        )
+    
+    # Check permissions
+    can_delete = False
+    if 'admin' in current_user.get('roles', []) or current_user.get('role') == 'admin':
+        can_delete = True
+    elif 'patient' in current_user.get('roles', []) or current_user.get('role') == 'patient':
+        if appointment["patient_id"] == ObjectId(current_user["_id"]):
+            can_delete = True
+    
+    if not can_delete:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only delete your own appointments"
+        )
+    
+    await db_client.appointments.delete_one({"_id": ObjectId(appointment_id)}) 

deployment/routes/auth.py

@@ -0,0 +1,462 @@
+from fastapi import APIRouter, HTTPException, Depends, status, Request, Query
+from typing import Optional
+from fastapi.security import OAuth2PasswordRequestForm
+from db.mongo import users_collection
+from core.security import hash_password, verify_password, create_access_token, get_current_user
+from models.schemas import (
+    SignupForm,
+    TokenResponse,
+    DoctorCreate,
+    AdminCreate,
+    ProfileUpdate,
+    PasswordChange,
+    AdminUserUpdate,
+    AdminPasswordReset,
+)
+from datetime import datetime
+import logging
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(name)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+@router.post("/signup", status_code=status.HTTP_201_CREATED)
+async def signup(data: SignupForm):
+    """
+    Patient registration endpoint - only patients can register through signup
+    Doctors and admins must be created by existing admins
+    """
+    logger.info(f"Patient signup attempt for email: {data.email}")
+    logger.info(f"Received signup data: {data.dict()}")
+    email = data.email.lower().strip()
+    existing = await users_collection.find_one({"email": email})
+    if existing:
+        logger.warning(f"Signup failed: Email already exists: {email}")
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Email already exists"
+        )
+    
+    hashed_pw = hash_password(data.password)
+    user_doc = {
+        "email": email,
+        "full_name": data.full_name.strip(),
+        "password": hashed_pw,
+        "roles": ["patient"],  # Only patients can register through signup
+        "created_at": datetime.utcnow().isoformat(),
+        "updated_at": datetime.utcnow().isoformat(),
+        "device_token": ""  # Default empty device token for patients
+    }
+    
+    try:
+        result = await users_collection.insert_one(user_doc)
+        logger.info(f"User created successfully: {email}")
+        return {
+            "status": "success",
+            "id": str(result.inserted_id),
+            "email": email
+        }
+    except Exception as e:
+        logger.error(f"Failed to create user {email}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create user: {str(e)}"
+        )
+
+@router.post("/admin/doctors", status_code=status.HTTP_201_CREATED)
+async def create_doctor(
+    data: DoctorCreate,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Create doctor account - only admins can create doctor accounts
+    """
+    logger.info(f"Doctor creation attempt by {current_user.get('email')}")
+    if 'admin' not in current_user.get('roles', []):
+        logger.warning(f"Unauthorized doctor creation attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only admins can create doctor accounts"
+        )
+    
+    email = data.email.lower().strip()
+    existing = await users_collection.find_one({"email": email})
+    if existing:
+        logger.warning(f"Doctor creation failed: Email already exists: {email}")
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Email already exists"
+        )
+    
+    hashed_pw = hash_password(data.password)
+    doctor_doc = {
+        "email": email,
+        "full_name": data.full_name.strip(),
+        "password": hashed_pw,
+        "roles": data.roles,  # Support multiple roles
+        "specialty": data.specialty,
+        "license_number": data.license_number,
+        "created_at": datetime.utcnow().isoformat(),
+        "updated_at": datetime.utcnow().isoformat(),
+        "device_token": data.device_token or ""
+    }
+    
+    try:
+        result = await users_collection.insert_one(doctor_doc)
+        logger.info(f"Doctor created successfully: {email}")
+        return {
+            "status": "success",
+            "id": str(result.inserted_id),
+            "email": email
+        }
+    except Exception as e:
+        logger.error(f"Failed to create doctor {email}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create doctor: {str(e)}"
+        )
+
+@router.post("/admin/admins", status_code=status.HTTP_201_CREATED)
+async def create_admin(
+    data: AdminCreate,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Create admin account - only existing admins can create new admin accounts
+    """
+    logger.info(f"Admin creation attempt by {current_user.get('email')}")
+    if 'admin' not in current_user.get('roles', []):
+        logger.warning(f"Unauthorized admin creation attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only admins can create admin accounts"
+        )
+    
+    email = data.email.lower().strip()
+    existing = await users_collection.find_one({"email": email})
+    if existing:
+        logger.warning(f"Admin creation failed: Email already exists: {email}")
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Email already exists"
+        )
+    
+    hashed_pw = hash_password(data.password)
+    admin_doc = {
+        "email": email,
+        "full_name": data.full_name.strip(),
+        "password": hashed_pw,
+        "roles": data.roles,  # Support multiple roles
+        "created_at": datetime.utcnow().isoformat(),
+        "updated_at": datetime.utcnow().isoformat(),
+        "device_token": ""
+    }
+    
+    try:
+        result = await users_collection.insert_one(admin_doc)
+        logger.info(f"Admin created successfully: {email}")
+        return {
+            "status": "success",
+            "id": str(result.inserted_id),
+            "email": email
+        }
+    except Exception as e:
+        logger.error(f"Failed to create admin {email}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create admin: {str(e)}"
+        )
+
+@router.post("/login", response_model=TokenResponse)
+async def login(form_data: OAuth2PasswordRequestForm = Depends()):
+    logger.info(f"Login attempt for email: {form_data.username}")
+    user = await users_collection.find_one({"email": form_data.username.lower()})
+    if not user or not verify_password(form_data.password, user["password"]):
+        logger.warning(f"Login failed for {form_data.username}: Invalid credentials")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid credentials",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    # Update device token if provided in form_data (e.g., from frontend)
+    if hasattr(form_data, 'device_token') and form_data.device_token:
+        await users_collection.update_one(
+            {"email": user["email"]},
+            {"$set": {"device_token": form_data.device_token}}
+        )
+        logger.info(f"Device token updated for {form_data.username}")
+
+    access_token = create_access_token(data={"sub": user["email"]})
+    logger.info(f"Successful login for {form_data.username}")
+    return {
+        "access_token": access_token,
+        "token_type": "bearer",
+        "roles": user.get("roles", ["patient"])  # Return all roles
+    }
+
+@router.get("/me")
+async def get_me(request: Request, current_user: dict = Depends(get_current_user)):
+    logger.info(f"Fetching user profile for {current_user['email']} at {datetime.utcnow().isoformat()}")
+    print(f"Headers: {request.headers}")
+    try:
+        user = await users_collection.find_one({"email": current_user["email"]})
+        if not user:
+            logger.warning(f"User not found: {current_user['email']}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="User not found"
+            )
+        
+        # Handle both "role" (singular) and "roles" (array) formats
+        user_roles = user.get("roles", [])
+        if not user_roles and user.get("role"):
+            # If roles array is empty but role field exists, convert to array
+            user_roles = [user.get("role")]
+        
+        print(f"🔍 User from DB: {user}")
+        print(f"🔍 User roles: {user_roles}")
+        
+        response = {
+            "id": str(user["_id"]),
+            "email": user["email"],
+            "full_name": user.get("full_name", ""),
+            "roles": user_roles,  # Return all roles
+            "specialty": user.get("specialty"),
+            "created_at": user.get("created_at"),
+            "updated_at": user.get("updated_at"),
+            "device_token": user.get("device_token", "")  # Include device token in response
+        }
+        logger.info(f"User profile retrieved for {current_user['email']} at {datetime.utcnow().isoformat()}")
+        return response
+    except Exception as e:
+        logger.error(f"Database error for user {current_user['email']}: {str(e)} at {datetime.utcnow().isoformat()}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Database error: {str(e)}"
+        )
+
+@router.get("/users")
+async def list_users(
+    role: Optional[str] = None,
+    search: Optional[str] = Query(None, description="Search by name or email"),
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    List users - admins can see all users, doctors can see patients, patients can only see themselves
+    """
+    logger.info(f"User list request by {current_user.get('email')} with role filter: {role}")
+    
+    # Build query based on user role and requested filter
+    query = {}
+    if role:
+        # support both role singlular and roles array in historical docs
+        query["roles"] = {"$in": [role]}
+    if search:
+        query["$or"] = [
+            {"full_name": {"$regex": search, "$options": "i"}},
+            {"email": {"$regex": search, "$options": "i"}},
+        ]
+    
+    # Role-based access control
+    if 'admin' in current_user.get('roles', []):
+        # Admins can see all users
+        pass
+    elif 'doctor' in current_user.get('roles', []):
+        # Doctors can only see patients
+        query["roles"] = {"$in": ["patient"]}
+    elif 'patient' in current_user.get('roles', []):
+        # Patients can only see themselves
+        query["email"] = current_user.get('email')
+    
+    try:
+        users = await users_collection.find(query).limit(500).to_list(length=500)
+        # Remove sensitive information
+        for user in users:
+            user["id"] = str(user["_id"])
+            del user["_id"]
+            del user["password"]
+            user.pop("device_token", None)  # Safely remove device_token if it exists
+        
+        logger.info(f"Retrieved {len(users)} users for {current_user.get('email')}")
+        return users
+    except Exception as e:
+        logger.error(f"Error retrieving users: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to retrieve users: {str(e)}"
+        )
+
+@router.put("/admin/users/{user_id}")
+async def admin_update_user(
+    user_id: str,
+    data: AdminUserUpdate,
+    current_user: dict = Depends(get_current_user)
+):
+    if 'admin' not in current_user.get('roles', []):
+        raise HTTPException(status_code=403, detail="Admins only")
+    try:
+        update_data = {k: v for k, v in data.dict().items() if v is not None}
+        update_data["updated_at"] = datetime.utcnow().isoformat()
+        result = await users_collection.update_one({"_id": __import__('bson').ObjectId(user_id)}, {"$set": update_data})
+        if result.matched_count == 0:
+            raise HTTPException(status_code=404, detail="User not found")
+        return {"status": "success"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Failed to update user: {str(e)}")
+
+@router.delete("/admin/users/{user_id}")
+async def admin_delete_user(
+    user_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    if 'admin' not in current_user.get('roles', []):
+        raise HTTPException(status_code=403, detail="Admins only")
+    try:
+        result = await users_collection.delete_one({"_id": __import__('bson').ObjectId(user_id)})
+        if result.deleted_count == 0:
+            raise HTTPException(status_code=404, detail="User not found")
+        return {"status": "success"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Failed to delete user: {str(e)}")
+
+@router.post("/admin/users/{user_id}/reset-password")
+async def admin_reset_password(
+    user_id: str,
+    data: AdminPasswordReset,
+    current_user: dict = Depends(get_current_user)
+):
+    if 'admin' not in current_user.get('roles', []):
+        raise HTTPException(status_code=403, detail="Admins only")
+    if len(data.new_password) < 6:
+        raise HTTPException(status_code=400, detail="Password must be at least 6 characters")
+    try:
+        hashed = hash_password(data.new_password)
+        result = await users_collection.update_one(
+            {"_id": __import__('bson').ObjectId(user_id)},
+            {"$set": {"password": hashed, "updated_at": datetime.utcnow().isoformat()}}
+        )
+        if result.matched_count == 0:
+            raise HTTPException(status_code=404, detail="User not found")
+        return {"status": "success"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Failed to reset password: {str(e)}")
+
+@router.put("/profile", status_code=status.HTTP_200_OK)
+async def update_profile(
+    data: ProfileUpdate,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Update user profile - users can update their own profile
+    """
+    logger.info(f"Profile update attempt by {current_user.get('email')}")
+    
+    # Build update data (only include fields that are provided)
+    update_data = {}
+    if data.full_name is not None:
+        update_data["full_name"] = data.full_name.strip()
+    if data.phone is not None:
+        update_data["phone"] = data.phone.strip()
+    if data.address is not None:
+        update_data["address"] = data.address.strip()
+    if data.date_of_birth is not None:
+        update_data["date_of_birth"] = data.date_of_birth
+    if data.gender is not None:
+        update_data["gender"] = data.gender.strip()
+    if data.specialty is not None:
+        update_data["specialty"] = data.specialty.strip()
+    if data.license_number is not None:
+        update_data["license_number"] = data.license_number.strip()
+    
+    # Add updated timestamp
+    update_data["updated_at"] = datetime.utcnow().isoformat()
+    
+    try:
+        result = await users_collection.update_one(
+            {"email": current_user.get('email')},
+            {"$set": update_data}
+        )
+        
+        if result.modified_count == 0:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="User not found"
+            )
+        
+        logger.info(f"Profile updated successfully for {current_user.get('email')}")
+        return {
+            "status": "success",
+            "message": "Profile updated successfully"
+        }
+    except Exception as e:
+        logger.error(f"Failed to update profile for {current_user.get('email')}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to update profile: {str(e)}"
+        )
+
+@router.post("/change-password", status_code=status.HTTP_200_OK)
+async def change_password(
+    data: PasswordChange,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Change user password - users can change their own password
+    """
+    logger.info(f"Password change attempt by {current_user.get('email')}")
+    
+    # Verify current password
+    if not verify_password(data.current_password, current_user.get('password')):
+        logger.warning(f"Password change failed: incorrect current password for {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Current password is incorrect"
+        )
+    
+    # Validate new password
+    if len(data.new_password) < 6:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="New password must be at least 6 characters long"
+        )
+    
+    # Hash new password
+    hashed_new_password = hash_password(data.new_password)
+    
+    try:
+        result = await users_collection.update_one(
+            {"email": current_user.get('email')},
+            {
+                "$set": {
+                    "password": hashed_new_password,
+                    "updated_at": datetime.utcnow().isoformat()
+                }
+            }
+        )
+        
+        if result.modified_count == 0:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="User not found"
+            )
+        
+        logger.info(f"Password changed successfully for {current_user.get('email')}")
+        return {
+            "status": "success",
+            "message": "Password changed successfully"
+        }
+    except Exception as e:
+        logger.error(f"Failed to change password for {current_user.get('email')}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to change password: {str(e)}"
+        )
+
+# Export the router as 'auth' for api.__init__.py
+auth = router

deployment/routes/fhir_integration.py

@@ -0,0 +1,375 @@
+from fastapi import APIRouter, HTTPException, Depends
+from typing import List, Optional
+import httpx
+import json
+from datetime import datetime
+from ..auth.auth import get_current_user
+from models.schemas import User
+
+router = APIRouter()
+
+# HAPI FHIR Test Server URL
+HAPI_FHIR_BASE_URL = "https://hapi.fhir.org/baseR4"
+
+class FHIRIntegration:
+    def __init__(self):
+        self.base_url = HAPI_FHIR_BASE_URL
+        self.client = httpx.AsyncClient(timeout=30.0)
+    
+    async def search_patients(self, limit: int = 10, offset: int = 0) -> dict:
+        """Search for patients in HAPI FHIR Test Server"""
+        try:
+            url = f"{self.base_url}/Patient"
+            params = {
+                "_count": limit,
+                "_getpagesoffset": offset
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"FHIR server error: {str(e)}")
+    
+    async def get_patient_by_id(self, patient_id: str) -> dict:
+        """Get a specific patient by ID from HAPI FHIR Test Server"""
+        try:
+            url = f"{self.base_url}/Patient/{patient_id}"
+            response = await self.client.get(url)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=404, detail=f"Patient not found: {str(e)}")
+    
+    async def get_patient_observations(self, patient_id: str) -> dict:
+        """Get observations (vital signs, lab results) for a patient"""
+        try:
+            url = f"{self.base_url}/Observation"
+            params = {
+                "patient": patient_id,
+                "_count": 100
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Error fetching observations: {str(e)}")
+    
+    async def get_patient_medications(self, patient_id: str) -> dict:
+        """Get medications for a patient"""
+        try:
+            url = f"{self.base_url}/MedicationRequest"
+            params = {
+                "patient": patient_id,
+                "_count": 100
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Error fetching medications: {str(e)}")
+    
+    async def get_patient_conditions(self, patient_id: str) -> dict:
+        """Get conditions (diagnoses) for a patient"""
+        try:
+            url = f"{self.base_url}/Condition"
+            params = {
+                "patient": patient_id,
+                "_count": 100
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Error fetching conditions: {str(e)}")
+    
+    async def get_patient_encounters(self, patient_id: str) -> dict:
+        """Get encounters (visits) for a patient"""
+        try:
+            url = f"{self.base_url}/Encounter"
+            params = {
+                "patient": patient_id,
+                "_count": 100
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Error fetching encounters: {str(e)}")
+
+# Initialize FHIR integration
+fhir_integration = FHIRIntegration()
+
+@router.get("/fhir/patients")
+async def get_fhir_patients(
+    limit: int = 10,
+    offset: int = 0,
+    current_user: User = Depends(get_current_user)
+):
+    """Get patients from HAPI FHIR Test Server"""
+    try:
+        patients_data = await fhir_integration.search_patients(limit, offset)
+        
+        # Transform FHIR patients to our format
+        transformed_patients = []
+        for patient in patients_data.get("entry", []):
+            fhir_patient = patient.get("resource", {})
+            
+            # Extract patient information
+            patient_info = {
+                "fhir_id": fhir_patient.get("id"),
+                "full_name": "",
+                "gender": fhir_patient.get("gender", "unknown"),
+                "date_of_birth": "",
+                "address": "",
+                "phone": "",
+                "email": ""
+            }
+            
+            # Extract name
+            if fhir_patient.get("name"):
+                name_parts = []
+                for name in fhir_patient["name"]:
+                    if name.get("given"):
+                        name_parts.extend(name["given"])
+                    if name.get("family"):
+                        name_parts.append(name["family"])
+                patient_info["full_name"] = " ".join(name_parts)
+            
+            # Extract birth date
+            if fhir_patient.get("birthDate"):
+                patient_info["date_of_birth"] = fhir_patient["birthDate"]
+            
+            # Extract address
+            if fhir_patient.get("address"):
+                address_parts = []
+                for address in fhir_patient["address"]:
+                    if address.get("line"):
+                        address_parts.extend(address["line"])
+                    if address.get("city"):
+                        address_parts.append(address["city"])
+                    if address.get("state"):
+                        address_parts.append(address["state"])
+                    if address.get("postalCode"):
+                        address_parts.append(address["postalCode"])
+                patient_info["address"] = ", ".join(address_parts)
+            
+            # Extract contact information
+            if fhir_patient.get("telecom"):
+                for telecom in fhir_patient["telecom"]:
+                    if telecom.get("system") == "phone":
+                        patient_info["phone"] = telecom.get("value", "")
+                    elif telecom.get("system") == "email":
+                        patient_info["email"] = telecom.get("value", "")
+            
+            transformed_patients.append(patient_info)
+        
+        return {
+            "patients": transformed_patients,
+            "total": patients_data.get("total", len(transformed_patients)),
+            "count": len(transformed_patients)
+        }
+        
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Error fetching FHIR patients: {str(e)}")
+
+@router.get("/fhir/patients/{patient_id}")
+async def get_fhir_patient_details(
+    patient_id: str,
+    current_user: User = Depends(get_current_user)
+):
+    """Get detailed patient information from HAPI FHIR Test Server"""
+    try:
+        # Get basic patient info
+        patient_data = await fhir_integration.get_patient_by_id(patient_id)
+        
+        # Get additional patient data
+        observations = await fhir_integration.get_patient_observations(patient_id)
+        medications = await fhir_integration.get_patient_medications(patient_id)
+        conditions = await fhir_integration.get_patient_conditions(patient_id)
+        encounters = await fhir_integration.get_patient_encounters(patient_id)
+        
+        # Transform and combine all data
+        patient_info = {
+            "fhir_id": patient_data.get("id"),
+            "full_name": "",
+            "gender": patient_data.get("gender", "unknown"),
+            "date_of_birth": patient_data.get("birthDate", ""),
+            "address": "",
+            "phone": "",
+            "email": "",
+            "observations": [],
+            "medications": [],
+            "conditions": [],
+            "encounters": []
+        }
+        
+        # Extract name
+        if patient_data.get("name"):
+            name_parts = []
+            for name in patient_data["name"]:
+                if name.get("given"):
+                    name_parts.extend(name["given"])
+                if name.get("family"):
+                    name_parts.append(name["family"])
+            patient_info["full_name"] = " ".join(name_parts)
+        
+        # Extract address
+        if patient_data.get("address"):
+            address_parts = []
+            for address in patient_data["address"]:
+                if address.get("line"):
+                    address_parts.extend(address["line"])
+                if address.get("city"):
+                    address_parts.append(address["city"])
+                if address.get("state"):
+                    address_parts.append(address["state"])
+                if address.get("postalCode"):
+                    address_parts.append(address["postalCode"])
+            patient_info["address"] = ", ".join(address_parts)
+        
+        # Extract contact information
+        if patient_data.get("telecom"):
+            for telecom in patient_data["telecom"]:
+                if telecom.get("system") == "phone":
+                    patient_info["phone"] = telecom.get("value", "")
+                elif telecom.get("system") == "email":
+                    patient_info["email"] = telecom.get("value", "")
+        
+        # Transform observations
+        for obs in observations.get("entry", []):
+            resource = obs.get("resource", {})
+            if resource.get("code", {}).get("text"):
+                patient_info["observations"].append({
+                    "type": resource["code"]["text"],
+                    "value": resource.get("valueQuantity", {}).get("value"),
+                    "unit": resource.get("valueQuantity", {}).get("unit"),
+                    "date": resource.get("effectiveDateTime", "")
+                })
+        
+        # Transform medications
+        for med in medications.get("entry", []):
+            resource = med.get("resource", {})
+            if resource.get("medicationCodeableConcept", {}).get("text"):
+                patient_info["medications"].append({
+                    "name": resource["medicationCodeableConcept"]["text"],
+                    "status": resource.get("status", ""),
+                    "prescribed_date": resource.get("authoredOn", ""),
+                    "dosage": resource.get("dosageInstruction", [{}])[0].get("text", "")
+                })
+        
+        # Transform conditions
+        for condition in conditions.get("entry", []):
+            resource = condition.get("resource", {})
+            if resource.get("code", {}).get("text"):
+                patient_info["conditions"].append({
+                    "name": resource["code"]["text"],
+                    "status": resource.get("clinicalStatus", {}).get("text", ""),
+                    "onset_date": resource.get("onsetDateTime", ""),
+                    "severity": resource.get("severity", {}).get("text", "")
+                })
+        
+        # Transform encounters
+        for encounter in encounters.get("entry", []):
+            resource = encounter.get("resource", {})
+            if resource.get("type"):
+                patient_info["encounters"].append({
+                    "type": resource["type"][0].get("text", ""),
+                    "status": resource.get("status", ""),
+                    "start_date": resource.get("period", {}).get("start", ""),
+                    "end_date": resource.get("period", {}).get("end", ""),
+                    "service_provider": resource.get("serviceProvider", {}).get("display", "")
+                })
+        
+        return patient_info
+        
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Error fetching FHIR patient details: {str(e)}")
+
+@router.post("/fhir/import-patient/{patient_id}")
+async def import_fhir_patient(
+    patient_id: str,
+    current_user: User = Depends(get_current_user)
+):
+    """Import a patient from HAPI FHIR Test Server to our database"""
+    try:
+        from db.mongo import patients_collection
+        from bson import ObjectId
+        
+        # Get patient data from FHIR server
+        patient_data = await fhir_integration.get_patient_by_id(patient_id)
+        
+        # Transform FHIR data to our format
+        transformed_patient = {
+            "fhir_id": patient_data.get("id"),
+            "full_name": "",
+            "gender": patient_data.get("gender", "unknown"),
+            "date_of_birth": patient_data.get("birthDate", ""),
+            "address": "",
+            "phone": "",
+            "email": "",
+            "source": "fhir_import",
+            "status": "active",
+            "assigned_doctor_id": str(current_user.id),
+            "created_at": datetime.now(),
+            "updated_at": datetime.now()
+        }
+        
+        # Extract name
+        if patient_data.get("name"):
+            name_parts = []
+            for name in patient_data["name"]:
+                if name.get("given"):
+                    name_parts.extend(name["given"])
+                if name.get("family"):
+                    name_parts.append(name["family"])
+            transformed_patient["full_name"] = " ".join(name_parts)
+        
+        # Extract address
+        if patient_data.get("address"):
+            address_parts = []
+            for address in patient_data["address"]:
+                if address.get("line"):
+                    address_parts.extend(address["line"])
+                if address.get("city"):
+                    address_parts.append(address["city"])
+                if address.get("state"):
+                    address_parts.append(address["state"])
+                if address.get("postalCode"):
+                    address_parts.append(address["postalCode"])
+            transformed_patient["address"] = ", ".join(address_parts)
+        
+        # Extract contact information
+        if patient_data.get("telecom"):
+            for telecom in patient_data["telecom"]:
+                if telecom.get("system") == "phone":
+                    transformed_patient["phone"] = telecom.get("value", "")
+                elif telecom.get("system") == "email":
+                    transformed_patient["email"] = telecom.get("value", "")
+        
+        # Check if patient already exists
+        existing_patient = await patients_collection.find_one({"fhir_id": patient_data.get("id")})
+        if existing_patient:
+            raise HTTPException(status_code=400, detail="Patient already exists in database")
+        
+        # Insert patient into database
+        result = await patients_collection.insert_one(transformed_patient)
+        
+        return {
+            "message": "Patient imported successfully",
+            "patient_id": str(result.inserted_id),
+            "fhir_id": patient_data.get("id")
+        }
+        
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Error importing FHIR patient: {str(e)}") 

deployment/routes/messaging.py

@@ -0,0 +1,903 @@
+from fastapi import APIRouter, Depends, HTTPException, status, Query, WebSocket, WebSocketDisconnect, UploadFile, File
+from typing import List, Optional
+from datetime import datetime, timedelta
+from bson import ObjectId
+from motor.motor_asyncio import AsyncIOMotorClient
+import json
+import asyncio
+from collections import defaultdict
+import os
+import uuid
+from pathlib import Path
+
+from core.security import get_current_user
+from db.mongo import db
+from models.schemas import (
+    MessageCreate, MessageUpdate, MessageResponse, MessageListResponse,
+    ConversationResponse, ConversationListResponse, MessageType, MessageStatus,
+    NotificationCreate, NotificationResponse, NotificationListResponse,
+    NotificationType, NotificationPriority
+)
+
+router = APIRouter(prefix="/messaging", tags=["messaging"])
+
+# WebSocket connection manager
+class ConnectionManager:
+    def __init__(self):
+        self.active_connections: dict = defaultdict(list)  # user_id -> list of connections
+
+    async def connect(self, websocket: WebSocket, user_id: str):
+        await websocket.accept()
+        self.active_connections[user_id].append(websocket)
+
+    def disconnect(self, websocket: WebSocket, user_id: str):
+        if user_id in self.active_connections:
+            self.active_connections[user_id] = [
+                conn for conn in self.active_connections[user_id] if conn != websocket
+            ]
+
+    async def send_personal_message(self, message: dict, user_id: str):
+        if user_id in self.active_connections:
+            for connection in self.active_connections[user_id]:
+                try:
+                    await connection.send_text(json.dumps(message))
+                except:
+                    # Remove dead connections
+                    self.active_connections[user_id].remove(connection)
+
+manager = ConnectionManager()
+
+# --- HELPER FUNCTIONS ---
+def is_valid_object_id(id_str: str) -> bool:
+    try:
+        ObjectId(id_str)
+        return True
+    except:
+        return False
+
+def get_conversation_id(user1_id, user2_id) -> str:
+    """Generate a consistent conversation ID for two users"""
+    # Convert both IDs to strings for consistent comparison
+    user1_str = str(user1_id)
+    user2_str = str(user2_id)
+    # Sort IDs to ensure consistent conversation ID regardless of sender/recipient
+    sorted_ids = sorted([user1_str, user2_str])
+    return f"{sorted_ids[0]}_{sorted_ids[1]}"
+
+async def create_notification(
+    db_client: AsyncIOMotorClient,
+    recipient_id: str,
+    title: str,
+    message: str,
+    notification_type: NotificationType,
+    priority: NotificationPriority = NotificationPriority.MEDIUM,
+    data: Optional[dict] = None
+):
+    """Create a notification for a user"""
+    notification_doc = {
+        "recipient_id": ObjectId(recipient_id),
+        "title": title,
+        "message": message,
+        "notification_type": notification_type,
+        "priority": priority,
+        "data": data or {},
+        "is_read": False,
+        "created_at": datetime.now()
+    }
+    
+    result = await db_client.notifications.insert_one(notification_doc)
+    notification_doc["_id"] = result.inserted_id
+    
+    # Convert ObjectId to string for WebSocket transmission
+    notification_for_ws = {
+        "id": str(notification_doc["_id"]),
+        "recipient_id": str(notification_doc["recipient_id"]),
+        "title": notification_doc["title"],
+        "message": notification_doc["message"],
+        "notification_type": notification_doc["notification_type"],
+        "priority": notification_doc["priority"],
+        "data": notification_doc["data"],
+        "is_read": notification_doc["is_read"],
+        "created_at": notification_doc["created_at"]
+    }
+    
+    # Send real-time notification via WebSocket
+    await manager.send_personal_message({
+        "type": "new_notification",
+        "data": notification_for_ws
+    }, recipient_id)
+    
+    return notification_doc
+
+# --- WEBSOCKET ENDPOINT ---
+@router.websocket("/ws/{user_id}")
+async def websocket_endpoint(websocket: WebSocket, user_id: str):
+    await manager.connect(websocket, user_id)
+    print(f"🔌 WebSocket connected for user: {user_id}")
+    
+    try:
+        while True:
+            # Wait for messages from client (keep connection alive)
+            data = await websocket.receive_text()
+            try:
+                message_data = json.loads(data)
+                if message_data.get("type") == "ping":
+                    # Send pong to keep connection alive
+                    await websocket.send_text(json.dumps({"type": "pong"}))
+            except json.JSONDecodeError:
+                pass  # Ignore invalid JSON
+    except WebSocketDisconnect:
+        print(f"🔌 WebSocket disconnected for user: {user_id}")
+        manager.disconnect(websocket, user_id)
+    except Exception as e:
+        print(f"❌ WebSocket error for user {user_id}: {e}")
+        manager.disconnect(websocket, user_id)
+
+# --- CONVERSATION ENDPOINTS ---
+@router.get("/conversations", response_model=ConversationListResponse)
+async def get_conversations(
+    page: int = Query(1, ge=1),
+    limit: int = Query(20, ge=1, le=100),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get user's conversations"""
+    skip = (page - 1) * limit
+    user_id = current_user["_id"]
+    
+    # Get all messages where user is sender or recipient
+    pipeline = [
+        {
+            "$match": {
+                "$or": [
+                    {"sender_id": ObjectId(user_id)},
+                    {"recipient_id": ObjectId(user_id)}
+                ]
+            }
+        },
+        {
+            "$sort": {"created_at": -1}
+        },
+        {
+            "$group": {
+                "_id": {
+                    "$cond": [
+                        {"$eq": ["$sender_id", ObjectId(user_id)]},
+                        "$recipient_id",
+                        "$sender_id"
+                    ]
+                },
+                "last_message": {"$first": "$$ROOT"},
+                "unread_count": {
+                    "$sum": {
+                        "$cond": [
+                            {
+                                "$and": [
+                                    {"$eq": ["$recipient_id", ObjectId(user_id)]},
+                                    {"$ne": ["$status", "read"]}
+                                ]
+                            },
+                            1,
+                            0
+                        ]
+                    }
+                }
+            }
+        },
+        {
+            "$sort": {"last_message.created_at": -1}
+        },
+        {
+            "$skip": skip
+        },
+        {
+            "$limit": limit
+        }
+    ]
+    
+    conversations_data = await db_client.messages.aggregate(pipeline).to_list(length=limit)
+    
+    # Get user details for each conversation
+    conversations = []
+    for conv_data in conversations_data:
+        other_user_id = str(conv_data["_id"])
+        other_user = await db_client.users.find_one({"_id": conv_data["_id"]})
+        
+        if other_user:
+            # Convert user_id to string for consistent comparison
+            user_id_str = str(user_id)
+            conversation_id = get_conversation_id(user_id_str, other_user_id)
+            
+            # Build last message response
+            last_message = None
+            if conv_data["last_message"]:
+                last_message = MessageResponse(
+                    id=str(conv_data["last_message"]["_id"]),
+                    sender_id=str(conv_data["last_message"]["sender_id"]),
+                    recipient_id=str(conv_data["last_message"]["recipient_id"]),
+                    sender_name=current_user["full_name"] if conv_data["last_message"]["sender_id"] == ObjectId(user_id) else other_user["full_name"],
+                    recipient_name=other_user["full_name"] if conv_data["last_message"]["sender_id"] == ObjectId(user_id) else current_user["full_name"],
+                    content=conv_data["last_message"]["content"],
+                    message_type=conv_data["last_message"]["message_type"],
+                    attachment_url=conv_data["last_message"].get("attachment_url"),
+                    reply_to_message_id=str(conv_data["last_message"]["reply_to_message_id"]) if conv_data["last_message"].get("reply_to_message_id") else None,
+                    status=conv_data["last_message"]["status"],
+                    is_archived=conv_data["last_message"].get("is_archived", False),
+                    created_at=conv_data["last_message"]["created_at"],
+                    updated_at=conv_data["last_message"]["updated_at"],
+                    read_at=conv_data["last_message"].get("read_at")
+                )
+            
+            conversations.append(ConversationResponse(
+                id=conversation_id,
+                participant_ids=[user_id_str, other_user_id],
+                participant_names=[current_user["full_name"], other_user["full_name"]],
+                last_message=last_message,
+                unread_count=conv_data["unread_count"],
+                created_at=conv_data["last_message"]["created_at"] if conv_data["last_message"] else datetime.now(),
+                updated_at=conv_data["last_message"]["updated_at"] if conv_data["last_message"] else datetime.now()
+            ))
+    
+    # Get total count
+    total_pipeline = [
+        {
+            "$match": {
+                "$or": [
+                    {"sender_id": ObjectId(user_id)},
+                    {"recipient_id": ObjectId(user_id)}
+                ]
+            }
+        },
+        {
+            "$group": {
+                "_id": {
+                    "$cond": [
+                        {"$eq": ["$sender_id", ObjectId(user_id)]},
+                        "$recipient_id",
+                        "$sender_id"
+                    ]
+                }
+            }
+        },
+        {
+            "$count": "total"
+        }
+    ]
+    
+    total_result = await db_client.messages.aggregate(total_pipeline).to_list(length=1)
+    total = total_result[0]["total"] if total_result else 0
+    
+    return ConversationListResponse(
+        conversations=conversations,
+        total=total,
+        page=page,
+        limit=limit
+    )
+
+# --- MESSAGE ENDPOINTS ---
+@router.post("/messages", response_model=MessageResponse, status_code=status.HTTP_201_CREATED)
+async def send_message(
+    message_data: MessageCreate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Send a message to another user"""
+    if not is_valid_object_id(message_data.recipient_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid recipient ID"
+        )
+    
+    # Check if recipient exists
+    recipient = await db_client.users.find_one({"_id": ObjectId(message_data.recipient_id)})
+    if not recipient:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Recipient not found"
+        )
+    
+    # Check if user can message this recipient
+    # Patients can only message their doctors, doctors can message their patients
+    current_user_roles = current_user.get('roles', [])
+    if isinstance(current_user.get('role'), str):
+        current_user_roles.append(current_user.get('role'))
+    
+    recipient_roles = recipient.get('roles', [])
+    if isinstance(recipient.get('role'), str):
+        recipient_roles.append(recipient.get('role'))
+    
+    if 'patient' in current_user_roles:
+        # Patients can only message doctors
+        if 'doctor' not in recipient_roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Patients can only message doctors"
+            )
+    elif 'doctor' in current_user_roles:
+        # Doctors can only message their patients
+        if 'patient' not in recipient_roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Doctors can only message patients"
+            )
+    
+    # Check reply message if provided
+    if message_data.reply_to_message_id:
+        if not is_valid_object_id(message_data.reply_to_message_id):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid reply message ID"
+            )
+        
+        reply_message = await db_client.messages.find_one({"_id": ObjectId(message_data.reply_to_message_id)})
+        if not reply_message:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Reply message not found"
+            )
+    
+    # Create message
+    message_doc = {
+        "sender_id": ObjectId(current_user["_id"]),
+        "recipient_id": ObjectId(message_data.recipient_id),
+        "content": message_data.content,
+        "message_type": message_data.message_type,
+        "attachment_url": message_data.attachment_url,
+        "reply_to_message_id": ObjectId(message_data.reply_to_message_id) if message_data.reply_to_message_id else None,
+        "status": MessageStatus.SENT,
+        "is_archived": False,
+        "created_at": datetime.now(),
+        "updated_at": datetime.now()
+    }
+    
+    result = await db_client.messages.insert_one(message_doc)
+    message_doc["_id"] = result.inserted_id
+    
+    # Send real-time message via WebSocket
+    await manager.send_personal_message({
+        "type": "new_message",
+        "data": {
+            "id": str(message_doc["_id"]),
+            "sender_id": str(message_doc["sender_id"]),
+            "recipient_id": str(message_doc["recipient_id"]),
+            "sender_name": current_user["full_name"],
+            "recipient_name": recipient["full_name"],
+            "content": message_doc["content"],
+            "message_type": message_doc["message_type"],
+            "attachment_url": message_doc["attachment_url"],
+            "reply_to_message_id": str(message_doc["reply_to_message_id"]) if message_doc["reply_to_message_id"] else None,
+            "status": message_doc["status"],
+            "is_archived": message_doc["is_archived"],
+            "created_at": message_doc["created_at"],
+            "updated_at": message_doc["updated_at"]
+        }
+    }, message_data.recipient_id)
+    
+    # Create notification for recipient
+    await create_notification(
+        db_client,
+        message_data.recipient_id,
+        f"New message from {current_user['full_name']}",
+        message_data.content[:100] + "..." if len(message_data.content) > 100 else message_data.content,
+        NotificationType.MESSAGE,
+        NotificationPriority.MEDIUM,
+        {"message_id": str(message_doc["_id"]), "sender_id": str(current_user["_id"])}
+    )
+    
+    return MessageResponse(
+        id=str(message_doc["_id"]),
+        sender_id=str(message_doc["sender_id"]),
+        recipient_id=str(message_doc["recipient_id"]),
+        sender_name=current_user["full_name"],
+        recipient_name=recipient["full_name"],
+        content=message_doc["content"],
+        message_type=message_doc["message_type"],
+        attachment_url=message_doc["attachment_url"],
+        reply_to_message_id=str(message_doc["reply_to_message_id"]) if message_doc["reply_to_message_id"] else None,
+        status=message_doc["status"],
+        is_archived=message_doc["is_archived"],
+        created_at=message_doc["created_at"],
+        updated_at=message_doc["updated_at"]
+    )
+
+@router.get("/messages/{conversation_id}", response_model=MessageListResponse)
+async def get_messages(
+    conversation_id: str,
+    page: int = Query(1, ge=1),
+    limit: int = Query(50, ge=1, le=100),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get messages for a specific conversation"""
+    skip = (page - 1) * limit
+    user_id = current_user["_id"]
+    
+    # Parse conversation ID to get the other participant
+    try:
+        participant_ids = conversation_id.split("_")
+        if len(participant_ids) != 2:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid conversation ID format"
+            )
+        
+        # Find the other participant
+        other_user_id = None
+        user_id_str = str(user_id)
+        for pid in participant_ids:
+            if pid != user_id_str:
+                other_user_id = pid
+                break
+        
+        if not other_user_id or not is_valid_object_id(other_user_id):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid conversation ID"
+            )
+        
+        # Verify the other user exists
+        other_user = await db_client.users.find_one({"_id": ObjectId(other_user_id)})
+        if not other_user:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Conversation participant not found"
+            )
+        
+    except Exception as e:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid conversation ID"
+        )
+    
+    # Get messages between the two users
+    filter_query = {
+        "$or": [
+            {
+                "sender_id": ObjectId(user_id),
+                "recipient_id": ObjectId(other_user_id)
+            },
+            {
+                "sender_id": ObjectId(other_user_id),
+                "recipient_id": ObjectId(user_id)
+            }
+        ]
+    }
+    
+    # Get messages
+    cursor = db_client.messages.find(filter_query).sort("created_at", -1).skip(skip).limit(limit)
+    messages = await cursor.to_list(length=limit)
+    
+    # Mark messages as read
+    unread_messages = [
+        msg["_id"] for msg in messages 
+        if msg["recipient_id"] == ObjectId(user_id) and msg["status"] != "read"
+    ]
+    
+    if unread_messages:
+        await db_client.messages.update_many(
+            {"_id": {"$in": unread_messages}},
+            {"$set": {"status": "read", "read_at": datetime.now()}}
+        )
+    
+    # Get total count
+    total = await db_client.messages.count_documents(filter_query)
+    
+    # Build message responses
+    message_responses = []
+    for msg in messages:
+        sender = await db_client.users.find_one({"_id": msg["sender_id"]})
+        recipient = await db_client.users.find_one({"_id": msg["recipient_id"]})
+        
+        message_responses.append(MessageResponse(
+            id=str(msg["_id"]),
+            sender_id=str(msg["sender_id"]),
+            recipient_id=str(msg["recipient_id"]),
+            sender_name=sender["full_name"] if sender else "Unknown User",
+            recipient_name=recipient["full_name"] if recipient else "Unknown User",
+            content=msg["content"],
+            message_type=msg["message_type"],
+            attachment_url=msg.get("attachment_url"),
+            reply_to_message_id=str(msg["reply_to_message_id"]) if msg.get("reply_to_message_id") else None,
+            status=msg["status"],
+            is_archived=msg.get("is_archived", False),
+            created_at=msg["created_at"],
+            updated_at=msg["updated_at"],
+            read_at=msg.get("read_at")
+        ))
+    
+    return MessageListResponse(
+        messages=message_responses,
+        total=total,
+        page=page,
+        limit=limit,
+        conversation_id=conversation_id
+    )
+
+@router.put("/messages/{message_id}", response_model=MessageResponse)
+async def update_message(
+    message_id: str,
+    message_data: MessageUpdate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Update a message (only sender can update)"""
+    if not is_valid_object_id(message_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid message ID"
+        )
+    
+    message = await db_client.messages.find_one({"_id": ObjectId(message_id)})
+    if not message:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Message not found"
+        )
+    
+    # Only sender can update message
+    if message["sender_id"] != ObjectId(current_user["_id"]):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only update your own messages"
+        )
+    
+    # Build update data
+    update_data = {"updated_at": datetime.now()}
+    
+    if message_data.content is not None:
+        update_data["content"] = message_data.content
+    if message_data.is_archived is not None:
+        update_data["is_archived"] = message_data.is_archived
+    
+    # Update message
+    await db_client.messages.update_one(
+        {"_id": ObjectId(message_id)},
+        {"$set": update_data}
+    )
+    
+    # Get updated message
+    updated_message = await db_client.messages.find_one({"_id": ObjectId(message_id)})
+    
+    # Get sender and recipient names
+    sender = await db_client.users.find_one({"_id": updated_message["sender_id"]})
+    recipient = await db_client.users.find_one({"_id": updated_message["recipient_id"]})
+    
+    return MessageResponse(
+        id=str(updated_message["_id"]),
+        sender_id=str(updated_message["sender_id"]),
+        recipient_id=str(updated_message["recipient_id"]),
+        sender_name=sender["full_name"] if sender else "Unknown User",
+        recipient_name=recipient["full_name"] if recipient else "Unknown User",
+        content=updated_message["content"],
+        message_type=updated_message["message_type"],
+        attachment_url=updated_message.get("attachment_url"),
+        reply_to_message_id=str(updated_message["reply_to_message_id"]) if updated_message.get("reply_to_message_id") else None,
+        status=updated_message["status"],
+        is_archived=updated_message.get("is_archived", False),
+        created_at=updated_message["created_at"],
+        updated_at=updated_message["updated_at"],
+        read_at=updated_message.get("read_at")
+    )
+
+@router.delete("/messages/{message_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_message(
+    message_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Delete a message (only sender can delete)"""
+    if not is_valid_object_id(message_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid message ID"
+        )
+    
+    message = await db_client.messages.find_one({"_id": ObjectId(message_id)})
+    if not message:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Message not found"
+        )
+    
+    # Only sender can delete message
+    if message["sender_id"] != ObjectId(current_user["_id"]):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only delete your own messages"
+        )
+    
+    await db_client.messages.delete_one({"_id": ObjectId(message_id)})
+
+# --- NOTIFICATION ENDPOINTS ---
+@router.get("/notifications", response_model=NotificationListResponse)
+async def get_notifications(
+    page: int = Query(1, ge=1),
+    limit: int = Query(20, ge=1, le=100),
+    unread_only: bool = Query(False),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get user's notifications"""
+    skip = (page - 1) * limit
+    user_id = current_user["_id"]
+    
+    # Build filter
+    filter_query = {"recipient_id": ObjectId(user_id)}
+    if unread_only:
+        filter_query["is_read"] = False
+    
+    # Get notifications
+    cursor = db_client.notifications.find(filter_query).sort("created_at", -1).skip(skip).limit(limit)
+    notifications = await cursor.to_list(length=limit)
+    
+    # Get total count and unread count
+    total = await db_client.notifications.count_documents(filter_query)
+    unread_count = await db_client.notifications.count_documents({
+        "recipient_id": ObjectId(user_id),
+        "is_read": False
+    })
+    
+    # Build notification responses
+    notification_responses = []
+    for notif in notifications:
+        # Convert any ObjectId fields in data to strings
+        data = notif.get("data", {})
+        if data:
+            # Convert ObjectId fields to strings
+            for key, value in data.items():
+                if isinstance(value, ObjectId):
+                    data[key] = str(value)
+        
+        notification_responses.append(NotificationResponse(
+            id=str(notif["_id"]),
+            recipient_id=str(notif["recipient_id"]),
+            recipient_name=current_user["full_name"],
+            title=notif["title"],
+            message=notif["message"],
+            notification_type=notif["notification_type"],
+            priority=notif["priority"],
+            data=data,
+            is_read=notif.get("is_read", False),
+            created_at=notif["created_at"],
+            read_at=notif.get("read_at")
+        ))
+    
+    return NotificationListResponse(
+        notifications=notification_responses,
+        total=total,
+        unread_count=unread_count,
+        page=page,
+        limit=limit
+    )
+
+@router.put("/notifications/{notification_id}/read", response_model=NotificationResponse)
+async def mark_notification_read(
+    notification_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Mark a notification as read"""
+    if not is_valid_object_id(notification_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid notification ID"
+        )
+    
+    notification = await db_client.notifications.find_one({"_id": ObjectId(notification_id)})
+    if not notification:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Notification not found"
+        )
+    
+    # Only recipient can mark as read
+    if notification["recipient_id"] != ObjectId(current_user["_id"]):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only mark your own notifications as read"
+        )
+    
+    # Update notification
+    await db_client.notifications.update_one(
+        {"_id": ObjectId(notification_id)},
+        {"$set": {"is_read": True, "read_at": datetime.now()}}
+    )
+    
+    # Get updated notification
+    updated_notification = await db_client.notifications.find_one({"_id": ObjectId(notification_id)})
+    
+    # Convert any ObjectId fields in data to strings
+    data = updated_notification.get("data", {})
+    if data:
+        # Convert ObjectId fields to strings
+        for key, value in data.items():
+            if isinstance(value, ObjectId):
+                data[key] = str(value)
+    
+    return NotificationResponse(
+        id=str(updated_notification["_id"]),
+        recipient_id=str(updated_notification["recipient_id"]),
+        recipient_name=current_user["full_name"],
+        title=updated_notification["title"],
+        message=updated_notification["message"],
+        notification_type=updated_notification["notification_type"],
+        priority=updated_notification["priority"],
+        data=data,
+        is_read=updated_notification.get("is_read", False),
+        created_at=updated_notification["created_at"],
+        read_at=updated_notification.get("read_at")
+    )
+
+@router.put("/notifications/read-all", status_code=status.HTTP_200_OK)
+async def mark_all_notifications_read(
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Mark all user's notifications as read"""
+    user_id = current_user["_id"]
+    
+    await db_client.notifications.update_many(
+        {
+            "recipient_id": ObjectId(user_id),
+            "is_read": False
+        },
+        {
+            "$set": {
+                "is_read": True,
+                "read_at": datetime.now()
+            }
+        }
+    )
+    
+    return {"message": "All notifications marked as read"} 
+
+# --- FILE UPLOAD ENDPOINT ---
+@router.post("/upload", status_code=status.HTTP_201_CREATED)
+async def upload_file(
+    file: UploadFile = File(...),
+    current_user: dict = Depends(get_current_user)
+):
+    """Upload a file for messaging"""
+    
+    # Validate file type
+    allowed_types = {
+        'image': ['.jpg', '.jpeg', '.png', '.gif', '.bmp', '.webp'],
+        'document': ['.pdf', '.doc', '.docx', '.txt', '.rtf'],
+        'spreadsheet': ['.xls', '.xlsx', '.csv'],
+        'presentation': ['.ppt', '.pptx'],
+        'archive': ['.zip', '.rar', '.7z']
+    }
+    
+    # Get file extension
+    file_ext = Path(file.filename).suffix.lower()
+    
+    # Check if file type is allowed
+    is_allowed = False
+    file_category = None
+    for category, extensions in allowed_types.items():
+        if file_ext in extensions:
+            is_allowed = True
+            file_category = category
+            break
+    
+    if not is_allowed:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"File type {file_ext} is not allowed. Allowed types: {', '.join([ext for exts in allowed_types.values() for ext in exts])}"
+        )
+    
+    # Check file size (max 10MB)
+    max_size = 10 * 1024 * 1024  # 10MB
+    if file.size and file.size > max_size:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"File size exceeds maximum limit of 10MB"
+        )
+    
+    # Create uploads directory if it doesn't exist
+    try:
+        upload_dir = Path("uploads")
+        upload_dir.mkdir(exist_ok=True)
+    except PermissionError:
+        # In containerized environments, use temp directory
+        import tempfile
+        upload_dir = Path(tempfile.gettempdir()) / "uploads"
+        upload_dir.mkdir(exist_ok=True)
+    
+    # Create category subdirectory
+    category_dir = upload_dir / file_category
+    category_dir.mkdir(exist_ok=True)
+    
+    # Generate unique filename
+    unique_filename = f"{uuid.uuid4()}{file_ext}"
+    file_path = category_dir / unique_filename
+    
+    try:
+        # Save file
+        with open(file_path, "wb") as buffer:
+            content = await file.read()
+            buffer.write(content)
+        
+        # Return file info
+        return {
+            "filename": file.filename,
+            "file_url": f"/uploads/{file_category}/{unique_filename}",
+            "file_size": len(content),
+            "file_type": file_category,
+            "message_type": MessageType.IMAGE if file_category == 'image' else MessageType.FILE
+        }
+        
+    except Exception as e:
+        # Clean up file if save fails
+        if file_path.exists():
+            file_path.unlink()
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to upload file: {str(e)}"
+        )
+
+# --- STATIC FILE SERVING ---
+@router.get("/uploads/{category}/{filename}")
+async def serve_file(category: str, filename: str):
+    """Serve uploaded files"""
+    import os
+    
+    # Get the current working directory and construct absolute path
+    current_dir = os.getcwd()
+    file_path = Path(current_dir) / "uploads" / category / filename
+    
+    print(f"🔍 Looking for file: {file_path}")
+    print(f"📁 File exists: {file_path.exists()}")
+    
+    if not file_path.exists():
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"File not found: {file_path}"
+        )
+    
+    # Determine content type based on file extension
+    ext = file_path.suffix.lower()
+    content_types = {
+        '.jpg': 'image/jpeg',
+        '.jpeg': 'image/jpeg',
+        '.png': 'image/png',
+        '.gif': 'image/gif',
+        '.bmp': 'image/bmp',
+        '.webp': 'image/webp',
+        '.pdf': 'application/pdf',
+        '.doc': 'application/msword',
+        '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        '.txt': 'text/plain',
+        '.rtf': 'application/rtf',
+        '.xls': 'application/vnd.ms-excel',
+        '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        '.csv': 'text/csv',
+        '.ppt': 'application/vnd.ms-powerpoint',
+        '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+        '.zip': 'application/zip',
+        '.rar': 'application/x-rar-compressed',
+        '.7z': 'application/x-7z-compressed'
+    }
+    
+    content_type = content_types.get(ext, 'application/octet-stream')
+    
+    try:
+        # Read and return file content
+        with open(file_path, "rb") as f:
+            content = f.read()
+        
+        from fastapi.responses import Response
+        return Response(
+            content=content,
+            media_type=content_type,
+            headers={
+                "Content-Disposition": f"inline; filename={filename}",
+                "Cache-Control": "public, max-age=31536000"
+            }
+        )
+    except Exception as e:
+        print(f"❌ Error reading file: {e}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error reading file: {str(e)}"
+        ) 

deployment/routes/patients.py

@@ -0,0 +1,1153 @@
+from fastapi import APIRouter, HTTPException, Depends, Query, status, Body
+from db.mongo import patients_collection, db  # Added db import
+from core.security import get_current_user
+from utils.db import create_indexes
+from utils.helpers import calculate_age, standardize_language
+from models.entities import Note, PatientCreate
+from models.schemas import PatientListResponse  # Fixed import
+from api.services.fhir_integration import HAPIFHIRIntegrationService
+from datetime import datetime
+from bson import ObjectId
+from bson.errors import InvalidId
+from typing import Optional, List, Dict, Any
+from pymongo import UpdateOne, DeleteOne
+from pymongo.errors import BulkWriteError
+import json
+from pathlib import Path
+import glob
+import uuid
+import re
+import logging
+import time
+import os
+from pydantic import BaseModel, Field
+from motor.motor_asyncio import AsyncIOMotorClient
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(name)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+# Configuration
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+SYNTHEA_DATA_DIR = BASE_DIR / "output" / "fhir"
+try:
+    os.makedirs(SYNTHEA_DATA_DIR, exist_ok=True)
+except PermissionError:
+    # In containerized environments, we might not have write permissions
+    # Use a temporary directory instead
+    import tempfile
+    SYNTHEA_DATA_DIR = Path(tempfile.gettempdir()) / "fhir"
+    os.makedirs(SYNTHEA_DATA_DIR, exist_ok=True)
+
+# Pydantic models for update validation
+class ConditionUpdate(BaseModel):
+    id: Optional[str] = None
+    code: Optional[str] = None
+    status: Optional[str] = None
+    onset_date: Optional[str] = None
+    recorded_date: Optional[str] = None
+    verification_status: Optional[str] = None
+    notes: Optional[str] = None
+
+class MedicationUpdate(BaseModel):
+    id: Optional[str] = None
+    name: Optional[str] = None
+    status: Optional[str] = None
+    prescribed_date: Optional[str] = None
+    requester: Optional[str] = None
+    dosage: Optional[str] = None
+
+class EncounterUpdate(BaseModel):
+    id: Optional[str] = None
+    type: Optional[str] = None
+    status: Optional[str] = None
+    period: Optional[Dict[str, str]] = None
+    service_provider: Optional[str] = None
+
+class NoteUpdate(BaseModel):
+    id: Optional[str] = None
+    title: Optional[str] = None
+    date: Optional[str] = None
+    author: Optional[str] = None
+    content: Optional[str] = None
+
+class PatientUpdate(BaseModel):
+    full_name: Optional[str] = None
+    gender: Optional[str] = None
+    date_of_birth: Optional[str] = None
+    address: Optional[str] = None
+    city: Optional[str] = None
+    state: Optional[str] = None
+    postal_code: Optional[str] = None
+    country: Optional[str] = None
+    marital_status: Optional[str] = None
+    language: Optional[str] = None
+    conditions: Optional[List[ConditionUpdate]] = None
+    medications: Optional[List[MedicationUpdate]] = None
+    encounters: Optional[List[EncounterUpdate]] = None
+    notes: Optional[List[NoteUpdate]] = None
+
+@router.get("/debug/count")
+async def debug_patient_count():
+    """Debug endpoint to verify patient counts"""
+    try:
+        total = await patients_collection.count_documents({})
+        synthea = await patients_collection.count_documents({"source": "synthea"})
+        manual = await patients_collection.count_documents({"source": "manual"})
+        return {
+            "total": total,
+            "synthea": synthea,
+            "manual": manual,
+            "message": f"Found {total} total patients ({synthea} from synthea, {manual} manual)"
+        }
+    except Exception as e:
+        logger.error(f"Error counting patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error counting patients: {str(e)}"
+        )
+
+@router.post("/patients", status_code=status.HTTP_201_CREATED)
+async def create_patient(
+    patient_data: PatientCreate,
+    current_user: dict = Depends(get_current_user)
+):
+    """Create a new patient in the database"""
+    logger.info(f"Creating new patient by user {current_user.get('email')}")
+    
+    if not any(role in current_user.get('roles', []) for role in ['admin', 'doctor']):
+        logger.warning(f"Unauthorized create attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators and doctors can create patients"
+        )
+    
+    try:
+        # Prepare the patient document
+        patient_doc = patient_data.dict()
+        now = datetime.utcnow().isoformat()
+        
+        # Add system-generated fields
+        patient_doc.update({
+            "fhir_id": str(uuid.uuid4()),
+            "import_date": now,
+            "last_updated": now,
+            "source": "manual",
+            "created_by": current_user.get('email')
+        })
+        
+        # Ensure arrays exist even if empty
+        for field in ['conditions', 'medications', 'encounters', 'notes']:
+            if field not in patient_doc:
+                patient_doc[field] = []
+        
+        # Insert the patient document
+        result = await patients_collection.insert_one(patient_doc)
+        
+        # Return the created patient with the generated ID
+        created_patient = await patients_collection.find_one(
+            {"_id": result.inserted_id}
+        )
+        
+        if not created_patient:
+            logger.error("Failed to retrieve created patient")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Failed to retrieve created patient"
+            )
+        
+        created_patient["id"] = str(created_patient["_id"])
+        del created_patient["_id"]
+        
+        logger.info(f"Successfully created patient {created_patient['fhir_id']}")
+        return created_patient
+        
+    except Exception as e:
+        logger.error(f"Failed to create patient: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create patient: {str(e)}"
+        )
+
+@router.delete("/patients/{patient_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_patient(
+    patient_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """Delete a patient from the database"""
+    logger.info(f"Deleting patient {patient_id} by user {current_user.get('email')}")
+    
+    if not any(role in current_user.get('roles', []) for role in ['admin', 'doctor']):
+        logger.warning(f"Unauthorized delete attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators can delete patients"
+        )
+    
+    try:
+        # Build the query based on whether patient_id is a valid ObjectId
+        query = {"fhir_id": patient_id}
+        if ObjectId.is_valid(patient_id):
+            query = {
+                "$or": [
+                    {"_id": ObjectId(patient_id)},
+                    {"fhir_id": patient_id}
+                ]
+            }
+        
+        # Check if patient exists
+        patient = await patients_collection.find_one(query)
+        
+        if not patient:
+            logger.warning(f"Patient not found for deletion: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        # Perform deletion
+        result = await patients_collection.delete_one(query)
+        
+        if result.deleted_count == 0:
+            logger.error(f"Failed to delete patient {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Failed to delete patient"
+            )
+        
+        logger.info(f"Successfully deleted patient {patient_id}")
+        return None
+        
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to delete patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to delete patient: {str(e)}"
+        )
+
+async def process_synthea_patient(bundle: dict, file_path: str) -> Optional[dict]:
+    logger.debug(f"Processing patient from file: {file_path}")
+    patient_data = {}
+    notes = []
+    conditions = []
+    medications = []
+    encounters = []
+    
+    # Validate bundle structure
+    if not isinstance(bundle, dict) or 'entry' not in bundle:
+        logger.error(f"Invalid FHIR bundle structure in {file_path}")
+        return None
+    
+    for entry in bundle.get('entry', []):
+        resource = entry.get('resource', {})
+        resource_type = resource.get('resourceType')
+        
+        if not resource_type:
+            logger.warning(f"Skipping entry with missing resourceType in {file_path}")
+            continue
+            
+        try:
+            if resource_type == 'Patient':
+                name = resource.get('name', [{}])[0]
+                address = resource.get('address', [{}])[0]
+                
+                # Construct full name and remove numbers
+                raw_full_name = f"{' '.join(name.get('given', ['']))} {name.get('family', '')}".strip()
+                clean_full_name = re.sub(r'\d+', '', raw_full_name).strip()
+                
+                patient_data = {
+                    'fhir_id': resource.get('id'),
+                    'full_name': clean_full_name,
+                    'gender': resource.get('gender', 'unknown'),
+                    'date_of_birth': resource.get('birthDate', ''),
+                    'address': ' '.join(address.get('line', [''])),
+                    'city': address.get('city', ''),
+                    'state': address.get('state', ''),
+                    'postal_code': address.get('postalCode', ''),
+                    'country': address.get('country', ''),
+                    'marital_status': resource.get('maritalStatus', {}).get('text', ''),
+                    'language': standardize_language(resource.get('communication', [{}])[0].get('language', {}).get('text', '')),
+                    'source': 'synthea',
+                    'last_updated': datetime.utcnow().isoformat()
+                }
+                
+            elif resource_type == 'Encounter':
+                encounter = {
+                    'id': resource.get('id'),
+                    'type': resource.get('type', [{}])[0].get('text', ''),
+                    'status': resource.get('status'),
+                    'period': resource.get('period', {}),
+                    'service_provider': resource.get('serviceProvider', {}).get('display', '')
+                }
+                encounters.append(encounter)
+                
+                for note in resource.get('note', []):
+                    if note.get('text'):
+                        notes.append({
+                            'date': resource.get('period', {}).get('start', datetime.utcnow().isoformat()),
+                            'type': resource.get('type', [{}])[0].get('text', 'Encounter Note'),
+                            'text': note.get('text'),
+                            'context': f"Encounter: {encounter.get('type')}",
+                            'author': 'System Generated'
+                        })
+                
+            elif resource_type == 'Condition':
+                conditions.append({
+                    'id': resource.get('id'),
+                    'code': resource.get('code', {}).get('text', ''),
+                    'status': resource.get('clinicalStatus', {}).get('text', ''),
+                    'onset_date': resource.get('onsetDateTime'),
+                    'recorded_date': resource.get('recordedDate'),
+                    'verification_status': resource.get('verificationStatus', {}).get('text', '')
+                })
+                
+            elif resource_type == 'MedicationRequest':
+                medications.append({
+                    'id': resource.get('id'),
+                    'name': resource.get('medicationCodeableConcept', {}).get('text', ''),
+                    'status': resource.get('status'),
+                    'prescribed_date': resource.get('authoredOn'),
+                    'requester': resource.get('requester', {}).get('display', ''),
+                    'dosage': resource.get('dosageInstruction', [{}])[0].get('text', '')
+                })
+                
+        except Exception as e:
+            logger.error(f"Error processing {resource_type} in {file_path}: {str(e)}")
+            continue
+    
+    if patient_data:
+        patient_data.update({
+            'notes': notes,
+            'conditions': conditions,
+            'medications': medications,
+            'encounters': encounters,
+            'import_date': datetime.utcnow().isoformat()
+        })
+        logger.info(f"Successfully processed patient {patient_data.get('fhir_id')} from {file_path}")
+        return patient_data
+    logger.warning(f"No valid patient data found in {file_path}")
+    return None
+
+@router.post("/import", status_code=status.HTTP_201_CREATED)
+async def import_patients(
+    limit: int = Query(100, ge=1, le=1000),
+    current_user: dict = Depends(get_current_user)
+):
+    request_id = str(uuid.uuid4())
+    logger.info(f"Starting import request {request_id} by user {current_user.get('email')}")
+    start_time = time.time()
+    
+    if current_user.get('role') not in ['admin', 'doctor']:
+        logger.warning(f"Unauthorized import attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators and doctors can import data"
+        )
+    
+    try:
+        await create_indexes()
+        
+        if not SYNTHEA_DATA_DIR.exists():
+            logger.error(f"Synthea data directory not found: {SYNTHEA_DATA_DIR}")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Data directory not found"
+            )
+            
+        # Filter out non-patient files
+        files = [
+            f for f in glob.glob(str(SYNTHEA_DATA_DIR / "*.json"))
+            if not re.search(r'(hospitalInformation|practitionerInformation)\d+\.json$', f)
+        ]
+        if not files:
+            logger.warning("No valid patient JSON files found in synthea data directory")
+            return {
+                "status": "success",
+                "message": "No patient data files found",
+                "imported": 0,
+                "request_id": request_id
+            }
+            
+        operations = []
+        imported = 0
+        errors = []
+        
+        for file_path in files[:limit]:
+            try:
+                logger.debug(f"Processing file: {file_path}")
+                
+                # Check file accessibility
+                if not os.path.exists(file_path):
+                    logger.error(f"File not found: {file_path}")
+                    errors.append(f"File not found: {file_path}")
+                    continue
+                    
+                # Check file size
+                file_size = os.path.getsize(file_path)
+                if file_size == 0:
+                    logger.warning(f"Empty file: {file_path}")
+                    errors.append(f"Empty file: {file_path}")
+                    continue
+                    
+                with open(file_path, 'r', encoding='utf-8') as f:
+                    try:
+                        bundle = json.load(f)
+                    except json.JSONDecodeError as je:
+                        logger.error(f"Invalid JSON in {file_path}: {str(je)}")
+                        errors.append(f"Invalid JSON in {file_path}: {str(je)}")
+                        continue
+                        
+                patient = await process_synthea_patient(bundle, file_path)
+                if patient:
+                    if not patient.get('fhir_id'):
+                        logger.warning(f"Missing FHIR ID in patient data from {file_path}")
+                        errors.append(f"Missing FHIR ID in {file_path}")
+                        continue
+                        
+                    operations.append(UpdateOne(
+                        {"fhir_id": patient['fhir_id']},
+                        {"$setOnInsert": patient},
+                        upsert=True
+                    ))
+                    imported += 1
+                else:
+                    logger.warning(f"No valid patient data in {file_path}")
+                    errors.append(f"No valid patient data in {file_path}")
+                    
+            except Exception as e:
+                logger.error(f"Error processing {file_path}: {str(e)}")
+                errors.append(f"Error in {file_path}: {str(e)}")
+                continue
+        
+        response = {
+            "status": "success",
+            "imported": imported,
+            "errors": errors,
+            "request_id": request_id,
+            "duration_seconds": time.time() - start_time
+        }
+        
+        if operations:
+            try:
+                result = await patients_collection.bulk_write(operations, ordered=False)
+                response.update({
+                    "upserted": result.upserted_count,
+                    "existing": len(operations) - result.upserted_count
+                })
+                logger.info(f"Import request {request_id} completed: {imported} patients processed, "
+                           f"{result.upserted_count} upserted, {len(errors)} errors")
+            except BulkWriteError as bwe:
+                logger.error(f"Partial bulk write failure for request {request_id}: {str(bwe.details)}")
+                response.update({
+                    "upserted": bwe.details.get('nUpserted', 0),
+                    "existing": len(operations) - bwe.details.get('nUpserted', 0),
+                    "write_errors": [
+                        f"Index {err['index']}: {err['errmsg']}" for err in bwe.details.get('writeErrors', [])
+                    ]
+                })
+                logger.info(f"Import request {request_id} partially completed: {imported} patients processed, "
+                           f"{response['upserted']} upserted, {len(errors)} errors")
+            except Exception as e:
+                logger.error(f"Bulk write failed for request {request_id}: {str(e)}")
+                raise HTTPException(
+                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                    detail=f"Database operation failed: {str(e)}"
+                )
+        else:
+            logger.info(f"Import request {request_id} completed: No new patients to import, {len(errors)} errors")
+            response["message"] = "No new patients found to import"
+            
+        return response
+        
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Import request {request_id} failed: {str(e)}", exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Import failed: {str(e)}"
+        )
+
+@router.post("/patients/import-ehr", status_code=status.HTTP_201_CREATED)
+async def import_ehr_patients(
+    ehr_data: List[dict],
+    ehr_system: str = Query(..., description="Name of the EHR system"),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Import patients from external EHR system"""
+    logger.info(f"Importing {len(ehr_data)} patients from EHR system: {ehr_system}")
+    
+    if not any(role in current_user.get('roles', []) for role in ['admin', 'doctor']):
+        logger.warning(f"Unauthorized EHR import attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators and doctors can import EHR patients"
+        )
+    
+    try:
+        imported_patients = []
+        skipped_patients = []
+        
+        for patient_data in ehr_data:
+            # Check if patient already exists by multiple criteria
+            existing_patient = await patients_collection.find_one({
+                "$or": [
+                    {"ehr_id": patient_data.get("ehr_id"), "ehr_system": ehr_system},
+                    {"full_name": patient_data.get("full_name"), "date_of_birth": patient_data.get("date_of_birth")},
+                    {"national_id": patient_data.get("national_id")} if patient_data.get("national_id") else {}
+                ]
+            })
+            
+            if existing_patient:
+                skipped_patients.append(patient_data.get("full_name", "Unknown"))
+                logger.info(f"Patient {patient_data.get('full_name', 'Unknown')} already exists, skipping...")
+                continue
+            
+            # Prepare patient document for EHR import
+            patient_doc = {
+                "full_name": patient_data.get("full_name"),
+                "date_of_birth": patient_data.get("date_of_birth"),
+                "gender": patient_data.get("gender"),
+                "address": patient_data.get("address"),
+                "national_id": patient_data.get("national_id"),
+                "blood_type": patient_data.get("blood_type"),
+                "allergies": patient_data.get("allergies", []),
+                "chronic_conditions": patient_data.get("chronic_conditions", []),
+                "medications": patient_data.get("medications", []),
+                "emergency_contact_name": patient_data.get("emergency_contact_name"),
+                "emergency_contact_phone": patient_data.get("emergency_contact_phone"),
+                "insurance_provider": patient_data.get("insurance_provider"),
+                "insurance_policy_number": patient_data.get("insurance_policy_number"),
+                "contact": patient_data.get("contact"),
+                "source": "ehr",
+                "ehr_id": patient_data.get("ehr_id"),
+                "ehr_system": ehr_system,
+                "status": "active",
+                "registration_date": datetime.now(),
+                "created_by": current_user.get('email'),
+                "created_at": datetime.now(),
+                "updated_at": datetime.now()
+            }
+            
+            # Insert patient
+            result = await patients_collection.insert_one(patient_doc)
+            imported_patients.append(patient_data.get("full_name", "Unknown"))
+        
+        logger.info(f"Successfully imported {len(imported_patients)} patients, skipped {len(skipped_patients)}")
+        
+        return {
+            "message": f"Successfully imported {len(imported_patients)} patients from {ehr_system}",
+            "imported_count": len(imported_patients),
+            "skipped_count": len(skipped_patients),
+            "imported_patients": imported_patients,
+            "skipped_patients": skipped_patients
+        }
+        
+    except Exception as e:
+        logger.error(f"Error importing EHR patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error importing EHR patients: {str(e)}"
+        )
+
+@router.get("/patients/sources", response_model=List[dict])
+async def get_patient_sources(
+    current_user: dict = Depends(get_current_user)
+):
+    """Get available patient sources and their counts"""
+    try:
+        # Get counts for each source
+        source_counts = await patients_collection.aggregate([
+            {
+                "$group": {
+                    "_id": "$source",
+                    "count": {"$sum": 1}
+                }
+            }
+        ]).to_list(length=None)
+        
+        # Format the response
+        sources = []
+        for source_count in source_counts:
+            source_name = source_count["_id"] or "unknown"
+            sources.append({
+                "source": source_name,
+                "count": source_count["count"],
+                "label": source_name.replace("_", " ").title()
+            })
+        
+        return sources
+        
+    except Exception as e:
+        logger.error(f"Error getting patient sources: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error getting patient sources: {str(e)}"
+        )
+
+@router.get("/patients", response_model=PatientListResponse)
+async def get_patients(
+    page: int = Query(1, ge=1),
+    limit: int = Query(20, ge=1, le=100),
+    search: Optional[str] = Query(None),
+    source: Optional[str] = Query(None),  # Filter by patient source
+    patient_status: Optional[str] = Query(None),   # Filter by patient status
+    doctor_id: Optional[str] = Query(None), # Filter by assigned doctor
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get patients with filtering options"""
+    skip = (page - 1) * limit
+    user_id = current_user["_id"]
+    
+    # Debug logging
+    logger.info(f"🔍 Getting patients for user: {current_user.get('email')} with roles: {current_user.get('roles', [])}")
+    
+    # Build filter query
+    filter_query = {}
+    
+    # Role-based access - apply this first
+    if 'admin' not in current_user.get('roles', []):
+        if 'doctor' in current_user.get('roles', []):
+            # Doctors can see all patients for now (temporarily simplified)
+            logger.info("👨‍⚕️ Doctor access - no restrictions applied")
+            pass  # No restrictions for doctors
+        else:
+            # Patients can only see their own record
+            logger.info(f"👤 Patient access - restricting to own record: {user_id}")
+            filter_query["_id"] = ObjectId(user_id)
+    
+    # Build additional filters
+    additional_filters = {}
+    
+    # Add search filter
+    if search:
+        additional_filters["$or"] = [
+            {"full_name": {"$regex": search, "$options": "i"}},
+            {"national_id": {"$regex": search, "$options": "i"}},
+            {"ehr_id": {"$regex": search, "$options": "i"}}
+        ]
+    
+    # Add source filter
+    if source:
+        additional_filters["source"] = source
+    
+    # Add status filter
+    if patient_status:
+        additional_filters["status"] = patient_status
+    
+    # Add doctor assignment filter
+    if doctor_id:
+        additional_filters["assigned_doctor_id"] = ObjectId(doctor_id)
+    
+    # Combine filters
+    if additional_filters:
+        if filter_query.get("$or"):
+            # If we have role-based $or, we need to combine with additional filters
+            # Create a new $and condition
+            filter_query = {
+                "$and": [
+                    filter_query,
+                    additional_filters
+                ]
+            }
+        else:
+            # No role-based restrictions, just use additional filters
+            filter_query.update(additional_filters)
+    
+    logger.info(f"🔍 Final filter query: {filter_query}")
+    
+    try:
+        # Get total count
+        total = await patients_collection.count_documents(filter_query)
+        logger.info(f"📊 Total patients matching filter: {total}")
+        
+        # Get patients with pagination
+        patients_cursor = patients_collection.find(filter_query).skip(skip).limit(limit)
+        patients = await patients_cursor.to_list(length=limit)
+        logger.info(f"📋 Retrieved {len(patients)} patients")
+        
+        # Process patients to include doctor names and format dates
+        processed_patients = []
+        for patient in patients:
+            # Get assigned doctor name if exists
+            assigned_doctor_name = None
+            if patient.get("assigned_doctor_id"):
+                doctor = await db_client.users.find_one({"_id": patient["assigned_doctor_id"]})
+                if doctor:
+                    assigned_doctor_name = doctor.get("full_name")
+            
+            # Convert ObjectId to string
+            patient["id"] = str(patient["_id"])
+            del patient["_id"]
+            
+            # Add assigned doctor name
+            patient["assigned_doctor_name"] = assigned_doctor_name
+            
+            processed_patients.append(patient)
+        
+        logger.info(f"✅ Returning {len(processed_patients)} processed patients")
+        
+        return PatientListResponse(
+            patients=processed_patients,
+            total=total,
+            page=page,
+            limit=limit,
+            source_filter=source,
+            status_filter=patient_status
+        )
+        
+    except Exception as e:
+        logger.error(f"❌ Error fetching patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error fetching patients: {str(e)}"
+        )
+
+@router.get("/patients/{patient_id}", response_model=dict)
+async def get_patient(patient_id: str):
+    logger.info(f"Retrieving patient: {patient_id}")
+    try:
+        patient = await patients_collection.find_one({
+            "$or": [
+                {"_id": ObjectId(patient_id)},
+                {"fhir_id": patient_id}
+            ]
+        })
+        
+        if not patient:
+            logger.warning(f"Patient not found: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        response = {
+            "demographics": {
+                "id": str(patient["_id"]),
+                "fhir_id": patient.get("fhir_id"),
+                "full_name": patient.get("full_name"),
+                "gender": patient.get("gender"),
+                "date_of_birth": patient.get("date_of_birth"),
+                "age": calculate_age(patient.get("date_of_birth")),
+                "address": {
+                    "line": patient.get("address"),
+                    "city": patient.get("city"),
+                    "state": patient.get("state"),
+                    "postal_code": patient.get("postal_code"),
+                    "country": patient.get("country")
+                },
+                "marital_status": patient.get("marital_status"),
+                "language": patient.get("language")
+            },
+            "clinical_data": {
+                "notes": patient.get("notes", []),
+                "conditions": patient.get("conditions", []),
+                "medications": patient.get("medications", []),
+                "encounters": patient.get("encounters", [])
+            },
+            "metadata": {
+                "source": patient.get("source"),
+                "import_date": patient.get("import_date"),
+                "last_updated": patient.get("last_updated")
+            }
+        }
+        
+        logger.info(f"Successfully retrieved patient: {patient_id}")
+        return response
+        
+    except ValueError as ve:
+        logger.error(f"Invalid patient ID format: {patient_id}, error: {str(ve)}")
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient ID format"
+        )
+    except Exception as e:
+        logger.error(f"Failed to retrieve patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to retrieve patient: {str(e)}"
+        )
+
+@router.post("/{patient_id}/notes", status_code=status.HTTP_201_CREATED)
+async def add_note(
+    patient_id: str,
+    note: Note,
+    current_user: dict = Depends(get_current_user)
+):
+    logger.info(f"Adding note for patient {patient_id} by user {current_user.get('email')}")
+    if current_user.get('role') not in ['doctor', 'admin']:
+        logger.warning(f"Unauthorized note addition attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only clinicians can add notes"
+        )
+    
+    try:
+        note_data = note.dict()
+        note_data.update({
+            "author": current_user.get('full_name', 'System'),
+            "timestamp": datetime.utcnow().isoformat()
+        })
+        
+        result = await patients_collection.update_one(
+            {"$or": [
+                {"_id": ObjectId(patient_id)},
+                {"fhir_id": patient_id}
+            ]},
+            {
+                "$push": {"notes": note_data},
+                "$set": {"last_updated": datetime.utcnow().isoformat()}
+            }
+        )
+        
+        if result.modified_count == 0:
+            logger.warning(f"Patient not found for note addition: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        logger.info(f"Note added successfully for patient {patient_id}")
+        return {"status": "success", "message": "Note added"}
+        
+    except ValueError as ve:
+        logger.error(f"Invalid patient ID format: {patient_id}, error: {str(ve)}")
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient ID format"
+        )
+    except Exception as e:
+        logger.error(f"Failed to add note for patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to add note: {str(e)}"
+        )
+
+@router.put("/patients/{patient_id}", status_code=status.HTTP_200_OK)
+async def update_patient(
+    patient_id: str,
+    update_data: PatientUpdate,
+    current_user: dict = Depends(get_current_user)
+):
+    """Update a patient's record in the database"""
+    logger.info(f"Updating patient {patient_id} by user {current_user.get('email')}")
+    
+    if not any(role in current_user.get('roles', []) for role in ['admin', 'doctor']):
+        logger.warning(f"Unauthorized update attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators and doctors can update patients"
+        )
+    
+    try:
+        # Build the query based on whether patient_id is a valid ObjectId
+        query = {"fhir_id": patient_id}
+        if ObjectId.is_valid(patient_id):
+            query = {
+                "$or": [
+                    {"_id": ObjectId(patient_id)},
+                    {"fhir_id": patient_id}
+                ]
+            }
+        
+        # Check if patient exists
+        patient = await patients_collection.find_one(query)
+        if not patient:
+            logger.warning(f"Patient not found for update: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        # Prepare update operations
+        update_ops = {"$set": {"last_updated": datetime.utcnow().isoformat()}}
+        
+        # Handle demographic updates
+        demographics = {
+            "full_name": update_data.full_name,
+            "gender": update_data.gender,
+            "date_of_birth": update_data.date_of_birth,
+            "address": update_data.address,
+            "city": update_data.city,
+            "state": update_data.state,
+            "postal_code": update_data.postal_code,
+            "country": update_data.country,
+            "marital_status": update_data.marital_status,
+            "language": update_data.language
+        }
+        for key, value in demographics.items():
+            if value is not None:
+                update_ops["$set"][key] = value
+        
+        # Handle array updates (conditions, medications, encounters, notes)
+        array_fields = {
+            "conditions": update_data.conditions,
+            "medications": update_data.medications,
+            "encounters": update_data.encounters,
+            "notes": update_data.notes
+        }
+        
+        for field, items in array_fields.items():
+            if items is not None:
+                # Fetch existing items
+                existing_items = patient.get(field, [])
+                updated_items = []
+                
+                for item in items:
+                    item_dict = item.dict(exclude_unset=True)
+                    if not item_dict:
+                        continue
+                    
+                    # Generate ID for new items
+                    if not item_dict.get("id"):
+                        item_dict["id"] = str(uuid.uuid4())
+                    
+                    # Validate required fields
+                    if field == "conditions" and not item_dict.get("code"):
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Condition code is required for {field}"
+                        )
+                    if field == "medications" and not item_dict.get("name"):
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Medication name is required for {field}"
+                        )
+                    if field == "encounters" and not item_dict.get("type"):
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Encounter type is required for {field}"
+                        )
+                    if field == "notes" and not item_dict.get("content"):
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Note content is required for {field}"
+                        )
+                    
+                    updated_items.append(item_dict)
+                
+                # Replace the entire array
+                update_ops["$set"][field] = updated_items
+        
+        # Perform the update
+        result = await patients_collection.update_one(query, update_ops)
+        
+        if result.modified_count == 0 and result.matched_count == 0:
+            logger.warning(f"Patient not found for update: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        # Retrieve and return the updated patient
+        updated_patient = await patients_collection.find_one(query)
+        if not updated_patient:
+            logger.error(f"Failed to retrieve updated patient: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Failed to retrieve updated patient"
+            )
+        
+        response = {
+            "id": str(updated_patient["_id"]),
+            "fhir_id": updated_patient.get("fhir_id"),
+            "full_name": updated_patient.get("full_name"),
+            "gender": updated_patient.get("gender"),
+            "date_of_birth": updated_patient.get("date_of_birth"),
+            "address": updated_patient.get("address"),
+            "city": updated_patient.get("city"),
+            "state": updated_patient.get("state"),
+            "postal_code": updated_patient.get("postal_code"),
+            "country": updated_patient.get("country"),
+            "marital_status": updated_patient.get("marital_status"),
+            "language": updated_patient.get("language"),
+            "conditions": updated_patient.get("conditions", []),
+            "medications": updated_patient.get("medications", []),
+            "encounters": updated_patient.get("encounters", []),
+            "notes": updated_patient.get("notes", []),
+            "source": updated_patient.get("source"),
+            "import_date": updated_patient.get("import_date"),
+            "last_updated": updated_patient.get("last_updated")
+        }
+        
+        logger.info(f"Successfully updated patient {patient_id}")
+        return response
+        
+    except ValueError as ve:
+        logger.error(f"Invalid patient ID format: {patient_id}, error: {str(ve)}")
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient ID format"
+        )
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to update patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to update patient: {str(e)}"
+        )
+
+# FHIR Integration Endpoints
+@router.post("/patients/import-hapi-fhir", status_code=status.HTTP_201_CREATED)
+async def import_hapi_patients(
+    limit: int = Query(20, ge=1, le=100, description="Number of patients to import"),
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Import patients from HAPI FHIR Test Server
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        result = await service.import_patients_from_hapi(limit=limit)
+        
+        # Create detailed message
+        message_parts = []
+        if result["imported_count"] > 0:
+            message_parts.append(f"Successfully imported {result['imported_count']} patients")
+        if result["skipped_count"] > 0:
+            message_parts.append(f"Skipped {result['skipped_count']} duplicate patients")
+        if result["errors"]:
+            message_parts.append(f"Encountered {len(result['errors'])} errors")
+        
+        message = ". ".join(message_parts) + " from HAPI FHIR"
+        
+        return {
+            "message": message,
+            "imported_count": result["imported_count"],
+            "skipped_count": result["skipped_count"],
+            "total_found": result["total_found"],
+            "imported_patients": result["imported_patients"],
+            "skipped_patients": result["skipped_patients"],
+            "errors": result["errors"],
+            "source": "hapi_fhir"
+        }
+        
+    except Exception as e:
+        logger.error(f"Error importing HAPI FHIR patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to import patients from HAPI FHIR: {str(e)}"
+        )
+
+@router.post("/patients/sync-patient/{patient_id}")
+async def sync_patient_data(
+    patient_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Sync a specific patient's data from HAPI FHIR
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        success = await service.sync_patient_data(patient_id)
+        
+        if success:
+            return {
+                "message": f"Successfully synced patient {patient_id} from HAPI FHIR",
+                "patient_id": patient_id,
+                "success": True
+            }
+        else:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail=f"Patient {patient_id} not found in HAPI FHIR or sync failed"
+            )
+            
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Error syncing patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to sync patient: {str(e)}"
+        )
+
+@router.get("/patients/hapi-fhir/patients")
+async def get_hapi_patients(
+    limit: int = Query(50, ge=1, le=200, description="Number of patients to fetch"),
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Get patients from HAPI FHIR without importing them
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        patients = await service.get_hapi_patients(limit=limit)
+        
+        return {
+            "patients": patients,
+            "count": len(patients),
+            "source": "hapi_fhir"
+        }
+        
+    except Exception as e:
+        logger.error(f"Error fetching HAPI FHIR patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to fetch patients from HAPI FHIR: {str(e)}"
+        )
+
+@router.get("/patients/hapi-fhir/patients/{patient_id}")
+async def get_hapi_patient_details(
+    patient_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Get detailed information for a specific HAPI FHIR patient
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        patient_details = await service.get_hapi_patient_details(patient_id)
+        
+        if not patient_details:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail=f"Patient {patient_id} not found in HAPI FHIR"
+            )
+        
+        return patient_details
+        
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Error fetching HAPI FHIR patient details: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to fetch patient details from HAPI FHIR: {str(e)}"
+        )
+
+@router.get("/patients/hapi-fhir/statistics")
+async def get_hapi_statistics(
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Get statistics about HAPI FHIR imported patients
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        stats = await service.get_patient_statistics()
+        
+        return {
+            "statistics": stats,
+            "source": "hapi_fhir"
+        }
+        
+    except Exception as e:
+        logger.error(f"Error getting HAPI FHIR statistics: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to get HAPI FHIR statistics: {str(e)}"
+        )
+
+# Export the router as 'patients' for api.__init__.py
+patients = router

deployment/routes/pdf.py

@@ -0,0 +1,268 @@
+from fastapi import APIRouter, HTTPException, Depends, Response
+from db.mongo import patients_collection
+from core.security import get_current_user
+from utils.helpers import calculate_age, escape_latex_special_chars, hyphenate_long_strings, format_timestamp
+from datetime import datetime
+from bson import ObjectId
+from bson.errors import InvalidId
+import os
+import subprocess
+from tempfile import TemporaryDirectory
+from string import Template
+import logging
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(name)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+@router.get("/{patient_id}/pdf", response_class=Response)
+async def generate_patient_pdf(patient_id: str, current_user: dict = Depends(get_current_user)):
+    # Suppress logging for this route
+    logger.setLevel(logging.CRITICAL)
+
+    try:
+        if current_user.get('role') not in ['doctor', 'admin']:
+            raise HTTPException(status_code=403, detail="Only clinicians can generate patient PDFs")
+
+        # Determine if patient_id is ObjectId or fhir_id
+        try:
+            obj_id = ObjectId(patient_id)
+            query = {"$or": [{"_id": obj_id}, {"fhir_id": patient_id}]}
+        except InvalidId:
+            query = {"fhir_id": patient_id}
+
+        patient = await patients_collection.find_one(query)
+        if not patient:
+            raise HTTPException(status_code=404, detail="Patient not found")
+
+        # Prepare table content with proper LaTeX formatting
+        def prepare_table_content(items, columns, default_message):
+            if not items:
+                return f"\\multicolumn{{{columns}}}{{l}}{{{default_message}}} \\\\"
+            
+            content = []
+            for item in items:
+                row = []
+                for field in item:
+                    value = item.get(field, "") or ""
+                    row.append(escape_latex_special_chars(hyphenate_long_strings(value)))
+                content.append(" & ".join(row) + " \\\\")
+            return "\n".join(content)
+
+        # Notes table
+        notes = patient.get("notes", [])
+        notes_content = prepare_table_content(
+            [{
+                "date": format_timestamp(n.get("date", "")),
+                "type": n.get("type", ""),
+                "text": n.get("text", "")
+            } for n in notes],
+            3,
+            "No notes available"
+        )
+
+        # Conditions table
+        conditions = patient.get("conditions", [])
+        conditions_content = prepare_table_content(
+            [{
+                "id": c.get("id", ""),
+                "code": c.get("code", ""),
+                "status": c.get("status", ""),
+                "onset": format_timestamp(c.get("onset_date", "")),
+                "verification": c.get("verification_status", "")
+            } for c in conditions],
+            5,
+            "No conditions available"
+        )
+
+        # Medications table
+        medications = patient.get("medications", [])
+        medications_content = prepare_table_content(
+            [{
+                "id": m.get("id", ""),
+                "name": m.get("name", ""),
+                "status": m.get("status", ""),
+                "date": format_timestamp(m.get("prescribed_date", "")),
+                "dosage": m.get("dosage", "")
+            } for m in medications],
+            5,
+            "No medications available"
+        )
+
+        # Encounters table
+        encounters = patient.get("encounters", [])
+        encounters_content = prepare_table_content(
+            [{
+                "id": e.get("id", ""),
+                "type": e.get("type", ""),
+                "status": e.get("status", ""),
+                "start": format_timestamp(e.get("period", {}).get("start", "")),
+                "provider": e.get("service_provider", "")
+            } for e in encounters],
+            5,
+            "No encounters available"
+        )
+
+        # LaTeX template with improved table formatting
+        latex_template = Template(r"""
+\documentclass[a4paper,12pt]{article}
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage{geometry}
+\geometry{margin=1in}
+\usepackage{booktabs,longtable,fancyhdr}
+\usepackage{array}
+\usepackage{microtype}
+\microtypesetup{expansion=false}
+\setlength{\headheight}{14.5pt}
+\pagestyle{fancy}
+\fancyhf{}
+\fancyhead[L]{Patient Report}
+\fancyhead[R]{Generated: \today}
+\fancyfoot[C]{\thepage}
+\begin{document}
+\begin{center}
+    \Large\textbf{Patient Medical Report} \\
+    \vspace{0.2cm}
+    \textit{Generated on $generated_on}
+\end{center}
+\section*{Demographics}
+\begin{itemize}
+    \item \textbf{FHIR ID:} $fhir_id
+    \item \textbf{Full Name:} $full_name
+    \item \textbf{Gender:} $gender
+    \item \textbf{Date of Birth:} $dob
+    \item \textbf{Age:} $age
+    \item \textbf{Address:} $address
+    \item \textbf{Marital Status:} $marital_status
+    \item \textbf{Language:} $language
+\end{itemize}
+\section*{Clinical Notes}
+\begin{longtable}[l]{>{\raggedright\arraybackslash}p{3.5cm}>{\raggedright\arraybackslash}p{3cm}>{\raggedright\arraybackslash}p{6.5cm}}
+\caption{Clinical Notes} \\
+\toprule
+\textbf{Date} & \textbf{Type} & \textbf{Text} \\
+\midrule
+$notes
+\bottomrule
+\end{longtable}
+\section*{Conditions}
+\begin{longtable}[l]{>{\raggedright\arraybackslash}p{2cm}>{\raggedright\arraybackslash}p{3cm}>{\raggedright\arraybackslash}p{2cm}>{\raggedright\arraybackslash}p{3.5cm}>{\raggedright\arraybackslash}p{3cm}}
+\caption{Conditions} \\
+\toprule
+\textbf{ID} & \textbf{Code} & \textbf{Status} & \textbf{Onset} & \textbf{Verification} \\
+\midrule
+$conditions
+\bottomrule
+\end{longtable}
+\section*{Medications}
+\begin{longtable}[l]{>{\raggedright\arraybackslash}p{2cm}>{\raggedright\arraybackslash}p{4cm}>{\raggedright\arraybackslash}p{2cm}>{\raggedright\arraybackslash}p{3.5cm}>{\raggedright\arraybackslash}p{3cm}}
+\caption{Medications} \\
+\toprule
+\textbf{ID} & \textbf{Name} & \textbf{Status} & \textbf{Date} & \textbf{Dosage} \\
+\midrule
+$medications
+\bottomrule
+\end{longtable}
+\section*{Encounters}
+\begin{longtable}[l]{>{\raggedright\arraybackslash}p{2.5cm}>{\raggedright\arraybackslash}p{4.5cm}>{\raggedright\arraybackslash}p{2.5cm}>{\raggedright\arraybackslash}p{4.5cm}>{\raggedright\arraybackslash}p{3.5cm}}
+\caption{Encounters} \\
+\toprule
+\textbf{ID} & \textbf{Type} & \textbf{Status} & \textbf{Start} & \textbf{Provider} \\
+\midrule
+$encounters
+\bottomrule
+\end{longtable}
+\end{document}
+""")
+
+        # Set the generated_on date to 02:54 PM CET, May 17, 2025
+        generated_on = datetime.strptime("2025-05-17 14:54:00+02:00", "%Y-%m-%d %H:%M:%S%z").strftime("%A, %B %d, %Y at %I:%M %p %Z")
+
+        latex_filled = latex_template.substitute(
+            generated_on=generated_on,
+            fhir_id=escape_latex_special_chars(hyphenate_long_strings(patient.get("fhir_id", "") or "")),
+            full_name=escape_latex_special_chars(patient.get("full_name", "") or ""),
+            gender=escape_latex_special_chars(patient.get("gender", "") or ""),
+            dob=escape_latex_special_chars(patient.get("date_of_birth", "") or ""),
+            age=escape_latex_special_chars(str(calculate_age(patient.get("date_of_birth", "")) or "N/A")),
+            address=escape_latex_special_chars(", ".join(filter(None, [
+                patient.get("address", ""),
+                patient.get("city", ""),
+                patient.get("state", ""),
+                patient.get("postal_code", ""),
+                patient.get("country", "")
+            ]))),
+            marital_status=escape_latex_special_chars(patient.get("marital_status", "") or ""),
+            language=escape_latex_special_chars(patient.get("language", "") or ""),
+            notes=notes_content,
+            conditions=conditions_content,
+            medications=medications_content,
+            encounters=encounters_content
+        )
+
+        # Compile LaTeX in a temporary directory
+        with TemporaryDirectory() as tmpdir:
+            tex_path = os.path.join(tmpdir, "report.tex")
+            pdf_path = os.path.join(tmpdir, "report.pdf")
+
+            with open(tex_path, "w", encoding="utf-8") as f:
+                f.write(latex_filled)
+
+            try:
+                # Run latexmk twice to ensure proper table rendering
+                for _ in range(2):
+                    result = subprocess.run(
+                        ["latexmk", "-pdf", "-interaction=nonstopmode", tex_path],
+                        cwd=tmpdir,
+                        check=False,
+                        capture_output=True,
+                        text=True
+                    )
+                
+                if result.returncode != 0:
+                    raise HTTPException(
+                        status_code=500,
+                        detail=f"LaTeX compilation failed: stdout={result.stdout}, stderr={result.stderr}"
+                    )
+
+            except subprocess.CalledProcessError as e:
+                raise HTTPException(
+                    status_code=500,
+                    detail=f"LaTeX compilation failed: stdout={e.stdout}, stderr={e.stderr}"
+                )
+
+            if not os.path.exists(pdf_path):
+                raise HTTPException(
+                    status_code=500,
+                    detail="PDF file was not generated"
+                )
+
+            with open(pdf_path, "rb") as f:
+                pdf_bytes = f.read()
+
+            response = Response(
+                content=pdf_bytes,
+                media_type="application/pdf",
+                headers={"Content-Disposition": f"attachment; filename=patient_{patient.get('fhir_id', 'unknown')}_report.pdf"}
+            )
+            return response
+
+    except HTTPException as http_error:
+        raise http_error
+    except Exception as e:
+        raise HTTPException(
+            status_code=500,
+            detail=f"Unexpected error generating PDF: {str(e)}"
+        )
+    finally:
+        # Restore the logger level for other routes
+        logger.setLevel(logging.INFO)
+
+# Export the router as 'pdf' for api.__init__.py
+pdf = router

deployment/routes/txagent.py

@@ -0,0 +1,170 @@
+from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Form
+from fastapi.responses import StreamingResponse
+from typing import Optional, List
+from pydantic import BaseModel
+from core.security import get_current_user
+from api.services.txagent_service import txagent_service
+import logging
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+class ChatRequest(BaseModel):
+    message: str
+    history: Optional[List[dict]] = None
+    patient_id: Optional[str] = None
+
+class VoiceOutputRequest(BaseModel):
+    text: str
+    language: str = "en-US"
+
+@router.get("/txagent/status")
+async def get_txagent_status(current_user: dict = Depends(get_current_user)):
+    """Obtient le statut du service TxAgent"""
+    try:
+        status = await txagent_service.get_status()
+        return {
+            "status": "success",
+            "txagent_status": status,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error getting TxAgent status: {e}")
+        raise HTTPException(status_code=500, detail="Failed to get TxAgent status")
+
+@router.post("/txagent/chat")
+async def chat_with_txagent(
+    request: ChatRequest,
+    current_user: dict = Depends(get_current_user)
+):
+    """Chat avec TxAgent"""
+    try:
+        # Vérifier que l'utilisateur est médecin ou admin
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can use TxAgent")
+        
+        response = await txagent_service.chat(
+            message=request.message,
+            history=request.history,
+            patient_id=request.patient_id
+        )
+        
+        return {
+            "status": "success",
+            "response": response,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error in TxAgent chat: {e}")
+        raise HTTPException(status_code=500, detail="Failed to process chat request")
+
+@router.post("/txagent/voice/transcribe")
+async def transcribe_audio(
+    audio: UploadFile = File(...),
+    current_user: dict = Depends(get_current_user)
+):
+    """Transcription vocale avec TxAgent"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can use voice features")
+        
+        audio_data = await audio.read()
+        result = await txagent_service.voice_transcribe(audio_data)
+        
+        return {
+            "status": "success",
+            "transcription": result,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error in voice transcription: {e}")
+        raise HTTPException(status_code=500, detail="Failed to transcribe audio")
+
+@router.post("/txagent/voice/synthesize")
+async def synthesize_speech(
+    request: VoiceOutputRequest,
+    current_user: dict = Depends(get_current_user)
+):
+    """Synthèse vocale avec TxAgent"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can use voice features")
+        
+        audio_data = await txagent_service.voice_synthesize(
+            text=request.text,
+            language=request.language
+        )
+        
+        return StreamingResponse(
+            iter([audio_data]),
+            media_type="audio/mpeg",
+            headers={
+                "Content-Disposition": "attachment; filename=synthesized_speech.mp3"
+            }
+        )
+    except Exception as e:
+        logger.error(f"Error in voice synthesis: {e}")
+        raise HTTPException(status_code=500, detail="Failed to synthesize speech")
+
+@router.post("/txagent/patients/analyze")
+async def analyze_patient_data(
+    patient_data: dict,
+    current_user: dict = Depends(get_current_user)
+):
+    """Analyse de données patient avec TxAgent"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can use analysis features")
+        
+        analysis = await txagent_service.analyze_patient(patient_data)
+        
+        return {
+            "status": "success",
+            "analysis": analysis,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error in patient analysis: {e}")
+        raise HTTPException(status_code=500, detail="Failed to analyze patient data")
+
+@router.get("/txagent/chats")
+async def get_chats(current_user: dict = Depends(get_current_user)):
+    """Obtient l'historique des chats"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can access chats")
+        
+        # Cette fonction devra être implémentée dans le service TxAgent
+        chats = await txagent_service.get_chats()
+        
+        return {
+            "status": "success",
+            "chats": chats,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error getting chats: {e}")
+        raise HTTPException(status_code=500, detail="Failed to get chats")
+
+@router.get("/txagent/patients/analysis-results")
+async def get_analysis_results(
+    risk_filter: Optional[str] = None,
+    current_user: dict = Depends(get_current_user)
+):
+    """Obtient les résultats d'analyse des patients"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can access analysis results")
+        
+        # Cette fonction devra être implémentée dans le service TxAgent
+        results = await txagent_service.get_analysis_results(risk_filter)
+        
+        return {
+            "status": "success",
+            "results": results,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error getting analysis results: {e}")
+        raise HTTPException(status_code=500, detail="Failed to get analysis results")

deployment/services/fhir_integration.py

@@ -0,0 +1,243 @@
+from datetime import datetime
+from typing import List, Dict, Optional
+from api.utils.fhir_client import HAPIFHIRClient
+from db.mongo import db
+
+class HAPIFHIRIntegrationService:
+    """
+    Service to integrate HAPI FHIR data with your existing database
+    """
+    
+    def __init__(self):
+        self.fhir_client = HAPIFHIRClient()
+    
+    async def import_patients_from_hapi(self, limit: int = 20) -> dict:
+        """
+        Import patients from HAPI FHIR Test Server with detailed feedback
+        """
+        try:
+            print(f"Fetching {limit} patients from HAPI FHIR...")
+            patients = self.fhir_client.get_patients(limit=limit)
+            
+            if not patients:
+                print("No patients found in HAPI FHIR")
+                return {
+                    "imported_count": 0,
+                    "skipped_count": 0,
+                    "total_found": 0,
+                    "imported_patients": [],
+                    "skipped_patients": [],
+                    "errors": []
+                }
+            
+            print(f"Found {len(patients)} patients, checking for duplicates...")
+            
+            imported_count = 0
+            skipped_count = 0
+            imported_patients = []
+            skipped_patients = []
+            errors = []
+            
+            for patient in patients:
+                try:
+                    # Check if patient already exists by multiple criteria
+                    existing = await db.patients.find_one({
+                        "$or": [
+                            {"fhir_id": patient['fhir_id']},
+                            {"full_name": patient['full_name'], "date_of_birth": patient['date_of_birth']},
+                            {"demographics.fhir_id": patient['fhir_id']}
+                        ]
+                    })
+                    
+                    if existing:
+                        skipped_count += 1
+                        skipped_patients.append(patient['full_name'])
+                        print(f"Patient {patient['full_name']} already exists (fhir_id: {patient['fhir_id']}), skipping...")
+                        continue
+                    
+                    # Enhance patient data with additional FHIR data
+                    enhanced_patient = await self._enhance_patient_data(patient)
+                    
+                    # Insert into database
+                    result = await db.patients.insert_one(enhanced_patient)
+                    
+                    if result.inserted_id:
+                        imported_count += 1
+                        imported_patients.append(patient['full_name'])
+                        print(f"Imported patient: {patient['full_name']} (ID: {result.inserted_id})")
+                    
+                except Exception as e:
+                    error_msg = f"Error importing patient {patient.get('full_name', 'Unknown')}: {e}"
+                    errors.append(error_msg)
+                    print(error_msg)
+                    continue
+            
+            print(f"Import completed: {imported_count} imported, {skipped_count} skipped")
+            
+            return {
+                "imported_count": imported_count,
+                "skipped_count": skipped_count,
+                "total_found": len(patients),
+                "imported_patients": imported_patients,
+                "skipped_patients": skipped_patients,
+                "errors": errors
+            }
+            
+        except Exception as e:
+            print(f"Error importing patients: {e}")
+            return {
+                "imported_count": 0,
+                "skipped_count": 0,
+                "total_found": 0,
+                "imported_patients": [],
+                "skipped_patients": [],
+                "errors": [str(e)]
+            }
+    
+    async def _enhance_patient_data(self, patient: Dict) -> Dict:
+        """
+        Enhance patient data with additional FHIR resources
+        """
+        try:
+            patient_id = patient['fhir_id']
+            
+            # Fetch additional data from HAPI FHIR
+            observations = self.fhir_client.get_patient_observations(patient_id)
+            medications = self.fhir_client.get_patient_medications(patient_id)
+            conditions = self.fhir_client.get_patient_conditions(patient_id)
+            
+            # Structure the enhanced patient data
+            enhanced_patient = {
+                # Basic demographics
+                **patient,
+                
+                # Clinical data
+                'demographics': {
+                    'id': patient['id'],
+                    'fhir_id': patient['fhir_id'],
+                    'full_name': patient['full_name'],
+                    'gender': patient['gender'],
+                    'date_of_birth': patient['date_of_birth'],
+                    'address': patient['address'],
+                    'phone': patient.get('phone', ''),
+                    'email': patient.get('email', ''),
+                    'marital_status': patient.get('marital_status', 'Unknown'),
+                    'language': patient.get('language', 'English')
+                },
+                
+                'clinical_data': {
+                    'observations': observations,
+                    'medications': medications,
+                    'conditions': conditions,
+                    'notes': [],  # Will be populated separately
+                    'encounters': []  # Will be populated separately
+                },
+                
+                'metadata': {
+                    'source': 'hapi_fhir',
+                    'import_date': datetime.now().isoformat(),
+                    'last_updated': datetime.now().isoformat(),
+                    'fhir_server': 'https://hapi.fhir.org/baseR4'
+                }
+            }
+            
+            return enhanced_patient
+            
+        except Exception as e:
+            print(f"Error enhancing patient data: {e}")
+            return patient
+    
+    async def sync_patient_data(self, patient_id: str) -> bool:
+        """
+        Sync a specific patient's data from HAPI FHIR
+        """
+        try:
+            # Get patient from HAPI FHIR
+            patient = self.fhir_client.get_patient_by_id(patient_id)
+            
+            if not patient:
+                print(f"Patient {patient_id} not found in HAPI FHIR")
+                return False
+            
+            # Enhance with additional data
+            enhanced_patient = await self._enhance_patient_data(patient)
+            
+            # Update in database
+            result = await db.patients.update_one(
+                {"fhir_id": patient_id},
+                {"$set": enhanced_patient},
+                upsert=True
+            )
+            
+            if result.modified_count > 0 or result.upserted_id:
+                print(f"Synced patient: {patient['full_name']}")
+                return True
+            else:
+                print(f"No changes for patient: {patient['full_name']}")
+                return False
+                
+        except Exception as e:
+            print(f"Error syncing patient {patient_id}: {e}")
+            return False
+    
+    async def get_patient_statistics(self) -> Dict:
+        """
+        Get statistics about imported patients
+        """
+        try:
+            total_patients = await db.patients.count_documents({})
+            hapi_patients = await db.patients.count_documents({"source": "hapi_fhir"})
+            
+            # Get sample patient data and convert ObjectId to string
+            sample_patient = await db.patients.find_one({"source": "hapi_fhir"})
+            if sample_patient:
+                # Convert ObjectId to string for JSON serialization
+                sample_patient['_id'] = str(sample_patient['_id'])
+            
+            stats = {
+                'total_patients': total_patients,
+                'hapi_fhir_patients': hapi_patients,
+                'sample_patient': sample_patient
+            }
+            
+            return stats
+            
+        except Exception as e:
+            print(f"Error getting statistics: {e}")
+            return {}
+    
+    async def get_hapi_patients(self, limit: int = 50) -> List[Dict]:
+        """
+        Get patients from HAPI FHIR without importing them
+        """
+        try:
+            patients = self.fhir_client.get_patients(limit=limit)
+            return patients
+        except Exception as e:
+            print(f"Error fetching HAPI patients: {e}")
+            return []
+    
+    async def get_hapi_patient_details(self, patient_id: str) -> Optional[Dict]:
+        """
+        Get detailed information for a specific HAPI FHIR patient
+        """
+        try:
+            patient = self.fhir_client.get_patient_by_id(patient_id)
+            if not patient:
+                return None
+            
+            # Get additional data
+            observations = self.fhir_client.get_patient_observations(patient_id)
+            medications = self.fhir_client.get_patient_medications(patient_id)
+            conditions = self.fhir_client.get_patient_conditions(patient_id)
+            
+            return {
+                'patient': patient,
+                'observations': observations,
+                'medications': medications,
+                'conditions': conditions
+            }
+            
+        except Exception as e:
+            print(f"Error fetching patient details: {e}")
+            return None 

deployment/services/txagent_service.py

@@ -0,0 +1,118 @@
+import aiohttp
+import asyncio
+import logging
+from typing import Optional, Dict, Any, List
+from core.txagent_config import txagent_config
+
+logger = logging.getLogger(__name__)
+
+class TxAgentService:
+    def __init__(self):
+        self.config = txagent_config
+        self.session = None
+    
+    async def _get_session(self):
+        """Obtient ou crée une session HTTP"""
+        if self.session is None:
+            self.session = aiohttp.ClientSession()
+        return self.session
+    
+    async def _make_request(self, endpoint: str, method: str = "GET", data: Optional[Dict] = None) -> Dict[str, Any]:
+        """Fait une requête vers le service TxAgent avec fallback"""
+        session = await self._get_session()
+        url = f"{self.config.get_txagent_url()}{endpoint}"
+        
+        try:
+            if method.upper() == "GET":
+                async with session.get(url) as response:
+                    return await response.json()
+            elif method.upper() == "POST":
+                async with session.post(url, json=data) as response:
+                    return await response.json()
+        except Exception as e:
+            logger.error(f"Error calling TxAgent service: {e}")
+            # Fallback vers cloud si local échoue
+            if self.config.get_txagent_mode() == "local":
+                logger.info("Falling back to cloud TxAgent service")
+                self.config.mode = "cloud"
+                return await self._make_request(endpoint, method, data)
+            else:
+                raise
+    
+    async def chat(self, message: str, history: Optional[list] = None, patient_id: Optional[str] = None) -> Dict[str, Any]:
+        """Service de chat avec TxAgent"""
+        data = {
+            "message": message,
+            "history": history or [],
+            "patient_id": patient_id
+        }
+        return await self._make_request("/chat", "POST", data)
+    
+    async def analyze_patient(self, patient_data: Dict[str, Any]) -> Dict[str, Any]:
+        """Analyse de données patient avec TxAgent"""
+        return await self._make_request("/patients/analyze", "POST", patient_data)
+    
+    async def voice_transcribe(self, audio_data: bytes) -> Dict[str, Any]:
+        """Transcription vocale avec TxAgent"""
+        session = await self._get_session()
+        url = f"{self.config.get_txagent_url()}/voice/transcribe"
+        
+        try:
+            form_data = aiohttp.FormData()
+            form_data.add_field('audio', audio_data, filename='audio.wav')
+            
+            async with session.post(url, data=form_data) as response:
+                return await response.json()
+        except Exception as e:
+            logger.error(f"Error in voice transcription: {e}")
+            if self.config.get_txagent_mode() == "local":
+                self.config.mode = "cloud"
+                return await self.voice_transcribe(audio_data)
+            else:
+                raise
+    
+    async def voice_synthesize(self, text: str, language: str = "en-US") -> bytes:
+        """Synthèse vocale avec TxAgent"""
+        session = await self._get_session()
+        url = f"{self.config.get_txagent_url()}/voice/synthesize"
+        
+        try:
+            data = {
+                "text": text,
+                "language": language,
+                "return_format": "mp3"
+            }
+            
+            async with session.post(url, json=data) as response:
+                return await response.read()
+        except Exception as e:
+            logger.error(f"Error in voice synthesis: {e}")
+            if self.config.get_txagent_mode() == "local":
+                self.config.mode = "cloud"
+                return await self.voice_synthesize(text, language)
+            else:
+                raise
+    
+    async def get_status(self) -> Dict[str, Any]:
+        """Obtient le statut du service TxAgent"""
+        return await self._make_request("/status")
+    
+    async def get_chats(self) -> List[Dict[str, Any]]:
+        """Obtient l'historique des chats"""
+        return await self._make_request("/chats")
+    
+    async def get_analysis_results(self, risk_filter: Optional[str] = None) -> List[Dict[str, Any]]:
+        """Obtient les résultats d'analyse des patients"""
+        params = {}
+        if risk_filter:
+            params["risk_filter"] = risk_filter
+        return await self._make_request("/patients/analysis-results", "GET", params)
+    
+    async def close(self):
+        """Ferme la session HTTP"""
+        if self.session:
+            await self.session.close()
+            self.session = None
+
+# Instance globale
+txagent_service = TxAgentService()

deployment/utils/fhir_client.py

@@ -0,0 +1,323 @@
+import requests
+import json
+from typing import List, Dict, Optional
+from datetime import datetime
+
+class HAPIFHIRClient:
+    """
+    Client for connecting to HAPI FHIR Test Server
+    """
+    
+    def __init__(self, base_url: str = "https://hapi.fhir.org/baseR4"):
+        self.base_url = base_url
+        self.session = requests.Session()
+        self.session.headers.update({
+            'Content-Type': 'application/fhir+json',
+            'Accept': 'application/fhir+json'
+        })
+    
+    def get_patients(self, limit: int = 50) -> List[Dict]:
+        """
+        Fetch patients from HAPI FHIR Test Server
+        """
+        try:
+            url = f"{self.base_url}/Patient"
+            params = {
+                '_count': limit,
+                '_format': 'json'
+            }
+            
+            response = self.session.get(url, params=params)
+            response.raise_for_status()
+            
+            data = response.json()
+            patients = []
+            
+            if 'entry' in data:
+                for entry in data['entry']:
+                    patient = self._parse_patient(entry['resource'])
+                    if patient:
+                        patients.append(patient)
+            
+            return patients
+            
+        except requests.RequestException as e:
+            print(f"Error fetching patients: {e}")
+            return []
+    
+    def get_patient_by_id(self, patient_id: str) -> Optional[Dict]:
+        """
+        Fetch a specific patient by ID
+        """
+        try:
+            url = f"{self.base_url}/Patient/{patient_id}"
+            response = self.session.get(url)
+            response.raise_for_status()
+            
+            patient_data = response.json()
+            return self._parse_patient(patient_data)
+            
+        except requests.RequestException as e:
+            print(f"Error fetching patient {patient_id}: {e}")
+            return None
+    
+    def get_patient_observations(self, patient_id: str) -> List[Dict]:
+        """
+        Fetch observations (vital signs, lab results) for a patient
+        """
+        try:
+            url = f"{self.base_url}/Observation"
+            params = {
+                'subject': f"Patient/{patient_id}",
+                '_count': 100,
+                '_format': 'json'
+            }
+            
+            response = self.session.get(url, params=params)
+            response.raise_for_status()
+            
+            data = response.json()
+            observations = []
+            
+            if 'entry' in data:
+                for entry in data['entry']:
+                    observation = self._parse_observation(entry['resource'])
+                    if observation:
+                        observations.append(observation)
+            
+            return observations
+            
+        except requests.RequestException as e:
+            print(f"Error fetching observations for patient {patient_id}: {e}")
+            return []
+    
+    def get_patient_medications(self, patient_id: str) -> List[Dict]:
+        """
+        Fetch medications for a patient
+        """
+        try:
+            url = f"{self.base_url}/MedicationRequest"
+            params = {
+                'subject': f"Patient/{patient_id}",
+                '_count': 100,
+                '_format': 'json'
+            }
+            
+            response = self.session.get(url, params=params)
+            response.raise_for_status()
+            
+            data = response.json()
+            medications = []
+            
+            if 'entry' in data:
+                for entry in data['entry']:
+                    medication = self._parse_medication(entry['resource'])
+                    if medication:
+                        medications.append(medication)
+            
+            return medications
+            
+        except requests.RequestException as e:
+            print(f"Error fetching medications for patient {patient_id}: {e}")
+            return []
+    
+    def get_patient_conditions(self, patient_id: str) -> List[Dict]:
+        """
+        Fetch conditions (diagnoses) for a patient
+        """
+        try:
+            url = f"{self.base_url}/Condition"
+            params = {
+                'subject': f"Patient/{patient_id}",
+                '_count': 100,
+                '_format': 'json'
+            }
+            
+            response = self.session.get(url, params=params)
+            response.raise_for_status()
+            
+            data = response.json()
+            conditions = []
+            
+            if 'entry' in data:
+                for entry in data['entry']:
+                    condition = self._parse_condition(entry['resource'])
+                    if condition:
+                        conditions.append(condition)
+            
+            return conditions
+            
+        except requests.RequestException as e:
+            print(f"Error fetching conditions for patient {patient_id}: {e}")
+            return []
+    
+    def _parse_patient(self, patient_data: Dict) -> Optional[Dict]:
+        """
+        Parse FHIR Patient resource into our format
+        """
+        try:
+            # Extract basic demographics
+            name = ""
+            if 'name' in patient_data and patient_data['name']:
+                name_parts = patient_data['name'][0]
+                given = name_parts.get('given', [])
+                family = name_parts.get('family', '')
+                name = f"{' '.join(given)} {family}".strip()
+            
+            # Extract address
+            address = ""
+            if 'address' in patient_data and patient_data['address']:
+                addr = patient_data['address'][0]
+                line = addr.get('line', [])
+                city = addr.get('city', '')
+                state = addr.get('state', '')
+                postal_code = addr.get('postalCode', '')
+                address = f"{', '.join(line)}, {city}, {state} {postal_code}".strip()
+            
+            # Extract contact info
+            phone = ""
+            email = ""
+            if 'telecom' in patient_data:
+                for telecom in patient_data['telecom']:
+                    if telecom.get('system') == 'phone':
+                        phone = telecom.get('value', '')
+                    elif telecom.get('system') == 'email':
+                        email = telecom.get('value', '')
+            
+            return {
+                'id': patient_data.get('id', ''),
+                'fhir_id': patient_data.get('id', ''),
+                'full_name': name,
+                'gender': patient_data.get('gender', 'unknown'),
+                'date_of_birth': patient_data.get('birthDate', ''),
+                'address': address,
+                'phone': phone,
+                'email': email,
+                'marital_status': self._get_marital_status(patient_data),
+                'language': self._get_language(patient_data),
+                'source': 'hapi_fhir',
+                'status': 'active',
+                'created_at': datetime.now().isoformat(),
+                'updated_at': datetime.now().isoformat()
+            }
+            
+        except Exception as e:
+            print(f"Error parsing patient data: {e}")
+            return None
+    
+    def _parse_observation(self, observation_data: Dict) -> Optional[Dict]:
+        """
+        Parse FHIR Observation resource
+        """
+        try:
+            code = observation_data.get('code', {})
+            coding = code.get('coding', [])
+            code_text = code.get('text', '')
+            
+            if coding:
+                code_text = coding[0].get('display', code_text)
+            
+            value = observation_data.get('valueQuantity', {})
+            unit = value.get('unit', '')
+            value_amount = value.get('value', '')
+            
+            return {
+                'id': observation_data.get('id', ''),
+                'code': code_text,
+                'value': f"{value_amount} {unit}".strip(),
+                'date': observation_data.get('effectiveDateTime', ''),
+                'category': self._get_observation_category(observation_data)
+            }
+            
+        except Exception as e:
+            print(f"Error parsing observation: {e}")
+            return None
+    
+    def _parse_medication(self, medication_data: Dict) -> Optional[Dict]:
+        """
+        Parse FHIR MedicationRequest resource
+        """
+        try:
+            medication = medication_data.get('medicationCodeableConcept', {})
+            coding = medication.get('coding', [])
+            name = medication.get('text', '')
+            
+            if coding:
+                name = coding[0].get('display', name)
+            
+            dosage = medication_data.get('dosageInstruction', [])
+            dosage_text = ""
+            if dosage:
+                dosage_text = dosage[0].get('text', '')
+            
+            return {
+                'id': medication_data.get('id', ''),
+                'name': name,
+                'dosage': dosage_text,
+                'status': medication_data.get('status', 'active'),
+                'prescribed_date': medication_data.get('authoredOn', ''),
+                'requester': self._get_practitioner_name(medication_data)
+            }
+            
+        except Exception as e:
+            print(f"Error parsing medication: {e}")
+            return None
+    
+    def _parse_condition(self, condition_data: Dict) -> Optional[Dict]:
+        """
+        Parse FHIR Condition resource
+        """
+        try:
+            code = condition_data.get('code', {})
+            coding = code.get('coding', [])
+            name = code.get('text', '')
+            
+            if coding:
+                name = coding[0].get('display', name)
+            
+            return {
+                'id': condition_data.get('id', ''),
+                'code': name,
+                'status': condition_data.get('clinicalStatus', {}).get('coding', [{}])[0].get('code', 'active'),
+                'onset_date': condition_data.get('onsetDateTime', ''),
+                'recorded_date': condition_data.get('recordedDate', ''),
+                'notes': condition_data.get('note', [{}])[0].get('text', '') if condition_data.get('note') else ''
+            }
+            
+        except Exception as e:
+            print(f"Error parsing condition: {e}")
+            return None
+    
+    def _get_marital_status(self, patient_data: Dict) -> str:
+        """Extract marital status from patient data"""
+        if 'maritalStatus' in patient_data:
+            coding = patient_data['maritalStatus'].get('coding', [])
+            if coding:
+                return coding[0].get('display', 'Unknown')
+        return 'Unknown'
+    
+    def _get_language(self, patient_data: Dict) -> str:
+        """Extract language from patient data"""
+        if 'communication' in patient_data and patient_data['communication']:
+            language = patient_data['communication'][0].get('language', {})
+            coding = language.get('coding', [])
+            if coding:
+                return coding[0].get('display', 'English')
+        return 'English'
+    
+    def _get_observation_category(self, observation_data: Dict) -> str:
+        """Extract observation category"""
+        category = observation_data.get('category', {})
+        coding = category.get('coding', [])
+        if coding:
+            return coding[0].get('display', 'Unknown')
+        return 'Unknown'
+    
+    def _get_practitioner_name(self, medication_data: Dict) -> str:
+        """Extract practitioner name from medication request"""
+        requester = medication_data.get('requester', {})
+        reference = requester.get('reference', '')
+        if reference.startswith('Practitioner/'):
+            # In a real implementation, you'd fetch the practitioner details
+            return 'Dr. Practitioner'
+        return 'Unknown' 

routes.py

@@ -0,0 +1 @@
+#

routes/appointments.py

@@ -0,0 +1,904 @@
+from fastapi import APIRouter, Depends, HTTPException, status, Query
+from typing import List, Optional
+from datetime import date, time, datetime, timedelta
+from bson import ObjectId
+from motor.motor_asyncio import AsyncIOMotorClient
+
+from core.security import get_current_user
+from db.mongo import db, patients_collection
+from models.schemas import (
+    AppointmentCreate, AppointmentUpdate, AppointmentResponse, AppointmentListResponse,
+    AppointmentStatus, AppointmentType, DoctorAvailabilityCreate, DoctorAvailabilityUpdate,
+    DoctorAvailabilityResponse, AvailableSlotsResponse, AppointmentSlot, DoctorListResponse
+)
+
+router = APIRouter(prefix="/appointments", tags=["appointments"])
+
+# --- HELPER FUNCTIONS ---
+def is_valid_object_id(id_str: str) -> bool:
+    try:
+        ObjectId(id_str)
+        return True
+    except:
+        return False
+
+def get_weekday_from_date(appointment_date: date) -> int:
+    """Convert date to weekday (0=Monday, 6=Sunday)"""
+    return appointment_date.weekday()
+
+def generate_time_slots(start_time: time, end_time: time, duration: int = 30) -> List[time]:
+    """Generate time slots between start and end time"""
+    slots = []
+    current_time = datetime.combine(date.today(), start_time)
+    end_datetime = datetime.combine(date.today(), end_time)
+    
+    while current_time < end_datetime:
+        slots.append(current_time.time())
+        current_time += timedelta(minutes=duration)
+    
+    return slots
+
+# --- PATIENT ASSIGNMENT ENDPOINT ---
+
+@router.post("/assign-patient", status_code=status.HTTP_200_OK)
+async def assign_patient_to_doctor(
+    patient_id: str,
+    doctor_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Manually assign a patient to a doctor"""
+    # Only doctors and admins can assign patients
+    if not (('doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor') or 
+            ('admin' in current_user.get('roles', []) or current_user.get('role') == 'admin')):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only doctors and admins can assign patients"
+        )
+    
+    # Validate ObjectIds
+    if not is_valid_object_id(patient_id) or not is_valid_object_id(doctor_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient_id or doctor_id"
+        )
+    
+    # Check if doctor exists and is a doctor
+    doctor = await db_client.users.find_one({"_id": ObjectId(doctor_id)})
+    if not doctor or (doctor.get('role') != 'doctor' and 'doctor' not in doctor.get('roles', [])):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Check if patient exists
+    patient = await db_client.users.find_one({"_id": ObjectId(patient_id)})
+    if not patient:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Patient not found"
+        )
+    
+    try:
+        # Check if patient already exists in patients collection
+        existing_patient = await patients_collection.find_one({
+            "fhir_id": patient.get("fhir_id") or str(patient["_id"])
+        })
+        
+        if existing_patient:
+            # Update existing patient to assign to this doctor
+            await patients_collection.update_one(
+                {"_id": existing_patient["_id"]},
+                {
+                    "$set": {
+                        "assigned_doctor_id": str(doctor_id),  # Convert to string
+                        "updated_at": datetime.now()
+                    }
+                }
+            )
+            message = f"Patient {patient.get('full_name', 'Unknown')} reassigned to doctor {doctor.get('full_name', 'Unknown')}"
+        else:
+            # Create new patient record in patients collection
+            patient_doc = {
+                "fhir_id": patient.get("fhir_id") or str(patient["_id"]),
+                "full_name": patient.get("full_name", ""),
+                "date_of_birth": patient.get("date_of_birth") or datetime.now().strftime('%Y-%m-%d'),  # Store as string
+                "gender": patient.get("gender") or "unknown",  # Provide default
+                "address": patient.get("address"),
+                "city": patient.get("city"),
+                "state": patient.get("state"),
+                "postal_code": patient.get("postal_code"),
+                "country": patient.get("country"),
+                "national_id": patient.get("national_id"),
+                "blood_type": patient.get("blood_type"),
+                "allergies": patient.get("allergies", []),
+                "chronic_conditions": patient.get("chronic_conditions", []),
+                "medications": patient.get("medications", []),
+                "emergency_contact_name": patient.get("emergency_contact_name"),
+                "emergency_contact_phone": patient.get("emergency_contact_phone"),
+                "insurance_provider": patient.get("insurance_provider"),
+                "insurance_policy_number": patient.get("insurance_policy_number"),
+                "notes": patient.get("notes", []),
+                "source": "manual",  # Manually assigned
+                "status": "active",
+                "assigned_doctor_id": str(doctor_id),  # Convert to string
+                "registration_date": datetime.now(),
+                "created_at": datetime.now(),
+                "updated_at": datetime.now()
+            }
+            await patients_collection.insert_one(patient_doc)
+            message = f"Patient {patient.get('full_name', 'Unknown')} assigned to doctor {doctor.get('full_name', 'Unknown')}"
+        
+        print(f"✅ {message}")
+        return {"message": message, "success": True}
+        
+    except Exception as e:
+        print(f"❌ Error assigning patient to doctor: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to assign patient to doctor: {str(e)}"
+        )
+
+# --- DOCTOR LIST ENDPOINT (MUST BE BEFORE PARAMETERIZED ROUTES) ---
+
+@router.get("/doctors", response_model=List[DoctorListResponse])
+async def get_doctors(
+    specialty: Optional[str] = Query(None),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get list of available doctors"""
+    # Build filter - handle both "role" (singular) and "roles" (array) fields
+    filter_query = {
+        "$or": [
+            {"roles": {"$in": ["doctor"]}},
+            {"role": "doctor"}
+        ]
+    }
+    if specialty:
+        filter_query["$and"] = [
+            {"$or": [{"roles": {"$in": ["doctor"]}}, {"role": "doctor"}]},
+            {"specialty": {"$regex": specialty, "$options": "i"}}
+        ]
+    
+    # Get doctors
+    cursor = db_client.users.find(filter_query)
+    doctors = await cursor.to_list(length=None)
+    
+    return [
+        DoctorListResponse(
+            id=str(doctor["_id"]),
+            full_name=doctor['full_name'],
+            specialty=doctor.get('specialty', ''),
+            license_number=doctor.get('license_number', ''),
+            email=doctor['email'],
+            phone=doctor.get('phone')
+        )
+        for doctor in doctors
+    ]
+
+# --- DOCTOR AVAILABILITY ENDPOINTS ---
+
+@router.post("/availability", response_model=DoctorAvailabilityResponse, status_code=status.HTTP_201_CREATED)
+async def create_doctor_availability(
+    availability_data: DoctorAvailabilityCreate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Create doctor availability"""
+    if (current_user.get('role') != 'doctor' and 'doctor' not in current_user.get('roles', [])) and 'admin' not in current_user.get('roles', []):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only doctors can set their availability"
+        )
+    
+    # Check if doctor exists
+    doctor = await db_client.users.find_one({"_id": ObjectId(availability_data.doctor_id)})
+    if not doctor:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Check if doctor is setting their own availability or admin is setting it
+    if (current_user.get('role') != 'admin' and 'admin' not in current_user.get('roles', [])) and availability_data.doctor_id != current_user["_id"]:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only set your own availability"
+        )
+    
+    # Check if availability already exists for this day
+    existing = await db_client.doctor_availability.find_one({
+        "doctor_id": ObjectId(availability_data.doctor_id),
+        "day_of_week": availability_data.day_of_week
+    })
+    
+    if existing:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Availability already exists for this day"
+        )
+    
+    # Create availability
+    availability_doc = {
+        "doctor_id": ObjectId(availability_data.doctor_id),
+        "day_of_week": availability_data.day_of_week,
+        "start_time": availability_data.start_time,
+        "end_time": availability_data.end_time,
+        "is_available": availability_data.is_available
+    }
+    
+    result = await db_client.doctor_availability.insert_one(availability_doc)
+    availability_doc["_id"] = result.inserted_id
+    
+    return DoctorAvailabilityResponse(
+        id=str(availability_doc["_id"]),
+        doctor_id=availability_data.doctor_id,
+        doctor_name=doctor['full_name'],
+        day_of_week=availability_doc["day_of_week"],
+        start_time=availability_doc["start_time"],
+        end_time=availability_doc["end_time"],
+        is_available=availability_doc["is_available"]
+    )
+
+@router.get("/availability/{doctor_id}", response_model=List[DoctorAvailabilityResponse])
+async def get_doctor_availability(
+    doctor_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get doctor availability"""
+    if not is_valid_object_id(doctor_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid doctor ID"
+        )
+    
+    # Check if doctor exists
+    doctor = await db_client.users.find_one({"_id": ObjectId(doctor_id)})
+    if not doctor:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Get availability
+    cursor = db_client.doctor_availability.find({"doctor_id": ObjectId(doctor_id)})
+    availabilities = await cursor.to_list(length=None)
+    
+    return [
+        DoctorAvailabilityResponse(
+            id=str(avail["_id"]),
+            doctor_id=doctor_id,
+            doctor_name=doctor['full_name'],
+            day_of_week=avail["day_of_week"],
+            start_time=avail["start_time"],
+            end_time=avail["end_time"],
+            is_available=avail["is_available"]
+        )
+        for avail in availabilities
+    ]
+
+# --- AVAILABLE SLOTS ENDPOINTS ---
+
+@router.get("/slots/{doctor_id}/{date}", response_model=AvailableSlotsResponse)
+async def get_available_slots(
+    doctor_id: str,
+    date: date,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get available appointment slots for a doctor on a specific date"""
+    if not is_valid_object_id(doctor_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid doctor ID"
+        )
+    
+    # Check if doctor exists
+    doctor = await db_client.users.find_one({"_id": ObjectId(doctor_id)})
+    if not doctor or (doctor.get('role') != 'doctor' and 'doctor' not in doctor.get('roles', [])):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Get doctor availability for this day
+    weekday = get_weekday_from_date(date)
+    availability = await db_client.doctor_availability.find_one({
+        "doctor_id": ObjectId(doctor_id),
+        "day_of_week": weekday,
+        "is_available": True
+    })
+    
+    if not availability:
+        return AvailableSlotsResponse(
+            doctor_id=doctor_id,
+            doctor_name=doctor['full_name'],
+            specialty=doctor.get('specialty', ''),
+            date=date,
+            slots=[]
+        )
+    
+    # Generate time slots
+    time_slots = generate_time_slots(availability["start_time"], availability["end_time"])
+    
+    # Get existing appointments for this date
+    existing_appointments = await db_client.appointments.find({
+        "doctor_id": ObjectId(doctor_id),
+        "date": date,
+        "status": {"$in": ["pending", "confirmed"]}
+    }).to_list(length=None)
+    
+    booked_times = {apt["time"] for apt in existing_appointments}
+    
+    # Create slot responses
+    slots = []
+    for slot_time in time_slots:
+        is_available = slot_time not in booked_times
+        appointment_id = None
+        if not is_available:
+            # Find the appointment ID for this slot
+            appointment = next((apt for apt in existing_appointments if apt["time"] == slot_time), None)
+            appointment_id = str(appointment["_id"]) if appointment else None
+        
+        slots.append(AppointmentSlot(
+            date=date,
+            time=slot_time,
+            is_available=is_available,
+            appointment_id=appointment_id
+        ))
+    
+    return AvailableSlotsResponse(
+        doctor_id=doctor_id,
+        doctor_name=doctor['full_name'],
+        specialty=doctor.get('specialty', ''),
+        date=date,
+        slots=slots
+    )
+
+# --- APPOINTMENT ENDPOINTS ---
+
+@router.post("/", response_model=AppointmentResponse, status_code=status.HTTP_201_CREATED)
+async def create_appointment(
+    appointment_data: AppointmentCreate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Create a new appointment"""
+    print(f"🔍 Creating appointment with data: {appointment_data}")
+    print(f"🔍 Current user: {current_user}")
+    # Check if user is a patient
+    if 'patient' not in current_user.get('roles', []) and current_user.get('role') != 'patient':
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only patients can create appointments"
+        )
+    
+    # Validate ObjectIds
+    if not is_valid_object_id(appointment_data.patient_id) or not is_valid_object_id(appointment_data.doctor_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient_id or doctor_id"
+        )
+    
+    # Check if patient exists and matches current user
+    patient = await db_client.users.find_one({"_id": ObjectId(appointment_data.patient_id)})
+    if not patient:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Patient not found"
+        )
+    
+    if patient['email'] != current_user['email']:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only create appointments for yourself"
+        )
+    
+    # Check if doctor exists and is a doctor
+    doctor = await db_client.users.find_one({"_id": ObjectId(appointment_data.doctor_id)})
+    if not doctor or (doctor.get('role') != 'doctor' and 'doctor' not in doctor.get('roles', [])):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Doctor not found"
+        )
+    
+    # Convert string date and time to proper objects
+    try:
+        appointment_date = datetime.strptime(appointment_data.date, '%Y-%m-%d').date()
+        appointment_time = datetime.strptime(appointment_data.time, '%H:%M:%S').time()
+        # Convert date to datetime for MongoDB compatibility
+        appointment_datetime = datetime.combine(appointment_date, appointment_time)
+    except ValueError:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid date or time format. Use YYYY-MM-DD for date and HH:MM:SS for time"
+        )
+    
+    # Check if appointment date is in the future
+    if appointment_datetime <= datetime.now():
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Appointment must be scheduled for a future date and time"
+        )
+    
+    # Check if slot is available
+    existing_appointment = await db_client.appointments.find_one({
+        "doctor_id": ObjectId(appointment_data.doctor_id),
+        "date": appointment_data.date,
+        "time": appointment_data.time,
+        "status": {"$in": ["pending", "confirmed"]}
+    })
+    
+    if existing_appointment:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="This time slot is already booked"
+        )
+    
+    # Create appointment
+    appointment_doc = {
+        "patient_id": ObjectId(appointment_data.patient_id),
+        "doctor_id": ObjectId(appointment_data.doctor_id),
+        "date": appointment_data.date,  # Store as string
+        "time": appointment_data.time,  # Store as string
+        "datetime": appointment_datetime,  # Store full datetime for easier querying
+        "type": appointment_data.type,
+        "status": AppointmentStatus.PENDING,
+        "reason": appointment_data.reason,
+        "notes": appointment_data.notes,
+        "duration": appointment_data.duration,
+        "created_at": datetime.now(),
+        "updated_at": datetime.now()
+    }
+    
+    result = await db_client.appointments.insert_one(appointment_doc)
+    appointment_doc["_id"] = result.inserted_id
+    
+    # If appointment is created with confirmed status, assign patient to doctor
+    if appointment_data.status == "confirmed":
+        try:
+            # Get patient details from users collection
+            patient = await db_client.users.find_one({"_id": ObjectId(appointment_data.patient_id)})
+            if patient:
+                # Check if patient already exists in patients collection
+                existing_patient = await patients_collection.find_one({
+                    "fhir_id": patient.get("fhir_id") or str(patient["_id"])
+                })
+                
+                if existing_patient:
+                    # Update existing patient to assign to this doctor
+                    await patients_collection.update_one(
+                        {"_id": existing_patient["_id"]},
+                        {
+                            "$set": {
+                                "assigned_doctor_id": str(appointment_data.doctor_id),  # Convert to string
+                                "updated_at": datetime.now()
+                            }
+                        }
+                    )
+                else:
+                    # Create new patient record in patients collection
+                    patient_doc = {
+                        "fhir_id": patient.get("fhir_id") or str(patient["_id"]),
+                        "full_name": patient.get("full_name", ""),
+                        "date_of_birth": patient.get("date_of_birth") or datetime.now().strftime('%Y-%m-%d'),  # Store as string
+                        "gender": patient.get("gender") or "unknown",  # Provide default
+                        "address": patient.get("address"),
+                        "city": patient.get("city"),
+                        "state": patient.get("state"),
+                        "postal_code": patient.get("postal_code"),
+                        "country": patient.get("country"),
+                        "national_id": patient.get("national_id"),
+                        "blood_type": patient.get("blood_type"),
+                        "allergies": patient.get("allergies", []),
+                        "chronic_conditions": patient.get("chronic_conditions", []),
+                        "medications": patient.get("medications", []),
+                        "emergency_contact_name": patient.get("emergency_contact_name"),
+                        "emergency_contact_phone": patient.get("emergency_contact_phone"),
+                        "insurance_provider": patient.get("insurance_provider"),
+                        "insurance_policy_number": patient.get("insurance_policy_number"),
+                        "notes": patient.get("notes", []),
+                        "source": "direct",  # Patient came through appointment booking
+                        "status": "active",
+                        "assigned_doctor_id": str(appointment_data.doctor_id),  # Convert to string
+                        "registration_date": datetime.now(),
+                        "created_at": datetime.now(),
+                        "updated_at": datetime.now()
+                    }
+                    await patients_collection.insert_one(patient_doc)
+                
+                print(f"✅ Patient {patient.get('full_name', 'Unknown')} assigned to doctor {appointment_data.doctor_id}")
+        except Exception as e:
+            print(f"⚠️ Warning: Failed to assign patient to doctor: {str(e)}")
+            # Don't fail the appointment creation if patient assignment fails
+    
+    # Return appointment with patient and doctor names
+    return AppointmentResponse(
+        id=str(appointment_doc["_id"]),
+        patient_id=appointment_data.patient_id,
+        doctor_id=appointment_data.doctor_id,
+        patient_name=patient['full_name'],
+        doctor_name=doctor['full_name'],
+        date=appointment_date,  # Convert back to date object
+        time=appointment_time,  # Convert back to time object
+        type=appointment_doc["type"],
+        status=appointment_doc["status"],
+        reason=appointment_doc["reason"],
+        notes=appointment_doc["notes"],
+        duration=appointment_doc["duration"],
+        created_at=appointment_doc["created_at"],
+        updated_at=appointment_doc["updated_at"]
+    )
+
+@router.get("/", response_model=AppointmentListResponse)
+async def get_appointments(
+    page: int = Query(1, ge=1),
+    limit: int = Query(10, ge=1, le=100),
+    status_filter: Optional[AppointmentStatus] = Query(None),
+    date_from: Optional[date] = Query(None),
+    date_to: Optional[date] = Query(None),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get appointments based on user role"""
+    skip = (page - 1) * limit
+    
+    # Build filter based on user role
+    if 'patient' in current_user.get('roles', []) or current_user.get('role') == 'patient':
+        # Patients see their own appointments
+        filter_query = {"patient_id": ObjectId(current_user["_id"])}
+    elif 'doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor':
+        # Doctors see appointments assigned to them
+        filter_query = {"doctor_id": ObjectId(current_user["_id"])}
+    elif 'admin' in current_user.get('roles', []) or current_user.get('role') == 'admin':
+        # Admins see all appointments
+        filter_query = {}
+    else:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Insufficient permissions"
+        )
+    
+    # Add status filter
+    if status_filter:
+        filter_query["status"] = status_filter
+    
+    # Add date range filter
+    if date_from or date_to:
+        date_filter = {}
+        if date_from:
+            date_filter["$gte"] = date_from
+        if date_to:
+            date_filter["$lte"] = date_to
+        filter_query["date"] = date_filter
+    
+    # Get appointments
+    cursor = db_client.appointments.find(filter_query).skip(skip).limit(limit).sort("date", -1)
+    appointments = await cursor.to_list(length=limit)
+    
+    print(f"🔍 Found {len(appointments)} appointments")
+    for i, apt in enumerate(appointments):
+        print(f"🔍 Appointment {i}: {apt}")
+    
+    # Get total count
+    total = await db_client.appointments.count_documents(filter_query)
+    
+    # Get patient and doctor names
+    appointment_responses = []
+    for apt in appointments:
+        patient = await db_client.users.find_one({"_id": apt["patient_id"]})
+        doctor = await db_client.users.find_one({"_id": apt["doctor_id"]})
+        
+        # Convert string date/time back to objects for response
+        apt_date = datetime.strptime(apt["date"], '%Y-%m-%d').date() if isinstance(apt["date"], str) else apt["date"]
+        apt_time = datetime.strptime(apt["time"], '%H:%M:%S').time() if isinstance(apt["time"], str) else apt["time"]
+        
+        appointment_responses.append(AppointmentResponse(
+            id=str(apt["_id"]),
+            patient_id=str(apt["patient_id"]),
+            doctor_id=str(apt["doctor_id"]),
+            patient_name=patient['full_name'] if patient else "Unknown Patient",
+            doctor_name=doctor['full_name'] if doctor else "Unknown Doctor",
+            date=apt_date,
+            time=apt_time,
+            type=apt.get("type", "consultation"),  # Default to consultation if missing
+            status=apt.get("status", "pending"),  # Default to pending if missing
+            reason=apt.get("reason"),
+            notes=apt.get("notes"),
+            duration=apt.get("duration", 30),
+            created_at=apt.get("created_at", datetime.now()),
+            updated_at=apt.get("updated_at", datetime.now())
+        ))
+    
+    return AppointmentListResponse(
+        appointments=appointment_responses,
+        total=total,
+        page=page,
+        limit=limit
+    )
+
+@router.get("/{appointment_id}", response_model=AppointmentResponse)
+async def get_appointment(
+    appointment_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get a specific appointment"""
+    if not is_valid_object_id(appointment_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid appointment ID"
+        )
+    
+    appointment = await db_client.appointments.find_one({"_id": ObjectId(appointment_id)})
+    if not appointment:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Appointment not found"
+        )
+    
+    # Check permissions
+    if 'patient' in current_user.get('roles', []) or current_user.get('role') == 'patient':
+        if appointment["patient_id"] != ObjectId(current_user["_id"]):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="You can only view your own appointments"
+            )
+    elif 'doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor':
+        if appointment["doctor_id"] != ObjectId(current_user["_id"]):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="You can only view appointments assigned to you"
+            )
+    elif (current_user.get('role') != 'admin' and 'admin' not in current_user.get('roles', [])):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Insufficient permissions"
+        )
+    
+    # Get patient and doctor names
+    patient = await db_client.users.find_one({"_id": appointment["patient_id"]})
+    doctor = await db_client.users.find_one({"_id": appointment["doctor_id"]})
+    
+    # Convert string date/time back to objects for response
+    apt_date = datetime.strptime(appointment["date"], '%Y-%m-%d').date() if isinstance(appointment["date"], str) else appointment["date"]
+    apt_time = datetime.strptime(appointment["time"], '%H:%M:%S').time() if isinstance(appointment["time"], str) else appointment["time"]
+    
+    return AppointmentResponse(
+        id=str(appointment["_id"]),
+        patient_id=str(appointment["patient_id"]),
+        doctor_id=str(appointment["doctor_id"]),
+        patient_name=patient['full_name'] if patient else "Unknown Patient",
+        doctor_name=doctor['full_name'] if doctor else "Unknown Doctor",
+        date=apt_date,
+        time=apt_time,
+        type=appointment.get("type", "consultation"),  # Default to consultation if missing
+        status=appointment.get("status", "pending"),  # Default to pending if missing
+        reason=appointment.get("reason"),
+        notes=appointment.get("notes"),
+        duration=appointment.get("duration", 30),
+        created_at=appointment.get("created_at", datetime.now()),
+        updated_at=appointment.get("updated_at", datetime.now())
+    )
+
+@router.put("/{appointment_id}", response_model=AppointmentResponse)
+async def update_appointment(
+    appointment_id: str,
+    appointment_data: AppointmentUpdate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Update an appointment"""
+    if not is_valid_object_id(appointment_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid appointment ID"
+        )
+    
+    appointment = await db_client.appointments.find_one({"_id": ObjectId(appointment_id)})
+    if not appointment:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Appointment not found"
+        )
+    
+    # Check permissions
+    can_update = False
+    if 'admin' in current_user.get('roles', []) or current_user.get('role') == 'admin':
+        can_update = True
+    elif 'doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor':
+        if appointment["doctor_id"] == ObjectId(current_user["_id"]):
+            can_update = True
+    elif 'patient' in current_user.get('roles', []) or current_user.get('role') == 'patient':
+        if appointment["patient_id"] == ObjectId(current_user["_id"]):
+            # Patients can only update certain fields
+            can_update = True
+    
+    if not can_update:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only update appointments you're involved with"
+        )
+    
+    # Build update data
+    update_data = {"updated_at": datetime.now()}
+    
+    if appointment_data.date is not None:
+        try:
+            # Store as string for MongoDB compatibility
+            update_data["date"] = appointment_data.date
+        except ValueError:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid date format. Use YYYY-MM-DD"
+            )
+    if appointment_data.time is not None:
+        try:
+            # Store as string for MongoDB compatibility
+            update_data["time"] = appointment_data.time
+        except ValueError:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid time format. Use HH:MM:SS"
+            )
+    if appointment_data.type is not None:
+        update_data["type"] = appointment_data.type
+    if appointment_data.reason is not None:
+        update_data["reason"] = appointment_data.reason
+    if appointment_data.notes is not None:
+        update_data["notes"] = appointment_data.notes
+    if appointment_data.duration is not None:
+        update_data["duration"] = appointment_data.duration
+    
+    # Only doctors and admins can update status
+    if appointment_data.status is not None and (('doctor' in current_user.get('roles', []) or current_user.get('role') == 'doctor') or ('admin' in current_user.get('roles', []) or current_user.get('role') == 'admin')):
+        update_data["status"] = appointment_data.status
+    
+    # Check for conflicts if date/time is being updated
+    if appointment_data.date is not None or appointment_data.time is not None:
+        new_date = update_data.get("date") or appointment["date"]
+        new_time = update_data.get("time") or appointment["time"]
+        
+        existing_appointment = await db_client.appointments.find_one({
+            "_id": {"$ne": ObjectId(appointment_id)},
+            "doctor_id": appointment["doctor_id"],
+            "date": new_date,
+            "time": new_time,
+            "status": {"$in": ["pending", "confirmed"]}
+        })
+        
+        if existing_appointment:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail="This time slot is already booked"
+            )
+    
+    # Update appointment
+    await db_client.appointments.update_one(
+        {"_id": ObjectId(appointment_id)},
+        {"$set": update_data}
+    )
+    
+    # If appointment status is being changed to confirmed, assign patient to doctor
+    if appointment_data.status == "confirmed":
+        try:
+            # Get patient details from users collection
+            patient = await db_client.users.find_one({"_id": appointment["patient_id"]})
+            if patient:
+                # Check if patient already exists in patients collection
+                existing_patient = await patients_collection.find_one({
+                    "fhir_id": patient.get("fhir_id") or str(patient["_id"])
+                })
+                
+                if existing_patient:
+                    # Update existing patient to assign to this doctor
+                    await patients_collection.update_one(
+                        {"_id": existing_patient["_id"]},
+                        {
+                            "$set": {
+                                "assigned_doctor_id": str(appointment["doctor_id"]),  # Convert to string
+                                "updated_at": datetime.now()
+                            }
+                        }
+                    )
+                else:
+                    # Create new patient record in patients collection
+                    patient_doc = {
+                        "fhir_id": patient.get("fhir_id") or str(patient["_id"]),
+                        "full_name": patient.get("full_name", ""),
+                        "date_of_birth": patient.get("date_of_birth") or datetime.now().strftime('%Y-%m-%d'),  # Store as string
+                        "gender": patient.get("gender") or "unknown",  # Provide default
+                        "address": patient.get("address"),
+                        "city": patient.get("city"),
+                        "state": patient.get("state"),
+                        "postal_code": patient.get("postal_code"),
+                        "country": patient.get("country"),
+                        "national_id": patient.get("national_id"),
+                        "blood_type": patient.get("blood_type"),
+                        "allergies": patient.get("allergies", []),
+                        "chronic_conditions": patient.get("chronic_conditions", []),
+                        "medications": patient.get("medications", []),
+                        "emergency_contact_name": patient.get("emergency_contact_name"),
+                        "emergency_contact_phone": patient.get("emergency_contact_phone"),
+                        "insurance_provider": patient.get("insurance_provider"),
+                        "insurance_policy_number": patient.get("insurance_policy_number"),
+                        "notes": patient.get("notes", []),
+                        "source": "direct",  # Patient came through appointment booking
+                        "status": "active",
+                        "assigned_doctor_id": str(appointment["doctor_id"]),  # Convert to string
+                        "registration_date": datetime.now(),
+                        "created_at": datetime.now(),
+                        "updated_at": datetime.now()
+                    }
+                    await patients_collection.insert_one(patient_doc)
+                
+                print(f"✅ Patient {patient.get('full_name', 'Unknown')} assigned to doctor {appointment['doctor_id']}")
+        except Exception as e:
+            print(f"⚠️ Warning: Failed to assign patient to doctor: {str(e)}")
+            # Don't fail the appointment update if patient assignment fails
+    
+    # Get updated appointment
+    updated_appointment = await db_client.appointments.find_one({"_id": ObjectId(appointment_id)})
+    
+    # Get patient and doctor names
+    patient = await db_client.users.find_one({"_id": updated_appointment["patient_id"]})
+    doctor = await db_client.users.find_one({"_id": updated_appointment["doctor_id"]})
+    
+    # Convert string date/time back to objects for response
+    apt_date = datetime.strptime(updated_appointment["date"], '%Y-%m-%d').date() if isinstance(updated_appointment["date"], str) else updated_appointment["date"]
+    apt_time = datetime.strptime(updated_appointment["time"], '%H:%M:%S').time() if isinstance(updated_appointment["time"], str) else updated_appointment["time"]
+    
+    return AppointmentResponse(
+        id=str(updated_appointment["_id"]),
+        patient_id=str(updated_appointment["patient_id"]),
+        doctor_id=str(updated_appointment["doctor_id"]),
+        patient_name=patient['full_name'] if patient else "Unknown Patient",
+        doctor_name=doctor['full_name'] if doctor else "Unknown Doctor",
+        date=apt_date,
+        time=apt_time,
+        type=updated_appointment.get("type", "consultation"),  # Default to consultation if missing
+        status=updated_appointment.get("status", "pending"),  # Default to pending if missing
+        reason=updated_appointment.get("reason"),
+        notes=updated_appointment.get("notes"),
+        duration=updated_appointment.get("duration", 30),
+        created_at=updated_appointment.get("created_at", datetime.now()),
+        updated_at=updated_appointment.get("updated_at", datetime.now())
+    )
+
+@router.delete("/{appointment_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_appointment(
+    appointment_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Delete an appointment"""
+    if not is_valid_object_id(appointment_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid appointment ID"
+        )
+    
+    appointment = await db_client.appointments.find_one({"_id": ObjectId(appointment_id)})
+    if not appointment:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Appointment not found"
+        )
+    
+    # Check permissions
+    can_delete = False
+    if 'admin' in current_user.get('roles', []) or current_user.get('role') == 'admin':
+        can_delete = True
+    elif 'patient' in current_user.get('roles', []) or current_user.get('role') == 'patient':
+        if appointment["patient_id"] == ObjectId(current_user["_id"]):
+            can_delete = True
+    
+    if not can_delete:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only delete your own appointments"
+        )
+    
+    await db_client.appointments.delete_one({"_id": ObjectId(appointment_id)}) 

routes/auth.py

@@ -0,0 +1,462 @@
+from fastapi import APIRouter, HTTPException, Depends, status, Request, Query
+from typing import Optional
+from fastapi.security import OAuth2PasswordRequestForm
+from db.mongo import users_collection
+from core.security import hash_password, verify_password, create_access_token, get_current_user
+from models.schemas import (
+    SignupForm,
+    TokenResponse,
+    DoctorCreate,
+    AdminCreate,
+    ProfileUpdate,
+    PasswordChange,
+    AdminUserUpdate,
+    AdminPasswordReset,
+)
+from datetime import datetime
+import logging
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(name)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+@router.post("/signup", status_code=status.HTTP_201_CREATED)
+async def signup(data: SignupForm):
+    """
+    Patient registration endpoint - only patients can register through signup
+    Doctors and admins must be created by existing admins
+    """
+    logger.info(f"Patient signup attempt for email: {data.email}")
+    logger.info(f"Received signup data: {data.dict()}")
+    email = data.email.lower().strip()
+    existing = await users_collection.find_one({"email": email})
+    if existing:
+        logger.warning(f"Signup failed: Email already exists: {email}")
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Email already exists"
+        )
+    
+    hashed_pw = hash_password(data.password)
+    user_doc = {
+        "email": email,
+        "full_name": data.full_name.strip(),
+        "password": hashed_pw,
+        "roles": ["patient"],  # Only patients can register through signup
+        "created_at": datetime.utcnow().isoformat(),
+        "updated_at": datetime.utcnow().isoformat(),
+        "device_token": ""  # Default empty device token for patients
+    }
+    
+    try:
+        result = await users_collection.insert_one(user_doc)
+        logger.info(f"User created successfully: {email}")
+        return {
+            "status": "success",
+            "id": str(result.inserted_id),
+            "email": email
+        }
+    except Exception as e:
+        logger.error(f"Failed to create user {email}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create user: {str(e)}"
+        )
+
+@router.post("/admin/doctors", status_code=status.HTTP_201_CREATED)
+async def create_doctor(
+    data: DoctorCreate,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Create doctor account - only admins can create doctor accounts
+    """
+    logger.info(f"Doctor creation attempt by {current_user.get('email')}")
+    if 'admin' not in current_user.get('roles', []):
+        logger.warning(f"Unauthorized doctor creation attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only admins can create doctor accounts"
+        )
+    
+    email = data.email.lower().strip()
+    existing = await users_collection.find_one({"email": email})
+    if existing:
+        logger.warning(f"Doctor creation failed: Email already exists: {email}")
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Email already exists"
+        )
+    
+    hashed_pw = hash_password(data.password)
+    doctor_doc = {
+        "email": email,
+        "full_name": data.full_name.strip(),
+        "password": hashed_pw,
+        "roles": data.roles,  # Support multiple roles
+        "specialty": data.specialty,
+        "license_number": data.license_number,
+        "created_at": datetime.utcnow().isoformat(),
+        "updated_at": datetime.utcnow().isoformat(),
+        "device_token": data.device_token or ""
+    }
+    
+    try:
+        result = await users_collection.insert_one(doctor_doc)
+        logger.info(f"Doctor created successfully: {email}")
+        return {
+            "status": "success",
+            "id": str(result.inserted_id),
+            "email": email
+        }
+    except Exception as e:
+        logger.error(f"Failed to create doctor {email}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create doctor: {str(e)}"
+        )
+
+@router.post("/admin/admins", status_code=status.HTTP_201_CREATED)
+async def create_admin(
+    data: AdminCreate,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Create admin account - only existing admins can create new admin accounts
+    """
+    logger.info(f"Admin creation attempt by {current_user.get('email')}")
+    if 'admin' not in current_user.get('roles', []):
+        logger.warning(f"Unauthorized admin creation attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only admins can create admin accounts"
+        )
+    
+    email = data.email.lower().strip()
+    existing = await users_collection.find_one({"email": email})
+    if existing:
+        logger.warning(f"Admin creation failed: Email already exists: {email}")
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Email already exists"
+        )
+    
+    hashed_pw = hash_password(data.password)
+    admin_doc = {
+        "email": email,
+        "full_name": data.full_name.strip(),
+        "password": hashed_pw,
+        "roles": data.roles,  # Support multiple roles
+        "created_at": datetime.utcnow().isoformat(),
+        "updated_at": datetime.utcnow().isoformat(),
+        "device_token": ""
+    }
+    
+    try:
+        result = await users_collection.insert_one(admin_doc)
+        logger.info(f"Admin created successfully: {email}")
+        return {
+            "status": "success",
+            "id": str(result.inserted_id),
+            "email": email
+        }
+    except Exception as e:
+        logger.error(f"Failed to create admin {email}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create admin: {str(e)}"
+        )
+
+@router.post("/login", response_model=TokenResponse)
+async def login(form_data: OAuth2PasswordRequestForm = Depends()):
+    logger.info(f"Login attempt for email: {form_data.username}")
+    user = await users_collection.find_one({"email": form_data.username.lower()})
+    if not user or not verify_password(form_data.password, user["password"]):
+        logger.warning(f"Login failed for {form_data.username}: Invalid credentials")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid credentials",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    
+    # Update device token if provided in form_data (e.g., from frontend)
+    if hasattr(form_data, 'device_token') and form_data.device_token:
+        await users_collection.update_one(
+            {"email": user["email"]},
+            {"$set": {"device_token": form_data.device_token}}
+        )
+        logger.info(f"Device token updated for {form_data.username}")
+
+    access_token = create_access_token(data={"sub": user["email"]})
+    logger.info(f"Successful login for {form_data.username}")
+    return {
+        "access_token": access_token,
+        "token_type": "bearer",
+        "roles": user.get("roles", ["patient"])  # Return all roles
+    }
+
+@router.get("/me")
+async def get_me(request: Request, current_user: dict = Depends(get_current_user)):
+    logger.info(f"Fetching user profile for {current_user['email']} at {datetime.utcnow().isoformat()}")
+    print(f"Headers: {request.headers}")
+    try:
+        user = await users_collection.find_one({"email": current_user["email"]})
+        if not user:
+            logger.warning(f"User not found: {current_user['email']}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="User not found"
+            )
+        
+        # Handle both "role" (singular) and "roles" (array) formats
+        user_roles = user.get("roles", [])
+        if not user_roles and user.get("role"):
+            # If roles array is empty but role field exists, convert to array
+            user_roles = [user.get("role")]
+        
+        print(f"🔍 User from DB: {user}")
+        print(f"🔍 User roles: {user_roles}")
+        
+        response = {
+            "id": str(user["_id"]),
+            "email": user["email"],
+            "full_name": user.get("full_name", ""),
+            "roles": user_roles,  # Return all roles
+            "specialty": user.get("specialty"),
+            "created_at": user.get("created_at"),
+            "updated_at": user.get("updated_at"),
+            "device_token": user.get("device_token", "")  # Include device token in response
+        }
+        logger.info(f"User profile retrieved for {current_user['email']} at {datetime.utcnow().isoformat()}")
+        return response
+    except Exception as e:
+        logger.error(f"Database error for user {current_user['email']}: {str(e)} at {datetime.utcnow().isoformat()}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Database error: {str(e)}"
+        )
+
+@router.get("/users")
+async def list_users(
+    role: Optional[str] = None,
+    search: Optional[str] = Query(None, description="Search by name or email"),
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    List users - admins can see all users, doctors can see patients, patients can only see themselves
+    """
+    logger.info(f"User list request by {current_user.get('email')} with role filter: {role}")
+    
+    # Build query based on user role and requested filter
+    query = {}
+    if role:
+        # support both role singlular and roles array in historical docs
+        query["roles"] = {"$in": [role]}
+    if search:
+        query["$or"] = [
+            {"full_name": {"$regex": search, "$options": "i"}},
+            {"email": {"$regex": search, "$options": "i"}},
+        ]
+    
+    # Role-based access control
+    if 'admin' in current_user.get('roles', []):
+        # Admins can see all users
+        pass
+    elif 'doctor' in current_user.get('roles', []):
+        # Doctors can only see patients
+        query["roles"] = {"$in": ["patient"]}
+    elif 'patient' in current_user.get('roles', []):
+        # Patients can only see themselves
+        query["email"] = current_user.get('email')
+    
+    try:
+        users = await users_collection.find(query).limit(500).to_list(length=500)
+        # Remove sensitive information
+        for user in users:
+            user["id"] = str(user["_id"])
+            del user["_id"]
+            del user["password"]
+            user.pop("device_token", None)  # Safely remove device_token if it exists
+        
+        logger.info(f"Retrieved {len(users)} users for {current_user.get('email')}")
+        return users
+    except Exception as e:
+        logger.error(f"Error retrieving users: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to retrieve users: {str(e)}"
+        )
+
+@router.put("/admin/users/{user_id}")
+async def admin_update_user(
+    user_id: str,
+    data: AdminUserUpdate,
+    current_user: dict = Depends(get_current_user)
+):
+    if 'admin' not in current_user.get('roles', []):
+        raise HTTPException(status_code=403, detail="Admins only")
+    try:
+        update_data = {k: v for k, v in data.dict().items() if v is not None}
+        update_data["updated_at"] = datetime.utcnow().isoformat()
+        result = await users_collection.update_one({"_id": __import__('bson').ObjectId(user_id)}, {"$set": update_data})
+        if result.matched_count == 0:
+            raise HTTPException(status_code=404, detail="User not found")
+        return {"status": "success"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Failed to update user: {str(e)}")
+
+@router.delete("/admin/users/{user_id}")
+async def admin_delete_user(
+    user_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    if 'admin' not in current_user.get('roles', []):
+        raise HTTPException(status_code=403, detail="Admins only")
+    try:
+        result = await users_collection.delete_one({"_id": __import__('bson').ObjectId(user_id)})
+        if result.deleted_count == 0:
+            raise HTTPException(status_code=404, detail="User not found")
+        return {"status": "success"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Failed to delete user: {str(e)}")
+
+@router.post("/admin/users/{user_id}/reset-password")
+async def admin_reset_password(
+    user_id: str,
+    data: AdminPasswordReset,
+    current_user: dict = Depends(get_current_user)
+):
+    if 'admin' not in current_user.get('roles', []):
+        raise HTTPException(status_code=403, detail="Admins only")
+    if len(data.new_password) < 6:
+        raise HTTPException(status_code=400, detail="Password must be at least 6 characters")
+    try:
+        hashed = hash_password(data.new_password)
+        result = await users_collection.update_one(
+            {"_id": __import__('bson').ObjectId(user_id)},
+            {"$set": {"password": hashed, "updated_at": datetime.utcnow().isoformat()}}
+        )
+        if result.matched_count == 0:
+            raise HTTPException(status_code=404, detail="User not found")
+        return {"status": "success"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Failed to reset password: {str(e)}")
+
+@router.put("/profile", status_code=status.HTTP_200_OK)
+async def update_profile(
+    data: ProfileUpdate,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Update user profile - users can update their own profile
+    """
+    logger.info(f"Profile update attempt by {current_user.get('email')}")
+    
+    # Build update data (only include fields that are provided)
+    update_data = {}
+    if data.full_name is not None:
+        update_data["full_name"] = data.full_name.strip()
+    if data.phone is not None:
+        update_data["phone"] = data.phone.strip()
+    if data.address is not None:
+        update_data["address"] = data.address.strip()
+    if data.date_of_birth is not None:
+        update_data["date_of_birth"] = data.date_of_birth
+    if data.gender is not None:
+        update_data["gender"] = data.gender.strip()
+    if data.specialty is not None:
+        update_data["specialty"] = data.specialty.strip()
+    if data.license_number is not None:
+        update_data["license_number"] = data.license_number.strip()
+    
+    # Add updated timestamp
+    update_data["updated_at"] = datetime.utcnow().isoformat()
+    
+    try:
+        result = await users_collection.update_one(
+            {"email": current_user.get('email')},
+            {"$set": update_data}
+        )
+        
+        if result.modified_count == 0:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="User not found"
+            )
+        
+        logger.info(f"Profile updated successfully for {current_user.get('email')}")
+        return {
+            "status": "success",
+            "message": "Profile updated successfully"
+        }
+    except Exception as e:
+        logger.error(f"Failed to update profile for {current_user.get('email')}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to update profile: {str(e)}"
+        )
+
+@router.post("/change-password", status_code=status.HTTP_200_OK)
+async def change_password(
+    data: PasswordChange,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Change user password - users can change their own password
+    """
+    logger.info(f"Password change attempt by {current_user.get('email')}")
+    
+    # Verify current password
+    if not verify_password(data.current_password, current_user.get('password')):
+        logger.warning(f"Password change failed: incorrect current password for {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Current password is incorrect"
+        )
+    
+    # Validate new password
+    if len(data.new_password) < 6:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="New password must be at least 6 characters long"
+        )
+    
+    # Hash new password
+    hashed_new_password = hash_password(data.new_password)
+    
+    try:
+        result = await users_collection.update_one(
+            {"email": current_user.get('email')},
+            {
+                "$set": {
+                    "password": hashed_new_password,
+                    "updated_at": datetime.utcnow().isoformat()
+                }
+            }
+        )
+        
+        if result.modified_count == 0:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="User not found"
+            )
+        
+        logger.info(f"Password changed successfully for {current_user.get('email')}")
+        return {
+            "status": "success",
+            "message": "Password changed successfully"
+        }
+    except Exception as e:
+        logger.error(f"Failed to change password for {current_user.get('email')}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to change password: {str(e)}"
+        )
+
+# Export the router as 'auth' for api.__init__.py
+auth = router

routes/fhir_integration.py

@@ -0,0 +1,375 @@
+from fastapi import APIRouter, HTTPException, Depends
+from typing import List, Optional
+import httpx
+import json
+from datetime import datetime
+from ..auth.auth import get_current_user
+from models.schemas import User
+
+router = APIRouter()
+
+# HAPI FHIR Test Server URL
+HAPI_FHIR_BASE_URL = "https://hapi.fhir.org/baseR4"
+
+class FHIRIntegration:
+    def __init__(self):
+        self.base_url = HAPI_FHIR_BASE_URL
+        self.client = httpx.AsyncClient(timeout=30.0)
+    
+    async def search_patients(self, limit: int = 10, offset: int = 0) -> dict:
+        """Search for patients in HAPI FHIR Test Server"""
+        try:
+            url = f"{self.base_url}/Patient"
+            params = {
+                "_count": limit,
+                "_getpagesoffset": offset
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"FHIR server error: {str(e)}")
+    
+    async def get_patient_by_id(self, patient_id: str) -> dict:
+        """Get a specific patient by ID from HAPI FHIR Test Server"""
+        try:
+            url = f"{self.base_url}/Patient/{patient_id}"
+            response = await self.client.get(url)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=404, detail=f"Patient not found: {str(e)}")
+    
+    async def get_patient_observations(self, patient_id: str) -> dict:
+        """Get observations (vital signs, lab results) for a patient"""
+        try:
+            url = f"{self.base_url}/Observation"
+            params = {
+                "patient": patient_id,
+                "_count": 100
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Error fetching observations: {str(e)}")
+    
+    async def get_patient_medications(self, patient_id: str) -> dict:
+        """Get medications for a patient"""
+        try:
+            url = f"{self.base_url}/MedicationRequest"
+            params = {
+                "patient": patient_id,
+                "_count": 100
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Error fetching medications: {str(e)}")
+    
+    async def get_patient_conditions(self, patient_id: str) -> dict:
+        """Get conditions (diagnoses) for a patient"""
+        try:
+            url = f"{self.base_url}/Condition"
+            params = {
+                "patient": patient_id,
+                "_count": 100
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Error fetching conditions: {str(e)}")
+    
+    async def get_patient_encounters(self, patient_id: str) -> dict:
+        """Get encounters (visits) for a patient"""
+        try:
+            url = f"{self.base_url}/Encounter"
+            params = {
+                "patient": patient_id,
+                "_count": 100
+            }
+            
+            response = await self.client.get(url, params=params)
+            response.raise_for_status()
+            
+            return response.json()
+        except Exception as e:
+            raise HTTPException(status_code=500, detail=f"Error fetching encounters: {str(e)}")
+
+# Initialize FHIR integration
+fhir_integration = FHIRIntegration()
+
+@router.get("/fhir/patients")
+async def get_fhir_patients(
+    limit: int = 10,
+    offset: int = 0,
+    current_user: User = Depends(get_current_user)
+):
+    """Get patients from HAPI FHIR Test Server"""
+    try:
+        patients_data = await fhir_integration.search_patients(limit, offset)
+        
+        # Transform FHIR patients to our format
+        transformed_patients = []
+        for patient in patients_data.get("entry", []):
+            fhir_patient = patient.get("resource", {})
+            
+            # Extract patient information
+            patient_info = {
+                "fhir_id": fhir_patient.get("id"),
+                "full_name": "",
+                "gender": fhir_patient.get("gender", "unknown"),
+                "date_of_birth": "",
+                "address": "",
+                "phone": "",
+                "email": ""
+            }
+            
+            # Extract name
+            if fhir_patient.get("name"):
+                name_parts = []
+                for name in fhir_patient["name"]:
+                    if name.get("given"):
+                        name_parts.extend(name["given"])
+                    if name.get("family"):
+                        name_parts.append(name["family"])
+                patient_info["full_name"] = " ".join(name_parts)
+            
+            # Extract birth date
+            if fhir_patient.get("birthDate"):
+                patient_info["date_of_birth"] = fhir_patient["birthDate"]
+            
+            # Extract address
+            if fhir_patient.get("address"):
+                address_parts = []
+                for address in fhir_patient["address"]:
+                    if address.get("line"):
+                        address_parts.extend(address["line"])
+                    if address.get("city"):
+                        address_parts.append(address["city"])
+                    if address.get("state"):
+                        address_parts.append(address["state"])
+                    if address.get("postalCode"):
+                        address_parts.append(address["postalCode"])
+                patient_info["address"] = ", ".join(address_parts)
+            
+            # Extract contact information
+            if fhir_patient.get("telecom"):
+                for telecom in fhir_patient["telecom"]:
+                    if telecom.get("system") == "phone":
+                        patient_info["phone"] = telecom.get("value", "")
+                    elif telecom.get("system") == "email":
+                        patient_info["email"] = telecom.get("value", "")
+            
+            transformed_patients.append(patient_info)
+        
+        return {
+            "patients": transformed_patients,
+            "total": patients_data.get("total", len(transformed_patients)),
+            "count": len(transformed_patients)
+        }
+        
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Error fetching FHIR patients: {str(e)}")
+
+@router.get("/fhir/patients/{patient_id}")
+async def get_fhir_patient_details(
+    patient_id: str,
+    current_user: User = Depends(get_current_user)
+):
+    """Get detailed patient information from HAPI FHIR Test Server"""
+    try:
+        # Get basic patient info
+        patient_data = await fhir_integration.get_patient_by_id(patient_id)
+        
+        # Get additional patient data
+        observations = await fhir_integration.get_patient_observations(patient_id)
+        medications = await fhir_integration.get_patient_medications(patient_id)
+        conditions = await fhir_integration.get_patient_conditions(patient_id)
+        encounters = await fhir_integration.get_patient_encounters(patient_id)
+        
+        # Transform and combine all data
+        patient_info = {
+            "fhir_id": patient_data.get("id"),
+            "full_name": "",
+            "gender": patient_data.get("gender", "unknown"),
+            "date_of_birth": patient_data.get("birthDate", ""),
+            "address": "",
+            "phone": "",
+            "email": "",
+            "observations": [],
+            "medications": [],
+            "conditions": [],
+            "encounters": []
+        }
+        
+        # Extract name
+        if patient_data.get("name"):
+            name_parts = []
+            for name in patient_data["name"]:
+                if name.get("given"):
+                    name_parts.extend(name["given"])
+                if name.get("family"):
+                    name_parts.append(name["family"])
+            patient_info["full_name"] = " ".join(name_parts)
+        
+        # Extract address
+        if patient_data.get("address"):
+            address_parts = []
+            for address in patient_data["address"]:
+                if address.get("line"):
+                    address_parts.extend(address["line"])
+                if address.get("city"):
+                    address_parts.append(address["city"])
+                if address.get("state"):
+                    address_parts.append(address["state"])
+                if address.get("postalCode"):
+                    address_parts.append(address["postalCode"])
+            patient_info["address"] = ", ".join(address_parts)
+        
+        # Extract contact information
+        if patient_data.get("telecom"):
+            for telecom in patient_data["telecom"]:
+                if telecom.get("system") == "phone":
+                    patient_info["phone"] = telecom.get("value", "")
+                elif telecom.get("system") == "email":
+                    patient_info["email"] = telecom.get("value", "")
+        
+        # Transform observations
+        for obs in observations.get("entry", []):
+            resource = obs.get("resource", {})
+            if resource.get("code", {}).get("text"):
+                patient_info["observations"].append({
+                    "type": resource["code"]["text"],
+                    "value": resource.get("valueQuantity", {}).get("value"),
+                    "unit": resource.get("valueQuantity", {}).get("unit"),
+                    "date": resource.get("effectiveDateTime", "")
+                })
+        
+        # Transform medications
+        for med in medications.get("entry", []):
+            resource = med.get("resource", {})
+            if resource.get("medicationCodeableConcept", {}).get("text"):
+                patient_info["medications"].append({
+                    "name": resource["medicationCodeableConcept"]["text"],
+                    "status": resource.get("status", ""),
+                    "prescribed_date": resource.get("authoredOn", ""),
+                    "dosage": resource.get("dosageInstruction", [{}])[0].get("text", "")
+                })
+        
+        # Transform conditions
+        for condition in conditions.get("entry", []):
+            resource = condition.get("resource", {})
+            if resource.get("code", {}).get("text"):
+                patient_info["conditions"].append({
+                    "name": resource["code"]["text"],
+                    "status": resource.get("clinicalStatus", {}).get("text", ""),
+                    "onset_date": resource.get("onsetDateTime", ""),
+                    "severity": resource.get("severity", {}).get("text", "")
+                })
+        
+        # Transform encounters
+        for encounter in encounters.get("entry", []):
+            resource = encounter.get("resource", {})
+            if resource.get("type"):
+                patient_info["encounters"].append({
+                    "type": resource["type"][0].get("text", ""),
+                    "status": resource.get("status", ""),
+                    "start_date": resource.get("period", {}).get("start", ""),
+                    "end_date": resource.get("period", {}).get("end", ""),
+                    "service_provider": resource.get("serviceProvider", {}).get("display", "")
+                })
+        
+        return patient_info
+        
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Error fetching FHIR patient details: {str(e)}")
+
+@router.post("/fhir/import-patient/{patient_id}")
+async def import_fhir_patient(
+    patient_id: str,
+    current_user: User = Depends(get_current_user)
+):
+    """Import a patient from HAPI FHIR Test Server to our database"""
+    try:
+        from db.mongo import patients_collection
+        from bson import ObjectId
+        
+        # Get patient data from FHIR server
+        patient_data = await fhir_integration.get_patient_by_id(patient_id)
+        
+        # Transform FHIR data to our format
+        transformed_patient = {
+            "fhir_id": patient_data.get("id"),
+            "full_name": "",
+            "gender": patient_data.get("gender", "unknown"),
+            "date_of_birth": patient_data.get("birthDate", ""),
+            "address": "",
+            "phone": "",
+            "email": "",
+            "source": "fhir_import",
+            "status": "active",
+            "assigned_doctor_id": str(current_user.id),
+            "created_at": datetime.now(),
+            "updated_at": datetime.now()
+        }
+        
+        # Extract name
+        if patient_data.get("name"):
+            name_parts = []
+            for name in patient_data["name"]:
+                if name.get("given"):
+                    name_parts.extend(name["given"])
+                if name.get("family"):
+                    name_parts.append(name["family"])
+            transformed_patient["full_name"] = " ".join(name_parts)
+        
+        # Extract address
+        if patient_data.get("address"):
+            address_parts = []
+            for address in patient_data["address"]:
+                if address.get("line"):
+                    address_parts.extend(address["line"])
+                if address.get("city"):
+                    address_parts.append(address["city"])
+                if address.get("state"):
+                    address_parts.append(address["state"])
+                if address.get("postalCode"):
+                    address_parts.append(address["postalCode"])
+            transformed_patient["address"] = ", ".join(address_parts)
+        
+        # Extract contact information
+        if patient_data.get("telecom"):
+            for telecom in patient_data["telecom"]:
+                if telecom.get("system") == "phone":
+                    transformed_patient["phone"] = telecom.get("value", "")
+                elif telecom.get("system") == "email":
+                    transformed_patient["email"] = telecom.get("value", "")
+        
+        # Check if patient already exists
+        existing_patient = await patients_collection.find_one({"fhir_id": patient_data.get("id")})
+        if existing_patient:
+            raise HTTPException(status_code=400, detail="Patient already exists in database")
+        
+        # Insert patient into database
+        result = await patients_collection.insert_one(transformed_patient)
+        
+        return {
+            "message": "Patient imported successfully",
+            "patient_id": str(result.inserted_id),
+            "fhir_id": patient_data.get("id")
+        }
+        
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Error importing FHIR patient: {str(e)}") 

routes/messaging.py

@@ -0,0 +1,903 @@
+from fastapi import APIRouter, Depends, HTTPException, status, Query, WebSocket, WebSocketDisconnect, UploadFile, File
+from typing import List, Optional
+from datetime import datetime, timedelta
+from bson import ObjectId
+from motor.motor_asyncio import AsyncIOMotorClient
+import json
+import asyncio
+from collections import defaultdict
+import os
+import uuid
+from pathlib import Path
+
+from core.security import get_current_user
+from db.mongo import db
+from models.schemas import (
+    MessageCreate, MessageUpdate, MessageResponse, MessageListResponse,
+    ConversationResponse, ConversationListResponse, MessageType, MessageStatus,
+    NotificationCreate, NotificationResponse, NotificationListResponse,
+    NotificationType, NotificationPriority
+)
+
+router = APIRouter(prefix="/messaging", tags=["messaging"])
+
+# WebSocket connection manager
+class ConnectionManager:
+    def __init__(self):
+        self.active_connections: dict = defaultdict(list)  # user_id -> list of connections
+
+    async def connect(self, websocket: WebSocket, user_id: str):
+        await websocket.accept()
+        self.active_connections[user_id].append(websocket)
+
+    def disconnect(self, websocket: WebSocket, user_id: str):
+        if user_id in self.active_connections:
+            self.active_connections[user_id] = [
+                conn for conn in self.active_connections[user_id] if conn != websocket
+            ]
+
+    async def send_personal_message(self, message: dict, user_id: str):
+        if user_id in self.active_connections:
+            for connection in self.active_connections[user_id]:
+                try:
+                    await connection.send_text(json.dumps(message))
+                except:
+                    # Remove dead connections
+                    self.active_connections[user_id].remove(connection)
+
+manager = ConnectionManager()
+
+# --- HELPER FUNCTIONS ---
+def is_valid_object_id(id_str: str) -> bool:
+    try:
+        ObjectId(id_str)
+        return True
+    except:
+        return False
+
+def get_conversation_id(user1_id, user2_id) -> str:
+    """Generate a consistent conversation ID for two users"""
+    # Convert both IDs to strings for consistent comparison
+    user1_str = str(user1_id)
+    user2_str = str(user2_id)
+    # Sort IDs to ensure consistent conversation ID regardless of sender/recipient
+    sorted_ids = sorted([user1_str, user2_str])
+    return f"{sorted_ids[0]}_{sorted_ids[1]}"
+
+async def create_notification(
+    db_client: AsyncIOMotorClient,
+    recipient_id: str,
+    title: str,
+    message: str,
+    notification_type: NotificationType,
+    priority: NotificationPriority = NotificationPriority.MEDIUM,
+    data: Optional[dict] = None
+):
+    """Create a notification for a user"""
+    notification_doc = {
+        "recipient_id": ObjectId(recipient_id),
+        "title": title,
+        "message": message,
+        "notification_type": notification_type,
+        "priority": priority,
+        "data": data or {},
+        "is_read": False,
+        "created_at": datetime.now()
+    }
+    
+    result = await db_client.notifications.insert_one(notification_doc)
+    notification_doc["_id"] = result.inserted_id
+    
+    # Convert ObjectId to string for WebSocket transmission
+    notification_for_ws = {
+        "id": str(notification_doc["_id"]),
+        "recipient_id": str(notification_doc["recipient_id"]),
+        "title": notification_doc["title"],
+        "message": notification_doc["message"],
+        "notification_type": notification_doc["notification_type"],
+        "priority": notification_doc["priority"],
+        "data": notification_doc["data"],
+        "is_read": notification_doc["is_read"],
+        "created_at": notification_doc["created_at"]
+    }
+    
+    # Send real-time notification via WebSocket
+    await manager.send_personal_message({
+        "type": "new_notification",
+        "data": notification_for_ws
+    }, recipient_id)
+    
+    return notification_doc
+
+# --- WEBSOCKET ENDPOINT ---
+@router.websocket("/ws/{user_id}")
+async def websocket_endpoint(websocket: WebSocket, user_id: str):
+    await manager.connect(websocket, user_id)
+    print(f"🔌 WebSocket connected for user: {user_id}")
+    
+    try:
+        while True:
+            # Wait for messages from client (keep connection alive)
+            data = await websocket.receive_text()
+            try:
+                message_data = json.loads(data)
+                if message_data.get("type") == "ping":
+                    # Send pong to keep connection alive
+                    await websocket.send_text(json.dumps({"type": "pong"}))
+            except json.JSONDecodeError:
+                pass  # Ignore invalid JSON
+    except WebSocketDisconnect:
+        print(f"🔌 WebSocket disconnected for user: {user_id}")
+        manager.disconnect(websocket, user_id)
+    except Exception as e:
+        print(f"❌ WebSocket error for user {user_id}: {e}")
+        manager.disconnect(websocket, user_id)
+
+# --- CONVERSATION ENDPOINTS ---
+@router.get("/conversations", response_model=ConversationListResponse)
+async def get_conversations(
+    page: int = Query(1, ge=1),
+    limit: int = Query(20, ge=1, le=100),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get user's conversations"""
+    skip = (page - 1) * limit
+    user_id = current_user["_id"]
+    
+    # Get all messages where user is sender or recipient
+    pipeline = [
+        {
+            "$match": {
+                "$or": [
+                    {"sender_id": ObjectId(user_id)},
+                    {"recipient_id": ObjectId(user_id)}
+                ]
+            }
+        },
+        {
+            "$sort": {"created_at": -1}
+        },
+        {
+            "$group": {
+                "_id": {
+                    "$cond": [
+                        {"$eq": ["$sender_id", ObjectId(user_id)]},
+                        "$recipient_id",
+                        "$sender_id"
+                    ]
+                },
+                "last_message": {"$first": "$$ROOT"},
+                "unread_count": {
+                    "$sum": {
+                        "$cond": [
+                            {
+                                "$and": [
+                                    {"$eq": ["$recipient_id", ObjectId(user_id)]},
+                                    {"$ne": ["$status", "read"]}
+                                ]
+                            },
+                            1,
+                            0
+                        ]
+                    }
+                }
+            }
+        },
+        {
+            "$sort": {"last_message.created_at": -1}
+        },
+        {
+            "$skip": skip
+        },
+        {
+            "$limit": limit
+        }
+    ]
+    
+    conversations_data = await db_client.messages.aggregate(pipeline).to_list(length=limit)
+    
+    # Get user details for each conversation
+    conversations = []
+    for conv_data in conversations_data:
+        other_user_id = str(conv_data["_id"])
+        other_user = await db_client.users.find_one({"_id": conv_data["_id"]})
+        
+        if other_user:
+            # Convert user_id to string for consistent comparison
+            user_id_str = str(user_id)
+            conversation_id = get_conversation_id(user_id_str, other_user_id)
+            
+            # Build last message response
+            last_message = None
+            if conv_data["last_message"]:
+                last_message = MessageResponse(
+                    id=str(conv_data["last_message"]["_id"]),
+                    sender_id=str(conv_data["last_message"]["sender_id"]),
+                    recipient_id=str(conv_data["last_message"]["recipient_id"]),
+                    sender_name=current_user["full_name"] if conv_data["last_message"]["sender_id"] == ObjectId(user_id) else other_user["full_name"],
+                    recipient_name=other_user["full_name"] if conv_data["last_message"]["sender_id"] == ObjectId(user_id) else current_user["full_name"],
+                    content=conv_data["last_message"]["content"],
+                    message_type=conv_data["last_message"]["message_type"],
+                    attachment_url=conv_data["last_message"].get("attachment_url"),
+                    reply_to_message_id=str(conv_data["last_message"]["reply_to_message_id"]) if conv_data["last_message"].get("reply_to_message_id") else None,
+                    status=conv_data["last_message"]["status"],
+                    is_archived=conv_data["last_message"].get("is_archived", False),
+                    created_at=conv_data["last_message"]["created_at"],
+                    updated_at=conv_data["last_message"]["updated_at"],
+                    read_at=conv_data["last_message"].get("read_at")
+                )
+            
+            conversations.append(ConversationResponse(
+                id=conversation_id,
+                participant_ids=[user_id_str, other_user_id],
+                participant_names=[current_user["full_name"], other_user["full_name"]],
+                last_message=last_message,
+                unread_count=conv_data["unread_count"],
+                created_at=conv_data["last_message"]["created_at"] if conv_data["last_message"] else datetime.now(),
+                updated_at=conv_data["last_message"]["updated_at"] if conv_data["last_message"] else datetime.now()
+            ))
+    
+    # Get total count
+    total_pipeline = [
+        {
+            "$match": {
+                "$or": [
+                    {"sender_id": ObjectId(user_id)},
+                    {"recipient_id": ObjectId(user_id)}
+                ]
+            }
+        },
+        {
+            "$group": {
+                "_id": {
+                    "$cond": [
+                        {"$eq": ["$sender_id", ObjectId(user_id)]},
+                        "$recipient_id",
+                        "$sender_id"
+                    ]
+                }
+            }
+        },
+        {
+            "$count": "total"
+        }
+    ]
+    
+    total_result = await db_client.messages.aggregate(total_pipeline).to_list(length=1)
+    total = total_result[0]["total"] if total_result else 0
+    
+    return ConversationListResponse(
+        conversations=conversations,
+        total=total,
+        page=page,
+        limit=limit
+    )
+
+# --- MESSAGE ENDPOINTS ---
+@router.post("/messages", response_model=MessageResponse, status_code=status.HTTP_201_CREATED)
+async def send_message(
+    message_data: MessageCreate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Send a message to another user"""
+    if not is_valid_object_id(message_data.recipient_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid recipient ID"
+        )
+    
+    # Check if recipient exists
+    recipient = await db_client.users.find_one({"_id": ObjectId(message_data.recipient_id)})
+    if not recipient:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Recipient not found"
+        )
+    
+    # Check if user can message this recipient
+    # Patients can only message their doctors, doctors can message their patients
+    current_user_roles = current_user.get('roles', [])
+    if isinstance(current_user.get('role'), str):
+        current_user_roles.append(current_user.get('role'))
+    
+    recipient_roles = recipient.get('roles', [])
+    if isinstance(recipient.get('role'), str):
+        recipient_roles.append(recipient.get('role'))
+    
+    if 'patient' in current_user_roles:
+        # Patients can only message doctors
+        if 'doctor' not in recipient_roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Patients can only message doctors"
+            )
+    elif 'doctor' in current_user_roles:
+        # Doctors can only message their patients
+        if 'patient' not in recipient_roles:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Doctors can only message patients"
+            )
+    
+    # Check reply message if provided
+    if message_data.reply_to_message_id:
+        if not is_valid_object_id(message_data.reply_to_message_id):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid reply message ID"
+            )
+        
+        reply_message = await db_client.messages.find_one({"_id": ObjectId(message_data.reply_to_message_id)})
+        if not reply_message:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Reply message not found"
+            )
+    
+    # Create message
+    message_doc = {
+        "sender_id": ObjectId(current_user["_id"]),
+        "recipient_id": ObjectId(message_data.recipient_id),
+        "content": message_data.content,
+        "message_type": message_data.message_type,
+        "attachment_url": message_data.attachment_url,
+        "reply_to_message_id": ObjectId(message_data.reply_to_message_id) if message_data.reply_to_message_id else None,
+        "status": MessageStatus.SENT,
+        "is_archived": False,
+        "created_at": datetime.now(),
+        "updated_at": datetime.now()
+    }
+    
+    result = await db_client.messages.insert_one(message_doc)
+    message_doc["_id"] = result.inserted_id
+    
+    # Send real-time message via WebSocket
+    await manager.send_personal_message({
+        "type": "new_message",
+        "data": {
+            "id": str(message_doc["_id"]),
+            "sender_id": str(message_doc["sender_id"]),
+            "recipient_id": str(message_doc["recipient_id"]),
+            "sender_name": current_user["full_name"],
+            "recipient_name": recipient["full_name"],
+            "content": message_doc["content"],
+            "message_type": message_doc["message_type"],
+            "attachment_url": message_doc["attachment_url"],
+            "reply_to_message_id": str(message_doc["reply_to_message_id"]) if message_doc["reply_to_message_id"] else None,
+            "status": message_doc["status"],
+            "is_archived": message_doc["is_archived"],
+            "created_at": message_doc["created_at"],
+            "updated_at": message_doc["updated_at"]
+        }
+    }, message_data.recipient_id)
+    
+    # Create notification for recipient
+    await create_notification(
+        db_client,
+        message_data.recipient_id,
+        f"New message from {current_user['full_name']}",
+        message_data.content[:100] + "..." if len(message_data.content) > 100 else message_data.content,
+        NotificationType.MESSAGE,
+        NotificationPriority.MEDIUM,
+        {"message_id": str(message_doc["_id"]), "sender_id": str(current_user["_id"])}
+    )
+    
+    return MessageResponse(
+        id=str(message_doc["_id"]),
+        sender_id=str(message_doc["sender_id"]),
+        recipient_id=str(message_doc["recipient_id"]),
+        sender_name=current_user["full_name"],
+        recipient_name=recipient["full_name"],
+        content=message_doc["content"],
+        message_type=message_doc["message_type"],
+        attachment_url=message_doc["attachment_url"],
+        reply_to_message_id=str(message_doc["reply_to_message_id"]) if message_doc["reply_to_message_id"] else None,
+        status=message_doc["status"],
+        is_archived=message_doc["is_archived"],
+        created_at=message_doc["created_at"],
+        updated_at=message_doc["updated_at"]
+    )
+
+@router.get("/messages/{conversation_id}", response_model=MessageListResponse)
+async def get_messages(
+    conversation_id: str,
+    page: int = Query(1, ge=1),
+    limit: int = Query(50, ge=1, le=100),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get messages for a specific conversation"""
+    skip = (page - 1) * limit
+    user_id = current_user["_id"]
+    
+    # Parse conversation ID to get the other participant
+    try:
+        participant_ids = conversation_id.split("_")
+        if len(participant_ids) != 2:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid conversation ID format"
+            )
+        
+        # Find the other participant
+        other_user_id = None
+        user_id_str = str(user_id)
+        for pid in participant_ids:
+            if pid != user_id_str:
+                other_user_id = pid
+                break
+        
+        if not other_user_id or not is_valid_object_id(other_user_id):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Invalid conversation ID"
+            )
+        
+        # Verify the other user exists
+        other_user = await db_client.users.find_one({"_id": ObjectId(other_user_id)})
+        if not other_user:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Conversation participant not found"
+            )
+        
+    except Exception as e:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid conversation ID"
+        )
+    
+    # Get messages between the two users
+    filter_query = {
+        "$or": [
+            {
+                "sender_id": ObjectId(user_id),
+                "recipient_id": ObjectId(other_user_id)
+            },
+            {
+                "sender_id": ObjectId(other_user_id),
+                "recipient_id": ObjectId(user_id)
+            }
+        ]
+    }
+    
+    # Get messages
+    cursor = db_client.messages.find(filter_query).sort("created_at", -1).skip(skip).limit(limit)
+    messages = await cursor.to_list(length=limit)
+    
+    # Mark messages as read
+    unread_messages = [
+        msg["_id"] for msg in messages 
+        if msg["recipient_id"] == ObjectId(user_id) and msg["status"] != "read"
+    ]
+    
+    if unread_messages:
+        await db_client.messages.update_many(
+            {"_id": {"$in": unread_messages}},
+            {"$set": {"status": "read", "read_at": datetime.now()}}
+        )
+    
+    # Get total count
+    total = await db_client.messages.count_documents(filter_query)
+    
+    # Build message responses
+    message_responses = []
+    for msg in messages:
+        sender = await db_client.users.find_one({"_id": msg["sender_id"]})
+        recipient = await db_client.users.find_one({"_id": msg["recipient_id"]})
+        
+        message_responses.append(MessageResponse(
+            id=str(msg["_id"]),
+            sender_id=str(msg["sender_id"]),
+            recipient_id=str(msg["recipient_id"]),
+            sender_name=sender["full_name"] if sender else "Unknown User",
+            recipient_name=recipient["full_name"] if recipient else "Unknown User",
+            content=msg["content"],
+            message_type=msg["message_type"],
+            attachment_url=msg.get("attachment_url"),
+            reply_to_message_id=str(msg["reply_to_message_id"]) if msg.get("reply_to_message_id") else None,
+            status=msg["status"],
+            is_archived=msg.get("is_archived", False),
+            created_at=msg["created_at"],
+            updated_at=msg["updated_at"],
+            read_at=msg.get("read_at")
+        ))
+    
+    return MessageListResponse(
+        messages=message_responses,
+        total=total,
+        page=page,
+        limit=limit,
+        conversation_id=conversation_id
+    )
+
+@router.put("/messages/{message_id}", response_model=MessageResponse)
+async def update_message(
+    message_id: str,
+    message_data: MessageUpdate,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Update a message (only sender can update)"""
+    if not is_valid_object_id(message_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid message ID"
+        )
+    
+    message = await db_client.messages.find_one({"_id": ObjectId(message_id)})
+    if not message:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Message not found"
+        )
+    
+    # Only sender can update message
+    if message["sender_id"] != ObjectId(current_user["_id"]):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only update your own messages"
+        )
+    
+    # Build update data
+    update_data = {"updated_at": datetime.now()}
+    
+    if message_data.content is not None:
+        update_data["content"] = message_data.content
+    if message_data.is_archived is not None:
+        update_data["is_archived"] = message_data.is_archived
+    
+    # Update message
+    await db_client.messages.update_one(
+        {"_id": ObjectId(message_id)},
+        {"$set": update_data}
+    )
+    
+    # Get updated message
+    updated_message = await db_client.messages.find_one({"_id": ObjectId(message_id)})
+    
+    # Get sender and recipient names
+    sender = await db_client.users.find_one({"_id": updated_message["sender_id"]})
+    recipient = await db_client.users.find_one({"_id": updated_message["recipient_id"]})
+    
+    return MessageResponse(
+        id=str(updated_message["_id"]),
+        sender_id=str(updated_message["sender_id"]),
+        recipient_id=str(updated_message["recipient_id"]),
+        sender_name=sender["full_name"] if sender else "Unknown User",
+        recipient_name=recipient["full_name"] if recipient else "Unknown User",
+        content=updated_message["content"],
+        message_type=updated_message["message_type"],
+        attachment_url=updated_message.get("attachment_url"),
+        reply_to_message_id=str(updated_message["reply_to_message_id"]) if updated_message.get("reply_to_message_id") else None,
+        status=updated_message["status"],
+        is_archived=updated_message.get("is_archived", False),
+        created_at=updated_message["created_at"],
+        updated_at=updated_message["updated_at"],
+        read_at=updated_message.get("read_at")
+    )
+
+@router.delete("/messages/{message_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_message(
+    message_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Delete a message (only sender can delete)"""
+    if not is_valid_object_id(message_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid message ID"
+        )
+    
+    message = await db_client.messages.find_one({"_id": ObjectId(message_id)})
+    if not message:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Message not found"
+        )
+    
+    # Only sender can delete message
+    if message["sender_id"] != ObjectId(current_user["_id"]):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only delete your own messages"
+        )
+    
+    await db_client.messages.delete_one({"_id": ObjectId(message_id)})
+
+# --- NOTIFICATION ENDPOINTS ---
+@router.get("/notifications", response_model=NotificationListResponse)
+async def get_notifications(
+    page: int = Query(1, ge=1),
+    limit: int = Query(20, ge=1, le=100),
+    unread_only: bool = Query(False),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get user's notifications"""
+    skip = (page - 1) * limit
+    user_id = current_user["_id"]
+    
+    # Build filter
+    filter_query = {"recipient_id": ObjectId(user_id)}
+    if unread_only:
+        filter_query["is_read"] = False
+    
+    # Get notifications
+    cursor = db_client.notifications.find(filter_query).sort("created_at", -1).skip(skip).limit(limit)
+    notifications = await cursor.to_list(length=limit)
+    
+    # Get total count and unread count
+    total = await db_client.notifications.count_documents(filter_query)
+    unread_count = await db_client.notifications.count_documents({
+        "recipient_id": ObjectId(user_id),
+        "is_read": False
+    })
+    
+    # Build notification responses
+    notification_responses = []
+    for notif in notifications:
+        # Convert any ObjectId fields in data to strings
+        data = notif.get("data", {})
+        if data:
+            # Convert ObjectId fields to strings
+            for key, value in data.items():
+                if isinstance(value, ObjectId):
+                    data[key] = str(value)
+        
+        notification_responses.append(NotificationResponse(
+            id=str(notif["_id"]),
+            recipient_id=str(notif["recipient_id"]),
+            recipient_name=current_user["full_name"],
+            title=notif["title"],
+            message=notif["message"],
+            notification_type=notif["notification_type"],
+            priority=notif["priority"],
+            data=data,
+            is_read=notif.get("is_read", False),
+            created_at=notif["created_at"],
+            read_at=notif.get("read_at")
+        ))
+    
+    return NotificationListResponse(
+        notifications=notification_responses,
+        total=total,
+        unread_count=unread_count,
+        page=page,
+        limit=limit
+    )
+
+@router.put("/notifications/{notification_id}/read", response_model=NotificationResponse)
+async def mark_notification_read(
+    notification_id: str,
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Mark a notification as read"""
+    if not is_valid_object_id(notification_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid notification ID"
+        )
+    
+    notification = await db_client.notifications.find_one({"_id": ObjectId(notification_id)})
+    if not notification:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Notification not found"
+        )
+    
+    # Only recipient can mark as read
+    if notification["recipient_id"] != ObjectId(current_user["_id"]):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="You can only mark your own notifications as read"
+        )
+    
+    # Update notification
+    await db_client.notifications.update_one(
+        {"_id": ObjectId(notification_id)},
+        {"$set": {"is_read": True, "read_at": datetime.now()}}
+    )
+    
+    # Get updated notification
+    updated_notification = await db_client.notifications.find_one({"_id": ObjectId(notification_id)})
+    
+    # Convert any ObjectId fields in data to strings
+    data = updated_notification.get("data", {})
+    if data:
+        # Convert ObjectId fields to strings
+        for key, value in data.items():
+            if isinstance(value, ObjectId):
+                data[key] = str(value)
+    
+    return NotificationResponse(
+        id=str(updated_notification["_id"]),
+        recipient_id=str(updated_notification["recipient_id"]),
+        recipient_name=current_user["full_name"],
+        title=updated_notification["title"],
+        message=updated_notification["message"],
+        notification_type=updated_notification["notification_type"],
+        priority=updated_notification["priority"],
+        data=data,
+        is_read=updated_notification.get("is_read", False),
+        created_at=updated_notification["created_at"],
+        read_at=updated_notification.get("read_at")
+    )
+
+@router.put("/notifications/read-all", status_code=status.HTTP_200_OK)
+async def mark_all_notifications_read(
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Mark all user's notifications as read"""
+    user_id = current_user["_id"]
+    
+    await db_client.notifications.update_many(
+        {
+            "recipient_id": ObjectId(user_id),
+            "is_read": False
+        },
+        {
+            "$set": {
+                "is_read": True,
+                "read_at": datetime.now()
+            }
+        }
+    )
+    
+    return {"message": "All notifications marked as read"} 
+
+# --- FILE UPLOAD ENDPOINT ---
+@router.post("/upload", status_code=status.HTTP_201_CREATED)
+async def upload_file(
+    file: UploadFile = File(...),
+    current_user: dict = Depends(get_current_user)
+):
+    """Upload a file for messaging"""
+    
+    # Validate file type
+    allowed_types = {
+        'image': ['.jpg', '.jpeg', '.png', '.gif', '.bmp', '.webp'],
+        'document': ['.pdf', '.doc', '.docx', '.txt', '.rtf'],
+        'spreadsheet': ['.xls', '.xlsx', '.csv'],
+        'presentation': ['.ppt', '.pptx'],
+        'archive': ['.zip', '.rar', '.7z']
+    }
+    
+    # Get file extension
+    file_ext = Path(file.filename).suffix.lower()
+    
+    # Check if file type is allowed
+    is_allowed = False
+    file_category = None
+    for category, extensions in allowed_types.items():
+        if file_ext in extensions:
+            is_allowed = True
+            file_category = category
+            break
+    
+    if not is_allowed:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"File type {file_ext} is not allowed. Allowed types: {', '.join([ext for exts in allowed_types.values() for ext in exts])}"
+        )
+    
+    # Check file size (max 10MB)
+    max_size = 10 * 1024 * 1024  # 10MB
+    if file.size and file.size > max_size:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"File size exceeds maximum limit of 10MB"
+        )
+    
+    # Create uploads directory if it doesn't exist
+    try:
+        upload_dir = Path("uploads")
+        upload_dir.mkdir(exist_ok=True)
+    except PermissionError:
+        # In containerized environments, use temp directory
+        import tempfile
+        upload_dir = Path(tempfile.gettempdir()) / "uploads"
+        upload_dir.mkdir(exist_ok=True)
+    
+    # Create category subdirectory
+    category_dir = upload_dir / file_category
+    category_dir.mkdir(exist_ok=True)
+    
+    # Generate unique filename
+    unique_filename = f"{uuid.uuid4()}{file_ext}"
+    file_path = category_dir / unique_filename
+    
+    try:
+        # Save file
+        with open(file_path, "wb") as buffer:
+            content = await file.read()
+            buffer.write(content)
+        
+        # Return file info
+        return {
+            "filename": file.filename,
+            "file_url": f"/uploads/{file_category}/{unique_filename}",
+            "file_size": len(content),
+            "file_type": file_category,
+            "message_type": MessageType.IMAGE if file_category == 'image' else MessageType.FILE
+        }
+        
+    except Exception as e:
+        # Clean up file if save fails
+        if file_path.exists():
+            file_path.unlink()
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to upload file: {str(e)}"
+        )
+
+# --- STATIC FILE SERVING ---
+@router.get("/uploads/{category}/{filename}")
+async def serve_file(category: str, filename: str):
+    """Serve uploaded files"""
+    import os
+    
+    # Get the current working directory and construct absolute path
+    current_dir = os.getcwd()
+    file_path = Path(current_dir) / "uploads" / category / filename
+    
+    print(f"🔍 Looking for file: {file_path}")
+    print(f"📁 File exists: {file_path.exists()}")
+    
+    if not file_path.exists():
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"File not found: {file_path}"
+        )
+    
+    # Determine content type based on file extension
+    ext = file_path.suffix.lower()
+    content_types = {
+        '.jpg': 'image/jpeg',
+        '.jpeg': 'image/jpeg',
+        '.png': 'image/png',
+        '.gif': 'image/gif',
+        '.bmp': 'image/bmp',
+        '.webp': 'image/webp',
+        '.pdf': 'application/pdf',
+        '.doc': 'application/msword',
+        '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        '.txt': 'text/plain',
+        '.rtf': 'application/rtf',
+        '.xls': 'application/vnd.ms-excel',
+        '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        '.csv': 'text/csv',
+        '.ppt': 'application/vnd.ms-powerpoint',
+        '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+        '.zip': 'application/zip',
+        '.rar': 'application/x-rar-compressed',
+        '.7z': 'application/x-7z-compressed'
+    }
+    
+    content_type = content_types.get(ext, 'application/octet-stream')
+    
+    try:
+        # Read and return file content
+        with open(file_path, "rb") as f:
+            content = f.read()
+        
+        from fastapi.responses import Response
+        return Response(
+            content=content,
+            media_type=content_type,
+            headers={
+                "Content-Disposition": f"inline; filename={filename}",
+                "Cache-Control": "public, max-age=31536000"
+            }
+        )
+    except Exception as e:
+        print(f"❌ Error reading file: {e}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error reading file: {str(e)}"
+        ) 

routes/patients.py

@@ -0,0 +1,1153 @@
+from fastapi import APIRouter, HTTPException, Depends, Query, status, Body
+from db.mongo import patients_collection, db  # Added db import
+from core.security import get_current_user
+from utils.db import create_indexes
+from utils.helpers import calculate_age, standardize_language
+from models.entities import Note, PatientCreate
+from models.schemas import PatientListResponse  # Fixed import
+from api.services.fhir_integration import HAPIFHIRIntegrationService
+from datetime import datetime
+from bson import ObjectId
+from bson.errors import InvalidId
+from typing import Optional, List, Dict, Any
+from pymongo import UpdateOne, DeleteOne
+from pymongo.errors import BulkWriteError
+import json
+from pathlib import Path
+import glob
+import uuid
+import re
+import logging
+import time
+import os
+from pydantic import BaseModel, Field
+from motor.motor_asyncio import AsyncIOMotorClient
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(name)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+# Configuration
+BASE_DIR = Path(__file__).resolve().parent.parent.parent
+SYNTHEA_DATA_DIR = BASE_DIR / "output" / "fhir"
+try:
+    os.makedirs(SYNTHEA_DATA_DIR, exist_ok=True)
+except PermissionError:
+    # In containerized environments, we might not have write permissions
+    # Use a temporary directory instead
+    import tempfile
+    SYNTHEA_DATA_DIR = Path(tempfile.gettempdir()) / "fhir"
+    os.makedirs(SYNTHEA_DATA_DIR, exist_ok=True)
+
+# Pydantic models for update validation
+class ConditionUpdate(BaseModel):
+    id: Optional[str] = None
+    code: Optional[str] = None
+    status: Optional[str] = None
+    onset_date: Optional[str] = None
+    recorded_date: Optional[str] = None
+    verification_status: Optional[str] = None
+    notes: Optional[str] = None
+
+class MedicationUpdate(BaseModel):
+    id: Optional[str] = None
+    name: Optional[str] = None
+    status: Optional[str] = None
+    prescribed_date: Optional[str] = None
+    requester: Optional[str] = None
+    dosage: Optional[str] = None
+
+class EncounterUpdate(BaseModel):
+    id: Optional[str] = None
+    type: Optional[str] = None
+    status: Optional[str] = None
+    period: Optional[Dict[str, str]] = None
+    service_provider: Optional[str] = None
+
+class NoteUpdate(BaseModel):
+    id: Optional[str] = None
+    title: Optional[str] = None
+    date: Optional[str] = None
+    author: Optional[str] = None
+    content: Optional[str] = None
+
+class PatientUpdate(BaseModel):
+    full_name: Optional[str] = None
+    gender: Optional[str] = None
+    date_of_birth: Optional[str] = None
+    address: Optional[str] = None
+    city: Optional[str] = None
+    state: Optional[str] = None
+    postal_code: Optional[str] = None
+    country: Optional[str] = None
+    marital_status: Optional[str] = None
+    language: Optional[str] = None
+    conditions: Optional[List[ConditionUpdate]] = None
+    medications: Optional[List[MedicationUpdate]] = None
+    encounters: Optional[List[EncounterUpdate]] = None
+    notes: Optional[List[NoteUpdate]] = None
+
+@router.get("/debug/count")
+async def debug_patient_count():
+    """Debug endpoint to verify patient counts"""
+    try:
+        total = await patients_collection.count_documents({})
+        synthea = await patients_collection.count_documents({"source": "synthea"})
+        manual = await patients_collection.count_documents({"source": "manual"})
+        return {
+            "total": total,
+            "synthea": synthea,
+            "manual": manual,
+            "message": f"Found {total} total patients ({synthea} from synthea, {manual} manual)"
+        }
+    except Exception as e:
+        logger.error(f"Error counting patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error counting patients: {str(e)}"
+        )
+
+@router.post("/patients", status_code=status.HTTP_201_CREATED)
+async def create_patient(
+    patient_data: PatientCreate,
+    current_user: dict = Depends(get_current_user)
+):
+    """Create a new patient in the database"""
+    logger.info(f"Creating new patient by user {current_user.get('email')}")
+    
+    if not any(role in current_user.get('roles', []) for role in ['admin', 'doctor']):
+        logger.warning(f"Unauthorized create attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators and doctors can create patients"
+        )
+    
+    try:
+        # Prepare the patient document
+        patient_doc = patient_data.dict()
+        now = datetime.utcnow().isoformat()
+        
+        # Add system-generated fields
+        patient_doc.update({
+            "fhir_id": str(uuid.uuid4()),
+            "import_date": now,
+            "last_updated": now,
+            "source": "manual",
+            "created_by": current_user.get('email')
+        })
+        
+        # Ensure arrays exist even if empty
+        for field in ['conditions', 'medications', 'encounters', 'notes']:
+            if field not in patient_doc:
+                patient_doc[field] = []
+        
+        # Insert the patient document
+        result = await patients_collection.insert_one(patient_doc)
+        
+        # Return the created patient with the generated ID
+        created_patient = await patients_collection.find_one(
+            {"_id": result.inserted_id}
+        )
+        
+        if not created_patient:
+            logger.error("Failed to retrieve created patient")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Failed to retrieve created patient"
+            )
+        
+        created_patient["id"] = str(created_patient["_id"])
+        del created_patient["_id"]
+        
+        logger.info(f"Successfully created patient {created_patient['fhir_id']}")
+        return created_patient
+        
+    except Exception as e:
+        logger.error(f"Failed to create patient: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create patient: {str(e)}"
+        )
+
+@router.delete("/patients/{patient_id}", status_code=status.HTTP_204_NO_CONTENT)
+async def delete_patient(
+    patient_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """Delete a patient from the database"""
+    logger.info(f"Deleting patient {patient_id} by user {current_user.get('email')}")
+    
+    if not any(role in current_user.get('roles', []) for role in ['admin', 'doctor']):
+        logger.warning(f"Unauthorized delete attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators can delete patients"
+        )
+    
+    try:
+        # Build the query based on whether patient_id is a valid ObjectId
+        query = {"fhir_id": patient_id}
+        if ObjectId.is_valid(patient_id):
+            query = {
+                "$or": [
+                    {"_id": ObjectId(patient_id)},
+                    {"fhir_id": patient_id}
+                ]
+            }
+        
+        # Check if patient exists
+        patient = await patients_collection.find_one(query)
+        
+        if not patient:
+            logger.warning(f"Patient not found for deletion: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        # Perform deletion
+        result = await patients_collection.delete_one(query)
+        
+        if result.deleted_count == 0:
+            logger.error(f"Failed to delete patient {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Failed to delete patient"
+            )
+        
+        logger.info(f"Successfully deleted patient {patient_id}")
+        return None
+        
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to delete patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to delete patient: {str(e)}"
+        )
+
+async def process_synthea_patient(bundle: dict, file_path: str) -> Optional[dict]:
+    logger.debug(f"Processing patient from file: {file_path}")
+    patient_data = {}
+    notes = []
+    conditions = []
+    medications = []
+    encounters = []
+    
+    # Validate bundle structure
+    if not isinstance(bundle, dict) or 'entry' not in bundle:
+        logger.error(f"Invalid FHIR bundle structure in {file_path}")
+        return None
+    
+    for entry in bundle.get('entry', []):
+        resource = entry.get('resource', {})
+        resource_type = resource.get('resourceType')
+        
+        if not resource_type:
+            logger.warning(f"Skipping entry with missing resourceType in {file_path}")
+            continue
+            
+        try:
+            if resource_type == 'Patient':
+                name = resource.get('name', [{}])[0]
+                address = resource.get('address', [{}])[0]
+                
+                # Construct full name and remove numbers
+                raw_full_name = f"{' '.join(name.get('given', ['']))} {name.get('family', '')}".strip()
+                clean_full_name = re.sub(r'\d+', '', raw_full_name).strip()
+                
+                patient_data = {
+                    'fhir_id': resource.get('id'),
+                    'full_name': clean_full_name,
+                    'gender': resource.get('gender', 'unknown'),
+                    'date_of_birth': resource.get('birthDate', ''),
+                    'address': ' '.join(address.get('line', [''])),
+                    'city': address.get('city', ''),
+                    'state': address.get('state', ''),
+                    'postal_code': address.get('postalCode', ''),
+                    'country': address.get('country', ''),
+                    'marital_status': resource.get('maritalStatus', {}).get('text', ''),
+                    'language': standardize_language(resource.get('communication', [{}])[0].get('language', {}).get('text', '')),
+                    'source': 'synthea',
+                    'last_updated': datetime.utcnow().isoformat()
+                }
+                
+            elif resource_type == 'Encounter':
+                encounter = {
+                    'id': resource.get('id'),
+                    'type': resource.get('type', [{}])[0].get('text', ''),
+                    'status': resource.get('status'),
+                    'period': resource.get('period', {}),
+                    'service_provider': resource.get('serviceProvider', {}).get('display', '')
+                }
+                encounters.append(encounter)
+                
+                for note in resource.get('note', []):
+                    if note.get('text'):
+                        notes.append({
+                            'date': resource.get('period', {}).get('start', datetime.utcnow().isoformat()),
+                            'type': resource.get('type', [{}])[0].get('text', 'Encounter Note'),
+                            'text': note.get('text'),
+                            'context': f"Encounter: {encounter.get('type')}",
+                            'author': 'System Generated'
+                        })
+                
+            elif resource_type == 'Condition':
+                conditions.append({
+                    'id': resource.get('id'),
+                    'code': resource.get('code', {}).get('text', ''),
+                    'status': resource.get('clinicalStatus', {}).get('text', ''),
+                    'onset_date': resource.get('onsetDateTime'),
+                    'recorded_date': resource.get('recordedDate'),
+                    'verification_status': resource.get('verificationStatus', {}).get('text', '')
+                })
+                
+            elif resource_type == 'MedicationRequest':
+                medications.append({
+                    'id': resource.get('id'),
+                    'name': resource.get('medicationCodeableConcept', {}).get('text', ''),
+                    'status': resource.get('status'),
+                    'prescribed_date': resource.get('authoredOn'),
+                    'requester': resource.get('requester', {}).get('display', ''),
+                    'dosage': resource.get('dosageInstruction', [{}])[0].get('text', '')
+                })
+                
+        except Exception as e:
+            logger.error(f"Error processing {resource_type} in {file_path}: {str(e)}")
+            continue
+    
+    if patient_data:
+        patient_data.update({
+            'notes': notes,
+            'conditions': conditions,
+            'medications': medications,
+            'encounters': encounters,
+            'import_date': datetime.utcnow().isoformat()
+        })
+        logger.info(f"Successfully processed patient {patient_data.get('fhir_id')} from {file_path}")
+        return patient_data
+    logger.warning(f"No valid patient data found in {file_path}")
+    return None
+
+@router.post("/import", status_code=status.HTTP_201_CREATED)
+async def import_patients(
+    limit: int = Query(100, ge=1, le=1000),
+    current_user: dict = Depends(get_current_user)
+):
+    request_id = str(uuid.uuid4())
+    logger.info(f"Starting import request {request_id} by user {current_user.get('email')}")
+    start_time = time.time()
+    
+    if current_user.get('role') not in ['admin', 'doctor']:
+        logger.warning(f"Unauthorized import attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators and doctors can import data"
+        )
+    
+    try:
+        await create_indexes()
+        
+        if not SYNTHEA_DATA_DIR.exists():
+            logger.error(f"Synthea data directory not found: {SYNTHEA_DATA_DIR}")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Data directory not found"
+            )
+            
+        # Filter out non-patient files
+        files = [
+            f for f in glob.glob(str(SYNTHEA_DATA_DIR / "*.json"))
+            if not re.search(r'(hospitalInformation|practitionerInformation)\d+\.json$', f)
+        ]
+        if not files:
+            logger.warning("No valid patient JSON files found in synthea data directory")
+            return {
+                "status": "success",
+                "message": "No patient data files found",
+                "imported": 0,
+                "request_id": request_id
+            }
+            
+        operations = []
+        imported = 0
+        errors = []
+        
+        for file_path in files[:limit]:
+            try:
+                logger.debug(f"Processing file: {file_path}")
+                
+                # Check file accessibility
+                if not os.path.exists(file_path):
+                    logger.error(f"File not found: {file_path}")
+                    errors.append(f"File not found: {file_path}")
+                    continue
+                    
+                # Check file size
+                file_size = os.path.getsize(file_path)
+                if file_size == 0:
+                    logger.warning(f"Empty file: {file_path}")
+                    errors.append(f"Empty file: {file_path}")
+                    continue
+                    
+                with open(file_path, 'r', encoding='utf-8') as f:
+                    try:
+                        bundle = json.load(f)
+                    except json.JSONDecodeError as je:
+                        logger.error(f"Invalid JSON in {file_path}: {str(je)}")
+                        errors.append(f"Invalid JSON in {file_path}: {str(je)}")
+                        continue
+                        
+                patient = await process_synthea_patient(bundle, file_path)
+                if patient:
+                    if not patient.get('fhir_id'):
+                        logger.warning(f"Missing FHIR ID in patient data from {file_path}")
+                        errors.append(f"Missing FHIR ID in {file_path}")
+                        continue
+                        
+                    operations.append(UpdateOne(
+                        {"fhir_id": patient['fhir_id']},
+                        {"$setOnInsert": patient},
+                        upsert=True
+                    ))
+                    imported += 1
+                else:
+                    logger.warning(f"No valid patient data in {file_path}")
+                    errors.append(f"No valid patient data in {file_path}")
+                    
+            except Exception as e:
+                logger.error(f"Error processing {file_path}: {str(e)}")
+                errors.append(f"Error in {file_path}: {str(e)}")
+                continue
+        
+        response = {
+            "status": "success",
+            "imported": imported,
+            "errors": errors,
+            "request_id": request_id,
+            "duration_seconds": time.time() - start_time
+        }
+        
+        if operations:
+            try:
+                result = await patients_collection.bulk_write(operations, ordered=False)
+                response.update({
+                    "upserted": result.upserted_count,
+                    "existing": len(operations) - result.upserted_count
+                })
+                logger.info(f"Import request {request_id} completed: {imported} patients processed, "
+                           f"{result.upserted_count} upserted, {len(errors)} errors")
+            except BulkWriteError as bwe:
+                logger.error(f"Partial bulk write failure for request {request_id}: {str(bwe.details)}")
+                response.update({
+                    "upserted": bwe.details.get('nUpserted', 0),
+                    "existing": len(operations) - bwe.details.get('nUpserted', 0),
+                    "write_errors": [
+                        f"Index {err['index']}: {err['errmsg']}" for err in bwe.details.get('writeErrors', [])
+                    ]
+                })
+                logger.info(f"Import request {request_id} partially completed: {imported} patients processed, "
+                           f"{response['upserted']} upserted, {len(errors)} errors")
+            except Exception as e:
+                logger.error(f"Bulk write failed for request {request_id}: {str(e)}")
+                raise HTTPException(
+                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                    detail=f"Database operation failed: {str(e)}"
+                )
+        else:
+            logger.info(f"Import request {request_id} completed: No new patients to import, {len(errors)} errors")
+            response["message"] = "No new patients found to import"
+            
+        return response
+        
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Import request {request_id} failed: {str(e)}", exc_info=True)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Import failed: {str(e)}"
+        )
+
+@router.post("/patients/import-ehr", status_code=status.HTTP_201_CREATED)
+async def import_ehr_patients(
+    ehr_data: List[dict],
+    ehr_system: str = Query(..., description="Name of the EHR system"),
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Import patients from external EHR system"""
+    logger.info(f"Importing {len(ehr_data)} patients from EHR system: {ehr_system}")
+    
+    if not any(role in current_user.get('roles', []) for role in ['admin', 'doctor']):
+        logger.warning(f"Unauthorized EHR import attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators and doctors can import EHR patients"
+        )
+    
+    try:
+        imported_patients = []
+        skipped_patients = []
+        
+        for patient_data in ehr_data:
+            # Check if patient already exists by multiple criteria
+            existing_patient = await patients_collection.find_one({
+                "$or": [
+                    {"ehr_id": patient_data.get("ehr_id"), "ehr_system": ehr_system},
+                    {"full_name": patient_data.get("full_name"), "date_of_birth": patient_data.get("date_of_birth")},
+                    {"national_id": patient_data.get("national_id")} if patient_data.get("national_id") else {}
+                ]
+            })
+            
+            if existing_patient:
+                skipped_patients.append(patient_data.get("full_name", "Unknown"))
+                logger.info(f"Patient {patient_data.get('full_name', 'Unknown')} already exists, skipping...")
+                continue
+            
+            # Prepare patient document for EHR import
+            patient_doc = {
+                "full_name": patient_data.get("full_name"),
+                "date_of_birth": patient_data.get("date_of_birth"),
+                "gender": patient_data.get("gender"),
+                "address": patient_data.get("address"),
+                "national_id": patient_data.get("national_id"),
+                "blood_type": patient_data.get("blood_type"),
+                "allergies": patient_data.get("allergies", []),
+                "chronic_conditions": patient_data.get("chronic_conditions", []),
+                "medications": patient_data.get("medications", []),
+                "emergency_contact_name": patient_data.get("emergency_contact_name"),
+                "emergency_contact_phone": patient_data.get("emergency_contact_phone"),
+                "insurance_provider": patient_data.get("insurance_provider"),
+                "insurance_policy_number": patient_data.get("insurance_policy_number"),
+                "contact": patient_data.get("contact"),
+                "source": "ehr",
+                "ehr_id": patient_data.get("ehr_id"),
+                "ehr_system": ehr_system,
+                "status": "active",
+                "registration_date": datetime.now(),
+                "created_by": current_user.get('email'),
+                "created_at": datetime.now(),
+                "updated_at": datetime.now()
+            }
+            
+            # Insert patient
+            result = await patients_collection.insert_one(patient_doc)
+            imported_patients.append(patient_data.get("full_name", "Unknown"))
+        
+        logger.info(f"Successfully imported {len(imported_patients)} patients, skipped {len(skipped_patients)}")
+        
+        return {
+            "message": f"Successfully imported {len(imported_patients)} patients from {ehr_system}",
+            "imported_count": len(imported_patients),
+            "skipped_count": len(skipped_patients),
+            "imported_patients": imported_patients,
+            "skipped_patients": skipped_patients
+        }
+        
+    except Exception as e:
+        logger.error(f"Error importing EHR patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error importing EHR patients: {str(e)}"
+        )
+
+@router.get("/patients/sources", response_model=List[dict])
+async def get_patient_sources(
+    current_user: dict = Depends(get_current_user)
+):
+    """Get available patient sources and their counts"""
+    try:
+        # Get counts for each source
+        source_counts = await patients_collection.aggregate([
+            {
+                "$group": {
+                    "_id": "$source",
+                    "count": {"$sum": 1}
+                }
+            }
+        ]).to_list(length=None)
+        
+        # Format the response
+        sources = []
+        for source_count in source_counts:
+            source_name = source_count["_id"] or "unknown"
+            sources.append({
+                "source": source_name,
+                "count": source_count["count"],
+                "label": source_name.replace("_", " ").title()
+            })
+        
+        return sources
+        
+    except Exception as e:
+        logger.error(f"Error getting patient sources: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error getting patient sources: {str(e)}"
+        )
+
+@router.get("/patients", response_model=PatientListResponse)
+async def get_patients(
+    page: int = Query(1, ge=1),
+    limit: int = Query(20, ge=1, le=100),
+    search: Optional[str] = Query(None),
+    source: Optional[str] = Query(None),  # Filter by patient source
+    patient_status: Optional[str] = Query(None),   # Filter by patient status
+    doctor_id: Optional[str] = Query(None), # Filter by assigned doctor
+    current_user: dict = Depends(get_current_user),
+    db_client: AsyncIOMotorClient = Depends(lambda: db)
+):
+    """Get patients with filtering options"""
+    skip = (page - 1) * limit
+    user_id = current_user["_id"]
+    
+    # Debug logging
+    logger.info(f"🔍 Getting patients for user: {current_user.get('email')} with roles: {current_user.get('roles', [])}")
+    
+    # Build filter query
+    filter_query = {}
+    
+    # Role-based access - apply this first
+    if 'admin' not in current_user.get('roles', []):
+        if 'doctor' in current_user.get('roles', []):
+            # Doctors can see all patients for now (temporarily simplified)
+            logger.info("👨‍⚕️ Doctor access - no restrictions applied")
+            pass  # No restrictions for doctors
+        else:
+            # Patients can only see their own record
+            logger.info(f"👤 Patient access - restricting to own record: {user_id}")
+            filter_query["_id"] = ObjectId(user_id)
+    
+    # Build additional filters
+    additional_filters = {}
+    
+    # Add search filter
+    if search:
+        additional_filters["$or"] = [
+            {"full_name": {"$regex": search, "$options": "i"}},
+            {"national_id": {"$regex": search, "$options": "i"}},
+            {"ehr_id": {"$regex": search, "$options": "i"}}
+        ]
+    
+    # Add source filter
+    if source:
+        additional_filters["source"] = source
+    
+    # Add status filter
+    if patient_status:
+        additional_filters["status"] = patient_status
+    
+    # Add doctor assignment filter
+    if doctor_id:
+        additional_filters["assigned_doctor_id"] = ObjectId(doctor_id)
+    
+    # Combine filters
+    if additional_filters:
+        if filter_query.get("$or"):
+            # If we have role-based $or, we need to combine with additional filters
+            # Create a new $and condition
+            filter_query = {
+                "$and": [
+                    filter_query,
+                    additional_filters
+                ]
+            }
+        else:
+            # No role-based restrictions, just use additional filters
+            filter_query.update(additional_filters)
+    
+    logger.info(f"🔍 Final filter query: {filter_query}")
+    
+    try:
+        # Get total count
+        total = await patients_collection.count_documents(filter_query)
+        logger.info(f"📊 Total patients matching filter: {total}")
+        
+        # Get patients with pagination
+        patients_cursor = patients_collection.find(filter_query).skip(skip).limit(limit)
+        patients = await patients_cursor.to_list(length=limit)
+        logger.info(f"📋 Retrieved {len(patients)} patients")
+        
+        # Process patients to include doctor names and format dates
+        processed_patients = []
+        for patient in patients:
+            # Get assigned doctor name if exists
+            assigned_doctor_name = None
+            if patient.get("assigned_doctor_id"):
+                doctor = await db_client.users.find_one({"_id": patient["assigned_doctor_id"]})
+                if doctor:
+                    assigned_doctor_name = doctor.get("full_name")
+            
+            # Convert ObjectId to string
+            patient["id"] = str(patient["_id"])
+            del patient["_id"]
+            
+            # Add assigned doctor name
+            patient["assigned_doctor_name"] = assigned_doctor_name
+            
+            processed_patients.append(patient)
+        
+        logger.info(f"✅ Returning {len(processed_patients)} processed patients")
+        
+        return PatientListResponse(
+            patients=processed_patients,
+            total=total,
+            page=page,
+            limit=limit,
+            source_filter=source,
+            status_filter=patient_status
+        )
+        
+    except Exception as e:
+        logger.error(f"❌ Error fetching patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Error fetching patients: {str(e)}"
+        )
+
+@router.get("/patients/{patient_id}", response_model=dict)
+async def get_patient(patient_id: str):
+    logger.info(f"Retrieving patient: {patient_id}")
+    try:
+        patient = await patients_collection.find_one({
+            "$or": [
+                {"_id": ObjectId(patient_id)},
+                {"fhir_id": patient_id}
+            ]
+        })
+        
+        if not patient:
+            logger.warning(f"Patient not found: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        response = {
+            "demographics": {
+                "id": str(patient["_id"]),
+                "fhir_id": patient.get("fhir_id"),
+                "full_name": patient.get("full_name"),
+                "gender": patient.get("gender"),
+                "date_of_birth": patient.get("date_of_birth"),
+                "age": calculate_age(patient.get("date_of_birth")),
+                "address": {
+                    "line": patient.get("address"),
+                    "city": patient.get("city"),
+                    "state": patient.get("state"),
+                    "postal_code": patient.get("postal_code"),
+                    "country": patient.get("country")
+                },
+                "marital_status": patient.get("marital_status"),
+                "language": patient.get("language")
+            },
+            "clinical_data": {
+                "notes": patient.get("notes", []),
+                "conditions": patient.get("conditions", []),
+                "medications": patient.get("medications", []),
+                "encounters": patient.get("encounters", [])
+            },
+            "metadata": {
+                "source": patient.get("source"),
+                "import_date": patient.get("import_date"),
+                "last_updated": patient.get("last_updated")
+            }
+        }
+        
+        logger.info(f"Successfully retrieved patient: {patient_id}")
+        return response
+        
+    except ValueError as ve:
+        logger.error(f"Invalid patient ID format: {patient_id}, error: {str(ve)}")
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient ID format"
+        )
+    except Exception as e:
+        logger.error(f"Failed to retrieve patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to retrieve patient: {str(e)}"
+        )
+
+@router.post("/{patient_id}/notes", status_code=status.HTTP_201_CREATED)
+async def add_note(
+    patient_id: str,
+    note: Note,
+    current_user: dict = Depends(get_current_user)
+):
+    logger.info(f"Adding note for patient {patient_id} by user {current_user.get('email')}")
+    if current_user.get('role') not in ['doctor', 'admin']:
+        logger.warning(f"Unauthorized note addition attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only clinicians can add notes"
+        )
+    
+    try:
+        note_data = note.dict()
+        note_data.update({
+            "author": current_user.get('full_name', 'System'),
+            "timestamp": datetime.utcnow().isoformat()
+        })
+        
+        result = await patients_collection.update_one(
+            {"$or": [
+                {"_id": ObjectId(patient_id)},
+                {"fhir_id": patient_id}
+            ]},
+            {
+                "$push": {"notes": note_data},
+                "$set": {"last_updated": datetime.utcnow().isoformat()}
+            }
+        )
+        
+        if result.modified_count == 0:
+            logger.warning(f"Patient not found for note addition: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        logger.info(f"Note added successfully for patient {patient_id}")
+        return {"status": "success", "message": "Note added"}
+        
+    except ValueError as ve:
+        logger.error(f"Invalid patient ID format: {patient_id}, error: {str(ve)}")
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient ID format"
+        )
+    except Exception as e:
+        logger.error(f"Failed to add note for patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to add note: {str(e)}"
+        )
+
+@router.put("/patients/{patient_id}", status_code=status.HTTP_200_OK)
+async def update_patient(
+    patient_id: str,
+    update_data: PatientUpdate,
+    current_user: dict = Depends(get_current_user)
+):
+    """Update a patient's record in the database"""
+    logger.info(f"Updating patient {patient_id} by user {current_user.get('email')}")
+    
+    if not any(role in current_user.get('roles', []) for role in ['admin', 'doctor']):
+        logger.warning(f"Unauthorized update attempt by {current_user.get('email')}")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only administrators and doctors can update patients"
+        )
+    
+    try:
+        # Build the query based on whether patient_id is a valid ObjectId
+        query = {"fhir_id": patient_id}
+        if ObjectId.is_valid(patient_id):
+            query = {
+                "$or": [
+                    {"_id": ObjectId(patient_id)},
+                    {"fhir_id": patient_id}
+                ]
+            }
+        
+        # Check if patient exists
+        patient = await patients_collection.find_one(query)
+        if not patient:
+            logger.warning(f"Patient not found for update: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        # Prepare update operations
+        update_ops = {"$set": {"last_updated": datetime.utcnow().isoformat()}}
+        
+        # Handle demographic updates
+        demographics = {
+            "full_name": update_data.full_name,
+            "gender": update_data.gender,
+            "date_of_birth": update_data.date_of_birth,
+            "address": update_data.address,
+            "city": update_data.city,
+            "state": update_data.state,
+            "postal_code": update_data.postal_code,
+            "country": update_data.country,
+            "marital_status": update_data.marital_status,
+            "language": update_data.language
+        }
+        for key, value in demographics.items():
+            if value is not None:
+                update_ops["$set"][key] = value
+        
+        # Handle array updates (conditions, medications, encounters, notes)
+        array_fields = {
+            "conditions": update_data.conditions,
+            "medications": update_data.medications,
+            "encounters": update_data.encounters,
+            "notes": update_data.notes
+        }
+        
+        for field, items in array_fields.items():
+            if items is not None:
+                # Fetch existing items
+                existing_items = patient.get(field, [])
+                updated_items = []
+                
+                for item in items:
+                    item_dict = item.dict(exclude_unset=True)
+                    if not item_dict:
+                        continue
+                    
+                    # Generate ID for new items
+                    if not item_dict.get("id"):
+                        item_dict["id"] = str(uuid.uuid4())
+                    
+                    # Validate required fields
+                    if field == "conditions" and not item_dict.get("code"):
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Condition code is required for {field}"
+                        )
+                    if field == "medications" and not item_dict.get("name"):
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Medication name is required for {field}"
+                        )
+                    if field == "encounters" and not item_dict.get("type"):
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Encounter type is required for {field}"
+                        )
+                    if field == "notes" and not item_dict.get("content"):
+                        raise HTTPException(
+                            status_code=status.HTTP_400_BAD_REQUEST,
+                            detail=f"Note content is required for {field}"
+                        )
+                    
+                    updated_items.append(item_dict)
+                
+                # Replace the entire array
+                update_ops["$set"][field] = updated_items
+        
+        # Perform the update
+        result = await patients_collection.update_one(query, update_ops)
+        
+        if result.modified_count == 0 and result.matched_count == 0:
+            logger.warning(f"Patient not found for update: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail="Patient not found"
+            )
+        
+        # Retrieve and return the updated patient
+        updated_patient = await patients_collection.find_one(query)
+        if not updated_patient:
+            logger.error(f"Failed to retrieve updated patient: {patient_id}")
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail="Failed to retrieve updated patient"
+            )
+        
+        response = {
+            "id": str(updated_patient["_id"]),
+            "fhir_id": updated_patient.get("fhir_id"),
+            "full_name": updated_patient.get("full_name"),
+            "gender": updated_patient.get("gender"),
+            "date_of_birth": updated_patient.get("date_of_birth"),
+            "address": updated_patient.get("address"),
+            "city": updated_patient.get("city"),
+            "state": updated_patient.get("state"),
+            "postal_code": updated_patient.get("postal_code"),
+            "country": updated_patient.get("country"),
+            "marital_status": updated_patient.get("marital_status"),
+            "language": updated_patient.get("language"),
+            "conditions": updated_patient.get("conditions", []),
+            "medications": updated_patient.get("medications", []),
+            "encounters": updated_patient.get("encounters", []),
+            "notes": updated_patient.get("notes", []),
+            "source": updated_patient.get("source"),
+            "import_date": updated_patient.get("import_date"),
+            "last_updated": updated_patient.get("last_updated")
+        }
+        
+        logger.info(f"Successfully updated patient {patient_id}")
+        return response
+        
+    except ValueError as ve:
+        logger.error(f"Invalid patient ID format: {patient_id}, error: {str(ve)}")
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Invalid patient ID format"
+        )
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Failed to update patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to update patient: {str(e)}"
+        )
+
+# FHIR Integration Endpoints
+@router.post("/patients/import-hapi-fhir", status_code=status.HTTP_201_CREATED)
+async def import_hapi_patients(
+    limit: int = Query(20, ge=1, le=100, description="Number of patients to import"),
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Import patients from HAPI FHIR Test Server
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        result = await service.import_patients_from_hapi(limit=limit)
+        
+        # Create detailed message
+        message_parts = []
+        if result["imported_count"] > 0:
+            message_parts.append(f"Successfully imported {result['imported_count']} patients")
+        if result["skipped_count"] > 0:
+            message_parts.append(f"Skipped {result['skipped_count']} duplicate patients")
+        if result["errors"]:
+            message_parts.append(f"Encountered {len(result['errors'])} errors")
+        
+        message = ". ".join(message_parts) + " from HAPI FHIR"
+        
+        return {
+            "message": message,
+            "imported_count": result["imported_count"],
+            "skipped_count": result["skipped_count"],
+            "total_found": result["total_found"],
+            "imported_patients": result["imported_patients"],
+            "skipped_patients": result["skipped_patients"],
+            "errors": result["errors"],
+            "source": "hapi_fhir"
+        }
+        
+    except Exception as e:
+        logger.error(f"Error importing HAPI FHIR patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to import patients from HAPI FHIR: {str(e)}"
+        )
+
+@router.post("/patients/sync-patient/{patient_id}")
+async def sync_patient_data(
+    patient_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Sync a specific patient's data from HAPI FHIR
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        success = await service.sync_patient_data(patient_id)
+        
+        if success:
+            return {
+                "message": f"Successfully synced patient {patient_id} from HAPI FHIR",
+                "patient_id": patient_id,
+                "success": True
+            }
+        else:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail=f"Patient {patient_id} not found in HAPI FHIR or sync failed"
+            )
+            
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Error syncing patient {patient_id}: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to sync patient: {str(e)}"
+        )
+
+@router.get("/patients/hapi-fhir/patients")
+async def get_hapi_patients(
+    limit: int = Query(50, ge=1, le=200, description="Number of patients to fetch"),
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Get patients from HAPI FHIR without importing them
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        patients = await service.get_hapi_patients(limit=limit)
+        
+        return {
+            "patients": patients,
+            "count": len(patients),
+            "source": "hapi_fhir"
+        }
+        
+    except Exception as e:
+        logger.error(f"Error fetching HAPI FHIR patients: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to fetch patients from HAPI FHIR: {str(e)}"
+        )
+
+@router.get("/patients/hapi-fhir/patients/{patient_id}")
+async def get_hapi_patient_details(
+    patient_id: str,
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Get detailed information for a specific HAPI FHIR patient
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        patient_details = await service.get_hapi_patient_details(patient_id)
+        
+        if not patient_details:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail=f"Patient {patient_id} not found in HAPI FHIR"
+            )
+        
+        return patient_details
+        
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Error fetching HAPI FHIR patient details: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to fetch patient details from HAPI FHIR: {str(e)}"
+        )
+
+@router.get("/patients/hapi-fhir/statistics")
+async def get_hapi_statistics(
+    current_user: dict = Depends(get_current_user)
+):
+    """
+    Get statistics about HAPI FHIR imported patients
+    """
+    try:
+        service = HAPIFHIRIntegrationService()
+        stats = await service.get_patient_statistics()
+        
+        return {
+            "statistics": stats,
+            "source": "hapi_fhir"
+        }
+        
+    except Exception as e:
+        logger.error(f"Error getting HAPI FHIR statistics: {str(e)}")
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to get HAPI FHIR statistics: {str(e)}"
+        )
+
+# Export the router as 'patients' for api.__init__.py
+patients = router

routes/pdf.py

@@ -0,0 +1,268 @@
+from fastapi import APIRouter, HTTPException, Depends, Response
+from db.mongo import patients_collection
+from core.security import get_current_user
+from utils.helpers import calculate_age, escape_latex_special_chars, hyphenate_long_strings, format_timestamp
+from datetime import datetime
+from bson import ObjectId
+from bson.errors import InvalidId
+import os
+import subprocess
+from tempfile import TemporaryDirectory
+from string import Template
+import logging
+
+# Configure logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(name)s - %(message)s'
+)
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+@router.get("/{patient_id}/pdf", response_class=Response)
+async def generate_patient_pdf(patient_id: str, current_user: dict = Depends(get_current_user)):
+    # Suppress logging for this route
+    logger.setLevel(logging.CRITICAL)
+
+    try:
+        if current_user.get('role') not in ['doctor', 'admin']:
+            raise HTTPException(status_code=403, detail="Only clinicians can generate patient PDFs")
+
+        # Determine if patient_id is ObjectId or fhir_id
+        try:
+            obj_id = ObjectId(patient_id)
+            query = {"$or": [{"_id": obj_id}, {"fhir_id": patient_id}]}
+        except InvalidId:
+            query = {"fhir_id": patient_id}
+
+        patient = await patients_collection.find_one(query)
+        if not patient:
+            raise HTTPException(status_code=404, detail="Patient not found")
+
+        # Prepare table content with proper LaTeX formatting
+        def prepare_table_content(items, columns, default_message):
+            if not items:
+                return f"\\multicolumn{{{columns}}}{{l}}{{{default_message}}} \\\\"
+            
+            content = []
+            for item in items:
+                row = []
+                for field in item:
+                    value = item.get(field, "") or ""
+                    row.append(escape_latex_special_chars(hyphenate_long_strings(value)))
+                content.append(" & ".join(row) + " \\\\")
+            return "\n".join(content)
+
+        # Notes table
+        notes = patient.get("notes", [])
+        notes_content = prepare_table_content(
+            [{
+                "date": format_timestamp(n.get("date", "")),
+                "type": n.get("type", ""),
+                "text": n.get("text", "")
+            } for n in notes],
+            3,
+            "No notes available"
+        )
+
+        # Conditions table
+        conditions = patient.get("conditions", [])
+        conditions_content = prepare_table_content(
+            [{
+                "id": c.get("id", ""),
+                "code": c.get("code", ""),
+                "status": c.get("status", ""),
+                "onset": format_timestamp(c.get("onset_date", "")),
+                "verification": c.get("verification_status", "")
+            } for c in conditions],
+            5,
+            "No conditions available"
+        )
+
+        # Medications table
+        medications = patient.get("medications", [])
+        medications_content = prepare_table_content(
+            [{
+                "id": m.get("id", ""),
+                "name": m.get("name", ""),
+                "status": m.get("status", ""),
+                "date": format_timestamp(m.get("prescribed_date", "")),
+                "dosage": m.get("dosage", "")
+            } for m in medications],
+            5,
+            "No medications available"
+        )
+
+        # Encounters table
+        encounters = patient.get("encounters", [])
+        encounters_content = prepare_table_content(
+            [{
+                "id": e.get("id", ""),
+                "type": e.get("type", ""),
+                "status": e.get("status", ""),
+                "start": format_timestamp(e.get("period", {}).get("start", "")),
+                "provider": e.get("service_provider", "")
+            } for e in encounters],
+            5,
+            "No encounters available"
+        )
+
+        # LaTeX template with improved table formatting
+        latex_template = Template(r"""
+\documentclass[a4paper,12pt]{article}
+\usepackage[utf8]{inputenc}
+\usepackage[T1]{fontenc}
+\usepackage{geometry}
+\geometry{margin=1in}
+\usepackage{booktabs,longtable,fancyhdr}
+\usepackage{array}
+\usepackage{microtype}
+\microtypesetup{expansion=false}
+\setlength{\headheight}{14.5pt}
+\pagestyle{fancy}
+\fancyhf{}
+\fancyhead[L]{Patient Report}
+\fancyhead[R]{Generated: \today}
+\fancyfoot[C]{\thepage}
+\begin{document}
+\begin{center}
+    \Large\textbf{Patient Medical Report} \\
+    \vspace{0.2cm}
+    \textit{Generated on $generated_on}
+\end{center}
+\section*{Demographics}
+\begin{itemize}
+    \item \textbf{FHIR ID:} $fhir_id
+    \item \textbf{Full Name:} $full_name
+    \item \textbf{Gender:} $gender
+    \item \textbf{Date of Birth:} $dob
+    \item \textbf{Age:} $age
+    \item \textbf{Address:} $address
+    \item \textbf{Marital Status:} $marital_status
+    \item \textbf{Language:} $language
+\end{itemize}
+\section*{Clinical Notes}
+\begin{longtable}[l]{>{\raggedright\arraybackslash}p{3.5cm}>{\raggedright\arraybackslash}p{3cm}>{\raggedright\arraybackslash}p{6.5cm}}
+\caption{Clinical Notes} \\
+\toprule
+\textbf{Date} & \textbf{Type} & \textbf{Text} \\
+\midrule
+$notes
+\bottomrule
+\end{longtable}
+\section*{Conditions}
+\begin{longtable}[l]{>{\raggedright\arraybackslash}p{2cm}>{\raggedright\arraybackslash}p{3cm}>{\raggedright\arraybackslash}p{2cm}>{\raggedright\arraybackslash}p{3.5cm}>{\raggedright\arraybackslash}p{3cm}}
+\caption{Conditions} \\
+\toprule
+\textbf{ID} & \textbf{Code} & \textbf{Status} & \textbf{Onset} & \textbf{Verification} \\
+\midrule
+$conditions
+\bottomrule
+\end{longtable}
+\section*{Medications}
+\begin{longtable}[l]{>{\raggedright\arraybackslash}p{2cm}>{\raggedright\arraybackslash}p{4cm}>{\raggedright\arraybackslash}p{2cm}>{\raggedright\arraybackslash}p{3.5cm}>{\raggedright\arraybackslash}p{3cm}}
+\caption{Medications} \\
+\toprule
+\textbf{ID} & \textbf{Name} & \textbf{Status} & \textbf{Date} & \textbf{Dosage} \\
+\midrule
+$medications
+\bottomrule
+\end{longtable}
+\section*{Encounters}
+\begin{longtable}[l]{>{\raggedright\arraybackslash}p{2.5cm}>{\raggedright\arraybackslash}p{4.5cm}>{\raggedright\arraybackslash}p{2.5cm}>{\raggedright\arraybackslash}p{4.5cm}>{\raggedright\arraybackslash}p{3.5cm}}
+\caption{Encounters} \\
+\toprule
+\textbf{ID} & \textbf{Type} & \textbf{Status} & \textbf{Start} & \textbf{Provider} \\
+\midrule
+$encounters
+\bottomrule
+\end{longtable}
+\end{document}
+""")
+
+        # Set the generated_on date to 02:54 PM CET, May 17, 2025
+        generated_on = datetime.strptime("2025-05-17 14:54:00+02:00", "%Y-%m-%d %H:%M:%S%z").strftime("%A, %B %d, %Y at %I:%M %p %Z")
+
+        latex_filled = latex_template.substitute(
+            generated_on=generated_on,
+            fhir_id=escape_latex_special_chars(hyphenate_long_strings(patient.get("fhir_id", "") or "")),
+            full_name=escape_latex_special_chars(patient.get("full_name", "") or ""),
+            gender=escape_latex_special_chars(patient.get("gender", "") or ""),
+            dob=escape_latex_special_chars(patient.get("date_of_birth", "") or ""),
+            age=escape_latex_special_chars(str(calculate_age(patient.get("date_of_birth", "")) or "N/A")),
+            address=escape_latex_special_chars(", ".join(filter(None, [
+                patient.get("address", ""),
+                patient.get("city", ""),
+                patient.get("state", ""),
+                patient.get("postal_code", ""),
+                patient.get("country", "")
+            ]))),
+            marital_status=escape_latex_special_chars(patient.get("marital_status", "") or ""),
+            language=escape_latex_special_chars(patient.get("language", "") or ""),
+            notes=notes_content,
+            conditions=conditions_content,
+            medications=medications_content,
+            encounters=encounters_content
+        )
+
+        # Compile LaTeX in a temporary directory
+        with TemporaryDirectory() as tmpdir:
+            tex_path = os.path.join(tmpdir, "report.tex")
+            pdf_path = os.path.join(tmpdir, "report.pdf")
+
+            with open(tex_path, "w", encoding="utf-8") as f:
+                f.write(latex_filled)
+
+            try:
+                # Run latexmk twice to ensure proper table rendering
+                for _ in range(2):
+                    result = subprocess.run(
+                        ["latexmk", "-pdf", "-interaction=nonstopmode", tex_path],
+                        cwd=tmpdir,
+                        check=False,
+                        capture_output=True,
+                        text=True
+                    )
+                
+                if result.returncode != 0:
+                    raise HTTPException(
+                        status_code=500,
+                        detail=f"LaTeX compilation failed: stdout={result.stdout}, stderr={result.stderr}"
+                    )
+
+            except subprocess.CalledProcessError as e:
+                raise HTTPException(
+                    status_code=500,
+                    detail=f"LaTeX compilation failed: stdout={e.stdout}, stderr={e.stderr}"
+                )
+
+            if not os.path.exists(pdf_path):
+                raise HTTPException(
+                    status_code=500,
+                    detail="PDF file was not generated"
+                )
+
+            with open(pdf_path, "rb") as f:
+                pdf_bytes = f.read()
+
+            response = Response(
+                content=pdf_bytes,
+                media_type="application/pdf",
+                headers={"Content-Disposition": f"attachment; filename=patient_{patient.get('fhir_id', 'unknown')}_report.pdf"}
+            )
+            return response
+
+    except HTTPException as http_error:
+        raise http_error
+    except Exception as e:
+        raise HTTPException(
+            status_code=500,
+            detail=f"Unexpected error generating PDF: {str(e)}"
+        )
+    finally:
+        # Restore the logger level for other routes
+        logger.setLevel(logging.INFO)
+
+# Export the router as 'pdf' for api.__init__.py
+pdf = router

routes/txagent.py

@@ -0,0 +1,170 @@
+from fastapi import APIRouter, Depends, HTTPException, UploadFile, File, Form
+from fastapi.responses import StreamingResponse
+from typing import Optional, List
+from pydantic import BaseModel
+from core.security import get_current_user
+from api.services.txagent_service import txagent_service
+import logging
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter()
+
+class ChatRequest(BaseModel):
+    message: str
+    history: Optional[List[dict]] = None
+    patient_id: Optional[str] = None
+
+class VoiceOutputRequest(BaseModel):
+    text: str
+    language: str = "en-US"
+
+@router.get("/txagent/status")
+async def get_txagent_status(current_user: dict = Depends(get_current_user)):
+    """Obtient le statut du service TxAgent"""
+    try:
+        status = await txagent_service.get_status()
+        return {
+            "status": "success",
+            "txagent_status": status,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error getting TxAgent status: {e}")
+        raise HTTPException(status_code=500, detail="Failed to get TxAgent status")
+
+@router.post("/txagent/chat")
+async def chat_with_txagent(
+    request: ChatRequest,
+    current_user: dict = Depends(get_current_user)
+):
+    """Chat avec TxAgent"""
+    try:
+        # Vérifier que l'utilisateur est médecin ou admin
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can use TxAgent")
+        
+        response = await txagent_service.chat(
+            message=request.message,
+            history=request.history,
+            patient_id=request.patient_id
+        )
+        
+        return {
+            "status": "success",
+            "response": response,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error in TxAgent chat: {e}")
+        raise HTTPException(status_code=500, detail="Failed to process chat request")
+
+@router.post("/txagent/voice/transcribe")
+async def transcribe_audio(
+    audio: UploadFile = File(...),
+    current_user: dict = Depends(get_current_user)
+):
+    """Transcription vocale avec TxAgent"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can use voice features")
+        
+        audio_data = await audio.read()
+        result = await txagent_service.voice_transcribe(audio_data)
+        
+        return {
+            "status": "success",
+            "transcription": result,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error in voice transcription: {e}")
+        raise HTTPException(status_code=500, detail="Failed to transcribe audio")
+
+@router.post("/txagent/voice/synthesize")
+async def synthesize_speech(
+    request: VoiceOutputRequest,
+    current_user: dict = Depends(get_current_user)
+):
+    """Synthèse vocale avec TxAgent"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can use voice features")
+        
+        audio_data = await txagent_service.voice_synthesize(
+            text=request.text,
+            language=request.language
+        )
+        
+        return StreamingResponse(
+            iter([audio_data]),
+            media_type="audio/mpeg",
+            headers={
+                "Content-Disposition": "attachment; filename=synthesized_speech.mp3"
+            }
+        )
+    except Exception as e:
+        logger.error(f"Error in voice synthesis: {e}")
+        raise HTTPException(status_code=500, detail="Failed to synthesize speech")
+
+@router.post("/txagent/patients/analyze")
+async def analyze_patient_data(
+    patient_data: dict,
+    current_user: dict = Depends(get_current_user)
+):
+    """Analyse de données patient avec TxAgent"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can use analysis features")
+        
+        analysis = await txagent_service.analyze_patient(patient_data)
+        
+        return {
+            "status": "success",
+            "analysis": analysis,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error in patient analysis: {e}")
+        raise HTTPException(status_code=500, detail="Failed to analyze patient data")
+
+@router.get("/txagent/chats")
+async def get_chats(current_user: dict = Depends(get_current_user)):
+    """Obtient l'historique des chats"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can access chats")
+        
+        # Cette fonction devra être implémentée dans le service TxAgent
+        chats = await txagent_service.get_chats()
+        
+        return {
+            "status": "success",
+            "chats": chats,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error getting chats: {e}")
+        raise HTTPException(status_code=500, detail="Failed to get chats")
+
+@router.get("/txagent/patients/analysis-results")
+async def get_analysis_results(
+    risk_filter: Optional[str] = None,
+    current_user: dict = Depends(get_current_user)
+):
+    """Obtient les résultats d'analyse des patients"""
+    try:
+        if not any(role in current_user.get('roles', []) for role in ['doctor', 'admin']):
+            raise HTTPException(status_code=403, detail="Only doctors and admins can access analysis results")
+        
+        # Cette fonction devra être implémentée dans le service TxAgent
+        results = await txagent_service.get_analysis_results(risk_filter)
+        
+        return {
+            "status": "success",
+            "results": results,
+            "mode": txagent_service.config.get_txagent_mode()
+        }
+    except Exception as e:
+        logger.error(f"Error getting analysis results: {e}")
+        raise HTTPException(status_code=500, detail="Failed to get analysis results")

services/fhir_integration.py

@@ -0,0 +1,243 @@
+from datetime import datetime
+from typing import List, Dict, Optional
+from api.utils.fhir_client import HAPIFHIRClient
+from db.mongo import db
+
+class HAPIFHIRIntegrationService:
+    """
+    Service to integrate HAPI FHIR data with your existing database
+    """
+    
+    def __init__(self):
+        self.fhir_client = HAPIFHIRClient()
+    
+    async def import_patients_from_hapi(self, limit: int = 20) -> dict:
+        """
+        Import patients from HAPI FHIR Test Server with detailed feedback
+        """
+        try:
+            print(f"Fetching {limit} patients from HAPI FHIR...")
+            patients = self.fhir_client.get_patients(limit=limit)
+            
+            if not patients:
+                print("No patients found in HAPI FHIR")
+                return {
+                    "imported_count": 0,
+                    "skipped_count": 0,
+                    "total_found": 0,
+                    "imported_patients": [],
+                    "skipped_patients": [],
+                    "errors": []
+                }
+            
+            print(f"Found {len(patients)} patients, checking for duplicates...")
+            
+            imported_count = 0
+            skipped_count = 0
+            imported_patients = []
+            skipped_patients = []
+            errors = []
+            
+            for patient in patients:
+                try:
+                    # Check if patient already exists by multiple criteria
+                    existing = await db.patients.find_one({
+                        "$or": [
+                            {"fhir_id": patient['fhir_id']},
+                            {"full_name": patient['full_name'], "date_of_birth": patient['date_of_birth']},
+                            {"demographics.fhir_id": patient['fhir_id']}
+                        ]
+                    })
+                    
+                    if existing:
+                        skipped_count += 1
+                        skipped_patients.append(patient['full_name'])
+                        print(f"Patient {patient['full_name']} already exists (fhir_id: {patient['fhir_id']}), skipping...")
+                        continue
+                    
+                    # Enhance patient data with additional FHIR data
+                    enhanced_patient = await self._enhance_patient_data(patient)
+                    
+                    # Insert into database
+                    result = await db.patients.insert_one(enhanced_patient)
+                    
+                    if result.inserted_id:
+                        imported_count += 1
+                        imported_patients.append(patient['full_name'])
+                        print(f"Imported patient: {patient['full_name']} (ID: {result.inserted_id})")
+                    
+                except Exception as e:
+                    error_msg = f"Error importing patient {patient.get('full_name', 'Unknown')}: {e}"
+                    errors.append(error_msg)
+                    print(error_msg)
+                    continue
+            
+            print(f"Import completed: {imported_count} imported, {skipped_count} skipped")
+            
+            return {
+                "imported_count": imported_count,
+                "skipped_count": skipped_count,
+                "total_found": len(patients),
+                "imported_patients": imported_patients,
+                "skipped_patients": skipped_patients,
+                "errors": errors
+            }
+            
+        except Exception as e:
+            print(f"Error importing patients: {e}")
+            return {
+                "imported_count": 0,
+                "skipped_count": 0,
+                "total_found": 0,
+                "imported_patients": [],
+                "skipped_patients": [],
+                "errors": [str(e)]
+            }
+    
+    async def _enhance_patient_data(self, patient: Dict) -> Dict:
+        """
+        Enhance patient data with additional FHIR resources
+        """
+        try:
+            patient_id = patient['fhir_id']
+            
+            # Fetch additional data from HAPI FHIR
+            observations = self.fhir_client.get_patient_observations(patient_id)
+            medications = self.fhir_client.get_patient_medications(patient_id)
+            conditions = self.fhir_client.get_patient_conditions(patient_id)
+            
+            # Structure the enhanced patient data
+            enhanced_patient = {
+                # Basic demographics
+                **patient,
+                
+                # Clinical data
+                'demographics': {
+                    'id': patient['id'],
+                    'fhir_id': patient['fhir_id'],
+                    'full_name': patient['full_name'],
+                    'gender': patient['gender'],
+                    'date_of_birth': patient['date_of_birth'],
+                    'address': patient['address'],
+                    'phone': patient.get('phone', ''),
+                    'email': patient.get('email', ''),
+                    'marital_status': patient.get('marital_status', 'Unknown'),
+                    'language': patient.get('language', 'English')
+                },
+                
+                'clinical_data': {
+                    'observations': observations,
+                    'medications': medications,
+                    'conditions': conditions,
+                    'notes': [],  # Will be populated separately
+                    'encounters': []  # Will be populated separately
+                },
+                
+                'metadata': {
+                    'source': 'hapi_fhir',
+                    'import_date': datetime.now().isoformat(),
+                    'last_updated': datetime.now().isoformat(),
+                    'fhir_server': 'https://hapi.fhir.org/baseR4'
+                }
+            }
+            
+            return enhanced_patient
+            
+        except Exception as e:
+            print(f"Error enhancing patient data: {e}")
+            return patient
+    
+    async def sync_patient_data(self, patient_id: str) -> bool:
+        """
+        Sync a specific patient's data from HAPI FHIR
+        """
+        try:
+            # Get patient from HAPI FHIR
+            patient = self.fhir_client.get_patient_by_id(patient_id)
+            
+            if not patient:
+                print(f"Patient {patient_id} not found in HAPI FHIR")
+                return False
+            
+            # Enhance with additional data
+            enhanced_patient = await self._enhance_patient_data(patient)
+            
+            # Update in database
+            result = await db.patients.update_one(
+                {"fhir_id": patient_id},
+                {"$set": enhanced_patient},
+                upsert=True
+            )
+            
+            if result.modified_count > 0 or result.upserted_id:
+                print(f"Synced patient: {patient['full_name']}")
+                return True
+            else:
+                print(f"No changes for patient: {patient['full_name']}")
+                return False
+                
+        except Exception as e:
+            print(f"Error syncing patient {patient_id}: {e}")
+            return False
+    
+    async def get_patient_statistics(self) -> Dict:
+        """
+        Get statistics about imported patients
+        """
+        try:
+            total_patients = await db.patients.count_documents({})
+            hapi_patients = await db.patients.count_documents({"source": "hapi_fhir"})
+            
+            # Get sample patient data and convert ObjectId to string
+            sample_patient = await db.patients.find_one({"source": "hapi_fhir"})
+            if sample_patient:
+                # Convert ObjectId to string for JSON serialization
+                sample_patient['_id'] = str(sample_patient['_id'])
+            
+            stats = {
+                'total_patients': total_patients,
+                'hapi_fhir_patients': hapi_patients,
+                'sample_patient': sample_patient
+            }
+            
+            return stats
+            
+        except Exception as e:
+            print(f"Error getting statistics: {e}")
+            return {}
+    
+    async def get_hapi_patients(self, limit: int = 50) -> List[Dict]:
+        """
+        Get patients from HAPI FHIR without importing them
+        """
+        try:
+            patients = self.fhir_client.get_patients(limit=limit)
+            return patients
+        except Exception as e:
+            print(f"Error fetching HAPI patients: {e}")
+            return []
+    
+    async def get_hapi_patient_details(self, patient_id: str) -> Optional[Dict]:
+        """
+        Get detailed information for a specific HAPI FHIR patient
+        """
+        try:
+            patient = self.fhir_client.get_patient_by_id(patient_id)
+            if not patient:
+                return None
+            
+            # Get additional data
+            observations = self.fhir_client.get_patient_observations(patient_id)
+            medications = self.fhir_client.get_patient_medications(patient_id)
+            conditions = self.fhir_client.get_patient_conditions(patient_id)
+            
+            return {
+                'patient': patient,
+                'observations': observations,
+                'medications': medications,
+                'conditions': conditions
+            }
+            
+        except Exception as e:
+            print(f"Error fetching patient details: {e}")
+            return None 

services/txagent_service.py

@@ -0,0 +1,118 @@
+import aiohttp
+import asyncio
+import logging
+from typing import Optional, Dict, Any, List
+from core.txagent_config import txagent_config
+
+logger = logging.getLogger(__name__)
+
+class TxAgentService:
+    def __init__(self):
+        self.config = txagent_config
+        self.session = None
+    
+    async def _get_session(self):
+        """Obtient ou crée une session HTTP"""
+        if self.session is None:
+            self.session = aiohttp.ClientSession()
+        return self.session
+    
+    async def _make_request(self, endpoint: str, method: str = "GET", data: Optional[Dict] = None) -> Dict[str, Any]:
+        """Fait une requête vers le service TxAgent avec fallback"""
+        session = await self._get_session()
+        url = f"{self.config.get_txagent_url()}{endpoint}"
+        
+        try:
+            if method.upper() == "GET":
+                async with session.get(url) as response:
+                    return await response.json()
+            elif method.upper() == "POST":
+                async with session.post(url, json=data) as response:
+                    return await response.json()
+        except Exception as e:
+            logger.error(f"Error calling TxAgent service: {e}")
+            # Fallback vers cloud si local échoue
+            if self.config.get_txagent_mode() == "local":
+                logger.info("Falling back to cloud TxAgent service")
+                self.config.mode = "cloud"
+                return await self._make_request(endpoint, method, data)
+            else:
+                raise
+    
+    async def chat(self, message: str, history: Optional[list] = None, patient_id: Optional[str] = None) -> Dict[str, Any]:
+        """Service de chat avec TxAgent"""
+        data = {
+            "message": message,
+            "history": history or [],
+            "patient_id": patient_id
+        }
+        return await self._make_request("/chat", "POST", data)
+    
+    async def analyze_patient(self, patient_data: Dict[str, Any]) -> Dict[str, Any]:
+        """Analyse de données patient avec TxAgent"""
+        return await self._make_request("/patients/analyze", "POST", patient_data)
+    
+    async def voice_transcribe(self, audio_data: bytes) -> Dict[str, Any]:
+        """Transcription vocale avec TxAgent"""
+        session = await self._get_session()
+        url = f"{self.config.get_txagent_url()}/voice/transcribe"
+        
+        try:
+            form_data = aiohttp.FormData()
+            form_data.add_field('audio', audio_data, filename='audio.wav')
+            
+            async with session.post(url, data=form_data) as response:
+                return await response.json()
+        except Exception as e:
+            logger.error(f"Error in voice transcription: {e}")
+            if self.config.get_txagent_mode() == "local":
+                self.config.mode = "cloud"
+                return await self.voice_transcribe(audio_data)
+            else:
+                raise
+    
+    async def voice_synthesize(self, text: str, language: str = "en-US") -> bytes:
+        """Synthèse vocale avec TxAgent"""
+        session = await self._get_session()
+        url = f"{self.config.get_txagent_url()}/voice/synthesize"
+        
+        try:
+            data = {
+                "text": text,
+                "language": language,
+                "return_format": "mp3"
+            }
+            
+            async with session.post(url, json=data) as response:
+                return await response.read()
+        except Exception as e:
+            logger.error(f"Error in voice synthesis: {e}")
+            if self.config.get_txagent_mode() == "local":
+                self.config.mode = "cloud"
+                return await self.voice_synthesize(text, language)
+            else:
+                raise
+    
+    async def get_status(self) -> Dict[str, Any]:
+        """Obtient le statut du service TxAgent"""
+        return await self._make_request("/status")
+    
+    async def get_chats(self) -> List[Dict[str, Any]]:
+        """Obtient l'historique des chats"""
+        return await self._make_request("/chats")
+    
+    async def get_analysis_results(self, risk_filter: Optional[str] = None) -> List[Dict[str, Any]]:
+        """Obtient les résultats d'analyse des patients"""
+        params = {}
+        if risk_filter:
+            params["risk_filter"] = risk_filter
+        return await self._make_request("/patients/analysis-results", "GET", params)
+    
+    async def close(self):
+        """Ferme la session HTTP"""
+        if self.session:
+            await self.session.close()
+            self.session = None
+
+# Instance globale
+txagent_service = TxAgentService()

utils/fhir_client.py

@@ -0,0 +1,323 @@
+import requests
+import json
+from typing import List, Dict, Optional
+from datetime import datetime
+
+class HAPIFHIRClient:
+    """
+    Client for connecting to HAPI FHIR Test Server
+    """
+    
+    def __init__(self, base_url: str = "https://hapi.fhir.org/baseR4"):
+        self.base_url = base_url
+        self.session = requests.Session()
+        self.session.headers.update({
+            'Content-Type': 'application/fhir+json',
+            'Accept': 'application/fhir+json'
+        })
+    
+    def get_patients(self, limit: int = 50) -> List[Dict]:
+        """
+        Fetch patients from HAPI FHIR Test Server
+        """
+        try:
+            url = f"{self.base_url}/Patient"
+            params = {
+                '_count': limit,
+                '_format': 'json'
+            }
+            
+            response = self.session.get(url, params=params)
+            response.raise_for_status()
+            
+            data = response.json()
+            patients = []
+            
+            if 'entry' in data:
+                for entry in data['entry']:
+                    patient = self._parse_patient(entry['resource'])
+                    if patient:
+                        patients.append(patient)
+            
+            return patients
+            
+        except requests.RequestException as e:
+            print(f"Error fetching patients: {e}")
+            return []
+    
+    def get_patient_by_id(self, patient_id: str) -> Optional[Dict]:
+        """
+        Fetch a specific patient by ID
+        """
+        try:
+            url = f"{self.base_url}/Patient/{patient_id}"
+            response = self.session.get(url)
+            response.raise_for_status()
+            
+            patient_data = response.json()
+            return self._parse_patient(patient_data)
+            
+        except requests.RequestException as e:
+            print(f"Error fetching patient {patient_id}: {e}")
+            return None
+    
+    def get_patient_observations(self, patient_id: str) -> List[Dict]:
+        """
+        Fetch observations (vital signs, lab results) for a patient
+        """
+        try:
+            url = f"{self.base_url}/Observation"
+            params = {
+                'subject': f"Patient/{patient_id}",
+                '_count': 100,
+                '_format': 'json'
+            }
+            
+            response = self.session.get(url, params=params)
+            response.raise_for_status()
+            
+            data = response.json()
+            observations = []
+            
+            if 'entry' in data:
+                for entry in data['entry']:
+                    observation = self._parse_observation(entry['resource'])
+                    if observation:
+                        observations.append(observation)
+            
+            return observations
+            
+        except requests.RequestException as e:
+            print(f"Error fetching observations for patient {patient_id}: {e}")
+            return []
+    
+    def get_patient_medications(self, patient_id: str) -> List[Dict]:
+        """
+        Fetch medications for a patient
+        """
+        try:
+            url = f"{self.base_url}/MedicationRequest"
+            params = {
+                'subject': f"Patient/{patient_id}",
+                '_count': 100,
+                '_format': 'json'
+            }
+            
+            response = self.session.get(url, params=params)
+            response.raise_for_status()
+            
+            data = response.json()
+            medications = []
+            
+            if 'entry' in data:
+                for entry in data['entry']:
+                    medication = self._parse_medication(entry['resource'])
+                    if medication:
+                        medications.append(medication)
+            
+            return medications
+            
+        except requests.RequestException as e:
+            print(f"Error fetching medications for patient {patient_id}: {e}")
+            return []
+    
+    def get_patient_conditions(self, patient_id: str) -> List[Dict]:
+        """
+        Fetch conditions (diagnoses) for a patient
+        """
+        try:
+            url = f"{self.base_url}/Condition"
+            params = {
+                'subject': f"Patient/{patient_id}",
+                '_count': 100,
+                '_format': 'json'
+            }
+            
+            response = self.session.get(url, params=params)
+            response.raise_for_status()
+            
+            data = response.json()
+            conditions = []
+            
+            if 'entry' in data:
+                for entry in data['entry']:
+                    condition = self._parse_condition(entry['resource'])
+                    if condition:
+                        conditions.append(condition)
+            
+            return conditions
+            
+        except requests.RequestException as e:
+            print(f"Error fetching conditions for patient {patient_id}: {e}")
+            return []
+    
+    def _parse_patient(self, patient_data: Dict) -> Optional[Dict]:
+        """
+        Parse FHIR Patient resource into our format
+        """
+        try:
+            # Extract basic demographics
+            name = ""
+            if 'name' in patient_data and patient_data['name']:
+                name_parts = patient_data['name'][0]
+                given = name_parts.get('given', [])
+                family = name_parts.get('family', '')
+                name = f"{' '.join(given)} {family}".strip()
+            
+            # Extract address
+            address = ""
+            if 'address' in patient_data and patient_data['address']:
+                addr = patient_data['address'][0]
+                line = addr.get('line', [])
+                city = addr.get('city', '')
+                state = addr.get('state', '')
+                postal_code = addr.get('postalCode', '')
+                address = f"{', '.join(line)}, {city}, {state} {postal_code}".strip()
+            
+            # Extract contact info
+            phone = ""
+            email = ""
+            if 'telecom' in patient_data:
+                for telecom in patient_data['telecom']:
+                    if telecom.get('system') == 'phone':
+                        phone = telecom.get('value', '')
+                    elif telecom.get('system') == 'email':
+                        email = telecom.get('value', '')
+            
+            return {
+                'id': patient_data.get('id', ''),
+                'fhir_id': patient_data.get('id', ''),
+                'full_name': name,
+                'gender': patient_data.get('gender', 'unknown'),
+                'date_of_birth': patient_data.get('birthDate', ''),
+                'address': address,
+                'phone': phone,
+                'email': email,
+                'marital_status': self._get_marital_status(patient_data),
+                'language': self._get_language(patient_data),
+                'source': 'hapi_fhir',
+                'status': 'active',
+                'created_at': datetime.now().isoformat(),
+                'updated_at': datetime.now().isoformat()
+            }
+            
+        except Exception as e:
+            print(f"Error parsing patient data: {e}")
+            return None
+    
+    def _parse_observation(self, observation_data: Dict) -> Optional[Dict]:
+        """
+        Parse FHIR Observation resource
+        """
+        try:
+            code = observation_data.get('code', {})
+            coding = code.get('coding', [])
+            code_text = code.get('text', '')
+            
+            if coding:
+                code_text = coding[0].get('display', code_text)
+            
+            value = observation_data.get('valueQuantity', {})
+            unit = value.get('unit', '')
+            value_amount = value.get('value', '')
+            
+            return {
+                'id': observation_data.get('id', ''),
+                'code': code_text,
+                'value': f"{value_amount} {unit}".strip(),
+                'date': observation_data.get('effectiveDateTime', ''),
+                'category': self._get_observation_category(observation_data)
+            }
+            
+        except Exception as e:
+            print(f"Error parsing observation: {e}")
+            return None
+    
+    def _parse_medication(self, medication_data: Dict) -> Optional[Dict]:
+        """
+        Parse FHIR MedicationRequest resource
+        """
+        try:
+            medication = medication_data.get('medicationCodeableConcept', {})
+            coding = medication.get('coding', [])
+            name = medication.get('text', '')
+            
+            if coding:
+                name = coding[0].get('display', name)
+            
+            dosage = medication_data.get('dosageInstruction', [])
+            dosage_text = ""
+            if dosage:
+                dosage_text = dosage[0].get('text', '')
+            
+            return {
+                'id': medication_data.get('id', ''),
+                'name': name,
+                'dosage': dosage_text,
+                'status': medication_data.get('status', 'active'),
+                'prescribed_date': medication_data.get('authoredOn', ''),
+                'requester': self._get_practitioner_name(medication_data)
+            }
+            
+        except Exception as e:
+            print(f"Error parsing medication: {e}")
+            return None
+    
+    def _parse_condition(self, condition_data: Dict) -> Optional[Dict]:
+        """
+        Parse FHIR Condition resource
+        """
+        try:
+            code = condition_data.get('code', {})
+            coding = code.get('coding', [])
+            name = code.get('text', '')
+            
+            if coding:
+                name = coding[0].get('display', name)
+            
+            return {
+                'id': condition_data.get('id', ''),
+                'code': name,
+                'status': condition_data.get('clinicalStatus', {}).get('coding', [{}])[0].get('code', 'active'),
+                'onset_date': condition_data.get('onsetDateTime', ''),
+                'recorded_date': condition_data.get('recordedDate', ''),
+                'notes': condition_data.get('note', [{}])[0].get('text', '') if condition_data.get('note') else ''
+            }
+            
+        except Exception as e:
+            print(f"Error parsing condition: {e}")
+            return None
+    
+    def _get_marital_status(self, patient_data: Dict) -> str:
+        """Extract marital status from patient data"""
+        if 'maritalStatus' in patient_data:
+            coding = patient_data['maritalStatus'].get('coding', [])
+            if coding:
+                return coding[0].get('display', 'Unknown')
+        return 'Unknown'
+    
+    def _get_language(self, patient_data: Dict) -> str:
+        """Extract language from patient data"""
+        if 'communication' in patient_data and patient_data['communication']:
+            language = patient_data['communication'][0].get('language', {})
+            coding = language.get('coding', [])
+            if coding:
+                return coding[0].get('display', 'English')
+        return 'English'
+    
+    def _get_observation_category(self, observation_data: Dict) -> str:
+        """Extract observation category"""
+        category = observation_data.get('category', {})
+        coding = category.get('coding', [])
+        if coding:
+            return coding[0].get('display', 'Unknown')
+        return 'Unknown'
+    
+    def _get_practitioner_name(self, medication_data: Dict) -> str:
+        """Extract practitioner name from medication request"""
+        requester = medication_data.get('requester', {})
+        reference = requester.get('reference', '')
+        if reference.startswith('Practitioner/'):
+            # In a real implementation, you'd fetch the practitioner details
+            return 'Dr. Practitioner'
+        return 'Unknown'