JAVA · REST API
Clinic: patient records API
- The problem
- Keeping patients and medical histories in spreadsheets exposes sensitive data and gives no control over who can read or change each record.
- The solution
- A REST API with authentication, three roles (admin, doctor and reception) and Chilean RUT validation: reception registers patients, doctors write the medical history and only admins manage users.
Stack:
- Java 21
- Spring Boot
- PostgreSQL
- Docker
How I built it
How I used each technology
- Spring Boot 3
- Layered structure (controller → service → repository), DTOs and a global exception handler with consistent responses.
- Spring Security + JWT
- Login returns a token and every endpoint requires a role through
@PreAuthorize; passwords are stored with BCrypt. - PostgreSQL + Flyway
- The schema lives in versioned migrations (tables, indexes and development data), so the database is rebuilt identically in any environment.
- Spring Data JPA
- Paginated patient search by RUT, name or email without hand-written SQL.
- Docker Compose
- Starts the API and PostgreSQL with one command; multi-stage image with a non-root user, and Compose stops if a secret is missing.
- JUnit 5 + Mockito
- 22 tests: RUT validator, patient service and a security regression test.
- SpringDoc OpenAPI
- Swagger UI to document and try every endpoint.
Decisions & security
- I found that user registration was public and let anyone create an ADMIN account: now only an admin can register users, backed by a test.
- No default credentials or JWT secret: everything is read from environment variables (
.env.example). - The initial admin is created from an environment variable and its password is no longer printed in the logs.
CI with mvn verify, Docker build and CodeQL.
