HIPAA-Ready Backend on AWS: Keep PHI in Your Own Account

// Hand-rolled: same insert the Encore sample performs, against a pool you configured.
func createPatient(ctx context.Context, db *sql.DB, actor string, p Patient) error {
	tx, err := db.BeginTx(ctx, nil)
	if err != nil {
		return err
	}
	defer tx.Rollback()

	var id int64
	if err := tx.QueryRowContext(ctx, `
		INSERT INTO patients (external_id, full_name, dob, owner_uid)
		VALUES ($1, $2, $3::date, $4)
		RETURNING id
	`, p.ExternalID, p.FullName, p.DOB, actor).Scan(&id); err != nil {
		return err
	}
	if _, err := tx.ExecContext(ctx, `
		INSERT INTO audit_events (actor_uid, action, patient_id, detail)
		VALUES ($1, 'create_patient', $2, $3)
	`, actor, id, p.ExternalID); err != nil {
		return err
	}
	return tx.Commit()
}

-- patients/migrations/1_create_patients.up.sql
CREATE TABLE patients (
    id          BIGSERIAL PRIMARY KEY,
    external_id TEXT NOT NULL UNIQUE,
    full_name   TEXT NOT NULL,
    dob         DATE NOT NULL,
    owner_uid   TEXT NOT NULL,
    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE TABLE audit_events (
    id          BIGSERIAL PRIMARY KEY,
    actor_uid   TEXT NOT NULL,
    action      TEXT NOT NULL,
    patient_id  BIGINT REFERENCES patients(id),
    detail      TEXT NOT NULL DEFAULT '',
    created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
);

// patients/patients.go
package patients

import (
	"context"
	"fmt"
	"time"

	"encore.dev/beta/auth"
	"encore.dev/beta/errs"
	"encore.dev/storage/objects"
	"encore.dev/storage/sqldb"
)

// Postgres locally with `encore run`, Amazon RDS when deployed to AWS.
var db = sqldb.NewDatabase("patients", sqldb.DatabaseConfig{
	Migrations: "./migrations",
})

// Clinical documents: S3 on AWS, a local bucket with `encore run`.
var Documents = objects.NewBucket("patient-documents", objects.BucketConfig{
	Public: false,
})

// Signing key for short-lived document URLs. Values are not stored in the repo.
var secrets struct {
	DocumentSigningKey string
	AuthToken          string // local/dev bearer; replace with IdP verification in production
}

// AuthHandler validates the bearer token from your IdP.
// Swap the body for Clerk, Auth0 or Firebase; see /docs/go/develop/auth.
//
//encore:authhandler
func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
	// Local/dev: compare to a secret. In production, verify a JWT from your IdP
	// (signature, issuer, audience, expiry, revocation) and return the subject.
	if token == "" || token != secrets.AuthToken {
		return "", &errs.Error{Code: errs.Unauthenticated, Message: "invalid token"}
	}
	return auth.UID("user"), nil
}

type Patient struct {
	ID         int64     `json:"id"`
	ExternalID string    `json:"external_id"`
	FullName   string    `json:"full_name"`
	DOB        string    `json:"dob"` // YYYY-MM-DD
	CreatedAt  time.Time `json:"created_at"`
}

type CreatePatientParams struct {
	ExternalID string `json:"external_id"`
	FullName   string `json:"full_name"`
	DOB        string `json:"dob"`
}

// CreatePatient stores a patient row and writes an audit event.
//
//encore:api auth method=POST path=/patients
func CreatePatient(ctx context.Context, p *CreatePatientParams) (*Patient, error) {
	uid, exists := auth.UserID()
	if !exists {
		return nil, &errs.Error{Code: errs.Unauthenticated, Message: "login required"}
	}

	var out Patient
	err := db.QueryRow(ctx, `
		INSERT INTO patients (external_id, full_name, dob, owner_uid)
		VALUES ($1, $2, $3::date, $4)
		RETURNING id, external_id, full_name, to_char(dob, 'YYYY-MM-DD'), created_at
	`, p.ExternalID, p.FullName, p.DOB, string(uid)).Scan(
		&out.ID, &out.ExternalID, &out.FullName, &out.DOB, &out.CreatedAt,
	)
	if err != nil {
		return nil, err
	}

	if _, err := db.Exec(ctx, `
		INSERT INTO audit_events (actor_uid, action, patient_id, detail)
		VALUES ($1, 'create_patient', $2, $3)
	`, string(uid), out.ID, p.ExternalID); err != nil {
		return nil, err
	}
	return &out, nil
}

// GetPatient returns one patient. Requires auth so PHI is never public.
//
//encore:api auth method=GET path=/patients/:id
func GetPatient(ctx context.Context, id int64) (*Patient, error) {
	uid, exists := auth.UserID()
	if !exists {
		return nil, &errs.Error{Code: errs.Unauthenticated, Message: "login required"}
	}

	var out Patient
	err := db.QueryRow(ctx, `
		SELECT id, external_id, full_name, to_char(dob, 'YYYY-MM-DD'), created_at
		FROM patients WHERE id = $1 AND owner_uid = $2
	`, id, string(uid)).Scan(&out.ID, &out.ExternalID, &out.FullName, &out.DOB, &out.CreatedAt)
	if err != nil {
		return nil, &errs.Error{Code: errs.NotFound, Message: "patient not found"}
	}

	if _, err := db.Exec(ctx, `
		INSERT INTO audit_events (actor_uid, action, patient_id, detail)
		VALUES ($1, 'read_patient', $2, '')
	`, string(uid), out.ID); err != nil {
		return nil, err
	}
	return &out, nil
}

type UploadURLResponse struct {
	Key string `json:"key"`
}

// RequestUpload reserves an object key for a clinical document upload.
//
//encore:api auth method=POST path=/patients/:id/documents
func RequestUpload(ctx context.Context, id int64) (*UploadURLResponse, error) {
	uid, exists := auth.UserID()
	if !exists {
		return nil, &errs.Error{Code: errs.Unauthenticated, Message: "login required"}
	}

	var existsRow int
	if err := db.QueryRow(ctx, `SELECT 1 FROM patients WHERE id = $1 AND owner_uid = $2`, id, string(uid)).Scan(&existsRow); err != nil {
		return nil, &errs.Error{Code: errs.NotFound, Message: "patient not found"}
	}

	key := fmt.Sprintf("patients/%d/%s.pdf", id, time.Now().UTC().Format("20060102T150405"))
	// Upload bytes with Documents.Upload in a follow-up call or raw endpoint.
	// DocumentSigningKey is available here when you mint a short-lived URL.
	_ = secrets.DocumentSigningKey

	if _, err := db.Exec(ctx, `
		INSERT INTO audit_events (actor_uid, action, patient_id, detail)
		VALUES ($1, 'request_document_upload', $2, $3)
	`, string(uid), id, key); err != nil {
		return nil, err
	}

	return &UploadURLResponse{Key: key}, nil
}