At a glance
| Timeline | 5 months |
|---|---|
| Team | 4 developers |
| Stack | React · TypeScript · Node.js · MongoDB · Tailwind CSS |
The problem
Hospital software fails on permissions before it fails on features. Reception, doctors and administrators all need the same patient record, but each needs it to show something different — and getting that wrong is not a UI bug, it is a records breach. The second failure point is scheduling. The moment two people can book the same slot, staff stop trusting the calendar and go back to paper — and a calendar nobody trusts is worse than no calendar, because it still has to be maintained. So two requirements were fixed before any feature work started: every role sees exactly what its role permits and no more, and two concurrent bookings for the same practitioner and slot can never both succeed.
The approach
Role-based access control was designed first and enforced server-side, so the UI only ever hides what the API already refuses. Removing the client-side check by hand gets you a 403, not a patient record — a hidden button is a convenience, never a security boundary. Appointments are validated against the practitioner's calendar at write time rather than in the client. A client-side availability check is a display optimisation: it cannot arbitrate between two requests that arrive in the same second, because each was rendered from a calendar that was accurate when it loaded and stale by the time it was submitted. Putting the decision at the write boundary makes the calendar the single source of truth about what is actually booked. Patient records are indexed on the fields staff actually search by — not on every field, which inflates the cost of every write, and not on the defaults, which miss how reception really looks somebody up with a patient standing at the counter.
Stack
Work like this is quoted under web development services, with fixed prices agreed before anything starts.
Related: what a custom web application costs · how to choose a web development company
Built by Muhammad Mubashar Shahzad — React & MERN developer, WebDevStudio.