This document is the Full Blueprint for building the HMS Frontend. It combines technical API contracts with real-world User Flow Scenarios to guide the UI development.
- Backend: Spring Boot 3 + JWT Security + MySQL.
- Frontend: Thymeleaf templates (Server-side shell) + JavaScript (Client-side API calls).
- Aesthetics: Professional Medical Theme (Clean whitespace,
#3498dbprimary colors, Bootstrap 5.3).
Every user interaction starts here.
- Form Submission: User enters email/password on
/auth/login. - API Call:
POST /api/v1/auth/signin. - Token Storage: On success, JS stores
accessTokenandrolesinlocalStorage. - Dynamic Routing: JS checks
rolesarray and redirects:ROLE_ADMIN->/dashboard/adminROLE_DOCTOR->/dashboard/doctorROLE_NURSE->/dashboard/nurseROLE_PATIENT->/dashboard/patient
- Persistent Header: Every subsequent
fetch()request must attach:Authorization: Bearer <token>
Goal: Empower patients to manage their own care.
- Registration: New patient uses
/auth/signupwith rolepatient. They MUST provide their existingpatientSsnto link their login to their clinical record. - Dashboard Load: JS calls
GET /api/v1/patients/meto display personal contact info. - History Timeline: Patient views
GET /api/v1/medical-records/myto see a vertical timeline of all past procedures and doctor notes. - Booking: Patient fills a form (Date, Physician, Room) and hits
POST /api/v1/appointments. - Active Care: Patient checks
GET /api/v1/prescriptions/myto see current dosage instructions from their doctor.
Goal: Manage patient admissions and facility logistics.
- Admission: Nurse identifies a patient, finds an available room (
GET /api/v1/rooms/available), and registers a stay:POST /api/v1/stays. - Shift Management: Nurse views personal duty schedule via
GET /api/v1/shifts/nurse/{id}. - Rounding: Nurse views
GET /api/v1/stays/activeto see a list of all current inpatients and their assigned rooms. - Discharge: Nurse updates the stay record with
PUT /api/v1/stays/{id}?notes=...to record discharge time and release the room.
Goal: Diagnostic and Treatment documentation.
- Daily Schedule: Doctor views
GET /api/v1/appointments/physician/{id}for the day's queue. - Patient Consultation: During the appointment, doctor views the patient's full history:
GET /api/v1/medical-records/patient/{ssn}. - Prescribing: Doctor issues a medication order:
POST /api/v1/prescriptions. - Recording Procedures: Doctor records the results of a procedure:
POST /api/v1/medical-records/procedure. - Skill Tracking: Doctor checks their own certifications:
GET /api/v1/certifications/physician/{id}.
Goal: System onboarding and data integrity.
- Staff Onboarding: Admin creates accounts for new Doctors/Nurses using
POST /api/v1/auth/signup. - Facility Setup: Admin adds new rooms (
POST /api/v1/rooms) or creates departments (POST /api/v1/departments). - Command & Control: Admin assigns a Department Head via
PUT /api/v1/departments/{id}/head?physicianId=.... - Analytics: Admin views the executive dashboard
GET /api/v1/dashboard/summaryfor hospital-wide occupancy and status.
| Feature | Endpoint | Method | Payload Key Fields |
|---|---|---|---|
| Auth | /api/v1/auth/signin |
POST | email, password |
| Register | /api/v1/auth/signup |
POST | username, role[], patientSsn (if patient) |
| Appointments | /api/v1/appointments |
POST | patientSsn, physicianId, start, end |
| Admissions | /api/v1/stays |
POST | patientSsn, roomNumber, stayStart |
| Prescribe | /api/v1/prescriptions |
POST | patientSsn, medicationCode, dose |
| Analytics | /api/v1/dashboard/summary |
GET | N/A (Admin only) |
- Searchable Dropdowns: For selecting Physicians or Patients by SSN.
- Status Badges: For rooms (Green = Available, Red = Occupied).
- Timeline Component: For displaying medical history and stay history.
- Form Validation: Display field-level errors returned in the
ApiResponsedetailsmap.
- 401 Unauthenticated: Redirect to
/login. - 403 Unauthorized: Show "Access Denied" modal.
- 400 Validation Error: Use JavaScript to catch the
detailsobject and highlight individual form inputs in red with the helper text provided by the backend.