Patient Portal Suite
A hospital portal rebuilt so the archive has no method that can be asked for a document without naming the patient.
- Area
- Healthcare
- Main stack
- C# · .NET 9 · ASP.NET Core · Razor Pages
Key features
- • The archive cannot be asked about a document without a patient: the leaking version fails to compile
- • A reflection test that reads the interface instead of trusting it
- • One refusal for both “somebody else’s” and “does not exist”, so the archive cannot be mapped by asking
- • The audit line is computed from what the archive was actually asked, not from what the caller says
- • A one-time code minted only after the archive has already answered yes
About the project
A hospital that publishes reports online has one failure that matters more than all the others together: handing somebody another patient’s file. The original got that wrong in a way that survives review: four routes read the signed-in patient from the session and wrote them into the audit line, and two of them passed the accession number straight from the request body to the archive with nothing joining the two. Side by side the four methods look alike, which is why all four are kept runnable here: the difference can be counted instead of argued.
The rebuild replaces four checks with one type. Asked pairs a patient with a document, and the archive interface accepts nothing else: the leaking version does not fail review, it fails to compile. A reflection test asserts that every method on the interface still takes a patient, and the refusal is one value covering both “belongs to somebody else” and “does not exist”, so nobody can map the archive by asking.
Technologies used
C# 
.NET 9 
ASP.NET Core 
Razor Pages 
SQLite 
xUnit 
GitHub Actions