Add optional PocketBase backend for cloud sync and accounts

[prayashm]

Adds an optional PocketBase backend to ScribRx — accounts, cross-device sync, a server-side AI proxy, and hosted QR verification — while staying fully functional as the original local-only PWA when no backend is configured.

This PR supersedes the earlier #14 (which was reverted from main). The branch has main re-merged, so it applies cleanly on top of the cleaned-up main, and it includes the review fixes from #14.

Activation

Controlled by VITE_PB_URL (see rxpad/.env.example). Empty → original IndexedDB-only / BYOK / client-HMAC behaviour. Set → cloud features turn on, with IndexedDB kept as an offline cache.

App-side

• lib/pb.ts — PocketBase client singleton + auth helpers, gated on VITE_PB_URL.
• lib/store.ts — repository wrapping PocketBase + IndexedDB with the same surface as db.ts, so pages only swapped their import path.
• pages/Login.tsx — email/password + Google OAuth (cloud mode only); app.tsx gates routing on auth, keeps /verify and /auth/callback public.
• gemini.ts — parsePrescriptionViaServer() routes parsing through /api/parse-rx, reusing the existing sanitisers; BYOK retained as fallback.
• qr.ts + Verify.tsx — id-based QR verified server-side, with the HMAC payload as fallback.
• Onboarding/Settings adapt to cloud mode (skip BYOK step, add account/sign-out).

Backend (backend/)

• pb_hooks/main.pb.js — POST /api/parse-rx (Gemini server-side, key never shipped) and public GET /api/verify/{rxId}.
• migrations/ — creates the profiles/prescriptions collections with owner-scoped API rules on first start.
• Dockerfile, fly.toml, and README.md (collections, OAuth, CORS, Cloudflare R2 free-tier file storage).

Review fixes from #14 (included)

• Cloud-first getProfile() in prescriptionToFormData (fixes blank doctorName/regNo on a fresh device).
• pb.filter() parameter binding for all dynamic filters.
• getNextRxId fetches only the latest same-day record instead of the full list.
• ensurePdfBlob writes the fetched PDF back to the local cache.

⚠️ Enabling the backend stores patient data server-side — see the compliance notes in backend/README.md.

Type-check, the full test suite (22 passing), and the production build all pass on the merged branch.

https://claude.ai/code/session_01EWPrWETycUCJKFiBJFLg4L

[gemini-code-assist]

Code Review

This pull request introduces an optional PocketBase cloud backend to ScribRx, enabling accounts, cross-device sync, server-side AI parsing via Gemini, and hosted QR verification. The feedback highlights critical security and robustness improvements. Specifically, a potential Insecure Direct Object Reference (IDOR) vulnerability was identified in the public verification route because prescription IDs are only unique per doctor; scoping verification queries with the doctor's user ID resolves this. Additionally, the reviewer noted a potential query injection risk in store.ts that can be fixed by using pb.filter for safe parameter binding, a performance issue where the profile is unnecessarily fetched from the cloud on every save, and a bug where failed PDF fetches could cache corrupted error pages.

[gemini-code-assist]

Since rxId is only unique per doctor (as defined by the composite unique index idx_presc_user_rxid on (user, rxId)), multiple doctors can have prescriptions with the same rxId (e.g., RX-20250302-0001). Querying solely by rxId in this public verification route can return another doctor's prescription, leading to incorrect verification details. To resolve this, we should pass the doctor's user ID as a query parameter (u) and filter by both rxId and user.

routerAdd("GET", "/api/verify/{rxId}", (e) => {
  const rxId = e.request.pathValue("rxId");
  const info = e.requestInfo();
  const userId = info.query.u || "";
  let rec;
  try {
    if (userId) {
      rec = $app.findFirstRecordByFilter("prescriptions", "rxId = {:rxId} && user = {:userId}", { rxId, userId });
    } else {
      rec = $app.findFirstRecordByFilter("prescriptions", "rxId = {:rxId}", { rxId });
    }
  } catch (err) {
    return e.json(404, { error: "Not found." });
  }

[gemini-code-assist]

Fetching the profile from the cloud on every prescription save introduces unnecessary network latency and potential failures on a critical path. Since checkSetup already runs on app load and populates the local cache, we can safely use the local cache directly here.

Suggested change

	const profile = await getProfile();
	const profile = await local.getProfile();

[gemini-code-assist]

Import currentUserId to allow appending the doctor's user ID to the verification URL.

Suggested change

	import { pocketBaseEnabled } from './pb';
	import { pocketBaseEnabled, currentUserId } from './pb';

[gemini-code-assist]

Append the doctor's user ID (u) to the verification URL in cloud mode to ensure global uniqueness when verifying prescriptions.

Suggested change

	export async function generateQRCode(payload: string, rxId?: string): Promise<string> {
	// Cloud mode: encode just the prescription id and verify server-side (the
	// server is the source of truth). Local mode: embed the HMAC-signed payload.
	const url = pocketBaseEnabled && rxId
	? `${window.location.origin}/verify?id=${encodeURIComponent(rxId)}`
	: `${window.location.origin}/verify?data=${encodeURIComponent(btoa(payload))}`;
	return QRCode.toDataURL(url, { width: 120, margin: 1 });
	}
	export async function generateQRCode(payload: string, rxId?: string): Promise<string> {
	// Cloud mode: encode just the prescription id and verify server-side (the
	// server is the source of truth). Local mode: embed the HMAC-signed payload.
	const userId = currentUserId();
	const url = pocketBaseEnabled && rxId && userId
	? `${window.location.origin}/verify?id=${encodeURIComponent(rxId)}&u=${encodeURIComponent(userId)}`
	: `${window.location.origin}/verify?data=${encodeURIComponent(btoa(payload))}`;
	return QRCode.toDataURL(url, { width: 120, margin: 1 });
	}

[gemini-code-assist]

Add the optional u (user ID) prop to VerifyProps to support scoped server-side verification.

Suggested change

	interface VerifyProps {
	path?: string;
	data?: string;
	id?: string;
	}
	interface VerifyProps {
	path?: string;
	data?: string;
	id?: string;
	u?: string;
	}

[gemini-code-assist]

Destructure the u prop in the Verify component.

Suggested change

	export function Verify({ data, id }: VerifyProps) {
	export function Verify({ data, id, u }: VerifyProps) {

[gemini-code-assist]

Pass the u query parameter to the server-side verification API call if available.

  useEffect(() => {
    if (!id) return;
    let cancelled = false;
    (async () => {
      try {
        if (!pocketBaseEnabled) throw new Error('verification unavailable');
        const url = u
          ? `/api/verify/${encodeURIComponent(id)}?u=${encodeURIComponent(u)}`
          : `/api/verify/${encodeURIComponent(id)}`;
        const res = await pb.send(url, { method: 'GET' });
        if (!cancelled) setFetched(res as VerificationPayload);
      } catch {
        if (!cancelled) setFetched(null);
      } finally {
        if (!cancelled) setLoading(false);
      }
    })();
    return () => { cancelled = true; };
  }, [id, u]);

[gemini-code-assist]

Use pb.filter for safe parameter binding instead of string interpolation to prevent potential injection issues and maintain consistency with other queries in this file.

Suggested change

	const filter = status ? `status="${status}"` : '';
	const filter = status ? pb.filter('status = {:status}', { status }) : '';

[gemini-code-assist]

Check res.ok before calling res.blob(). If the server returns a non-200 status code (such as a 404 or 500 HTML error page), fetch does not throw an error, and calling res.blob() will succeed and cache the HTML error page as a corrupted PDF blob.

Suggested change

	const res = await fetch(rx.pdfUrl);
	const blob = await res.blob();
	const res = await fetch(rx.pdfUrl);
	if (!res.ok) throw new Error(`Failed to fetch PDF: ${res.statusText}`);
	const blob = await res.blob();

[cloudflare-workers-and-pages]

Deploying scribrx with    Cloudflare Pages

Latest commit:	c0360af
Status:	✅  Deploy successful!
Preview URL:	https://56a42d42.scribrx.pages.dev
Branch Preview URL:	https://claude-pocketbase-scribrx-in.scribrx.pages.dev

View logs