Senior Full Stack
Developer

/**
 * HIPAA-compliant audit logging service for tracking all PHI access
 * @see MEDCONNECT_PRO_COMPLIANCE_SPECIFICATION.md Section 9
 */
namespace App\Services;

class AuditService
{
    public static function log(
        string $action,
        string $resourceType,
        ?int $resourceId = null,
        ?array $oldValues = null,
        ?array $newValues = null,
        ?array $metadata = null
    ): AuditLog {
        $user = self::getCurrentUser();

        return AuditLog::create([
            'uuid' => (string) Str::uuid(),
            'tenant_id' => self::getCurrentTenantId(),
            'user_id' => $user?->id,
            'user_type' => self::getUserType($user),
            'action' => $action,
            'resource_type' => $resourceType,
            'resource_id' => $resourceId,
            'old_values' => self::sanitizeValues($oldValues),
            'new_values' => self::sanitizeValues($newValues),
            'metadata' => $metadata,
            'ip_address' => Request::ip(),
            'user_agent' => substr(Request::userAgent() ?? '', 0, 500),
            'session_id' => session()->getId(),
        ]);
    }

    // Sanitize values for logging (remove sensitive data)
    private static function sanitizeValues(?array $values): ?array
    {
        if (!$values) return null;

        $sensitiveFields = [
            'password', 'remember_token', 'two_factor_secret',
            'api_key', 'ssn', 'credit_card', 'cvv',
        ];

        foreach ($sensitiveFields as $field) {
            if (isset($values[$field])) {
                $values[$field] = '[REDACTED]';
            }
        }

        return $values;
    }
}

/**
 * API Rate Limiting Middleware - Dual Window Approach
 */
namespace App\Http\Middleware;

class ApiRateLimit
{
    public function handle(Request $request, Closure $next): Response
    {
        $apiKey = $request->attributes->get('api_key');

        // Check per-minute rate limit
        $minuteKey = "api_rate:{$apiKey->id}:minute:" . now()->format('Y-m-d-H-i');
        $minuteCount = (int) Cache::get($minuteKey, 0);

        if ($minuteCount >= $apiKey->rate_limit_per_minute) {
            return $this->rateLimitedResponse(
                $request, $apiKey, 'minute',
                $apiKey->rate_limit_per_minute,
                60 - now()->second // Retry-After
            );
        }

        // Check per-day rate limit
        $dayKey = "api_rate:{$apiKey->id}:day:" . now()->format('Y-m-d');
        $dayCount = (int) Cache::get($dayKey, 0);

        if ($dayCount >= $apiKey->rate_limit_per_day) {
            $secondsUntilMidnight = now()->endOfDay()->diffInSeconds(now());
            return $this->rateLimitedResponse(
                $request, $apiKey, 'day',
                $apiKey->rate_limit_per_day, $secondsUntilMidnight
            );
        }

        // Increment counters with appropriate TTL
        Cache::put($minuteKey, $minuteCount + 1, 120);
        Cache::put($dayKey, $dayCount + 1, 86400 + 3600);

        // Add standard rate limit headers
        return $next($request)->withHeaders([
            'X-RateLimit-Limit-Minute' => $apiKey->rate_limit_per_minute,
            'X-RateLimit-Remaining-Minute' => max(0, $apiKey->rate_limit_per_minute - $minuteCount - 1),
            'X-RateLimit-Limit-Day' => $apiKey->rate_limit_per_day,
            'X-RateLimit-Remaining-Day' => max(0, $apiKey->rate_limit_per_day - $dayCount - 1),
        ]);
    }
}

/**
 * Two-Factor Authentication with TOTP and Recovery Codes
 */
namespace App\Http\Controllers\Auth;

class TwoFactorController extends Controller
{
    public function enable(Request $request, TwoFactorService $twoFactor, string $guard)
    {
        $user = Auth::guard($guard)->user();

        $request->validate(['code' => ['required', 'string']]);

        // Verify TOTP code
        if (!$twoFactor->verifyCode($user->two_factor_secret, $request->code)) {
            return back()->withErrors(['code' => 'Invalid code.']);
        }

        // Generate recovery codes
        $recoveryCodes = $twoFactor->generateRecoveryCodes(10);
        $user->two_factor_recovery_codes = $twoFactor->hashRecoveryCodes($recoveryCodes);
        $user->two_factor_enabled = true;
        $user->save();

        // Audit logging
        AuditService::log(
            'two_factor_enabled', get_class($user), $user->id,
            'Two-factor authentication enabled',
            null, null,
            ['guard' => $guard, 'recovery_codes_generated' => count($recoveryCodes)]
        );

        session(["2fa_passed_{$guard}" => true]);

        return redirect()->intended($this->defaultRedirectForGuard($guard))
            ->with('status', '2FA enabled. Save your recovery codes.');
    }

    public function verifyChallenge(Request $request, TwoFactorService $twoFactor, string $guard)
    {
        $user = Auth::guard($guard)->user();
        $code = trim($request->code);

        // Try TOTP first, then recovery code
        if ($twoFactor->verifyCode($user->two_factor_secret, $code)) {
            $method = 'totp';
        } else {
            [$ok, $remaining] = $twoFactor->consumeRecoveryCode($user->recovery_codes, $code);
            if (!$ok) return back()->withErrors(['code' => 'Invalid code.']);
            $user->two_factor_recovery_codes = $remaining;
            $user->save();
            $method = 'recovery_code';
        }

        session(["2fa_passed_{$guard}" => true]);
        return redirect()->intended($this->defaultRedirectForGuard($guard));
    }
}

/**
 * Tenant Lifecycle Service - Multi-Tenant SaaS Architecture
 * Automated state transitions: trial → active → suspended → cancelled → archived → purged
 */
namespace App\Services;

class TenantLifecycleService
{
    public function process(bool $dryRun = true): array
    {
        $results = [
            'trial_to_active' => 0,
            'cancelled_to_archived' => 0,
            'archived_to_purged' => 0,
        ];

        $tenants = Tenant::all();

        foreach ($tenants as $tenant) {
            // Trial → Active (when trial period ends)
            if ($tenant->status === 'trial' && $tenant->trial_ends_at->isPast()) {
                if (!$dryRun) {
                    $this->transition($tenant, 'active', 'Trial ended - auto activation');
                }
                $results['trial_to_active']++;
            }

            // Cancelled → Archived (after export window + grace period)
            if ($tenant->status === 'cancelled') {
                $exportDeadline = $tenant->cancelled_at->addDays(PlatformConfig::tenantExportDays());
                $archiveAt = $exportDeadline->addDays(PlatformConfig::tenantGraceDays());

                if ($archiveAt->isPast()) {
                    if (!$dryRun) {
                        // HIPAA: Anchor retention to last medical encounter
                        $lastEncounter = $this->latestTenantEncounterAt($tenant->id);
                        $retentionYears = PlatformConfig::dataRetentionYears();
                        $tenant->purge_eligible_at = $lastEncounter->addYears($retentionYears);
                        $tenant->save();

                        $this->transition($tenant, 'archived', 'Export window elapsed');
                    }
                    $results['cancelled_to_archived']++;
                }
            }

            // Archived → Purged (after HIPAA retention period)
            if ($tenant->status === 'archived' && $tenant->purge_eligible_at->isPast()) {
                if (!$dryRun) {
                    $this->transition($tenant, 'purged', 'Retention window elapsed');
                }
                $results['archived_to_purged']++;
            }
        }

        return $results;
    }
}

# Enterprise Product Scraper with GPT-5-mini Integration
class RateLimitTracker:
    """Track API usage and enforce rate limits"""

    def __init__(self):
        self.daily_tokens_used = 0
        self.minute_requests = 0
        self.rate_limit_hits = 0
        self.last_minute_reset = time.time()
        self.load_state()  # Resume capability

    def check_and_wait(self, estimated_tokens: int):
        """Enforce rate limits with exponential backoff"""
        # Reset minute counter if needed
        if time.time() - self.last_minute_reset >= 60:
            self.minute_requests = 0
            self.last_minute_reset = time.time()

        # Check daily token limit
        if self.daily_tokens_used + estimated_tokens > TOKENS_PER_DAY:
            logger.warning("Daily token limit reached. Pausing until tomorrow.")
            time.sleep(3600)  # Wait 1 hour

        # Check requests per minute
        if self.minute_requests >= REQUESTS_PER_MINUTE:
            wait_time = 60 - (time.time() - self.last_minute_reset)
            if wait_time > 0:
                logger.info(f"Rate limit: waiting {wait_time:.1f}s")
                time.sleep(wait_time)

class ProductScraper:
    """GraphQL scraper with circuit breaker pattern"""

    def __init__(self):
        self.rate_limiter = RateLimitTracker()
        self.circuit_breaker_failures = 0
        self.circuit_breaker_threshold = 5

    def generate_seo_content(self, product_data: dict) -> str:
        """Generate unique SEO content using GPT-5-mini"""
        self.rate_limiter.check_and_wait(5000)

        try:
            response = openai.chat.completions.create(
                model="gpt-5-mini",
                messages=[{
                    "role": "system",
                    "content": "SEO expert writing unique product descriptions"
                }, {
                    "role": "user",
                    "content": f"Write SEO description for: {product_data['name']}"
                }],
                max_tokens=500,
                temperature=0.7
            )

            self.rate_limiter.record_success(response.usage.total_tokens)
            return response.choices[0].message.content

        except Exception as e:
            self.circuit_breaker_failures += 1
            if self.circuit_breaker_failures >= self.circuit_breaker_threshold:
                logger.error("Circuit breaker opened - too many failures")
                raise
            return ""

/**
 * Patient Portal Widget
 * Usage: <script src="https://platform.com/widget/embed.js" data-tenant="slug"></script>
 */
(function() {
    'use strict';

    // Get script configuration
    const currentScript = document.currentScript || (function() {
        const scripts = document.getElementsByTagName('script');
        return scripts[scripts.length - 1];
    })();

    const config = {
        tenant: currentScript.getAttribute('data-tenant'),
        mode: currentScript.getAttribute('data-mode') || 'inline',
        theme: currentScript.getAttribute('data-theme') || 'light',
    };

    // Validate required config
    if (!config.tenant) {
        console.error('MedConnect Widget: data-tenant is required');
        return;
    }

    // Determine base URL from script src
    const scriptSrc = currentScript.src;
    const baseUrl = scriptSrc.replace('/widget/embed.js', '');
    const portalUrl = `${baseUrl}/portal/${config.tenant}/login`;

    // Create modal portal
    function createModalPortal(container) {
        // Create button
        const button = document.createElement('button');
        button.className = 'mcpro-portal-button';
        button.textContent = 'Patient Portal';

        // Create modal with iframe
        const overlay = document.createElement('div');
        overlay.className = 'mcpro-modal-overlay';
        overlay.innerHTML = `
            <div class="mcpro-modal">
                <button class="mcpro-modal-close">×</button>
                <iframe src="${portalUrl}" class="mcpro-modal-iframe"></iframe>
            </div>
        `;

        container.appendChild(button);
        document.body.appendChild(overlay);

        // Event handlers
        button.addEventListener('click', () => {
            overlay.classList.add('open');
            document.body.style.overflow = 'hidden';
        });

        // Close on overlay click or Escape key
        function closeModal() {
            overlay.classList.remove('open');
            document.body.style.overflow = '';
        }

        overlay.querySelector('.mcpro-modal-close').addEventListener('click', closeModal);

        // PostMessage API - listen for login success from iframe
        window.addEventListener('message', function(event) {
            if (event.data?.type === 'mcpro-login-success') {
                closeModal();
                if (event.data.redirect) {
                    window.location.href = event.data.redirect;
                }
            }
        });
    }

    // Expose global API
    window.MedConnectPortal = {
        config: config,
        open: () => document.querySelector('.mcpro-modal-overlay')?.classList.add('open'),
        close: () => document.querySelector('.mcpro-modal-overlay')?.classList.remove('open')
    };
})();

-- Order Profitability Dashboard with Completion Status
-- Combines order data, item counts, and parsed PDF costs

SELECT
    o.increment_id AS 'Order ID',
    o.base_grand_total AS 'Revenue',

    -- Cost data from parsed PDFs
    COALESCE(costs.total_product_cost, 0) AS 'PDF Product Cost',
    COALESCE(costs.total_shipping_cost, 0) AS 'PDF Shipping Cost',

    -- Completion tracking
    CONCAT(
        COALESCE(costs.items_with_cost, 0),
        '/',
        items.total_items
    ) AS 'Items Costed',

    -- Dynamic status indicator
    CASE
        WHEN costs.items_with_cost IS NULL THEN '❌ No PDF Data'
        WHEN costs.items_with_cost >= items.total_items THEN '✅ Complete'
        ELSE CONCAT(
            '⚠️ Partial (',
            ROUND(costs.items_with_cost / items.total_items * 100),
            '%)'
        )
    END AS 'Status',

    -- Profit calculation (only if complete cost data)
    CASE
        WHEN costs.total_product_cost IS NOT NULL THEN
            ROUND(
                o.base_grand_total -
                costs.total_product_cost -
                costs.total_shipping_cost,
                2
            )
        ELSE NULL
    END AS 'Profit',

    costs.suppliers AS 'Suppliers'

FROM sales_order o

-- Subquery: Get item count per order
LEFT JOIN (
    SELECT
        order_id,
        COUNT(*) AS total_items
    FROM sales_order_item
    WHERE parent_item_id IS NULL
    GROUP BY order_id
) items ON o.entity_id = items.order_id

-- Subquery: Aggregate PDF parsed costs
LEFT JOIN (
    SELECT
        order_increment_id,
        SUM(total_product_cost) AS total_product_cost,
        SUM(shipping_cost) AS total_shipping_cost,
        COUNT(DISTINCT product_sku) AS items_with_cost,
        GROUP_CONCAT(DISTINCT supplier) AS suppliers
    FROM detailed_reports_line_item_costs
    GROUP BY order_increment_id
) costs ON o.increment_id = costs.order_increment_id

WHERE o.created_at >= DATE_SUB(NOW(), INTERVAL 30 DAY)
ORDER BY o.created_at DESC
LIMIT 20;

/**
 * Automated Tenant Provisioning with Docker
 * Deploys isolated containerized instances with SSL and domain routing
 */
namespace App\Services;

class TenantProvisioner
{
    public function provision(Tenant $tenant): array
    {
        $slug = $tenant->slug;
        $domain = $tenant->custom_domain ?? "{$slug}.medconnect.app";

        // 1. Create isolated database
        $dbName = "tenant_{$slug}";
        $dbPassword = Str::random(32);

        DB::statement("CREATE DATABASE IF NOT EXISTS `{$dbName}`");
        DB::statement("CREATE USER '{$dbName}'@'%' IDENTIFIED BY '{$dbPassword}'");
        DB::statement("GRANT ALL ON `{$dbName}`.* TO '{$dbName}'@'%'");

        // 2. Generate docker-compose configuration
        $dockerCompose = self::generateDockerCompose($tenant, $dbName, $dbPassword);
        File::put("/tenants/{$slug}/docker-compose.yml", $dockerCompose);

        // 3. Deploy container via Docker API
        $result = Process::run("docker-compose -f /tenants/{$slug}/docker-compose.yml up -d");

        // 4. Configure Traefik reverse proxy labels
        self::configureTraefik($tenant, $domain);

        // 5. Request SSL certificate from Let's Encrypt
        $sslResult = self::provisionSSL($domain);

        // 6. Run database migrations in container
        Process::run("docker exec tenant-{$slug} php artisan migrate --force");

        return [
            'status' => 'success',
            'domain' => $domain,
            'database' => $dbName,
            'container_id' => self::getContainerId($slug),
            'ssl_status' => $sslResult ? 'active' : 'pending',
        ];
    }

    private static function configureTraefik(Tenant $tenant, string $domain): void
    {
        // Dynamic Traefik labels for routing and SSL
        $labels = [
            "traefik.http.routers.{$tenant->slug}.rule=Host(`{$domain}`)",
            "traefik.http.routers.{$tenant->slug}.tls=true",
            "traefik.http.routers.{$tenant->slug}.tls.certresolver=letsencrypt",
        ];

        // Apply labels to running container
        foreach ($labels as $label) {
            Process::run("docker update --label-add '{$label}' tenant-{$tenant->slug}");
        }
    }
}