Overview
A review console for the calls a voice assistant takes at a clinic front desk. Those calls are full of health information, so the people reviewing them should see as little of it as their job allows.
The data is synthetic. There are no real patients, and this is not a HIPAA-compliant product. It is a demonstration of the engineering habits that kind of system needs. The hosted copy is offline for now (its free host paused the API), so the recording on the GitHub page is the way to see it run, and the repo starts the whole stack locally. The repo README lists two demo accounts, one reviewer and one admin.
What it does
- Masks when a call arrives, not when it is displayed. Names, phone numbers, birth dates, emails, record and insurance numbers and addresses are masked at ingest and the masked copy is what every screen reads. If masking happened at display time, any new endpoint or export would be unmasked by default.
- Reveals on purpose. Only an administrator can reveal a call, with a reason of 10 to 300 characters. The reveal and the reason are written to an append-only audit table in the same database transaction, and the revealed text hides itself again after 60 seconds.
- Audits everything. Sign-ins, including failed ones, opened calls, status changes and incoming calls appear in an admin-only trail.
- Takes calls by signed webhook. The signature covers a timestamp and the raw body and is checked before the body is parsed. There is a five minute replay window and a constant-time comparison, and one error message covers every failure.
- Encrypts the patient name and raw transcript in the database with AES-256-GCM, and a test reads the table columns to prove no readable name is in them.
What I measured
There are 71 Java tests, which call the real API as the wrong role, with no token, with a forged or expired token, with a missing reason and with a bad or replayed signature. There are 126 Angular unit tests, and a Playwright walkthrough of 39 checks covers login, filtering, masked reading, the reveal dialog, the audit trail and the 390 px phone layout. I re-ran the Java and Angular suites for this page and both pass at those counts.
The part I trust most is a script that breaks one guard at a time and requires a real test failure each time: reveal no longer admin-only, audit row not written, signature not checked, token sent to any origin. It breaks 28 guards, and all 28 are caught. It runs the tests unmutated first, so a suite that was already red cannot make a mutant look caught.
What broke
A form that reloaded the page. A (ngSubmit) on a form with no form directive submitted natively and refreshed the browser. The unit tests passed. The browser run found it, and a test now dispatches the submit event to pin it.
A health poll that never reached "waking up". I used switchMap for the poll, so each hanging request was cancelled by the next four-second tick and a sleeping server never reported anything. exhaustMap fixed it, because the poll should wait for the request in flight.
Tests that passed without testing anything. The mutation script found a cache-header assertion that Spring Security's default satisfied on its own, and a mutant that did not change behaviour at all. Both are rewritten.
Every deep link returned 404 once deployed. My first Vercel rewrite pattern was too clever. Local runs were fine, and only running the browser suite against the live URL showed it.
Limits
The redactor is rule-based, so it misses a name the caller never introduces, and it leaves appointment dates visible on purpose. The database is in-memory H2 in PostgreSQL mode, reseeded at start. Login lockout is in memory on one instance, the token is in session storage, and there is no real-time push. The README and docs/DECISIONS.md say what each of these would become.
Tech Stack
Frontend: Angular with standalone components, signals, RxJS, lazy routes, a route resolver, guards and interceptors, CDK dialog Backend: Java, Spring Boot, Spring Security with JWT roles, Spring Data JPA, Flyway Security: AES-256-GCM field encryption, HMAC-signed webhook, append-only audit Testing: JUnit, Vitest, Playwright, a mutation script Delivery: Docker, GitHub Actions, Render and Vercel free tiers