steve-ongera/Kemri-management-system

This is a Django-based web application designed for managing and analyzing data related to disease testing and research at KEMRI (Kenya Medical Research Institute). The system provides a dynamic dashboard for visualizing key statistics and trends, ensuring data-driven decision-making # KEMRI Data Management System — API + React Refactor This is a refactor of the original Django-templates app into a **decoupled architecture**: - **Backend:** Django + Django REST Framework, exposing a JSON API secured with JWT auth and role-based access control (RBAC). No server-rendered templates — `views.py` is entirely `ViewSet`s. - **Frontend:** React (Vite + JSX), talking to the API over `fetch`/`axios`, with client-side routing, protected routes, and role-aware navigation. ``` kemri/ ├── backend/ │ ├── config/ # Django project (settings, main urls) │ │ ├── settings.py │ │ └── urls.py # main url.py │ └── kemri_api/ # Django app │ ├── models.py │ ├── serializers.py │ ├── permissions.py # RBAC │ ├── views.py # ViewSets │ └── urls.py # app url.py (DRF router) └── frontend/ ├── index.html └── src/ ├── main.jsx ├── App.jsx ├── services/ │ └── api.js ├── context/ │ └── AuthContext.jsx ├── components/ │ ├── Navbar.jsx │ ├── Sidebar.jsx │ └── ProtectedRoute.jsx ├── layout/ │ └── DashboardLayout.jsx └── pages/ ├── Login.jsx ├── Dashboard.jsx ├── Doctors.jsx ├── Patients.jsx ├── Appointments.jsx └── NotAuthorized.jsx ``` ## RBAC model Every user has a `Profile` with a `role`: | Role | Can do | |-----------|--------| | `admin` | Full CRUD on every resource, sees system-wide dashboard stats | | `doctor` | Full CRUD on their own patients' appointments/medical records; read-only on doctor/department lists; dashboard scoped to **their own** patients/appointments | | `staff` | Read/write on patients, appointments, lab tests, reports; no access to Staff/Salary records; dashboard scoped to activity they created | | `intern` | Read-only across the board, can create medical records only for their `assigned_doctor` | Roles are enforced two ways: 1. **`permissions.py`** — custom DRF permission classes checked per ViewSet (`IsAdmin`, `IsAdminOrDocto …