[BackStacked]

What

Partner-lab PDFs (Hy Patho Lab, Clinova Pathlabs) are read by @mgpl-diagnostics/report-reader. The import is matched to one of our bookings and applied to our reports as entered results with provenance. Staff verify and release as usual. Full write-up: docs/18-imports.md.

Field	Permission
importExternalReport(pdfBase64, fileName, bookingId, branchId)	report:import (branch)
externalReport(id), externalReports(branchId, bookingId, status, first, after)	report:import
matchExternalReport(id, bookingId)	report:import
applyExternalReport(id, mappings, confirmPatientMismatch)	report:import + report:enter
rejectExternalReport(id, reason)	report:import
externalSignatories(lab) / nameExternalSignature(input)	signatory:read / signatory:manage
Report.provenance	report:read

New error codes: UNSUPPORTED_REPORT, FILE_TOO_LARGE, BOOKING_PATIENT_MISMATCH, REPORT_ALREADY_APPLIED.

How the rules are kept

• NABL per test. The NABL line ("NABL accredited laboratory (Certificate No. …)", worded as the partner's) appears only when test.accredited === true. No logo is ever drawn. Hy Patho reports carry no marks, so they never get the line.
• Signature only with its own PDF. Signature PNGs are stored with the sha256 of the PDF they came from. They are served and printed only through the lookup (orgId, that PDF's sha256, image sha). On pages from a single source, the partner signature prints instead of ours (report-kit's default, the owner's choice). It is never used as our own signatory, and our own reports never print a partner signature (a test checks this).
• Reported by lists medical signatories only.
• Staff still verify. Applied reports are entered, and printing still needs verifyReport. Results are copied as printed, with no catalog defaults and no recomputed ranges. Later edits are audited as report.edit_imported (parameter names only).
• Patient data.
  • The PDF, the JSON and the PNGs are stored per organisation. An unsupported PDF is not kept.
  • Job payloads carry the file id and the actor only. A test checks Redis for the PDF and for tokens.
  • Nothing is logged.
  • Tests draw fictional PDFs at run time (test/partner-pdfs.ts).

Changes from the brief (choices for review)

• Permission names use the existing resource:action form: report:import, signatory:read / signatory:manage (auth-kit 1.4.0).
• importExternalReport takes an optional branchId, which defaults to the booking's branch.
• applyExternalReport takes confirmPatientMismatch, so staff confirm a mismatch explicitly.
• Signature images are exposed as SignatureImage on ExternalSignatoryOnReport.image, not as a Document.
• Large uploads: Fastify's limit is raised to fit a base64 PDF of IMPORT_MAX_BYTES, but only for an operation whose single root field is importExternalReport. Every other operation keeps BODY_LIMIT_BYTES (413, FILE_TOO_LARGE).

Dependencies

auth-kit 1.4.0, db-kit 2.1.1 (external_report_files without a foreign key), report-kit 2.1.0, report-reader 0.1.0, client 1.4.0 (dev), and pdf-lib (dev, for the test PDFs). All are published, and package-lock.json and kits.json are updated. The client stays on 1.4.0 so that the lab-switching PR can follow this one.

Tests

CI: 438 passed, 0 failed. It runs on PostgreSQL, through PgBouncer, with replicas, and on MongoDB, with BullMQ on a real Redis. Typecheck, build, schema, API reference and llms-full freshness all pass.

The import checks cover:

• import and re-import;
• an unsupported PDF;
• base64 and size limits;
• the mismatch warning and its confirmation;
• apply with provenance (status entered until verify);
• NABL only when accredited;
• the signature served only for its own PDF;
• nameExternalSignature re-extraction;
• permissions, and NOT_FOUND for another organisation;
• the worker path.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_018jBohmYiwjQLWmN2duiZcA

[BackStacked]

CI ci fails at npm ci: ETARGET No matching version found for @mgpl-diagnostics/auth-kit@^1.4.0. This is the blocker listed in the description, not a code failure. auth-kit 1.4.0, db-kit 2.1.0, report-kit 2.1.0, report-reader 0.1.0 and client 1.4.0 are not published to GitHub Packages yet (tags are admin-only). Once they are, I'll update package-lock.json and push. A re-run before that would fail the same way.

---

Generated by Claude Code

[BackStacked]

The install now passes. The ci check still fails in [pg] imports, with external_report_files_id_fkey on every import.

The published db-kit 2.1.0 still has a foreign key from external_report_files.id to external_reports. The fix (b30ee5e) reached the branch after db-kit#11 had already merged, so 2.1.0 shipped without it. The api stores the PDF before it creates the report, so the key rejects every import.

The fix is in mgpl-diagnostics/db-kit#12 (2.1.1), which adds a contract check that would have caught this. Once v2.1.1 is published, I'll move this PR to ^2.1.1 and push. Re-running before then would fail the same way.

---

Generated by Claude Code