🏡 CuraVicina

Family-centric elderly care coordination platform for Forlì and Italy

CuraVicina ("nearby care" in Italian) is a full-stack platform that coordinates caregivers, medications, appointments, and health monitoring for families caring for elderly loved ones. Built for the Italian healthcare ecosystem — with SPID/CIE digital identity, FSE 2.0 health records, INPS payroll compliance, and 112 emergency integration — it gives families peace of mind whether they're in Forlì or across the country.

Key numbers: 57 API routes · 66 Prisma models · 31 dashboard pages · 31 unit test files · 13 UI components · 45+ library modules · 5 languages

✨ Features

🔐 Authentication & Security

PBKDF2-SHA256 password hashing (310K iterations, WebCrypto API)
SPID/CIE SAML 2.0 digital identity (mandatory for B2G integrations)
Role-based access control: family_admin, family_member, caregiver
Tiered API rate limiting, CORS, CSRF protection, input validation
API key auth for municipality (B2G) endpoints
Full audit trail with IP/action logging

🏥 Health & Care

Smart bracelet integration — heart rate, SpO₂, blood pressure, temperature, fall detection, GPS
Drug interaction engine — 12 clinically relevant Italian medication pairs, alias normalization
Predictive fall risk scoring — weighted heuristic model (HRV, gait, sleep, activity, age, polypharmacy)
Cognitive health — daily mood check-ins, screening questionnaires, wellness composite scoring
Emergency SOS — one-tap 112 protocol with patient dossier, GPS, family notification blast
FSE 2.0 integration — CDA2 document import/export from Italy's Fascicolo Sanitario Elettronico
Geofencing — circle/polygon safe zones, zone enter/exit event logging, movement heatmaps

👨‍👩‍👧‍👦 Family Coordination

Multi-patient dashboards with daily activity feed
Daily digest emails & weekly care report cards
Medication compliance streaks & engagement analytics
Churn prediction & re-engagement quick actions
In-app voice & video calls (Daily.co WebRTC)
Async voice messages with transcription
Rule-based AI care assistant (keyword intent detection)

💊 Services & Marketplace

Caregiver marketplace — verified profiles, ratings, reviews, shift scheduling
Stripe Connect — 15% commission, SEPA payouts, 48h escrow, dispute lifecycle
Pharmacy network — haversine proximity search, refill ordering, supply-day alerts
Telemedicine — video consultations, consultation notes, appointment linking
Caregiver training — course modules, quiz gating, certificate issuance with verification codes

🏛️ B2G & Enterprise

Municipality portal — anonymized population metrics, social worker case management
INPS/COLF payroll — CCNL 2024 wage tables, IRPEF brackets, quarterly MAV deadlines, TFR/13th month
Multi-tenant — subdomain routing, per-tenant feature flags, environment presets
Predictive analytics — health scoring, anomaly detection (z-score), trend analysis

🔧 Infrastructure

GDPR engine — granular consent (6 types), Art. 15 data export, Art. 17 cascading erasure, data retention
Stripe Billing — 3 subscription tiers (Base/Plus/Premium), Italian VAT invoicing, SDI identifiers
Observability — structured JSON logging, custom metrics, health checks, alert rules with cooldowns
Monitoring — Sentry integration, incident lifecycle, web vitals thresholds, status page
Delivery — Resend email + Twilio SMS with priority queuing and delivery logging
PWA — Service Worker, IndexedDB offline sync, conflict resolution, cache strategies
WCAG 2.1 AA accessibility with skip links, keyboard navigation, contrast compliance
5-language i18n — Italian, English, Romanian, Ukrainian, Moldovan (server-side, cookie-based)
CI/CD — GitHub Actions, Docker multi-stage build, Vercel (Frankfurt fra1 region)
Cron jobs — daily digest (06:00), weekly report (Monday 08:00), onboarding emails (08:00)

🏗️ Architecture

graph TB
    subgraph "Client Layer"
        PWA[PWA + Service Worker]
        IDB[IndexedDB<br/>Offline Cache]
    end

    subgraph "Next.js 16 Application"
        Pages[31 Dashboard Pages]
        API[57 API Routes]
        SSE[SSE Real-Time Events]
        Cron[Vercel Cron Jobs]
    end

    subgraph "Business Logic — src/lib/"
        Auth[auth · security · spid-auth]
        Health[drug-interactions · fall-risk<br/>geofencing · cognitive-health]
        Care[emergency · engagement<br/>ai-assistant · analytics]
        Payments[stripe-billing · stripe-connect<br/>payroll]
        Comms[voice-video · delivery<br/>notifications · i18n]
        Infra[observability · monitoring<br/>gdpr · offline-sync · tenant]
    end

    subgraph "Data Layer"
        Prisma[Prisma 7 ORM<br/>66 Models]
        SQLite[SQLite / LibSQL<br/>Development]
        PG[PostgreSQL 16<br/>Production]
    end

    subgraph "External Services"
        Stripe[Stripe<br/>Billing + Connect]
        Resend[Resend<br/>Email]
        Twilio[Twilio<br/>SMS]
        Daily[Daily.co<br/>WebRTC]
        SPID[SPID/CIE<br/>Identity]
        FSE[FSE 2.0<br/>Health Records]
        Sentry[Sentry<br/>Errors]
    end

    PWA --> API
    PWA --> SSE
    PWA <--> IDB
    API --> Auth & Health & Care & Payments & Comms & Infra
    Auth & Health & Care & Payments & Comms & Infra --> Prisma
    Prisma --> SQLite
    Prisma --> PG
    Payments --> Stripe
    Comms --> Resend & Twilio & Daily
    Auth --> SPID
    Health --> FSE
    Infra --> Sentry
    Cron --> API

For a deep-dive into data flow, domain models, and module relationships, see docs/ARCHITECTURE.md.

🚀 Quick Start

Prerequisites

Node.js 20+ and npm 10+
(Optional) Docker & Docker Compose for containerized deployment

Local Development

# 1. Clone and install
git clone https://github.com/forli/cura-vicina.git
cd cura-vicina
npm install

# 2. Configure environment
cp .env.example .env
# Only DATABASE_URL is required for local dev — all integrations degrade gracefully

# 3. Database setup
npx prisma generate        # Generate Prisma client (66 models)
npx prisma db push         # Apply schema to SQLite
npx tsx prisma/seed.ts     # Seed demo family, patients, medications, vitals

# 4. Start development server
npm run dev                # http://localhost:3000

Docker

docker compose up          # Starts app + PostgreSQL 16

Note: The Docker Compose DATABASE_URL currently defaults to SQLite (file:./dev.db). For PostgreSQL, update it to postgresql://curavicina:curavicina_dev@db:5432/curavicina.

Running Tests

npm test                   # Vitest — run all 31 test files
npm run test:watch         # Watch mode
npm run test:coverage      # V8 coverage report (src/lib/**)
npm run test:e2e           # Playwright end-to-end tests
npm run test:e2e:ui        # Playwright with UI

Other Commands

npm run build              # Production build (Next.js)
npm run lint               # ESLint
npm run typecheck          # TypeScript checks only
npm run ci                 # Local CI gate: lint + typecheck + tests
npm start                  # Start production server

📁 Project Structure

cura-vicina/
├── prisma/
│   ├── schema.prisma          # 66 Prisma models across 9 domains
│   ├── seed.ts                # Demo data: Famiglia Rossi, 5 users, meds, vitals
│   └── migrations/            # Migration history
├── src/
│   ├── app/
│   │   ├── api/               # 57 API route handlers (Next.js App Router)
│   │   │   ├── auth/          # login, register, logout, invite, me
│   │   │   ├── billing/       # Stripe subscriptions
│   │   │   ├── connect/       # Stripe Connect payouts
│   │   │   ├── caregivers/    # Profiles, reviews, shifts
│   │   │   ├── consultations/ # Telemedicine sessions + notes
│   │   │   ├── cron/          # daily-digest, weekly-report, onboarding-emails
│   │   │   ├── emergency/     # SOS trigger + resolution
│   │   │   ├── medications/   # CRUD + interactions + refills
│   │   │   ├── vitals/        # Readings + alert management
│   │   │   └── ...            # 17 more route groups
│   │   ├── dashboard/         # 31 dashboard pages
│   │   │   ├── analytics/     # Health insights, trends
│   │   │   ├── billing/       # Subscription management
│   │   │   ├── caregivers/    # Marketplace UI
│   │   │   ├── emergency/     # SOS interface
│   │   │   ├── medications/   # Drug management
│   │   │   ├── municipality/  # B2G portal
│   │   │   └── ...            # 24 more sections
│   │   ├── auth/              # Login/register pages
│   │   ├── accessibility/     # WCAG audit page
│   │   ├── layout.tsx         # Root layout: locale, manifest, cookie consent
│   │   └── page.tsx           # Marketing landing page
│   ├── components/            # 13 shared React components
│   │   ├── sos-button.tsx     # Emergency SOS trigger
│   │   ├── realtime-events.tsx # SSE event stream consumer
│   │   ├── cookie-consent.tsx # GDPR cookie banner
│   │   ├── language-switcher.tsx # 5-locale switcher
│   │   └── ...
│   ├── lib/                   # 45+ business logic modules
│   │   ├── auth.ts            # PBKDF2 + session management
│   │   ├── security.ts        # Rate limiting, CSRF, validation, API keys
│   │   ├── drug-interactions.ts # Medication safety engine
│   │   ├── fall-risk.ts       # Predictive fall scoring
│   │   ├── geofencing.ts      # Safe zone monitoring
│   │   ├── emergency.ts       # SOS + 112 integration
│   │   ├── gdpr.ts            # Consent, export, erasure
│   │   ├── stripe-billing.ts  # Subscriptions + VAT
│   │   ├── stripe-connect.ts  # Marketplace payments
│   │   ├── payroll.ts         # INPS/COLF payroll engine
│   │   ├── voice-video.ts     # WebRTC rooms + voice messages
│   │   ├── spid-auth.ts       # SPID/CIE SAML flow
│   │   ├── i18n.ts            # Server-side translations
│   │   ├── observability.ts   # Logging, metrics, health checks
│   │   ├── monitoring.ts      # Incidents, alerts, status page
│   │   ├── offline-sync.ts    # Conflict resolution (server)
│   │   ├── offline-sync-client.ts # IndexedDB sync (browser)
│   │   ├── openapi.ts         # OpenAPI 3.1 spec generator
│   │   ├── __tests__/         # 31 Vitest test files
│   │   └── translations/      # it.ts, en.ts, ro.ts, uk.ts, md.ts
│   └── generated/             # Prisma generated client
├── e2e/                       # Playwright E2E tests
├── public/                    # Static assets, PWA manifest
├── docker-compose.yml         # App + PostgreSQL 16
├── Dockerfile                 # Multi-stage Node 20 Alpine
├── vercel.json                # Vercel config: Frankfurt, cron, security headers
└── vitest.config.ts           # Vitest: node env, V8 coverage

🔧 Tech Stack

Layer	Technology	Details
Framework	Next.js 16	App Router, Turbopack, React 19
Language	TypeScript 5	Strict mode
Styling	Tailwind CSS 4	PostCSS pipeline
Database	Prisma 7	LibSQL adapter (dev), PostgreSQL 16 (prod)
Auth	PBKDF2-SHA256	310K iterations, WebCrypto, 30-day sessions
Identity	SPID/CIE	SAML 2.0, AGID-certified for production
Payments	Stripe	Billing (3 tiers) + Connect Express (SEPA)
Email	Resend	Transactional + digest emails
SMS	Twilio	Emergency SOS + medication reminders
Video	Daily.co	Managed WebRTC, TURN/STUN
Testing	Vitest 4 + Playwright	V8 coverage, E2E critical flows
CI/CD	GitHub Actions	Build → lint → test pipeline
Deployment	Vercel / Docker	Frankfurt region, multi-stage build
Monitoring	Sentry + custom	Structured logging, alert rules, status page

🌐 Environment Variables

All integrations degrade gracefully when credentials are missing. Only DATABASE_URL is required for local development.

Variable	Description	Required
`DATABASE_URL`	SQLite (`file:./dev.db`) or PostgreSQL connection	✅ Always
`NEXT_PUBLIC_BASE_URL`	Application URL (default `http://localhost:3000`)	✅ Production
`SESSION_SECRET`	32+ byte hex secret for session signing	✅ Production
`STRIPE_SECRET_KEY`	Stripe API key	Billing
`STRIPE_CONNECT_CLIENT_ID`	Stripe Connect app ID	Marketplace
`RESEND_API_KEY`	Resend email API key	Email
`TWILIO_ACCOUNT_SID`	Twilio account + auth token + from number	SMS
`SENTRY_DSN`	Sentry project DSN	Error tracking
`DAILY_API_KEY`	Daily.co API key + domain	Video calls
`SPID_ENTITY_ID`	SPID service provider entity ID	Digital identity

See .env.example for the complete list with inline documentation.

📊 API Overview

CuraVicina exposes 57 API routes organized into 28 groups. API documentation is auto-generated via an OpenAPI 3.1 spec at /api/docs.

Group	Endpoints	Auth	Description
Auth	`/api/auth/login`, `register`, `logout`, `me`, `invite`	Mixed	PBKDF2 login, session management, family invites
SPID	`/api/spid`	No	SPID provider listing + SAML AuthnRequest
Patients	`/api/patients`	Yes	Multi-patient listing
Medications	`/api/medications`, `interactions`, `refills`	No	CRUD, drug interaction checks, refill alerts
Vitals	`/api/vitals`, `vitals/alerts`	Yes	Smart bracelet readings, alert management
Emergency	`/api/emergency`	No	SOS trigger/resolve, active emergencies
Fall Risk	`/api/fall-risk`	Yes	Predictive scoring + alert creation
Geofencing	`/api/geofencing`	No	Safe zone management, GPS checking
Caregivers	`/api/caregivers`, `[id]`, `[id]/reviews`, `[id]/shifts`	Yes	Marketplace profiles, reviews, scheduling
Consultations	`/api/consultations`, `[id]`, `[id]/notes`	Yes	Telemedicine sessions
Billing	`/api/billing`	Yes	Stripe subscription management
Connect	`/api/connect`	No	Stripe Connect metrics + onboarding
Payroll	`/api/payroll`	Yes	INPS/COLF payroll calculations
GDPR	`/api/consent`, `data-requests`	Mixed	Consent management, data export/erasure
Engagement	`/api/digest`, `notifications`, `events`	Mixed	Digests, push notifications, SSE stream
Communication	`/api/calls`, `chat`, `voice-messages`	Mixed	WebRTC rooms, AI chat, async voice
Health Records	`/api/health-records`	Yes	FSE 2.0 import/export
Pharmacy	`/api/pharmacy`	No	Proximity search, refill ordering
Training	`/api/training`	No	Courses, enrollment, certificates
Municipality	`/api/municipality`	Yes	B2G portal analytics + cases
Analytics	`/api/analytics`	No	Patient insights + health scoring
Delivery	`/api/delivery`	No	Email/SMS queue + metrics
Reports	`/api/reports`	Yes	Generated care reports
Observability	`/api/health`, `metrics`, `status`, `security`	No	Health checks, metrics, audit log
Cron	`/api/cron/daily-digest`, `weekly-report`, `onboarding-emails`	No	Scheduled jobs
Docs	`/api/docs`, `docs/spec`	No	Swagger UI + OpenAPI 3.1 spec
Misc	`/api/locale`, `sync`, `onboarding`, `moonshots`	Mixed	i18n, offline sync, onboarding flow

Full endpoint reference with request/response schemas: docs/API.md

🗄️ Data Model

The Prisma schema defines 66 models organized across 9 domains:

Domain	Models	Key Entities
Auth & Identity	7	`User`, `Session`, `Family`, `FamilyInvite`, `SpidIdentity`, `OnboardingProgress`, `ConsentRecord`
Health & Care	14	`Patient`, `Medication`, `DrugInteraction`, `VitalReading`, `FallRiskScore`, `DailyCheckin`, `CognitiveAssessment`, `WellnessScore`
Emergency & Safety	3	`EmergencyEvent`, `SafeZone`, `GeofenceEvent`
Caregivers & Marketplace	8	`CaregiverProfile`, `CaregiverShift`, `CaregiverReview`, `ConnectAccount`, `ShiftPayment`, `PayoutRecord`, `PaymentDispute`
Communication	7	`Notification`, `RealtimeEvent`, `DeliveryLog`, `ChatMessage`, `VoiceMessageRecord`, `CallRecord`, `ScheduledCall`
Billing & Payroll	6	`Subscription`, `Invoice`, `Transaction`, `PayrollContract`, `Payslip`, `ComplianceEvent`
Medical Records	4	`Consultation`, `ConsultationNote`, `HealthRecord`, `Appointment`
Analytics & AI	8	`PatientInsight`, `AnalyticsSnapshot`, `CareTwinSnapshot`, `CareSimulation`, `CareAutopilotPolicy`, `CareAutopilotRun`, `CommunityHub`, `CommunityMission`
Operations	9	`Tenant`, `MunicipalityConfig`, `AuditLog`, `SocialWorkerCase`, `SystemHealthCheck`, `SyncCheckpoint`, `Course`, `Certificate`, `CarePassport`

Full ERD and relationship diagrams: docs/ARCHITECTURE.md

🏛️ Architecture Decisions

Decision	Choice	Rationale
Password hashing	PBKDF2-SHA256 (310K iterations)	WebCrypto API native, no compiled native deps, OWASP-compliant
Real-time updates	Server-Sent Events (SSE)	Simpler than WebSocket, sufficient for unidirectional dashboard updates
Database strategy	SQLite (dev) → PostgreSQL (prod)	Fast local dev with `file:./dev.db`; production on PostgreSQL 16
Auth protocol	SPID SAML 2.0	Italian digital identity standard, mandatory for B2G/municipality access
Marketplace payments	Stripe Connect Express	Handles KYC, SEPA payouts, tax reporting, dispute resolution
i18n approach	Flat key maps, server-only	Zero client bundle bloat, 5 locales (IT/EN/RO/UK/MD)
PWA offline	Service Worker + IndexedDB	Critical for rural areas with limited connectivity
Video calls	Daily.co managed WebRTC	Avoids self-hosting TURN/STUN infrastructure
Drug interactions	Local rule-based engine	12 curated Italian medication pairs; no external API dependency
Fall risk scoring	Weighted heuristic model	Rule-based v1 with clear path to ML model upgrade
Payroll engine	CCNL Colf 2024 tables	Hardcoded Italian domestic worker rates; annual update required

🤝 Contributing

Fork the repository
Create your feature branch (git checkout -b feature/amazing-feature)
Run tests (npm test)
Commit using Conventional Commits: feat:, fix:, docs:, test:, refactor:, chore:
Push and open a Pull Request

Development Notes

All external service integrations are designed to degrade gracefully — missing API keys disable specific features without breaking the app
Test coverage targets src/lib/**/*.ts exclusively
The seed script creates a demo family ("Famiglia Rossi") with realistic Italian data

📖 Documentation

API Reference — Complete endpoint documentation with request/response schemas
Architecture — System design, data flow diagrams, domain model ERD
Security — Security model, vulnerability reporting, compliance details

📜 License

This project is licensed under the MIT License — see the LICENSE file for details.

🔒 Security

For security vulnerabilities, please see SECURITY.md.

Made with ❤️ in Forlì, Italy
CuraVicina — Assistenza anziani familiare

Name		Name	Last commit message	Last commit date
Latest commit History 119 Commits
.github/workflows		.github/workflows
docs		docs
e2e		e2e
prisma		prisma
public		public
src		src
website		website
.editorconfig		.editorconfig
.gitignore		.gitignore
AGENTS.md		AGENTS.md
ANALYSIS-ITER2.md		ANALYSIS-ITER2.md
ANALYSIS-ITER3.md		ANALYSIS-ITER3.md
ANALYSIS-ITER4.md		ANALYSIS-ITER4.md
ANALYSIS-ITER5.md		ANALYSIS-ITER5.md
ANALYSIS.md		ANALYSIS.md
CHANGELOG.md		CHANGELOG.md
CLAUDE.md		CLAUDE.md
DEPTH-AUDIT-ITER2.md		DEPTH-AUDIT-ITER2.md
DEPTH-AUDIT.md		DEPTH-AUDIT.md
Dockerfile		Dockerfile
LICENSE		LICENSE
MOONSHOT-ANALYSIS.md		MOONSHOT-ANALYSIS.md
README.md		README.md
SECURITY.md		SECURITY.md
UX-AUDIT-ITER2.md		UX-AUDIT-ITER2.md
UX-AUDIT.md		UX-AUDIT.md
docker-compose.yml		docker-compose.yml
eslint.config.mjs		eslint.config.mjs
next.config.ts		next.config.ts
package-lock.json		package-lock.json
package.json		package.json
playwright.config.ts		playwright.config.ts
postcss.config.mjs		postcss.config.mjs
prisma.config.ts		prisma.config.ts
tsconfig.json		tsconfig.json
vercel.json		vercel.json
vitest.config.ts		vitest.config.ts

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

🏡 CuraVicina

✨ Features

🔐 Authentication & Security

🏥 Health & Care

👨‍👩‍👧‍👦 Family Coordination

💊 Services & Marketplace

🏛️ B2G & Enterprise

🔧 Infrastructure

🏗️ Architecture

🚀 Quick Start

Prerequisites

Local Development

Docker

Running Tests

Other Commands

📁 Project Structure

🔧 Tech Stack

🌐 Environment Variables

📊 API Overview

🗄️ Data Model

🏛️ Architecture Decisions

🤝 Contributing

Development Notes

📖 Documentation

📜 License

🔒 Security

About

Uh oh!

Releases

Packages

Uh oh!

Contributors

Uh oh!

Languages

Folders and files

Latest commit

History

Repository files navigation

🏡 CuraVicina

✨ Features

🔐 Authentication & Security

🏥 Health & Care

👨‍👩‍👧‍👦 Family Coordination

💊 Services & Marketplace

🏛️ B2G & Enterprise

🔧 Infrastructure

🏗️ Architecture

🚀 Quick Start

Prerequisites

Local Development

Docker

Running Tests

Other Commands

📁 Project Structure

🔧 Tech Stack

🌐 Environment Variables

📊 API Overview

🗄️ Data Model

🏛️ Architecture Decisions

🤝 Contributing

Development Notes

📖 Documentation

📜 License

🔒 Security

About

Topics

Resources

License

Security policy

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages