NovaHamo Technologies | Internal Project Documentation
Lakshman Module Documentation
Python Full Stack + AI + High Security Architecture
AI-Based Wound Analysis System
Prepared for Lakshman module only
Authentication, user management, patient records, image storage, AI
Scope
analysis API, JWT security, audit logging
FastAPI + React/[Link] + PostgreSQL + S3/MinIO + Celery + Redis
Technology Direction
+ AI inference service
Production-grade backend foundation with strict role access and
Design Goal
healthcare-style security controls
This document focuses only on Lakshman’s responsibilities in the project and presents them in
implementation-ready documentation format.
1. Purpose of the Lakshman Module
Lakshman owns the core backend foundation of the application. This layer acts as the backbone of the
system because all user access, patient data, wound images, AI result delivery, and security controls
depend on it.
His responsibilities include authentication, authorization, user management, patient registration, patient
updates, wound image storage, backend-to-AI integration, JWT protection, and audit logging.
The goal is not just to build working APIs. The goal is to build a secure, production-ready platform that
can protect sensitive healthcare-style data and support controlled access for Admin, Doctor, and Nurse
roles.
2. Recommended Python Full Stack + AI Architecture
Layer Recommended Technology Reason
Role-based dashboards for Admin,
Frontend [Link] or [Link]
Doctor, Nurse
Backend API FastAPI High-performance Python APIs with
Lakshman Module Documentation • AI-Based Wound Analysis System
NovaHamo Technologies | Internal Project Documentation
strong schema validation
Secure relational storage for users,
Database PostgreSQL
patients, tokens, and logs
Clean model management and
ORM + Migrations SQLAlchemy + Alembic
versioned schema updates
JWT access token + refresh Short-lived access with refresh
Authentication
token rotation
Hash passwords securely; never
Password Security Argon2 or bcrypt
store plain text
Object Storage AWS S3 or MinIO Private storage for wound images
FastAPI + PyTorch/TensorFlow Separate inference service for
AI Service
+ OpenCV wound analysis
Async analysis processing and
Background Jobs Celery + Redis
retries
HTTPS, routing, rate limiting, and
Reverse Proxy Nginx
security headers
Prometheus + Grafana / ELK or
Monitoring Visibility, traceability, and alerting
Loki
Centralized and secure secret
Secrets Vault or cloud secrets manager
handling
This stack is chosen because it is practical for Python development, easy to integrate with AI services,
and strong enough for production-level security controls.
3. Lakshman Task Ownership
Task ID Module Responsibility
T1 Authentication Secure login for Admin, Doctor, and Nurse
T2 User Management Create, update, deactivate, and control user accounts
T3 Add Patient Form Register patients with validated input
T5 Edit/Delete Patient Update or archive patient records safely
T7 Image Storage Store wound images privately and securely
Lakshman Module Documentation • AI-Based Wound Analysis System
NovaHamo Technologies | Internal Project Documentation
T11 Analysis API Send image data to AI service and return results
T16 JWT Authentication Protect APIs using access and refresh tokens
T17 Audit Logs Track all important user and system actions
Ownership Flow: User login → role validation → user management → patient save/update → image
storage → secure backend APIs → audit logs
4. Detailed Functional Modules
4.1 Authentication (T1)
Objective: Provide secure login for Admin, Doctor, and Nurse users.
Functional flow: user enters email and password, backend validates the credentials, password hash is
checked, role is identified, access token and refresh token are issued, and the user is redirected to the
proper dashboard.
High-security implementation: use Argon2 or bcrypt for password hashing, apply login throttling, lock
accounts after repeated failed attempts, use generic error responses, and log both successful and failed
login attempts.
Recommended endpoints: POST /api/v1/auth/login, POST /api/v1/auth/refresh, POST
/api/v1/auth/logout.
Important rule: never trust only the frontend. Even if the UI hides features, the backend must still verify
the user role on every protected endpoint.
4.2 JWT Authentication (T16)
Objective: Protect all sensitive APIs using access tokens and refresh tokens.
Implementation approach: keep the access token short-lived, store refresh tokens more carefully,
validate token signature and expiry, and revoke or rotate tokens when needed.
Recommended token claims: sub for user ID, role, exp for expiry, and type to distinguish access and
refresh tokens.
Required result handling: missing token should return 401, invalid token should return 401, and valid
token with insufficient permissions should return 403.
4.3 User Management (T2)
Objective: Allow Admin users to create, update, and deactivate accounts for Doctor, Nurse, and Admin
roles.
Functional fields: full name, email, role, department, status, temporary password or setup flow.
Lakshman Module Documentation • AI-Based Wound Analysis System
NovaHamo Technologies | Internal Project Documentation
Security requirements: only Admin can manage users, email must be unique, role changes must be
logged, and sensitive role updates should revoke existing user sessions.
Recommendation: use soft deactivation instead of hard deletion so historical audit references remain
intact.
4.4 Add Patient Form (T3)
Objective: Register a patient securely and store all required information for future wound analysis.
Suggested fields: patient ID, patient name, age, gender, contact, address, diagnosis or wound type,
assigned doctor, assigned nurse, visit date, and notes.
Security requirements: validate every field server-side, block duplicate patient IDs, and allow only
authorized roles to create patient records.
Implementation note: use Pydantic request schemas and keep request validation separate from database
models.
4.5 Edit / Delete Patient (T5)
Objective: Update patient details safely and archive records when needed.
Security design: Doctor and Nurse should only edit fields allowed by workflow rules, while Admin can
manage broader lifecycle actions.
Best practice: prefer archive or soft delete instead of hard delete to preserve history, images, and logs.
All updates must store timestamp, actor, and target patient information in audit logs.
4.6 Image Storage (T7)
Objective: Store wound images privately so they can be used for AI analysis without exposing them
publicly.
Workflow: Nurse uploads image, backend validates file type and size, image is renamed using a
generated identifier, stored in private object storage, and metadata is saved in PostgreSQL.
Metadata fields: patient_id, uploaded_by, storage_key, mime_type, file_size, checksum, uploaded_at,
and analysis_status.
Security requirements: reject invalid file types, block public access, prevent direct object reference
attacks, and return images only through signed URLs or backend-verified access.
4.7 Analysis API (T11)
Objective: Connect the backend to the AI service securely and deliver wound analysis results to the
frontend.
Flow: image upload completes, metadata is stored, backend sends an authenticated request to the AI
inference service, model generates analysis, result is validated and saved, and frontend retrieves the
result from protected APIs.
Lakshman Module Documentation • AI-Based Wound Analysis System
NovaHamo Technologies | Internal Project Documentation
AI output may include wound type, healing stage, infection risk, confidence score, recommendation
summary, and processed timestamp.
Security requirements: frontend must never call the AI service directly, backend must validate the
image-patient relationship before analysis, and every request should carry a trace ID for debugging and
auditing.
4.8 Audit Logs (T17)
Objective: Maintain a traceable record of all security-relevant actions.
Log examples: login success or failure, logout, token refresh, user created, user deactivated, patient
created, patient updated, image uploaded, analysis started, analysis completed, and access denied.
Suggested audit fields: user_id, role, action, target_type, target_id, IP address, user agent, request ID,
status, and created_at.
Do not store passwords, plain tokens, or raw secrets in logs.
5. Database Design
Recommended core tables are shown below. The structure is intentionally normalized for security,
traceability, and long-term maintainability.
Table Purpose
users Stores login identity, role, status, and account metadata
refresh_tokens Stores or references active refresh tokens for rotation and revocation
patients Stores patient demographic and workflow information
patient_images Stores image metadata such as storage key, checksum, and status
analysis_results Stores AI output linked to a patient image
audit_logs Stores security and activity trace data
failed_login_attempts Tracks brute-force patterns and lockout policies
user_sessions Tracks active sessions or device usage where needed
Lakshman Module Documentation • AI-Based Wound Analysis System
NovaHamo Technologies | Internal Project Documentation
6. Suggested Folder Structure
backend/
app/
[Link]
core/
[Link]
[Link]
[Link]
[Link]
models/
[Link]
[Link]
[Link]
[Link]
[Link]
schemas/
[Link]
[Link]
[Link]
[Link]
[Link]
api/
[Link]
[Link]
[Link]
[Link]
Lakshman Module Documentation • AI-Based Wound Analysis System
NovaHamo Technologies | Internal Project Documentation
[Link]
[Link]
services/
auth_service.py
user_service.py
patient_service.py
image_service.py
analysis_service.py
audit_service.py
repositories/
user_repo.py
patient_repo.py
image_repo.py
analysis_repo.py
tasks/
analysis_tasks.py
utils/
[Link]
file_security.py
This structure keeps API routes, business logic, database operations, validation, and background tasks
clearly separated.
7. Security Standards
• HTTPS only for all production traffic.
• Strict role-based access checks on every protected endpoint.
• Short-lived JWT access token and refresh-token rotation.
• Password hashing with Argon2 or bcrypt.
• Server-side input validation for all forms and APIs.
Lakshman Module Documentation • AI-Based Wound Analysis System
NovaHamo Technologies | Internal Project Documentation
• Private object storage for wound images.
• Rate limiting on login and sensitive endpoints.
• Secure secret handling using Vault or a managed secrets service.
• Security headers via Nginx or application middleware.
• Structured audit logging with searchable filters.
8. Deployment Recommendation
Run the frontend and backend behind Nginx with HTTPS enabled.
Keep PostgreSQL and Redis on private networks and never expose them directly to the public internet.
Use Docker for consistent deployment across development, testing, and production.
Store secrets outside the source code repository.
Back up the database and object storage regularly and test restore procedures.
Monitor application health, failed logins, API errors, and analysis failures.
9. Tough Implementation Expectations
Area Expected Standard
Secure login, lockout policy, token issuance, refresh flow, and audit
Authentication
logging
Authorization Backend-verified role checks for all sensitive APIs
Validated CRUD operations with controlled edit rights and archive-
Patient Data
first strategy
Private storage, metadata tracking, MIME validation, checksum, and
Image Handling
secure retrieval
Authenticated backend-to-AI communication with schema validation
AI Integration
and trace IDs
Observability Structured logs, monitoring, and searchable audit trails
Code Quality Clean architecture, unit tests, integration tests, and environment
Lakshman Module Documentation • AI-Based Wound Analysis System
NovaHamo Technologies | Internal Project Documentation
separation
10. Final Summary
Lakshman should build a secure FastAPI-based Python backend that handles authentication, role
control, user administration, patient records, wound image storage, AI analysis integration, JWT
protection, and audit logging. This module must be treated as a production-grade backbone for the full
project, not as simple CRUD.
In simple words: Lakshman is responsible for the system foundation, security controls, and protected
backend workflows that make the entire AI-based wound analysis platform reliable and safe.
Lakshman Module Documentation • AI-Based Wound Analysis System