Full-stack application
Dental Manager
A dental clinic operations application for managing treatment history, doctor fees, attendance, payroll, and reports in one workflow.
Problem and requirements
The clinic’s administrative process previously relied on multiple spreadsheets for recording patient treatments, calculating doctor fees, processing attendance, and preparing payroll. Related data had to be transferred manually, while review status and calculation changes were difficult to trace consistently.
Dental Manager was built as an internal application that brings these processes together. Administrators have full control over master data, transactions, calculations, reports, and user accounts. Operators receive limited access to record treatments, review attendance, submit protests, view their own payroll, and inspect their account activity.
Application implementation
The frontend uses React and TypeScript, with TanStack Query managing server state and ECharts visualising period comparisons. Core workflows include XLSX imports with preview and validation, doctor fee and payroll calculations, data review, period locking, and report exports in XLSX, PDF, and ZIP formats.
Calculations retain more than final totals. The application records fee components, taxes, deductions, shifts, lateness, holidays, overtime, allowances, and adjustments so each period can be reviewed before it is locked. Audit logs record important activity and limit log visibility according to the user’s role.
Production architecture
The frontend SPA is served through Cloudflare Workers Static Assets. The API runs on Cloudflare Workers with Hono, while D1 stores operational data and R2 stores uploads and report archives. API routes use the same domain as the frontend, allowing the application to retain its /api prefix without exposing cross-origin endpoints to the browser.
The backend preserved the API shape of the previous FastAPI implementation during migration to the Cloudflare runtime. SQLite data was exported into D1-compatible SQL, the schema was applied through numbered migrations, and high-risk workflows were checked through parity and calculation tests.
Security and operations
Authentication uses JWTs with bcrypt-compatible password hashes. Administrator and Operator authorisation is enforced by backend routes rather than frontend navigation alone. CORS is restricted to configured production, Cloudflare preview, and local development origins.
Workers observability is enabled for the production API. Report archives in R2 have a retention period and are removed by a scheduled Worker. Frontend builds run TypeScript checks before deployment, while the backend runs typechecking, tests, D1 migrations, and Worker deployment from the main branch.