Luna App
Background
Luna is Nxtcure’s patient companion: a warm, role-bounded nursing presence that checks in with cancer patients at the end of each day, tracks their medications, goals, and symptoms, and connects them to clinical trials and a support community. The product spans two sibling repositories with a shared git history, both under ~/void/www/git/medicalapps/nxtcure-appnxtcureapp-backend
The Mobile App
nxtcure-appapp/app/index.tsx
export { SplashScreen as default } from '@/features/screens';
with src/features/screens.tsxluna.tsxtracker.tsxscoreboard.tsxmatching.tsxcommunity/
State is one zustand store, src/store/useAppStore.tsexpo-secure-store
export function landingRoute(state: {
token: string | null;
onboardingComplete: boolean;
consentVersion: string | null;
}): LandingRoute {
if (!state.token) return '/auth/sign-in';
if (!state.onboardingComplete) return '/onboarding/welcome';
if (needsConsent(state.consentVersion)) return '/onboarding/consent';
return '/(tabs)/luna';
}
App Store guidelines shaped the architecture in visible ways: email plus password is the only sign-in (offering any third-party login would require adding Sign in with Apple, so the app offers none, though the backend’s /auth/googleexpo-iap
Talking to the Backend
All HTTP flows through one authenticated fetch in src/services/session.ts
export async function apiFetch(path: string, init: ApiInit = {}): Promise<Response> {
const { token, ...rest } = init;
const access = bridge?.getAccessToken() ?? token ?? null;
const res = await send(path, rest, access);
if (res.status !== 401) return res;
const fresh = await refreshAccessToken();
if (!fresh) return res; // session is over (or we're offline) — hand back the 401
return send(path, rest, fresh);
}
Feature services layer over it: chat, check-ins, tracker, transcripts, documents, clinical trials, billing, push devices, and a community repository with an interface, a real API client, and a mock selected by environment variable. The store and the session module avoid a circular import through a registered AuthBridge
The Backend
nxtcureapp-backenduvapp/main.py
controller (app/controllers/) — the HTTP/websocket endpoint; thin
-> service (app/services/) — the business rules for the feature
-> repository (app/repositories/) — the only layer that touches the DB
The API surface groups into auth (/auth/signup/auth/login/auth/refresh/auth/logout/me/community/ws/call/health
The central data modelling idea is the recorded versus tracked split. The tracked tables are the patient’s plan, edited in the tracker tab and soft-deleted with active=False
class RecordedSymptom(Base):
"""A symptom rating the agent recorded on a given day."""
__tablename__ = "recorded_symptoms"
id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
user_id: Mapped[str] = mapped_column(String, ForeignKey("users.id"), index=True)
day: Mapped[str] = mapped_column(String, index=True) # ISO YYYY-MM-DD
source: Mapped[str] = mapped_column(String, default="call") # 'call' | 'chat'
name: Mapped[str] = mapped_column(String)
value: Mapped[str] = mapped_column(String) # '0'-'4' rating
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
Days are bucketed in the patient’s own IANA timezone on both sides — the client persists a local day key with a migration that drops the old UTC key rather than misread it, and the check-in service stamps Checkin.day
Luna's Brain: Prompts and Providers
The LLM layer is provider agnostic. app/llm.pycomplete_jsoncomplete_chatocr_imageLLM_PROVIDERgpt-4o-miniclaude-opus-4-8None
def complete_json(system: str, user: str, max_tokens: int = 1024, model: str | None = None) -> str | None:
provider = config.active_llm_provider()
if provider == "openai":
return _openai(system, user, max_tokens, model)
if provider == "anthropic":
return _anthropic(system, user, max_tokens)
return None
There are two distinct Luna personas. app/chat.pyapp/prompt.pyMAX_ITEMSMAX_FIELD
return f"""You are Luna, a warm, calm end-of-day nursing companion for {name}, who is
a cancer patient. When you do the check-in your job is to ASK how their day went
and whether they did what they were supposed to do — you are checking in, NOT
giving reminders or instructions. Speak gently, ask only ONE question at a time,
keep each reply short (this is a spoken call), and always wait for the patient's
answer before moving on.
The Voice Call
The voice path bridges to the Deepgram Voice Agent: listen is Deepgram nova-3gpt-4o-minibuild_prompt(ctx)aura-2-aurora-enapp/deepgram_agent.py
# Authenticate BEFORE opening the Deepgram session. Every minute of that session
# is billable, so this has to gate the connect rather than merely decide whether
# the transcript gets attributed to a user.
claims = decode_token(start.get("token") or "")
if claims is None:
log.warning("Rejected unauthenticated call attempt")
await ws.send_json({"type": "error", "message": "Unauthorized — sign in again."})
await ws.close(code=1008) # policy violation
return
The client half opens the socket and sends the real tracker state so Luna asks about actual medications rather than a hardcoded list, reading the store at call time instead of subscribing to it (a lesson learned: the old subscription re-rendered every chat bubble on any store change anywhere in the app). On hangup the backend persists the transcript, runs structured extraction over it, and writes the recorded rows. The client uses @mykin-ai/expo-audio-stream
Check-Ins, Streaks, and the Scoreboard
The daily check-in has two paths that converge on the same data. The scripted chat builds a question queue from the active meds, goals, symptoms, and four meal slots, patching answers by item id so the tracker stays editable mid-conversation; on completion it submits the answers themselves rather than the transcript — the check-in is button driven, so re-deriving known answers through an LLM could only lose or distort them. The one thing buttons cannot give is how healthy the day’s food was, which the server asks the LLM to score zero to ten. The voice path counts as the day’s check-in only when it actually recorded answers; calling to ask a question leaves the check-in due. Once-a-day enforcement exists on both sides, and the voice controller reads check-in state from the database rather than trusting the client.
The scoreboard reconstructs history from GET /me/logscomputePerfectDays
Trial Matching
The matchingapp/services/matching/MatchRun
Community
The support groups are a federated social layer bridged to a PieFed instance at social.nxtcure.com
Auth and Sessions
Passwords are PBKDF2-HMAC-SHA256 at 240,000 iterations. A login returns a thirty minute HS256 access JWT plus a ninety day sliding refresh token (one year hard ceiling) of which only the SHA-256 hash is stored. Rotations share a family_id
def require_subscriber(
claims: dict = Depends(get_current_claims),
db: Session = Depends(get_db),
) -> dict:
"""`get_current_claims`, plus proof the account is on a trial or paid.
Answers 402 for the free tier — the HTTP status that means exactly this —
with a message the app surfaces verbatim. `User.subscription_active`
already treats an expired trial as lapsed, so a stale mirror cannot hold
this gate open."""
from .models import User # noqa: PLC0415 — models imports nothing from here
user = db.get(User, claims["sub"])
if user is None or not user.subscription_active:
raise HTTPException(status_code=402, detail=SUBSCRIPTION_REQUIRED_MESSAGE)
return claims
The voice entitlement check fails open on a database outage — a blip must not hang up on a paying patient — but a definitive free-tier answer denies. Sign-out clears the keychain first and treats the logout request as best effort, so a network failure cannot leave a user stuck signed in.
Deployment
The backend ships as a two stage Docker image on python:3.11-slim-bookwormuv sync --frozencompose.ymlstop_grace_period: 30s.dockerignore.env