Architecture

program salud_health_records_v6.aleo {
    // 1. PROGRAM CONFIGURATION
    @admin(address = "aleo1...")
    async constructor() {}
    
    // 2. CONSTANTS
    const DEFAULT_ACCESS_DURATION_BLOCKS: u32 = 5760u32;
    
    // 3. DATA STRUCTURES
    record MedicalRecord { ... }
    struct AccessGrant { ... }
    
    // 4. PUBLIC STATE (MAPPINGS)
    mapping access_grants: field => AccessGrant;
    
    // 5. TRANSITION FUNCTIONS
    async transition create_record(...) -> (MedicalRecord, Future) { ... }
}

/// MedicalRecord - Private record storing encrypted patient health data
/// 
/// This record is owned by the patient and contains their encrypted medical
/// information. Only the patient can decrypt and read the contents.
record MedicalRecord {
    owner: address,        // The patient's Aleo address
    record_id: field,      // Unique identifier for this record
    data_hash: field,      // Hash of encrypted data for integrity
    data_part1: field,     // Encrypted data segment 1
    data_part2: field,     // Encrypted data segment 2
    data_part3: field,     // Encrypted data segment 3
    data_part4: field,     // Encrypted data segment 4
    data_part5: field,     // Encrypted data segment 5
    data_part6: field,     // Encrypted data segment 6
    data_part7: field,     // Encrypted data segment 7
    data_part8: field,     // Encrypted data segment 8
    data_part9: field,     // Encrypted data segment 9
    data_part10: field,    // Encrypted data segment 10
    data_part11: field,    // Encrypted data segment 11
    data_part12: field,    // Encrypted data segment 12
    record_type: u8,       // Category of medical record (1-10)
    created_at: u32,       // Block height placeholder
    version: u8,           // Record version for upgradability
}

// Helper struct for hashing
struct RecordIdInput {
    patient: address,
    data_hash: field,
    nonce: field,
}

// Generate unique record ID
let record_id: field = BHP256::hash_to_field(RecordIdInput {
    patient: self.caller,     // Ensures uniqueness per patient
    data_hash: data_hash,     // Ensures uniqueness per content
    nonce: nonce,             // Prevents prediction
});

/// AccessGrant - Public struct representing temporary access permission
///
/// Stored in public mapping so doctors can verify their access rights.
/// The actual medical data remains private - this only proves permission.
struct AccessGrant {
    patient: address,         // Who granted access
    doctor: address,          // Who has access
    record_id: field,         // Which record (not the data itself)
    access_token: field,      // Cryptographic proof of permission
    granted_at: u32,          // When access was granted (block height)
    expires_at: u32,          // When access expires (block height)
    is_revoked: bool,         // Manual revocation flag
}

// Helper struct for hashing
struct AccessTokenInput {
    record_id: field,
    doctor: address,
    patient: address,
    nonce: field,
}

// Generate unique access token
let access_token: field = BHP256::hash_to_field(AccessTokenInput {
    record_id: medical_record.record_id,
    doctor: doctor,
    patient: self.caller,
    nonce: nonce,  // Client-provided randomness prevents prediction
});

/// RecordMetadata - Public struct for record discovery (optional indexing)
///
/// Allows patients to have a public index of their records without
/// revealing the actual content. Useful for frontend record listing.
struct RecordMetadata {
    patient: address,
    record_id: field,
    record_type: u8,
    created_at: u32,
    is_active: bool,
}

/// Maps access_token -> AccessGrant for verification
/// Doctors use this to prove they have valid access
mapping access_grants: field => AccessGrant;

/// Maps record_id -> RecordMetadata for optional public indexing
/// Patients can choose to make record existence public (not content)
mapping record_metadata: field => RecordMetadata;

/// Maps (patient_address as field) -> record_count for tracking
/// Helps track how many records a patient has created
mapping patient_record_count: field => u64;

/// Maps access_token -> bool for quick validity checks
/// Cheaper than reading full AccessGrant struct
mapping access_token_valid: field => bool;

async transition create_record(
    data_part1: field,
    data_part2: field,
    data_part3: field,
    data_part4: field,
    data_part5: field,
    data_part6: field,
    data_part7: field,
    data_part8: field,
    data_part9: field,
    data_part10: field,
    data_part11: field,
    data_part12: field,
    record_type: u8,
    data_hash: field,
    nonce: field,
    make_discoverable: bool
) -> (MedicalRecord, Future)

async function finalize_create_record(
    patient: address,
    record_id: field,
    record_type: u8,
    make_discoverable: bool
) {
    // Increment patient's record count
    let patient_key: field = patient as field;
    let current_count: u64 = patient_record_count.get_or_use(patient_key, 0u64);
    patient_record_count.set(patient_key, current_count + 1u64);

    // If patient wants record to be discoverable, add metadata
    if make_discoverable {
        let metadata: RecordMetadata = RecordMetadata {
            patient: patient,
            record_id: record_id,
            record_type: record_type,
            created_at: block.height,  // Actual block height
            is_active: true,
        };
        record_metadata.set(record_id, metadata);
    }
}

async transition grant_access(
    medical_record: MedicalRecord,
    doctor: address,
    duration_blocks: u32,
    nonce: field
) -> (MedicalRecord, field, Future)

async function finalize_grant_access(
    patient: address,
    doctor: address,
    record_id: field,
    access_token: field,
    duration_blocks: u32
) {
    // Calculate expiration block height
    let expires_at: u32 = block.height + duration_blocks;

    // Create and store the access grant
    let grant: AccessGrant = AccessGrant {
        patient: patient,
        doctor: doctor,
        record_id: record_id,
        access_token: access_token,
        granted_at: block.height,
        expires_at: expires_at,
        is_revoked: false,
    };

    // Store in mappings
    access_grants.set(access_token, grant);
    access_token_valid.set(access_token, true);
}

async transition verify_access(
    access_token: field,
    doctor: address,
    record_id: field
) -> Future {
    return finalize_verify_access(access_token, doctor, record_id);
}

async function finalize_verify_access(
    access_token: field,
    doctor: address,
    record_id: field
) {
    // Check if token exists and is valid
    let is_valid: bool = access_token_valid.get_or_use(access_token, false);
    assert(is_valid); // Fails if token doesn't exist or is invalid

    // Get the full access grant
    let grant: AccessGrant = access_grants.get(access_token);

    // Verify doctor address matches
    assert_eq(grant.doctor, doctor);

    // Verify record_id matches
    assert_eq(grant.record_id, record_id);

    // Verify not revoked
    assert(!grant.is_revoked);

    // Verify not expired
    assert(block.height <= grant.expires_at);

    // If all assertions pass, access is valid
}

async transition revoke_access(
    access_token: field
) -> Future {
    return finalize_revoke_access(self.caller, access_token);
}

async function finalize_revoke_access(
    caller: address,
    access_token: field
) {
    // Get the existing grant
    let grant: AccessGrant = access_grants.get(access_token);

    // Verify caller is the patient who granted access
    assert_eq(grant.patient, caller);

    // Update grant with revoked status
    let revoked_grant: AccessGrant = AccessGrant {
        patient: grant.patient,
        doctor: grant.doctor,
        record_id: grant.record_id,
        access_token: grant.access_token,
        granted_at: grant.granted_at,
        expires_at: grant.expires_at,
        is_revoked: true,  // Mark as revoked
    };

    // Update mappings
    access_grants.set(access_token, revoked_grant);
    access_token_valid.set(access_token, false);
}

/// compute_record_id - Helper to compute record ID off-chain
transition compute_record_id(
    patient: address,
    data_hash: field,
    nonce: field
) -> field {
    return BHP256::hash_to_field(RecordIdInput {
        patient: patient,
        data_hash: data_hash,
        nonce: nonce,
    });
}

/// compute_access_token - Helper to compute access token off-chain
transition compute_access_token(
    record_id: field,
    doctor: address,
    patient: address,
    nonce: field
) -> field {
    return BHP256::hash_to_field(AccessTokenInput {
        record_id: record_id,
        doctor: doctor,
        patient: patient,
        nonce: nonce,
    });
}

{
  "program": "salud_health_records_v6.aleo",
  "version": "0.1.0",
  "description": "Privacy-preserving health records management on Aleo. Enables patients to store encrypted medical records and share them temporarily with healthcare providers via secure access tokens.",
  "license": "MIT",
  "leo": "3.4.0"
}