Openfront Pharmacy

Openfront Pharmacy is a self-hosted pharmacy app built on Next.js, Keystone 6, GraphQL, Prisma, and PostgreSQL. It has two parts:

• A public storefront. Customers pick a location, browse and buy over-the-counter (OTC) products, check an order's status, request refills, and send online registration, transfer, and new-prescription requests.
• An operator dashboard at /dashboard. Staff handle patients, prescribers, prescription intake and review, clinical safety review, fills, dispensing with labels, refills, transfers, products, drug references, suppliers, inventory lots, recalls, orders, point of sale, payments, staff, locations, integrations, and the audit log.

Live site: pharmacy.openship.org. Source: github.com/openshiporg/openfront-pharmacy.

Human authority

Clinical, inventory, and money records cannot be created or edited through the generic GraphQL API. They change only through named commands. Most of those commands need a signed-in user with the right permission and location scope, a written reason, and an explicit attestation. Each one writes a HumanApproval, an AuditEvent, and an OutboxEvent in the same transaction.

The pharmacist decides whether a prescription is valid, whether it is safe for the patient, and whether to dispense it. Openfront Pharmacy records that decision with the person who made it, their reason, and the evidence behind it.

Tenancy

• Organization is the pharmacy business (the tenant). It holds branding, the privacy notice, the cash and sales-tax policy, and the fill policy.
• PharmacyLocation is a store. Products, lots, prescriptions, orders, and recalls belong to a location.
• OrganizationMembership links a user to an organization, either organization-wide or for one location. Its role is one of owner, administrator, pharmacist, technician, cashier, delivery, or read_only. Staff credential evidence is stored on the membership.
• Role holds 19 can* permission flags, such as canReviewPrescriptions, canDispenseMedications, and canViewPatientPrivateData.

Operator queries filter by the caller's active memberships. The storefront finds its organization from the request host, matching it against storefrontKey, storefrontHost, or slug. If nothing matches and only one organization is active, that organization is used.