How to Build a Insurance Claims Tool with Replit

1// Prompt to type into Replit Agent:
2// Build an insurance claims management system with Express and PostgreSQL using Drizzle ORM.
3// Create these tables in shared/schema.ts:
4// - policyholders: id serial pk, user_id text unique, name text, email text,
5//   phone text, address jsonb, created_at timestamp
6// - policies: id serial pk, policyholder_id integer references policyholders,
7//   policy_number text unique, type text (auto/home/health/life/commercial),
8//   coverage_amount integer (cents), deductible integer, premium integer,
9//   status text default 'active' (active/lapsed/cancelled),
10//   start_date date, end_date date
11// - claims: id serial pk, policy_id integer references policies,
12//   claimant_id integer references policyholders,
13//   claim_number text unique, type text (accident/theft/damage/medical/liability),
14//   description text, incident_date date, amount_claimed integer (cents),
15//   amount_approved integer, status text default 'submitted',
16//   assigned_adjuster text, priority text default 'normal' (low/normal/high/urgent),
17//   created_at timestamp, updated_at timestamp
18// - claim_documents: id serial pk, claim_id integer references claims,
19//   filename text, file_url text, document_type text
20//   (photo/receipt/police_report/medical_record/estimate/other),
21//   uploaded_by text, uploaded_at timestamp
22// - claim_notes: id serial pk, claim_id integer references claims,
23//   author text, note text, is_internal boolean default false, created_at timestamp
24// - claim_status_history: id serial pk, claim_id integer references claims,
25//   from_status text, to_status text, changed_by text, reason text, created_at timestamp
26// Install multer for file uploads. Set up Replit Auth. Bind server to 0.0.0.0.

1// Role middleware — add to server/middleware/roles.js
2function getRoleMiddleware(req, res, next) {
3  if (!req.user) return res.status(401).json({ error: 'Auth required' });
4
5  const adminIds = (process.env.ADMIN_USER_IDS || '').split(',').filter(Boolean);
6  const adjusterIds = (process.env.ADJUSTER_USER_IDS || '').split(',').filter(Boolean);
7
8  req.userRole = adminIds.includes(req.user.id) ? 'admin'
9    : adjusterIds.includes(req.user.id) ? 'adjuster'
10    : 'policyholder';
11
12  next();
13}
14
15function requireRole(...roles) {
16  return (req, res, next) => {
17    if (!roles.includes(req.userRole)) {
18      return res.status(403).json({ error: `Requires role: ${roles.join(' or ')}` });
19    }
20    next();
21  };
22}
23
24module.exports = { getRoleMiddleware, requireRole };
25
26// Claim submission route — server/routes/claims.js
27const { db } = require('../db');
28const { claims, policyholders, policies, claimStatusHistory } = require('../../shared/schema');
29const { eq, and } = require('drizzle-orm');
30const crypto = require('crypto');
31
32function generateClaimNumber() {
33  const date = new Date().toISOString().slice(0, 10).replace(/-/g, '');
34  const suffix = crypto.randomBytes(2).toString('hex').toUpperCase();
35  return `CLM-${date}-${suffix}`;
36}
37
38router.post('/api/claims', async (req, res) => {
39  const { policyId, type, description, incidentDate, amountClaimed, priority } = req.body;
40
41  // Find policyholder record
42  const policyholder = await db.query.policyholders.findFirst({
43    where: eq(policyholders.userId, req.user.id)
44  });
45
46  if (!policyholder) {
47    // Auto-create policyholder profile on first claim
48    const [ph] = await db.insert(policyholders).values({
49      userId: req.user.id, name: req.user.name || 'Unknown', email: req.user.email || ''
50    }).returning();
51    req.policyholder = ph;
52  } else {
53    req.policyholder = policyholder;
54  }
55
56  // Validate policy belongs to this policyholder
57  const policy = await db.query.policies.findFirst({
58    where: and(eq(policies.id, Number(policyId)), eq(policies.policyholderId, req.policyholder.id))
59  });
60  if (!policy) return res.status(404).json({ error: 'Policy not found' });
61  if (policy.status !== 'active') return res.status(400).json({ error: 'Policy is not active' });
62
63  const claimNumber = generateClaimNumber();
64
65  const [claim] = await db.insert(claims).values({
66    policyId: Number(policyId), claimantId: req.policyholder.id,
67    claimNumber, type, description, incidentDate,
68    amountClaimed: Number(amountClaimed), status: 'submitted',
69    priority: priority || 'normal'
70  }).returning();
71
72  // Log initial status
73  await db.insert(claimStatusHistory).values({
74    claimId: claim.id, fromStatus: null, toStatus: 'submitted',
75    changedBy: req.user.id, reason: 'Initial submission'
76  });
77
78  res.json(claim);
79});

1const VALID_TRANSITIONS = {
2  draft: ['submitted'],
3  submitted: ['under_review'],
4  under_review: ['approved', 'partially_approved', 'rejected', 'additional_info_requested'],
5  additional_info_requested: ['under_review'],
6  approved: ['paid'],
7  partially_approved: ['paid']
8};
9
10const ROLE_PERMISSIONS = {
11  submitted: ['adjuster', 'admin'],
12  under_review: ['adjuster', 'admin'],
13  additional_info_requested: ['adjuster', 'admin'],
14  approved: ['adjuster', 'admin'],
15  partially_approved: ['adjuster', 'admin'],
16  rejected: ['adjuster', 'admin'],
17  paid: ['admin']
18};
19
20router.patch('/api/claims/:id/status', async (req, res) => {
21  const { newStatus, reason, amountApproved } = req.body;
22  const claimId = Number(req.params.id);
23
24  const claim = await getClaim(claimId, req);
25  if (!claim) return res.status(404).json({ error: 'Claim not found' });
26
27  const allowedNext = VALID_TRANSITIONS[claim.status] || [];
28  if (!allowedNext.includes(newStatus)) {
29    return res.status(400).json({
30      error: `Invalid transition from '${claim.status}' to '${newStatus}'`,
31      allowedTransitions: allowedNext
32    });
33  }
34
35  const rolesAllowed = ROLE_PERMISSIONS[newStatus] || [];
36  if (!rolesAllowed.includes(req.userRole)) {
37    return res.status(403).json({ error: `Only ${rolesAllowed.join(' or ')} can set status to ${newStatus}` });
38  }
39
40  const updateData = { status: newStatus, updatedAt: new Date() };
41  if (newStatus === 'approved' || newStatus === 'partially_approved') {
42    if (!amountApproved) return res.status(400).json({ error: 'amount_approved required for approval' });
43    updateData.amountApproved = Number(amountApproved);
44  }
45
46  await db.update(claims).set(updateData).where(eq(claims.id, claimId));
47
48  await db.insert(claimStatusHistory).values({
49    claimId, fromStatus: claim.status, toStatus: newStatus,
50    changedBy: req.user.id, reason: reason || null
51  });
52
53  res.json({ success: true, newStatus, claimNumber: claim.claimNumber });
54});

1// Prompt to type into Replit Agent:
2// Add document and notes routes to server/routes/claims.js:
3//
4// POST /api/claims/:id/documents — upload document
5//   Use multer memoryStorage with:
6//     fileFilter: only allow jpeg, jpg, png, pdf (check mimetype)
7//     limits: fileSize 5MB
8//   Validate claim belongs to req.user (either claimant or adjuster/admin)
9//   For simplicity, store file as base64 in file_url column:
10//     const fileUrl = `data:${req.file.mimetype};base64,${req.file.buffer.toString('base64')}`
11//   Insert into claim_documents: {claim_id, filename, file_url, document_type, uploaded_by}
12//   document_type comes from req.body.documentType
13//   Return the document record (without the full base64 for the list view)
14//
15// GET /api/claims/:id/documents — list documents
16//   Return id, filename, document_type, uploaded_by, uploaded_at (NOT file_url)
17//
18// GET /api/claims/:id/documents/:docId/download — download single document
19//   Return the full file_url for a specific document
20//
21// POST /api/claims/:id/notes — add note
22//   Body: {note, isInternal: boolean}
23//   is_internal=true notes: only adjusters/admins can see
24//   is_internal=false notes: visible to claimant
25//   Insert into claim_notes: {claim_id, author: req.user.id, note, is_internal}
26//
27// GET /api/claims/:id/notes — list notes
28//   If req.userRole === 'policyholder': WHERE is_internal = false
29//   If adjuster or admin: return all notes

1// Prompt to type into Replit Agent:
2// Add admin routes to server/routes/admin.js:
3//
4// GET /api/admin/claims/dashboard — aggregate stats (admin only):
5//   Claims count by status (submitted, under_review, approved, etc.)
6//   Total amount claimed vs total amount approved this month
7//   Average days from submitted_at to approved_at (for closed claims)
8//   Return these as a summary object
9//
10// GET /api/admin/claims/overdue — claims overdue for review
11//   Claims where status = 'under_review' AND
12//   created_at < NOW() - interval '7 days'
13//   Include: claim_number, type, priority, days_in_review, claimant name
14//   Order by priority (urgent first) then by age (oldest first)
15//
16// GET /api/admin/claims — all claims with filters:
17//   Query params: status, priority, assigned_adjuster, page, limit
18//   Include claimant name from policyholders join
19//
20// PATCH /api/admin/claims/:id/assign — assign adjuster
21//   Body: {adjusterId} — set assigned_adjuster = adjusterId
22//
23// React frontend:
24// 1. Policyholder view: My Claims list, submit new claim wizard, claim detail page
25// 2. Adjuster view: Assigned claims queue, claim detail with status transition buttons,
26//    document viewer, notes (all including internal), approve/reject form
27// 3. Admin view: Dashboard with stats pipeline, all claims table, overdue alerts
28//
29// Add SESSION_SECRET to Replit Secrets, ensure server binds to 0.0.0.0
30// Deploy → Autoscale