hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): make appointment-booking-locations publicly accessible

Browse Source 
The new booking-locations endpoint is consumed by the public site without a
token, but it was missing from both the public_endpoints firewall pattern and
access_control, so every call returned 401 ERR_AUTH_001.

Verified against the dev data: the endpoint now returns both contexts for the
test doctor (clinic in service mode, personal practice in slot mode), ordered
by earliest free slot.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
hamed
2026-07-18 13:48:18 +03:30
co-authored by Claude Opus 4.8
parent 45814f254c
commit 11bbc4e343
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/api/appointment.md
+2 -1
View File
@@ -717,7 +717,8 @@ On `POST /api/v1/appointment`, any `service_item_uuids` must belong to the same
### GET `/api/v1/appointment-booking-locations/{doctorUuid}`
**Permission:** public.
**Permission:** public — whitelisted in `config/packages/security.yaml` (both the
`public_endpoints` firewall pattern and an `access_control` entry).
Lists every place the doctor can be booked at. The site should show **all** of them, grouped by
location — picking one and hiding the rest removes real capacity from the doctor.