The API and React components were already parameterized by doctor uuid, but 14
copy-pasted identity checks limited every endpoint to "the doctor themselves or
an admin", so a clinic owner could not touch a member doctor's booking setup.
- Replaces those 14 checks with one denyDoctorAccess() that also admits the
owner of a clinic the doctor belongs to, and a member doctor holding the
clinic's appointment_settings permission (view for GET, update for writes).
A doctor's own settings short-circuit before any permission lookup.
- Moves ScheduleSection and its tabs out of DoctorDetailPage into
components/schedule/ScheduleSection.tsx so the doctor panel and the new
clinic page render the same module instead of one page importing another.
Pure relocation — no logic changed.
- Adds ClinicAppointmentSettingsPage: one tab per clinic doctor, each rendering
that same section. The tab wrapper is keyed by doctor uuid so in-progress
schedule edits cannot leak onto the wrong doctor.
- insurance-pricing accepts an optional doctor_uuid (query on GET, body on PUT)
under the same access rule, so the visit-price card works inside the clinic
tabs. Fixes saveInsurancePricing calling getInsurancePricing with the wrong
argument by extracting the shared pricingPayload().
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Removed MyClinicPage and redirected its functionality to a new ClinicDoctorsPage.
- Created ClinicDoctorsManager component for managing doctors and invitations within the settings layout.
- Updated backend permissions to allow clinic owners to detach doctors, alongside admins.
- Adjusted API documentation to reflect new permission structure.
- Updated tests to cover new functionality and permissions.
- Modified sidebar and settings menu to reflect the new structure and role-based visibility.
Remove پرسنل (/admin/staff) and منشی ها (/admin/my-secretaries) from the
clinic and doctor main sidebars; surface them under the settings menu instead
(PurchaseSubscriptionSidebar + SETTINGS_MENU). Wrap StaffPage in SettingsLayout
so it renders inside the settings shell like MySecretariesPage already does.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SettingsLayout rendered its own role-gated aside while the subscription page
rendered PurchaseSubscriptionSidebar, so /admin/subscription and other settings
pages (sms-wallet, ...) showed two different settings menus. Make SettingsLayout
render the shared PurchaseSubscriptionSidebar and have SubscriptionPage use
SettingsLayout too, so every settings page shows one identical menu. menuForRole
/ SETTINGS_MENU are kept for the mobile settings list (SettingsMenuPage).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add an optional `roles` filter to the settings menu and hide items that don't
apply to the current user's role, so a doctor no longer sees "مدیریت مطب"
(clinic-only) and a clinic no longer sees "مدیریت پزشک" / "مدیریت نوبت دهی"
(doctor-only) — avoiding menu entries that just redirect. Both the desktop
shell (SettingsLayout) and the mobile list (SettingsMenuPage) filter via the
shared `menuForRole` helper.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fill the three previously-placeholder settings sections so every menu item
is now a real page inside the settings shell:
- حساب کاربری: new authenticated POST /api/v1/user/change-password
(verifies current password, ≥8 chars, must differ) + account page with a
profile summary and change-password form.
- برچسبها: new per-tenant TenantTag domain (entity/repo/controller +
migration) with tenant-scoped CRUD at /api/v1/tenant-tag(s), plus a tags
management page (list + color + add/edit/delete).
- مدیریت نوبت دهی: export the existing WeeklyScheduleTab from
DoctorDetailPage and reuse it in a standalone AppointmentSettingsPage
(current doctor's uuid + addresses).
Wire all three menu entries to their routes. Backend covered by PHPUnit
(change-password, tenant-tag CRUD + ownership); FE covered by Vitest.
API docs updated (auth.md, tag.md).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Wrap the existing settings-area pages — doctor profile (مدیریت پزشک),
insurance pricing (بیمه), payment report (پرداخت), SMS wallet (پیامکها),
secretaries (منشی) and clinic info (مطب) — in SettingsLayout so they appear
under the settings sub-navigation like the Figma design, with the matching
menu item highlighted. Wire the doctor/clinic menu entries to their routes.
The نوبتدهی / برچسبها / حساب کاربری entries stay as disabled placeholders
until they have their own pages/designs.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a doctor/clinic settings sub-navigation shell (SettingsLayout) with
"خرید اشتراک" as its first section, plus a mobile settings-list page.
Rebuild the plan-selection page with a per-plan billing-period toggle,
single price, most-popular badge and a current-plan status banner.
Add a payment-success page that reads the gateway return params
(?payment_uuid&status), shows the transaction receipt and the newly
active plan, and redirects to the plans page with a toast on any
non-success status.
Frontend only — reuses the existing /api/v1/subscription/* and
/api/v1/subscription-payment endpoints; no backend or API-doc changes.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
