- Updated authStore to include 'representation' role.
- Modified DoctorFormPage and DoctorsPage to handle different endpoints based on user role.
- Created new RepresentationActionController for handling doctor and clinic creation by representatives.
- Added new API endpoints for representatives to manage doctors, clinics, and view appointments.
- Updated documentation to reflect new role and API changes.
- Updated the clinic API response to include new fields: title, phone, logo, images_clinic, doctors_count, city, state, 24_7, and field_working_days.
- Modified the ClinicController to fetch and include city and state information based on the clinic's address.
- Refactored the toListArray method in the Clinic entity to accept city and state parameters.
- Added a new method in the ClinicRepository to retrieve city and province names for each clinic based on their address.
.env holds credentials (API_DOC_PASSWORD, secrets) and must not be in git.
Removed it from tracking (file kept on disk) and added .env to .gitignore.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add GET /api/v1/specialties/doctor-counts?city_id= returning every active
specialty with number_of_doctors (distinct doctors via doctor_specialties,
scoped by doctor_cities when city_id is given). Make /api/v1/specialties GET
public. Powers the /specialties page count. Docs updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The appointment detail view needs the doctor's specialty and the clinic
address/phone/map, which toArray didn't return. Add doctor.specialties[] and
a top-level `address` (the doctor's first address via DoctorAddress::toArray —
address, telephone, map). Additive only; existing keys unchanged. Docs updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Birthday was never saved (hydrate forced null) and not returned in a form the
clients use. Now:
- hydrate stores the incoming `birthday` (Unix) into date_of_birth; `birthday`
takes priority over a stray `date_of_birth: null` in the same payload so it
can't be wiped.
- toArray exposes a single `birthday` (Unix) key — drop the duplicate
`date_of_birth` output to avoid overlap.
- admin UserDetailPage reads profile.birthday (formatDate renders Jalali).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
When a user completes their profile (POST/PATCH /api/v1/user-profile), the
name was only stored on the profile (label/family) and User.real_name stayed
empty — so users who registered via booking showed with no name in the admin
user list. hydrate() now mirrors the profile's full name (label + family)
onto the owning User.realName, persisted in the same flush.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Unify and harden the payment flow (same API for the main site and all
consumer sites; per-client difference is only frontend_address).
- Payment gains STATUS_CANCELED. Gateways distinguish user-cancel from
failure (Mellat ResCode=17, SEP CanceledByUser, mock cancel=1) via a new
PaymentVerifyResult::canceled flag; callback sets canceled vs failed and
skips the circuit-breaker on cancel.
- Expiry job now cancels the pending payment when a booking lapses
(AppointmentExpiryService + PaymentRepository::findPendingByAppointment).
- frontend_address allowlist is read from the payment_allowed_frontend_hosts
site setting (manageable via PATCH /api/v1/admin/settings), falling back to
the ALLOWED_FRONTEND_HOSTS env var — so a new consumer site needs no code
change.
- .env: broaden CORS_ALLOW_ORIGIN to city subdomains (*.localhost /
*.clinic-pro.ddev.site) and add yazd-nobat.localhost to ALLOWED_FRONTEND_HOSTS.
- Update docs/api/payment.md and docs/api/admin.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Rebuild the doctor rating/review system to power the public site's rich
review UI, and restrict who may submit.
Ratings:
- Rate entity holds five 0–100 dimensions (waiting time, diagnosis
accuracy, behaviour, cleanliness, expertise) instead of a single score.
- GET /rate/{uuid} returns aggregate {point, satisfaction, averages[]}.
- POST /rate upserts all five dimensions and returns the new aggregate.
Comments:
- Comment gains parent/replies (threaded) and a rich toArray with author,
like_status (like/dislike counts + current user's vote) and nested
approved replies. POST /comment accepts {comment, parent}.
- Likes are directional (value 1=like, -1=dislike) with toggle/replace;
POST /like/{uuid} returns like_count/dislike_count/current_user_like.
Eligibility:
- Only a user with a confirmed appointment in the last 30 days may rate or
comment (AppointmentRepository::hasRecentConfirmed); otherwise
403 ERR_RATING_NOT_ELIGIBLE. New GET /rate/{uuid}/eligibility for the UI.
- security.yaml: narrow the public rate pattern so /eligibility stays auth'd.
Also updates admin rates listing to the new dimensions and the rating/admin
API docs. Includes migration for the new columns.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a web_extra_daemons entry so ddev auto-runs
messenger:consume scheduler_default (time-limited to 1h, supervisor
restarts it) — the unpaid-booking expiry now runs every minute in dev
without manual steps. Document both messenger workers in CLAUDE.md. In
production this consume must run under supervisor/systemd.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Consolidate onto the symfony/scheduler recipe's App\Schedule (stateful +
processOnlyLastMissedRun, so missed runs after downtime still execute)
instead of a separate provider. Add the every-1-minute
ExpireAppointmentsMessage there, point scheduler_default at
schedule://default, and drop the redundant ExpireAppointmentsSchedule.
debug:scheduler shows the trigger registered.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Run the 15-min payment-expiry every minute through Symfony Scheduler so
unpaid pending bookings flip to expired without a system crontab. Install
symfony/scheduler; extract the expiry logic into AppointmentExpiryService
(reused by the existing command); add ExpireAppointmentsMessage + handler
and an #[AsSchedule] provider (RecurringMessage::every 1 minute); wire a
scheduler_default transport in messenger.yaml. Slots already free
just-in-time via isSlotTaken, so this only syncs the DB status.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The medical sections in other are structured objects, not flat strings:
allergies {substance,reaction,severity}, medications {name,dose,frequency},
surgeries {type,year,hospital}, family_history {relation,disease}, disease
{id,name,status}. The admin view printed raw JSON for all but disease.
Give each section a formatter, and for disease show only entries marked
active (status true) instead of the full 30-item checklist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a read-only پروفایل کاربر section to UserDetailPage that fetches
GET /api/v1/user-profile/{uuid} (admins are authorized) and renders the
patient profile — personal fields, insurance, and medical history from
other — with loading skeleton and an empty state when the user has no
profile. Response is double-nested (data.data).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
resolveProfile created an empty profile for any caller with create-intent,
including an admin merely viewing someone else's profile. Restrict
lazy-create to the user's own profile; an admin reading another user's
missing profile now gets 404 with no side-effect record. Doc updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add the user payments-list endpoint to payment.md: permission, query
params (page/limit/status), and the paginated response shape.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add PaymentRepository::findByUser/countByUser and a paginated
my/payments endpoint that returns the authenticated user's own payments
(derived from the token, never a userId in the URL). Public dashboard's
transactions tab can now list payments instead of hitting a nonexistent
route.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GET/PATCH /api/v1/user-profile/{uuid} now accept either a profile uuid or
the owning user's uuid, and lazily create an empty profile for a user who
has none — documented with the double-nested response note.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GET/PATCH /api/v1/user-profile/{uuid} treated {uuid} as the profile's own
uuid, but clients pass the user's uuid — and a freshly OTP-registered user
has no profile row, so the call always 404'd. Add resolveProfile(): try
profile uuid, then user uuid → that user's profile, and (for the current
user or an admin) lazy-create an empty profile so the client always gets
an editable one. Foreign/unknown uuids still 404 with no leak.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add config/packages/dev/rate_limiter.yaml raising send_code and login
limits to 1000 in the dev environment only, so repeated OTP testing
isn't blocked by 'درخواستهای زیاد'. Production limits in
config/packages/rate_limiter.yaml (5/hour, 10/min) are untouched.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
appointment.md: for_self + patient_* request fields, expires_at and
patient_* response fields, the 15-minute lock/expiry behavior, and the
atomic-conflict 409. payment.md: successful appointment payment confirms
the booking and SMSes the patient.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The payment callback handled subscription and sms-wallet types but left
appointment payments pending. Add a TYPE_APPOINTMENT branch that
transitions the booking pending → confirmed (guarded by canTransitionTo,
so an already-expired booking is skipped) and dispatches a confirmation
SMS to the patient's mobile.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add findPaymentExpired (pending with expires_at < now) and have the
cancel-expired command flip both payment-expired and slot-time-passed
pendings to expired (deduped). Run it on a schedule (e.g. every minute:
* * * * * php bin/console app:cancel-expired-appointments) to free locks
held by unpaid bookings.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
book() now accepts for_self plus patient_* fields: for_self fills the
patient from the paying user's profile, otherwise patient_name/mobile are
required (422 if missing) and the rest are stored. Every booking starts
pending with a 15-minute expires_at. Persisting goes through
bookAtomically (re-check inside a transaction) so two concurrent requests
for the same slot can't both win — the loser gets 409.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A slot is taken only if confirmed, or pending with a still-valid lock
(expires_at null or in the future). An expired pending booking no longer
blocks the slot even before the cron flips it to expired.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a 15-minute payment TTL (expires_at) plus patient_name/mobile/
national_code/gender/reason columns so a booking can hold a slot
temporarily and record a patient distinct from the paying user. New
markPendingWithTtl() sets the lock; transitioning out of pending clears
expires_at. All columns nullable (migration added).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
is_available only checked whether a slot was booked, so on today's date
slots whose start time had already passed (e.g. 10:00 when it is 12:00)
still showed as bookable until the POST /appointment 422. Treat a slot
with start < now as unavailable in getAllSlotsWithAvailability, and drop
past slots in filterBookedSlots so getAvailableSlots agrees. Future days
are unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- appointment-settings.md: weekly-schedule meta (online_booking_enabled,
booking_window value/unit), defaults, and the slot-gating behavior.
- appointment.md: new public month-availability endpoint (Gregorian
year/month, disabled/enabled dates) and the empty-slots conditions for
appointment-slots.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a نوبتدهی آنلاین card to the weekly-schedule tab: a toggle for
online_booking_enabled and a value+unit (هفته/ماه) booking window.
Hydrated from the schedule meta and sent in the weekly-schedule
POST/PATCH payload. Uses existing .input/.btn classes, RTL.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add GET /api/v1/appointment-settings/month-availability/{doctorUuid}
?year=&month= (Gregorian) returning disabled_dates / enabled_dates for
the month plus the doctor's online_booking flag and window. Lives in
AppointmentController (per-method guards) so it is genuinely public —
the class-level IsGranted on AppointmentSettingsController would have
forced auth. Whitelisted in security.yaml (firewall + access_control).
Uses SlotCalculator::hasAnyAvailability per day, so holidays, closed
overrides, non-working days and out-of-window dates all come back
disabled.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
buildAllSessions now rejects dates that are in the past, beyond the
doctor's booking window (today + value week|month), or when online
booking is disabled — gating overrides and weekly schedule alike. Add a
public hasAnyAvailability() for the month-availability endpoint. Window
config is read from the schedule meta, falling back to defaults.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a reserved meta key inside WeeklySchedule.setting (no migration) holding
online_booking_enabled and a booking_window value+unit (week|month), with
sane defaults. Expose meta separately in toArray() and keep it out of the
day schedule map. setSetting now preserves meta when the day schedule is
replaced; the weekly-schedule POST/PATCH endpoints accept an optional meta.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hamed