hamedandClaude Opus 4.8 7fa4b55d3f fix(security): unique payment reference_id, reject replayed callbacks (H3) ...

reference_id (the gateway's settled-transaction ref) was not unique, so the
same successful callback — or a RefNum replayed onto another order — could
credit twice. Add a unique index (NULL until success, so pending/failed rows
don't collide) and an application-level pre-check in the callback that fails the
payment if the reference already belongs to another order. The unique index is
the hard backstop behind the check.

Regression: PaymentCallbackAmountTest::testReplayedGatewayReferenceIsRejected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-28 19:08:26 +03:30

..

.gitignore

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609130407.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609131304.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609131553.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609132009.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609132708.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609133121.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609133334.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609133546.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609134112.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609134741.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609135126.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609135514.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609135704.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609135923.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609140223.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260609140423.php

feat: Implement SMS sending functionality with KavehNegar and Rangineh providers

2026-06-09 22:00:34 +03:30

Version20260610062539.php

feat: update representation management to use city_id instead of city and add city filtering

2026-06-10 10:03:46 +03:30

Version20260610092558.php

feat: enhance RepresentationsPage with searchable city filter and form improvements

2026-06-10 13:02:47 +03:30

Version20260610103401.php

feat: add insurance and location management

2026-06-10 14:22:26 +03:30

Version20260610110039.php

feat(data-import): Add data import script for provinces, cities, specialties, and doctor services

2026-06-10 14:32:00 +03:30

Version20260610110921.php

feat(doctor-address): add city and province associations to DoctorAddress entity

2026-06-10 14:45:01 +03:30

Version20260610111254.php

feat(doctor-address): add city and province associations to DoctorAddress entity

2026-06-10 14:45:01 +03:30

Version20260610113711.php

feat(clinic): change clinic_logo from JSON array to single URL string

2026-06-10 15:09:19 +03:30

Version20260610140853.php

fix(migrations): ensure safe migration steps for doctor_expertise and doctor_cities, drop legacy tables conditionally

2026-06-28 09:32:27 +03:30

Version20260610175105.php

feat: add clinic status management with active/inactive toggle and update related API endpoints

2026-06-10 21:29:29 +03:30

Version20260610183655.php

feat: add clinic doctor invitation feature

2026-06-10 22:13:39 +03:30

Version20260611075829.php

fix(migrations): ensure safe migration steps for doctor_expertise and doctor_cities, drop legacy tables conditionally

2026-06-28 09:32:27 +03:30

Version20260611083424.php

feat(api): add dashboard endpoints for clinic, doctor, and secretary roles

2026-06-11 12:20:12 +03:30

Version20260611084046.php

feat(api): add dashboard endpoints for clinic, doctor, and secretary roles

2026-06-11 12:20:12 +03:30

Version20260612081739.php

feat: add clinic management and financial reporting features

2026-06-12 12:31:27 +03:30

Version20260612132848.php

feat: enhance DoctorAddress entity to support clinic addresses and types

2026-06-12 13:39:37 +03:30

Version20260614181134.php

feat: implement staff management and subscription system

2026-06-14 22:10:28 +03:30

Version20260614181629.php

feat: implement staff management and subscription system

2026-06-14 22:10:28 +03:30

Version20260614181657.php

feat: implement staff management and subscription system

2026-06-14 22:10:28 +03:30

Version20260614182549.php

feat: implement staff management and subscription system

2026-06-14 22:10:28 +03:30

Version20260614182950.php

feat: implement staff management and subscription system

2026-06-14 22:10:28 +03:30

Version20260614183527.php

feat: implement staff management and subscription system

2026-06-14 22:10:28 +03:30

Version20260615060415.php

feat: enhance staff management and payment gateway features

2026-06-15 11:03:56 +03:30

Version20260615061938.php

feat: enhance staff management and payment gateway features

2026-06-15 11:03:56 +03:30

Version20260615074107.php

feat(secretary): implement scope separation for secretaries in clinics and personal practices

2026-06-15 11:19:37 +03:30

Version20260615142236.php

feat(appointment): add expires_at and patient fields to Appointment

2026-06-15 17:53:27 +03:30

Version20260615203529.php

feat(rating): multi-dimensional ratings, rich comments, eligibility guard

2026-06-16 00:25:59 +03:30

Version20260619062912.php

feat(user-profile): add avatar upload functionality and update UserProfile entity

2026-06-19 10:19:47 +03:30

Version20260619121047.php

feat: Add tagging system for SMS logs and templates

2026-06-19 20:42:04 +03:30

Version20260619170105.php

feat: Add tagging system for SMS logs and templates

2026-06-19 20:42:04 +03:30

Version20260621084558.php

feat: add social media links field to Doctor entity and update API documentation

2026-06-21 12:35:22 +03:30

Version20260621094624.php

feat: add social media fields to Clinic entity and update API documentation

2026-06-21 13:26:47 +03:30

Version20260622160119.php

feat: add national code to patient records and user entity, update related functionality

2026-06-22 19:44:17 +03:30

Version20260622163152.php

feat: insurance & medical billing system (6 phases)

2026-06-23 15:05:24 +03:30

Version20260622171538.php

feat: insurance & medical billing system (6 phases)

2026-06-23 15:05:24 +03:30

Version20260622173707.php

feat: insurance & medical billing system (6 phases)

2026-06-23 15:05:24 +03:30

Version20260622181251.php

feat: insurance & medical billing system (6 phases)

2026-06-23 15:05:24 +03:30

Version20260622184409.php

feat: insurance & medical billing system (6 phases)

2026-06-23 15:05:24 +03:30

Version20260622185948.php

feat: insurance & medical billing system (6 phases)

2026-06-23 15:05:24 +03:30

Version20260623115721.php

fix: store appointment address from schedule and auto-add patient to clinic

2026-06-23 16:10:36 +03:30

Version20260623173907.php

feat(patients): service quantity in visit session

2026-06-23 22:13:51 +03:30

Version20260624030339.php

feat(profile): enforce uniqueness of national_code across user profiles and update related error handling

2026-06-24 11:52:13 +03:30

Version20260624092459.php

feat: Implement financial engine for commission and tax calculations

2026-06-24 13:06:17 +03:30

Version20260624093738.php

feat(tax): implement tax rate history tracking and API endpoints

2026-06-24 13:17:08 +03:30

Version20260624123236.php

feat: implement domain guard for commission calculation and enhance representation dashboard

2026-06-24 16:14:41 +03:30

Version20260625135132.php

feat(settlement): add receipt handling and detail view for settlements

2026-06-25 17:34:39 +03:30

Version20260625150304.php

feat(migrations): add national_code_verified flag to users and normalize bank_account representation

2026-06-25 19:38:47 +03:30

Version20260628133044.php

fix(db): declare onDelete on required FKs that had none

2026-06-28 17:04:23 +03:30

Version20260628134241.php

perf(db): add missing indexes (appointment expiry, session dates, user status)

2026-06-28 17:13:44 +03:30

Version20260628152738.php

fix(db): prevent double-booking a slot via unique active_slot_key (H2)

2026-06-28 19:04:54 +03:30

Version20260628153625.php

fix(security): unique payment reference_id, reject replayed callbacks (H3)

2026-06-28 19:08:26 +03:30