From 1986356c918434a10253efa1728a3816729f4e4a Mon Sep 17 00:00:00 2001
From: hamed <15238-genius.ha@users.noreply.drupalcode.org>
Date: Thu, 23 Jul 2026 19:38:01 +0330
Subject: [PATCH] fix(doctor): hide deactivated doctors from public site

The public list GET /api/v1/doctors only excluded inactive doctors
when an explicit `active` filter was passed; with no param it returned
everyone (deactivated doctors just ranked lower). Deactivated doctors
(admin toggled active_doctor_appointment off) leaked onto nobat724.

- DoctorRepository::findWithFilters: default (no `active` param) now
  filters activeDoctorAppointment = true. The active=1 (bookable) and
  active=0 (admin, inactive-only) escape hatches are unchanged.
- Doctor::toDetailArray: expose raw `is_active` (= activeDoctorAppointment,
  independent of schedule) so public clients can 404 a deactivated
  doctor's profile page; distinct from `active` (flag && has_schedule).
- Tests + docs/api/doctor.md updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 app/doctor/[slug]/page.js | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/doctor/[slug]/page.js b/app/doctor/[slug]/page.js
index 3507261..c02d64a 100644
--- a/app/doctor/[slug]/page.js
+++ b/app/doctor/[slug]/page.js
@@ -22,7 +22,11 @@ const getDoctor = cache(async (slug) => {
   if (res.status === 404 || res.status === 400) return null;
   if (!res.ok) throw new Error(`Failed to fetch doctor: ${res.status}`);
   const json = await res.json();
-  return json?.data?.data ?? null;
+  const doctor = json?.data?.data ?? null;
+  // پزشک غیرفعال (ادمین فلگ فعال را خاموش کرده) نباید در سایت نمایش داده شود؛
+  // صفحهٔ تکی هم مثل لیست عمومی 404 می‌شود.
+  if (doctor?.is_active === false) return null;
+  return doctor;
 });
 
 const getDoctorAddresses = cache(async (doctorId) => {