From 1aa9f82d2a177aaaaf65cc37c7279b786b46f497 Mon Sep 17 00:00:00 2001 From: hamed <15238-genius.ha@users.noreply.drupalcode.org> Date: Fri, 5 Jun 2026 22:18:11 +0330 Subject: [PATCH] fix: resolve critical bugs and security issues across the project - Fix GPS map links always sending literal "latitude"/"longitude" strings instead of actual coordinates in openLocation/Content.js - Add api.clinic-pro.ir to next.config.js remotePatterns so production images load correctly - Fix appointment page: await params and getStateInfo (Next.js 15 pattern) - Enable 401 handling in api.js: clear cookies and redirect to /login - Move OAuth client_secret to server-side API routes (/api/auth/token, /api/auth/refresh) so it is never bundled into client-side JavaScript - Update SendReq, SubmitData, ButtonSendData to call API routes instead of directly sending client_secret from the browser - Update docker-compose.yml to use server-only CLIENT_SECRET env var - Remove debug console.log from clinic doctors list component Co-Authored-By: Claude Sonnet 4.6 --- app/api/auth/refresh/route.js | 31 ++++++++++++++++ app/api/auth/token/route.js | 33 +++++++++++++++++ app/appointment/[doctorId]/page.js | 17 +++------ app/component/openLocation/Content.js | 10 +++--- components/appointment/detail/SubmitData.js | 19 +++++----- components/clinic/components/doctors/List.js | 1 - .../detailUser/information/ButtonSendData.js | 36 +++++++++---------- .../register/verificationPage/SendReq.js | 30 ++++++++-------- docker-compose.yml | 5 +-- next.config.js | 4 +++ services/api.js | 10 +++--- 11 files changed, 126 insertions(+), 70 deletions(-) create mode 100644 app/api/auth/refresh/route.js create mode 100644 app/api/auth/token/route.js diff --git a/app/api/auth/refresh/route.js b/app/api/auth/refresh/route.js new file mode 100644 index 0000000..dca4e65 --- /dev/null +++ b/app/api/auth/refresh/route.js @@ -0,0 +1,31 @@ +import { NextResponse } from "next/server"; + +export async function POST(request) { + const { refresh_token } = await request.json(); + + const API_URL = process.env.NEXT_PUBLIC_API_URL; + const CLIENT_ID = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID; + const CLIENT_SECRET = process.env.CLIENT_SECRET || process.env.NEXT_PUBLIC_CLIENT_SECRET; + + if (!refresh_token) { + return NextResponse.json({ error: "refresh_token is required" }, { status: 400 }); + } + + const formData = new URLSearchParams(); + formData.append("grant_type", "refresh_token"); + formData.append("client_id", CLIENT_ID); + formData.append("client_secret", CLIENT_SECRET); + formData.append("refresh_token", refresh_token); + + try { + const res = await fetch(`${API_URL}/oauth/token`, { + method: "POST", + headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: "" }, + body: formData.toString(), + }); + const data = await res.json(); + return NextResponse.json(data, { status: res.status }); + } catch { + return NextResponse.json({ error: "Refresh request failed" }, { status: 500 }); + } +} diff --git a/app/api/auth/token/route.js b/app/api/auth/token/route.js new file mode 100644 index 0000000..cf2cf3b --- /dev/null +++ b/app/api/auth/token/route.js @@ -0,0 +1,33 @@ +import { NextResponse } from "next/server"; + +export async function POST(request) { + const { uuid, code, scope = "nobat724" } = await request.json(); + + const API_URL = process.env.NEXT_PUBLIC_API_URL; + const CLIENT_ID = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID; + const CLIENT_SECRET = process.env.CLIENT_SECRET || process.env.NEXT_PUBLIC_CLIENT_SECRET; + + if (!uuid || !code) { + return NextResponse.json({ error: "uuid and code are required" }, { status: 400 }); + } + + const formData = new URLSearchParams(); + formData.append("grant_type", "mobile"); + formData.append("client_id", CLIENT_ID); + formData.append("client_secret", CLIENT_SECRET); + formData.append("uuid", uuid); + formData.append("code", code); + formData.append("scope", scope); + + try { + const res = await fetch(`${API_URL}/oauth/token`, { + method: "POST", + headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: "" }, + body: formData.toString(), + }); + const data = await res.json(); + return NextResponse.json(data, { status: res.status }); + } catch { + return NextResponse.json({ error: "Token request failed" }, { status: 500 }); + } +} diff --git a/app/appointment/[doctorId]/page.js b/app/appointment/[doctorId]/page.js index d13873f..7f7b248 100644 --- a/app/appointment/[doctorId]/page.js +++ b/app/appointment/[doctorId]/page.js @@ -2,33 +2,26 @@ import AppointmentPage from "@/components/appointment"; import { getStateInfo } from "@/lib/getStateInfo"; import axios from "axios"; -async function Appointment({ params: { doctorId } }) { - const { matchedCity } = getStateInfo(); +async function Appointment({ params }) { + const { doctorId } = await params; + const { matchedCity } = await getStateInfo(); const API_URL = process.env.NEXT_PUBLIC_API_URL; let doctor = null; let disabledDates = []; try { - // دریافت اطلاعات دکتر با UUID const doctorRes = await axios.get(`${API_URL}/api/v1/doctor/${doctorId}`); doctor = doctorRes.data; - // دریافت روزهای غیرفعال با استفاده از doctor.id if (doctor && doctor.id) { const disabledDatesRes = await axios.get( `${API_URL}/api/v1/appointment/not-available/${doctor.id}`, - { - headers: { - 'Content-Type': 'application/json' - } - } + { headers: { "Content-Type": "application/json" } } ); disabledDates = disabledDatesRes.data?.data || []; } - } catch (error) { - console.error("Error fetching appointment data:", error.message); - } + } catch (error) {} return ( { try { const refreshToken = Cookies.get("refresh_token"); - if (!refreshToken) { - return false; - } + if (!refreshToken) return false; - const formData = new URLSearchParams(); - formData.append("grant_type", "refresh_token"); - formData.append("client_id", process.env.NEXT_PUBLIC_CLIENT_ID || "4gSZTqkcM-13yfCHptFjsIoEzwA996bjGuSEFy02Dkc"); - formData.append("client_secret", process.env.NEXT_PUBLIC_CLIENT_SECRET || "13yfCHptFjsIoEzwA996bjGuSEFy02Dkc"); - formData.append("refresh_token", refreshToken); - - const response = await request.postRefreshToken(formData); + const res = await fetch("/api/auth/refresh", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ refresh_token: refreshToken }), + }); + const response = await res.json(); if (response?.access_token) { Cookies.set("access_token", response.access_token, { expires: 7 }); @@ -32,7 +29,7 @@ function SubmitData({ setStep, data, prevData, setErrors, doctor, selectedSlot, return true; } return false; - } catch (error) { + } catch { return false; } }; diff --git a/components/clinic/components/doctors/List.js b/components/clinic/components/doctors/List.js index 82f54a0..203278e 100644 --- a/components/clinic/components/doctors/List.js +++ b/components/clinic/components/doctors/List.js @@ -36,7 +36,6 @@ function List({ }; const res = await getClinicDoctors(slug, params); - console.log("📦 پاسخ API:", res); // اگر سرور داده را در data برمی‌گرداند if (res?.data) { diff --git a/components/dashboard/userAccount/detailUser/information/ButtonSendData.js b/components/dashboard/userAccount/detailUser/information/ButtonSendData.js index e82520c..f440699 100644 --- a/components/dashboard/userAccount/detailUser/information/ButtonSendData.js +++ b/components/dashboard/userAccount/detailUser/information/ButtonSendData.js @@ -29,26 +29,22 @@ function ButtonSendData({ .postUserProfile(changeDateType(information, false)) .then((response) => { if (response.uuid) { - const formData = new URLSearchParams(); - formData.append("grant_type", "refresh_token"); - formData.append("client_id", process.env.NEXT_PUBLIC_CLIENT_ID); - formData.append( - "client_secret", - process.env.NEXT_PUBLIC_CLIENT_SECRET - ); - formData.append("refresh_token", Cookies.get("refresh_token")); - - request - .postRefreshToken(formData) + fetch("/api/auth/refresh", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ refresh_token: Cookies.get("refresh_token") }), + }) + .then((r) => r.json()) .then((res) => { - const expiresTime = handleTimeExpiresToken(res.expires_in); - Cookies.set("access_token", res.access_token, { - expires: expiresTime.accessTokenExpires, - path: "/", - secure: true, - sameSite: "strict", - }); - + if (res?.access_token) { + const expiresTime = handleTimeExpiresToken(res.expires_in); + Cookies.set("access_token", res.access_token, { + expires: expiresTime.accessTokenExpires, + path: "/", + secure: true, + sameSite: "strict", + }); + } setInformation({ ...information, prev_data: true, @@ -56,7 +52,7 @@ function ButtonSendData({ }); setLoading(false); }) - .catch((err) => { + .catch(() => { setLoading(false); }); } diff --git a/components/register/verificationPage/SendReq.js b/components/register/verificationPage/SendReq.js index b7a3b74..77a61c5 100644 --- a/components/register/verificationPage/SendReq.js +++ b/components/register/verificationPage/SendReq.js @@ -14,23 +14,23 @@ function SendReq({ }) { const handleReq = async () => { setLoading(true); - request - .getToken( - "mobile", - process.env.NEXT_PUBLIC_CLIENT_ID, - process.env.NEXT_PUBLIC_CLIENT_SECRET, - uuid, - code.join("") - ) - .then((response) => { - if (response.access_token) { - handleSetCookie(response); - } - }) - .catch(() => { + try { + const res = await fetch("/api/auth/token", { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ uuid, code: code.join("") }), + }); + const response = await res.json(); + if (response.access_token) { + handleSetCookie(response); + } else { setLoading(false); setIsError(true); - }); + } + } catch { + setLoading(false); + setIsError(true); + } }; const handleSetCookie = (response) => { diff --git a/docker-compose.yml b/docker-compose.yml index 2eed45d..d718f06 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -37,9 +37,10 @@ services: # API configuration NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL} - NEXT_PUBLIC_CLIENT_ID: ${NEXT_PUBLIC_CLIENT_ID} - NEXT_PUBLIC_CLIENT_SECRET: ${NEXT_PUBLIC_CLIENT_SECRET} DEV_MODE: ${DEV_MODE:-FALSE} + # Server-only OAuth credentials (not exposed to browser) + CLIENT_ID: ${CLIENT_ID:-${NEXT_PUBLIC_CLIENT_ID}} + CLIENT_SECRET: ${CLIENT_SECRET:-${NEXT_PUBLIC_CLIENT_SECRET}} # Health check (uses Dockerfile HEALTHCHECK) healthcheck: diff --git a/next.config.js b/next.config.js index 0f990b8..3e33a76 100644 --- a/next.config.js +++ b/next.config.js @@ -4,6 +4,10 @@ const nextConfig = { reactStrictMode: true, images: { remotePatterns: [ + { + protocol: 'https', + hostname: 'api.clinic-pro.ir', + }, { protocol: 'https', hostname: 'back-dev.clinic-pro.ir', diff --git a/services/api.js b/services/api.js index d6670e9..b5d222b 100644 --- a/services/api.js +++ b/services/api.js @@ -34,10 +34,12 @@ api.interceptors.response.use( return response.data; }, (error) => { - // if (error.status === 401) { - // removeToken(); - // window.location.pathname = "login"; - // } + if (error?.response?.status === 401 && typeof window !== "undefined") { + ["access_token", "refresh_token", "uuid", "userInfo"].forEach((key) => { + document.cookie = `${key}=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;`; + }); + window.location.href = "/login"; + } return Promise.reject(error); } );