- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens
- My-appointments tabs sent invalid status values (reserved/waiting_for_payment/
...) that don't exist in the backend, so every tab but "all" returned empty.
Map tabs to real statuses (pending/confirmed/completed/cancelled_by_user/
expired) so booked appointments show up.
- Booking form now validates required account fields before proceeding to
payment (national_code 10 digits, name, family, gender, basic_insurance),
in both self and other-person modes, surfacing per-field errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Booking response is double-nested: read appointment uuid/expires_at from
res.data.data so the payment countdown and gateway redirect actually fire.
- Payment result page (/payment/[uuid]): unwrap res.data.data, use real
backend fields (amount_rials, gateway, created_at, type) and statuses
(pending/success/failed/canceled/refunded); the "pay" button now re-initiates
via postAppointmentPayment instead of building a URL on the API origin.
- Add /payment/result interstitial that reads payment_uuid from the gateway
callback and forwards to /payment/[uuid].
- Prefill account info correctly in the booking form: name from profile.label,
insurances from *_id, gender as string, national_code editable unless approved.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With the backend now returning 200 (lazy-created profile) instead of
404, align the consumers: the profile lives at res.data.data (the
endpoint double-nests), so the booking detail and dashboard read that
instead of res.data / the raw envelope. Drop the obsolete 404 special
handling (empty editable form now comes from the 200 payload), seed the
dashboard empty state when the profile has no real data yet, and make
the profile POST fall back to PATCH on 409 (already lazy-created).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Show the backend's Persian error (errors[0].message, e.g. rate-limit
'درخواستهای زیاد') as a toast for any failed request.* call, from the
axios response interceptor — so failures are no longer silent. 401 still
logs out/redirects without a toast; callers can opt out with
config.skipErrorToast. Drop now-redundant per-caller alerts/toasts in
the booking submit, payment, and OTP userinfo paths.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the mock for-another button with a real toggle: switching keeps
the user's own data, clears the form to editable patient fields (phone
becomes an input, adds علت مراجعه), and can switch back. SubmitData now
sends for_self plus patient_* only when booking for someone else, skips
the self-profile PATCH/POST in that case, stores the booking expires_at,
and surfaces a clearer 409 message. Thread appointmentExpiresAt through
the wizard to the payment step.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
POST /api/v1/appointment expects { doctor_uuid, slot_start, slot_end,
note } with unix timestamps, and returns the appointment uuid at
data.uuid (not data.id). Send the right body, read the uuid, and on a
409 (slot already booked) alert the user and return to slot selection.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
prop loading روی Button فقط در MUI v6+ پشتیبانی میشود؛ این پروژه v5 است
و هشدار "Received false for a non-boolean attribute loading" میداد.
- دکمههای login/verify: disabled + CircularProgress شرطی (بازخورد بصری حفظ شد)
- بقیه دکمهها: loading → disabled (ادغام با disabled موجود در صورت وجود)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Fix GPS map links always sending literal "latitude"/"longitude" strings
instead of actual coordinates in openLocation/Content.js
- Add api.clinic-pro.ir to next.config.js remotePatterns so production
images load correctly
- Fix appointment page: await params and getStateInfo (Next.js 15 pattern)
- Enable 401 handling in api.js: clear cookies and redirect to /login
- Move OAuth client_secret to server-side API routes (/api/auth/token,
/api/auth/refresh) so it is never bundled into client-side JavaScript
- Update SendReq, SubmitData, ButtonSendData to call API routes instead
of directly sending client_secret from the browser
- Update docker-compose.yml to use server-only CLIENT_SECRET env var
- Remove debug console.log from clinic doctors list component
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
hamed