Tailwind was configured with darkMode: "class" while next-themes writes
data-theme="dark" on the public pages. Every dark: utility on the public
site — 111 of them — compiled to a selector that never matched, which is why
the booking flow stayed white in dark mode. The variant strategy now accepts
both .dark (the panel) and [data-theme="dark"] (the public pages), so neither
provider had to change and 66 dark rules now compile against the real
attribute.
The cancel and reschedule modals get tests, the first component tests in this
repo. They pin the things that would be silently wrong: the penalty comes from
the server before anything is cancelled, the free window says "no penalty"
rather than showing a zero, confirming actually sends the request (the old
dialog's confirm button only closed it), a failed preview does not block the
cancellation, slots are requested with exclude_appointment_uuid so the
patient's own hour is not shown as taken, and the reschedule sends only the
start time because the server owns the duration.
The amount assertion deliberately checks the number and unit rather than the
digit shape — numberToArStyle uses the ar-AE locale and its output depends on
the ICU data in the environment.
lib/getStateInfo.test.js had been failing since before this work: an unknown
host falls through to the representation API, so the test made a real network
call and timed out after five seconds. It mocks lib/req now. The suite is
fully green for the first time: 158 tests.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The site's own copy has been promising cancellation for a while —
lib/specialtyContent.js and components/appointment/information/Detail.js both
tell users they can cancel from "نوبتهای من" and get a refund up to five hours
before the visit. The UI never could. The cancel modal existed, but its confirm
button called handleClose: it closed the dialog and sent nothing. And the whole
button row it lived in (ButtonData.js) had been commented out since the PDF
download commit, so it was not even reachable.
Cancelling now goes through POST /appointment/{uuid}/cancel and shows the
penalty from /cancellation-preview before the confirm — the same calculation
the cancel itself runs, so the number the patient sees is the number they are
charged. If the preview fails, the dialog says so rather than blocking; the
cancellation is still allowed.
Rescheduling is new and service-aware. It asks for slots with
exclude_appointment_uuid, so the patient's own hour counts as free rather than
showing as taken, and it sends only the start time — the server computes the
duration. Sending a client-side duration would mean two parallel calculations,
and the day a service's minutes change the appointment would move with a stale
one. The services on the appointment are carried over unchanged.
Both actions only appear for an appointment that is still in the future and not
already cancelled, and both refresh the list afterwards so a just-cancelled
appointment stops showing as confirmed.
The day strip in the reschedule modal is its own small component rather than
the booking flow's DatePicker: that one reads the doctor uuid from route params
and would be undefined inside the dashboard.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
A patient who booked in service mode could not see which services they had
reserved or how long the appointment was. Both now appear on the list card and in
both detail layouts, reading service_items and service_total_minutes from
GET /api/v1/appointments/user.
Every field is behind an explicit guard. Slot-mode appointments carry none of
them, and an unguarded map would crash the card for every slot-mode appointment,
taking the whole panel with it. A reserve entry shows its services but not a
duration, because it has no time.
Covered by Card.test.jsx: slot-mode appointments render unchanged, absent fields
(older backend) do not crash, reserve hides the duration, and a zero duration
produces no row.
Task: clinicpro/docs/new_feture/taskes/task-00b-nobat724-service-mode/
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens
- Appointment detail (DetailLg/DetailSm) read the real response shape:
date/time from slot_start, specialty from doctor.specialties[0].name,
phone from address.telephone.
- Sidebar Head reads userInfo (cookie) after mount to avoid an SSR/client
hydration mismatch on the user's name.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- JalaliDatePicker gains an opt-in `stepwise` mode (year → month → day): the
year step is a scrollable list from the current Jalali year down to 1332,
used by the birthday field. Default-off so appointment/panel pickers keep
the month-grid behavior. Parse incoming Jalali string values safely
(fixes NaN keys).
- Birthday create path now converts Jalali→Unix on send (changeDateType true),
matching the update path and the Unix-based backend contract.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- My-appointments tabs sent invalid status values (reserved/waiting_for_payment/
...) that don't exist in the backend, so every tab but "all" returned empty.
Map tabs to real statuses (pending/confirmed/completed/cancelled_by_user/
expired) so booked appointments show up.
- Booking form now validates required account fields before proceeding to
payment (national_code 10 digits, name, family, gender, basic_insurance),
in both self and other-person modes, surfacing per-field errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The disease status Switch used defaultChecked, but row.status loads
async and changes via changeData, triggering MUI's uncontrolled→
controlled warning. Drive it with checked from row.status instead.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The ثبت اطلاعات button gave no feedback. Show a spinner while saving
(both POST and PATCH) and a 'اطلاعات با موفقیت ثبت شد' toast on success,
for the info tab and the medical-history sub-tabs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The backend stores the first name in the profile's label field, but the
account form binds the نام input to information.name, so a saved name
never displayed on reload. Map label→name when loading the profile (and
drop the raw label) so the field populates; saving still sends name,
which the backend hydrates back into label.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
DefaultSelect's onChange passes the whole option object {label,id}, but
the gender/blood_type/marital/education/job handlers compared it as a
string (education/blood via find(g=>g.label===value), others via ===),
so the value never stored — education in particular always saved empty.
Read option?.id uniformly across all five selects.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Clearing the blood type / education / insurance selects made
.find(...).id (and val.id) read .id on undefined, crashing the account
form. Use optional chaining with empty-string/empty-array fallbacks.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
These tabs have no backend endpoint yet (only per-doctor comments and
admin exist; user messages don't), so they read the always-empty
user.comments/user.messages. Guard against null and show a clear empty
state instead of a blank list.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The transactions list/card read mock fields (appointment_details,
row.amount, status 'received') and iterated user.turns.done. Pass the
real payments array and read order_id/type/created_at/amount_rials/status
from Payment.toArray(); map status to Persian labels, show rials→toman,
and render an empty state when there are no transactions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The turns list/card read start_time, slot.time and doctor.specialty,
none of which exist on Appointment.toArray() (slot_start, doctor.name,
status). Use slot_start for the Jalali date/time, replace the specialty
column with a Persian status label, and show an empty state when there
are no appointments.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The account tab read basic_insurance.id (object) but the profile returns
basic_insurance_id (number), yielding [NaN], and never loaded the medical
history (other). Map basic_insurance_id/supplementary_insurance_id and
merge profile.other on load, and keep the profile uuid even for an empty
profile so PATCH saves work. Verified round-trip (name→label, insurance,
other) against the live API.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Login now overwrites the uuid cookie with the real user uuid (was the
OTP uuid), so server-side profile/dashboard fetches resolve.
- getMyAppointments → /api/v1/appointments/user (patient's own bookings;
/my/appointments is role-scoped and empty for plain users), read from
the double-nested data.data.
- getMyPayments → /api/v1/my/payments (new endpoint), read paginated
data + meta.totalPages.
- Drop the userId path param (both endpoints derive the user from token).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
getParsedUserInfo() can return null (cookie missing/unparseable), so
reading userInfo.realName crashed the dashboard with a 500. Default to
an empty object and fall back to the user prop's name or 'کاربر'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With the backend now returning 200 (lazy-created profile) instead of
404, align the consumers: the profile lives at res.data.data (the
endpoint double-nests), so the booking detail and dashboard read that
instead of res.data / the raw envelope. Drop the obsolete 404 special
handling (empty editable form now comes from the 200 payload), seed the
dashboard empty state when the profile has no real data yet, and make
the profile POST fall back to PATCH on 409 (already lazy-created).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
GET /api/v1/insurances returns success(['data' => items]) → the body is
{ data: { data: [...] } }, so after the interceptor unwraps once the
array lives at res.data.data, not res.data. The callers set the list to
the wrapper object, so insurance.find threw 'not a function'. Read
res.data.data and guard with Array.isArray in both the booking detail
form and the dashboard insurance loader.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The routing modal shipped broken deep links: snapp.ir/route and
tapsi.ir/route paths don't exist (404), and balad used the wrong path
and params. Keep only apps with verified destination deep links and
fix their formats:
- Remove Snapp and Tapsi (no valid web destination route).
- Balad: balad.ir/location?latitude=&longitude= (was /map?lat=&lng=).
- Google Maps and Waze kept (already correct).
- Guard data.map destructuring against null.
- Dashboard turn detail: use maps/dir directions URL instead of a
plain q= pin to match the مسیریابی label.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
prop loading روی Button فقط در MUI v6+ پشتیبانی میشود؛ این پروژه v5 است
و هشدار "Received false for a non-boolean attribute loading" میداد.
- دکمههای login/verify: disabled + CircularProgress شرطی (بازخورد بصری حفظ شد)
- بقیه دکمهها: loading → disabled (ادغام با disabled موجود در صورت وجود)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- buildPatientUser: ساخت آبجکت user از user-profile واقعی با کلیدهای
مورد انتظار کامپوننتها؛ comments/messages خالی و اعداد هدر صفر
(بدون داده ساختگی، چون endpoint ندارند)
- app/dashboard/page.js پروفایل را server-side از user-profile/{uuid} میگیرد
- حذف import userData.json mock از Content داشبورد
- نوبت/تراکنش/تب اطلاعات از قبل به API واقعی وصل بودند (بدون تغییر)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Security:
- Disable SSL verification only in development (lib/req.js)
- Wrap all JSON.parse(cookie) calls in try-catch via safeJsonParse utility
- Sanitize dangerouslySetInnerHTML in blog/clinic with sanitizeHtml utility
- Fix open redirect in payment page — validate URL origin before redirect
- Fix cookie cleanup on 401 — use js-cookie with correct domain scope
Performance:
- Wrap ItemDoctor with React.memo to prevent unnecessary re-renders
- Replace <img> with Next.js <Image> in blog Caption component
Functionality:
- Fix memory leak in Recode.js — store intervals in refs, cleanup on unmount
- Add null guard on retryIcon.current before classList manipulation
- Fix getParsedUserInfo in helper to handle malformed cookie gracefully
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix GPS map links always sending literal "latitude"/"longitude" strings
instead of actual coordinates in openLocation/Content.js
- Add api.clinic-pro.ir to next.config.js remotePatterns so production
images load correctly
- Fix appointment page: await params and getStateInfo (Next.js 15 pattern)
- Enable 401 handling in api.js: clear cookies and redirect to /login
- Move OAuth client_secret to server-side API routes (/api/auth/token,
/api/auth/refresh) so it is never bundled into client-side JavaScript
- Update SendReq, SubmitData, ButtonSendData to call API routes instead
of directly sending client_secret from the browser
- Update docker-compose.yml to use server-only CLIENT_SECRET env var
- Remove debug console.log from clinic doctors list component
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
hamed