- Updated modification times and AST hashes for several JavaScript files in the app/blog, app/component, app/doctor, and components/common directories.
- Added a new AST cache file for a data JSON that was skipped due to a non-object root.
Deactivated doctors are now absent from the public list, but their
/doctor/{uuid} page still loaded. getDoctor() now treats the backend's
raw `is_active === false` as not-found, so the profile 404s like the
list — matching the site's "hide inactive doctors" behavior.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The public list GET /api/v1/doctors only excluded inactive doctors
when an explicit `active` filter was passed; with no param it returned
everyone (deactivated doctors just ranked lower). Deactivated doctors
(admin toggled active_doctor_appointment off) leaked onto nobat724.
- DoctorRepository::findWithFilters: default (no `active` param) now
filters activeDoctorAppointment = true. The active=1 (bookable) and
active=0 (admin, inactive-only) escape hatches are unchanged.
- Doctor::toDetailArray: expose raw `is_active` (= activeDoctorAppointment,
independent of schedule) so public clients can 404 a deactivated
doctor's profile page; distinct from `active` (flag && has_schedule).
- Tests + docs/api/doctor.md updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Updated mtime and ast_hash for several files in manifest.json
- Added new AST cache files for the clinic contact info fix and maintenance mode client prompts
The backend now answers 503 with code MAINTENANCE_MODE while maintenance is
on. Without this change a visitor got a red error toast over a broken page
client-side, and a silently empty page server-side, because fetchReq discards
the status and returns null on any failure.
- lib/maintenance.js detects the state by BOTH status 503 and the error code;
a bare 503 can come from a reverse proxy and is not maintenance
- The axios interceptor checks it before the 401 branch, so a maintenance
response never triggers the refresh-token path or logs the user out
- fetchReq redirects to /maintenance, with a silentMaintenance opt-out used by
getStateInfo: that one runs inside generateMetadata and while rendering the
maintenance page itself, where a redirect is either ineffective or loops
- redirect() works by throwing, so the try/catch blocks in the doctors,
clinics and specialties pages now rethrow NEXT_REDIRECT instead of
swallowing it
- clinicApi.js handles 503 too; it previously rendered maintenance as a clinic
with zero doctors
- The page reuses the existing 404 design and is marked noindex
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Updated community IDs for various components in graph.json to reflect correct associations.
- Added new function `getPublishedDoctors()` in app/sitemap.js and established relationships with existing functions.
- Adjusted source locations for several functions in app/sitemap.js to ensure accurate mapping.
- Enhanced canonical URL handling in lib/getCanonicalUrl.js to prevent incorrect canonicalization for paginated specialty pages.
- Updated manifest.json with new modification times and AST hashes for affected files.
- Created a new JSON file for the blog city scoping activation prompt, including nodes and edges representing the document structure.
- Added a new JSON file for the SEO post-deploy verification prompt, detailing nodes and edges related to SEO verification tasks.
P1-P11 of the live SEO audit are implemented and verified against a local
production build, so the audit file becomes a reference rather than a
task list: it now records what shipped, the root causes that differed
from the original hypotheses, and the deliberate trade-offs.
Remaining work is split into smaller prompts, ordered by dependency:
- seo-post-deploy-verification: the acceptance criteria were "curl on
production" but were only run against a local build
- blog-city-scoping-activate: blocked on the backend blog city column
- sitemap-simplify-with-city: drops the 35-sweep workaround once the
doctors list exposes city
Each names its blocking dependency and carries reference numbers so a
regression is visible.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Implemented canonical URL strategies for city-specific domains and entities.
- Added helper functions for domain and city resolution.
- Created tests for canonical URL generation and domain resolution.
- Introduced entity quality checks for doctors and clinics to ensure meaningful content.
- Developed unique introductory texts for listing pages to avoid duplicate content.
- Established robots.txt policies for listing pages to manage indexing based on user filters.
- Enhanced specialty content with dynamic introductions and FAQs to improve SEO.
The profile decided "نوبتدهی غیرفعال است" from `doctor.active` alone, while the
page already had `booking_locations` — the more precise source, since the backend
only returns locations that are genuinely bookable. The two could disagree, and
for a doctor bookable only at a clinic they did.
A shared `bookingState` helper now drives both the desktop card and the mobile
bar: any location means bookable, the label comes from the earliest
`next_available_at`, and locations with no capacity yet read as "فعلاً نوبت خالی
ندارد" rather than disabled. With no locations at all it falls back to the
previous `doctor.active` / `free_turn` fields.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The site offered a "personal practice" for a doctor who has no personal address
at all — the schedule existed but its shifts pointed at the clinic's address, so
there was nowhere to go. The backend now filters those out; this consumes the
filtered contract and adds the per-day dimension.
- getBookingLocations takes an optional date and the appointment page refetches
on it, merging available_on_date into the existing list rather than replacing
it, so browsing the calendar never resets the user's choice.
- The browsed day had to be lifted out of the Date step: selectedDate is only
set once a slot is confirmed, far too late to drive availability.
- A location closed on the chosen day renders disabled with «در این روز نوبت
ندارد», and when every location is closed the step says so instead of showing
an empty slot list. If the already-selected location closes, a notice appears
with a link back to the picker — silently showing nothing was the failure mode
worth avoiding.
- Doctor profile: workLocation in the Physician JSON-LD is limited to addresses
that appear in booking_locations, since schema.org presents them as places a
patient can attend. The address card still lists the others — they are real
practice details — tagged «بدون نوبتدهی آنلاین».
Verified end-to-end with a temporary unused address on the test doctor: the
visible card listed both and tagged the unused one, while workLocation carried
only the bookable one. The row was removed afterwards.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The doctor page listed where a doctor works but never when, so search engines
had no working hours for any location. booking_locations now carries
opening_hours per context, so each MedicalClinic in the Physician JSON-LD gets
its own openingHoursSpecification, matched to the address by uuid.
Verified against the rendered page: the clinic location emits five shifts with
schema.org weekday URLs alongside the availableService entries.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A doctor now has one booking schedule per context — the personal practice plus
one per clinic — and every booking endpoint takes an optional clinic_uuid where
omitting it means the personal practice, not a wildcard. This site sent none, so
a clinic-only doctor showed no availability at all and a doctor working in both
places silently booked into the wrong one.
- services/response.js: getBookingLocations + clinic_uuid on slots,
service-slots, booking-services and month-availability. The manual query
building is kept so the service_item_uuids[] serialisation does not change.
- AppointmentPage owns the selected location; booking_mode and services are
derived from it instead of a separate getBookingServices call, which drops a
request. Changing location clears the selected service, slot and date, since
a service from one location cannot be booked into another.
- New LocationSelect step, shown only when there is more than one location.
The list arrives sorted by earliest free slot, so the first item is the
default and is not re-sorted here.
- DatePicker drops its month cache when the location changes; otherwise the
previous location's disabled days stayed on the calendar.
- The slot address now comes from the selected location rather than
doctor.address, which does not contain clinic addresses.
- clinic_uuid rides through to the appointment payload, and
/appointment/[doctorId]?clinic_uuid=… preselects a location.
- Doctor page JSON-LD gains availableService from the bookable services.
openingHoursSpecification still needs a public weekly-hours endpoint.
Removed the dead locateVisit state, which was initialised true and never unset.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Companion to the clinicpro context-separation change. A doctor now has one
booking schedule per context (personal practice + one per clinic), and every
booking endpoint takes an optional clinic_uuid where omitting it means the
personal practice — not a wildcard.
This site sends no clinic_uuid anywhere, so today it shows no availability at
all for clinic-only doctors and silently books into the wrong location for
doctors who work in both. The prompt covers the new
/api/v1/appointment-booking-locations contract, threading the selected location
through the booking state, and the JSON-LD follow-up.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Google Maps iframe was blocked by CSP (frame-src falls back to
default-src 'self'). Switched the doctor-page location map to react-leaflet
with OpenStreetMap tiles — no iframe, and CSP already allows https image
tiles (img-src 'self' https:). Marker icons are bundled from the leaflet
package (no CDN). MapView is dynamically imported (ssr:false) since Leaflet
needs window.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GET /api/v1/clinic-pro/doctor-addresses/{id} returns { data: { data: [...] } },
but getDoctorAddresses read json.data (the wrapper object, not the array), so
addresses.length/.map were undefined — the locations card + map never rendered
even when the doctor had an address. Extract json.data.data.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Mobile is prefilled from the logged-in user's cookie (userInfo.mobile_number)
and rendered read-only; removed it from editable form state/validation and
send that number in the claim body. Backend already enforces it must match
the account, so the field can't diverge.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- isUserLoggedIn() checked the access_token cookie, which is never set
(access_token lives in memory / tokenStore; only userInfo + uuid are
cookies). It therefore always returned false — the claim modal (and
comment auth checks) kept showing the login prompt even when logged in.
Now reads the userInfo cookie.
- Claim modal login link carries ?redirect=<current path>; after OTP login
SendReq returns to that path (guarded to internal "/..." only, blocks
protocol-relative //) instead of always going to "/".
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Doctor page map: the visible locations card read doctor.address (empty
from the detail endpoint) while coordinates live in the separately
fetched addresses. Thread `addresses` (with map.latitude/longitude) down
page → DoctorPage → DetailDoctor → Locations; card hidden when empty
- Claim modal: updated info-box text ("نوبتهای این پروفایل عمومی و غیرخاص
هستند")، added mobile field (validated, must match account), added ALTCHA
widget (submit disabled until captcha resolves; payload sent as `altcha`)
- Owner delete: services.deleteDoctor + a guarded two-step "حذف این پروفایل"
in the claim success screen (owner enforced server-side; 403/409 shown)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- ClaimProfileSection (components/doctor/claim): shown only when
doctor.owner_status === "unclaimed"; banner explains the profile is not
yet managed by the doctor, button "تأیید و مدیریت این پروفایل"
- Modal: login prompt when logged out; otherwise first/last name,
national code, Jalali birth-date (existing JalaliDatePicker) — posts to
POST api/v1/doctor/{uuid}/claim (identity verified server-side via API.ir;
no client call to API.ir, no token exposure)
- States: loading, per-field validation, server error (Persian envelope
message), double-submit guard, success welcome message + redirect
- Shared component across main domain and all representative subdomains
- services/response.js: getDoctorClaimInfo / postDoctorClaim
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Updated `getStateInfo` to fetch site context for domains not in city.json, returning `repContext` with representative details.
- Implemented caching for site context requests to optimize performance.
- Modified doctor and clinic listing pages to pass the `domain` parameter when fetching data for global representatives.
- Adjusted metadata generation in layout and pages to reflect representative branding based on `repContext`.
- Added documentation for the new functionality in `.claude/prompt/global-rep-domain-site.md`.
- Introduced a new `title` field for each city record, incorporating local brand names.
- Rewrote `slogan` for each city to reflect startup tone and include city keywords.
- Optimized `keywords` with relevant local and long-tail search terms.
- Ensured compliance with SEO best practices and maintained JSON structure.
Coolify injects NODE_ENV=production / npm omit=dev at build time, which
made 'npm ci' skip devDependencies. babel-plugin-react-compiler is a
devDependency and Next 16's reactCompiler:true requires resolving it, so
the build failed with:
Failed to resolve package babel-plugin-react-compiler ...
React compiler is enabled in next.config.js.
Reproduced locally with npm_config_omit=dev (react-compiler MISSING with
plain npm ci, PRESENT with --include=dev). --include=dev overrides the
platform's omit config so all build-time devDeps are installed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The OAuth flow uses grant_type=mobile with a server-issued grant
(app/api/auth/token/route.js); no client_id/client_secret is sent at
runtime. These vars were dead — removed from Dockerfile args/env,
docker-compose, nixpacks, and docs. Also silences the Coolify
'variable not set' build warnings.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- update stage comments to Next 16; note Turbopack default build
- npm ci --no-audit --no-fund for faster reproducible install
- add HEALTHCHECK (referenced by docker-compose, previously missing)
- parametrize node version via ARG NODE_VERSION
- remove duplicate case-variant 'dockerfile' (collided with 'Dockerfile'
on case-insensitive FS, would be two files on Linux/Coolify)
Verified: docker build + run, all routes 200, multi-domain Host routing,
canonical in <head>, container healthcheck reports healthy.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Created stat-index.json to store metadata for various data files, including size, modification time, and hash.
- Added graph.html and graph.json files to the graphify-out directory for enhanced graph representation.
Enabling cacheComponents fails the build (/_not-found: uncached data
outside <Suspense>) because the multi-domain layout reads headers()
(host) in layout + generateMetadata. Safe adoption would need broad
Suspense boundaries and risks cross-domain city content leakage.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Auto-memoization via babel-plugin-react-compiler (stable in Next 16),
compiled through Turbopack's built-in babel. Build and test suite pass.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Next 16 deprecates the middleware file convention; a leftover
middleware.js is silently ignored, which would break the x-pathname
header that canonical URL generation depends on.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add metadata to login and login-verify pages to prevent indexing.
- Update robots.txt to disallow additional sensitive paths.
- Enhance sitemap generation to filter by city and include accurate last modified dates.
- Refactor canonical URL generation to support multi-domain architecture, ensuring self-canonicalization for city domains.
- Remove deprecated CanonicalHandler component and streamline canonical URL handling.
- Introduce safe JSON-LD output to prevent XSS vulnerabilities.
- Add payment layout with appropriate metadata to prevent indexing.
- Conduct a comprehensive technical SEO audit and implement necessary fixes across the application.
hamed