Staging Bugs - All Issues

Document Version: 5.0 Last Updated: 2026-06-25 Total Bugs: 62 Resolved & Verified: 49 | Pending: 13

✅ QA Verification Summary (PR #1735)Copy Anchor Link

Source: GitHub PR #1735 Verified by: SinglaKartik Dates: 2026-06-24, 2026-06-25

✨ New Feature Added (2026-06-25)Copy Anchor Link

• Confirm Follow-Up Flow: Added confirm button, confirmation modal, and "Confirmed" tab in Follow-ups page

🔧 Bug Fixes (2026-06-25)Copy Anchor Link

• Bug #3: OTP paste in reset password - Fixed missing paste handler in Patient App
• Bug #4: Photo upload preview - Already working, verified
• Bug #5: DOB allows future dates - Added .refine() validation + max date attribute
• Bug #6: No format validation on pincode/phone - Added regex validation (6 digits for pincode, 10-15 for phone)
• Bug #6b: Clear form fields not saved - Fixed backend to clear empty JSONB fields
• Bug #7: Special characters in name fields - Added regex to allow only letters, spaces, hyphens, apostrophes
• Bug #35: Email field missing in Patient App - Added email field to profile form
• Backend Fix: Rails update doesn't clear empty JSONB fields - Added explicit clearing logic

Bug Summary by StatusCopy Anchor Link

🔴 Critical Bugs (Block Production)Copy Anchor Link

Bug #10: Cross-App Authentication Not EnforcedCopy Anchor Link

Description: Users can login to applications they shouldn't have access to based on their role.

Resolution: Backend ALLOWED_APPS role-to-app gate in SessionsController. CMS login sends app: 'cms', patient login sends app: 'patient' as top-level param. Gate checks before issuing tokens — 403 APP_ACCESS_DENIED on cross-app attempts.

Issues Identified:

• Patient accounts can login to Clinic/CMS app
• Staff/Doctor/Admin accounts can login to Patient app

Expected Behavior:

• Patient account → Patient app ONLY
• Staff/Doctor/Admin → Clinic app ONLY

Actual Behavior:

• No app-level authentication enforcement
• Any registered phone can login to either app

Bug #17: Cross-App Forgot Password Not EnforcedCopy Anchor Link

Description: Forgot password allows cross-app password reset.

Resolution: Cross-app check moved BEFORE ResetService.call in PasswordsController#reset — SMS never sent if user can't access the requesting app. Frontend forgot-password pages check response message and stay on page (no OTP navigation) when blocked.

Issues Identified:

• Patient account can reset password via Clinic app
• Clinic account can reset password via Patient app

Bug #24: Invite Sent to Registered EmailCopy Anchor Link

Description: Invite sent to email that already exists in system.

Current Flow:

1. Invite created ✅
2. User opens link
3. Signup fails ❌ - "email already exists"

Expected: Block invite creation Actual: Invite created, acceptance fails

Bug #26: Invite to Active UserCopy Anchor Link

Description: Already active clinic members can receive new invites.

Expected: Block with error "User is already a member of this clinic" Actual: Invite created successfully

Bug #29: Doctor Can Set Other Doctor's Schedule — ✅ RESOLVEDCopy Anchor Link

Resolution: Fixed in commit 7c713c176 — fix(identity): restrict practitioner schedule writes to owner/admin or self (#1689). The PractitionerSchedulePolicy now correctly gates create?/update?/destroy? on tenant_admin? || tenant_owner? || owns_practitioner_role?.

🟡 High Priority BugsCopy Anchor Link

Bug #2: Resend OTP Not Working (Patient)Copy Anchor Link

Description: Resend OTP not working in patient signup flow.

Bug #9: Resend OTP 500 Error (Clinic)Copy Anchor Link

Description: Resend OTP gives 500 Internal Server Error.

Bug #19: Backend Validation Error Not DisplayedCopy Anchor Link

Description: Frontend shows generic toast instead of backend error message.

Backend Response:

{
  "error": {
    "code": "VALIDATION_FAILED",
    "message": "Invite already exists"
  }
}

Frontend shows: "Unable to send. Please try again." Should show: "Invite already exists"

Bug #21: Practitioner Invite to Existing PatientCopy Anchor Link

Description: Mobile registered as patient can still receive doctor invite.

Expected: Block invite creation Actual: Invite created successfully

Bug #27: Set Consultation Fee (PATCH API)Copy Anchor Link

Description: Unable to set consultation fee via PATCH API.

API: PATCH /identity/practitioner_roles/:id

Bug #28: Set Telemedicine Fees (PATCH API)Copy Anchor Link

Description: Unable to set telemedicine fees via PATCH API.

API: PATCH /identity/practitioner_roles/:id

Bug #30: Newly Created Doctors/Hospitals Not Appearing in SearchCopy Anchor Link

Description: Search functionality is working correctly (UI, filters, pagination), but newly created doctors and hospitals are not appearing in search results.

Root Cause: Data synchronization issue between database and Typesense search index.

🟠 Medium Priority BugsCopy Anchor Link

✅ Not a BugCopy Anchor Link

🆕 New Bugs (Session 08 - Add Patient & Booking)Copy Anchor Link

Bug #31: Federated Search - Partial Name Works, Full Name Doesn'tCopy Anchor Link

Description: Search by partial name (e.g., "mohit") returns results, but search by full name (e.g., "mohit goyal") returns no results.

Steps to Reproduce:

1. Search by "mohit" → Results found ✅
2. Search by "mohit goyal" → No results ❌

Expected: Full name search should return results Actual: Only partial name search works

API Evidence:

# Partial name - WORKS
curl '/clinical/patients/federated_search?name=mohit'
# Returns: Patient "Mohit Goyal" found

# Full name - FAILS
curl '/clinical/patients/federated_search?name=mohit%20goyal'
# Returns: No results

Bug #32: DOB Not Auto-filled When Importing from KulcareCopy Anchor Link

Description: When importing a patient from Kulcare network (in_kulcare bucket), the DOB is not auto-filled even though the patient has DOB set in their Patient App profile.

Steps to Reproduce:

1. Patient "Mohit Goyal" has DOB set in Patient App
2. Search in Clinic App → Find in "Elsewhere on Kulcare"
3. Click "Import" → Form auto-fills
4. Check DOB field → Empty ❌

Expected: DOB should be auto-filled from Kulcare profile Actual: DOB field is empty (phone, name, gender are auto-filled correctly)

Bug #33: Patient Visible Across Multiple ClinicsCopy Anchor Link

Description: When an admin has access to multiple clinics within the same tenant, patients added in one clinic are visible in other clinics.

Verified with Dev Team: ✅ This is expected behavior.

Explanation:

• Patients in the same tenant are shared across all clinics within that tenant
• This is by design for the federated search flow
• Patients can be found and booked across clinics in the same tenant

Architecture:

• Clinical::Patient is tenant-scoped via RLS
• FederatedSearchService.in_clinic searches within the current tenant
• All clinics in the same tenant share the patient pool

Bug #34: No Validation for Patient Form (Frontend + Backend)Copy Anchor Link

Description: Patient form accepts invalid data without validation. BOTH frontend AND backend accepted:

• First name: 100+ characters
• Last name: 100+ characters
• Phone: "dsadasdsadsads" (letters in phone field)
• DOB: Future date (2026-06-15)

Steps to Reproduce:

1. Open Add Patient form
2. Enter very long name (100+ chars)
3. Enter letters in phone field
4. Select future DOB
5. Submit → Form accepts invalid data ❌
6. API stores invalid data → Backend accepts it ❌

API Request That Succeeded:

curl 'https://api-stg.kulcare.com/clinical/patients' \
  -H 'Content-Type: application/json' \
  --data-raw '{
    "first_name":"ddasdsadsadasdsadsadsadsadsafsdfsdfsdfdsfsdfsfdsfdsfdsfdsfdfadsfdsfadsfdsdsadsadsadsadsadsadsa",
    "last_name":"dsadsadsadsadsadsadfdsfdsfdsfdsfdsfdsfdsfdsfdsfdsfdsfdsfdsfdsfdsfdsfdsf",
    "phone_number":"dsadasdsadsads",
    "phone_country_code":"91",
    "gender":"male",
    "birth_date":"2026-06-15"
  }'

API Response: 200 OK - Patient created successfully

Issues Found:

1. Frontend: No validation for name length, phone format, future DOB
2. Backend: No validation for name length, phone format, future DOB

Recommendation: Add validation on BOTH frontend AND backend:

• Name length: min 2 chars, max 50-100 chars
• Phone: digits only, exactly 10 digits
• DOB: must not be future date

Bug #35: Email Field Missing in Patient App Profile EditCopy Anchor Link

Description: Patient signs up with email, but the email field is not visible in the profile edit page. Patient cannot update their email later.

Steps to Reproduce:

1. Patient signs up with email "test@example.com"
2. Go to Profile → Edit
3. Check for email field → Not visible ❌

Expected: Email field should be editable in profile settings Actual: Email field missing from edit form

API Evidence: Patient profile PUT request (no email field in payload):

curl 'https://api-stg.kulcare.com/patient/profile' \
  -X 'PUT' \
  -H 'Authorization: Bearer ...' \
  --data-raw '{
    "profile": {
      "first_name": "Uday",
      "last_name": "Bisht",
      "birth_date": "2016-01-22",
      "gender": "male"
    }
  }'

API Response (shows email is stored but null):

{
  "data": {
    "id": "019ecefa-da2e-71cc-bb60-cd7d53ee8aa5",
    "first_name": "Uday",
    "last_name": "Bisht",
    "phone_number": "9988776655",
    "email": null
  }
}

Impact: Patients cannot update their email address after signup

🆕 New Bugs (Session 09 - Patient Management List)Copy Anchor Link

Bug #36: Phone Search Returns No Results on Patient ListCopy Anchor Link

Description: Searching by phone number on the patient list page returns no results, even when patients with that phone number exist in the list.

Steps to Reproduce:

1. Note a patient's phone number (e.g., ending in "988") from the patient list
2. Type the phone digits in the search bar
3. Observe: no results returned

API Evidence:

curl 'https://api-stg.kulcare.com/clinical/patients?search=988&page=1&per_page=10' \
  -H 'Authorization: Bearer <token>'
# Returns: empty results, even though patient with phone containing "988" exists

Root Cause (Suspected): The PatientsController#index search scope only queries first_name and last_name columns, not phone_number. Unlike the federated search endpoint which searches across multiple fields, the patient list search is name-only.

Expected: Phone number search should match phone_number column Actual: Only name fields are searched

Recommendation: Add phone_number to the search scope in Clinical::PatientsController#index:

scope.where('first_name ILIKE :q OR last_name ILIKE :q OR phone_number ILIKE :q', q: "%#{search}%")

Bug #37: Export Report API Fails - EFS Permission Denied (Staging)Copy Anchor Link

Description: Patient export report (POST /clinical/patients/generate_report) fails with a filesystem permission error on staging. The EFS mount path /opt/kulcare-efs-stg/patient_reports_staging either doesn't exist or the Rails process lacks write permissions.

Steps to Reproduce:

1. Go to Patient List → Click Export → Confirm
2. Observe: error toast appears

API Evidence:

curl 'https://api-stg.kulcare.com/clinical/patients/generate_report?facility_id=<id>' \
  -X POST \
  -H 'Authorization: Bearer <token>' \
  --data-raw '{}'

# Response: 422 Unprocessable Entity
{
  "data": null,
  "error": {
    "code": "validation_failed",
    "message": "Permission denied @ dir_s_mkdir - /opt/kulcare-efs-stg/patient_reports_staging",
    "details": [{
      "field": "base",
      "message": "Permission denied @ dir_s_mkdir - /opt/kulcare-efs-stg/patient_reports_staging"
    }]
  },
  "meta": { "request_id": "da9231c1-734b-4d77-97c0-095c9d473cdc" }
}

Root Cause: Staging infrastructure issue — Dir.mkdir fails with EACCES on the EFS mount path. The directory is either:

1. Not mounted on the staging Rails server
2. Missing write permissions for the Rails process user (deploy)

Expected: Report should be generated and emailed to the user Actual: Ruby Dir.mkdir raises Errno::EACCES — Permission denied

Recommendation:

• Verify EFS mount exists on staging: ls -la /opt/kulcare-efs-stg/
• Ensure correct permissions: chown deploy:deploy /opt/kulcare-efs-stg/patient_reports_staging
• Consider adding a fallback to /tmp if EFS is unavailable

Bug #38: Cross-Clinic Patient Flow Incomplete — No Facility Record CreatedCopy Anchor Link

Resolution: Two-part fix — (1) FindOrCreateService#auto_register_patient_facility creates facility link on search/view (commit 47118d2a9). (2) PatientsController#auto_register_facility_links batch-registers missing links on the patient LIST page before returning results. Uses a NOT IN subquery to find unlinked patients and creates PatientFacility records idempotently — one query on first load, zero queries on subsequent loads. All patients in the list now have valid patient_facility_id, all clickable, no crashes.

Files changed: find_or_create_service.rb, patients_controller.rb

Description: Patient "Mohit" was added in Clinic A. The clinic admin switches to Clinic B (same tenant). The patient appears in Clinic B's list — which is correct, patients are shared within a tenant. But the cross-clinic experience falls apart:

Real user flow (what happens today):

1. Staff sees patient "Mohit" in Clinic B's list
2. Tries to 👁️ View details → ❌ Broken (/cms/patient/{id}/null)
3. Staff can ✏️ Edit the patient — it opens (uses patient.id, not facility ID)
4. Staff can 📅 Book an appointment — the booking submits successfully
5. But after booking, staff STILL can't 👁️ View the patient they just booked
6. The appointment exists in Clinic B's queue, but the patient has no facility record in Clinic B — so the appointment has patient_facility_id: null

This is confusing for users: "I just booked a patient, why can't I see their details? The appointment is in my queue!"

Architectural Gap (how healthcare apps handle this):

In healthcare systems, a patient's relationship with a facility is a first-class concept. There are two common patterns:

Kulcare currently does neither — it's in an inconsistent middle ground:

• ✅ Patient is visible cross-clinic (tenant-scoped data)
• ❌ No facility record is created on access
• ❌ Booking succeeds but leaves the appointment orphaned
• ❌ View is broken because the URL depends on a relationship that was never established

Decision needed: Should Kulcare adopt implicit registration (auto-create facility record on first access)? This is the standard for multi-clinic platforms where patients flow between clinics naturally. The alternative is to explicitly scope the patient list to only show patients registered in the current facility.

Root Cause: When a cross-clinic patient is accessed (viewed, edited, booked), no Clinical::PatientFacility record is auto-created for the current facility. Two places are affected:

1. PatientBlueprint — resolves patient_facility_id only for current facility → null for cross-clinic patients → View link breaks
2. FindOrCreateService#find_patient_facility_by_patient — returns nil for existing patients without a facility record in the current facility → Appointment created without patient_facility_id

Why booking "works" but shouldn't: Clinical::Appointment model has belongs_to :patient_facility, optional: true — the appointment is created without validation errors, but it's orphaned from the facility context.

Recommended Fix: Auto-create PatientFacility record on first access. In FindOrCreateService:

if patient_id_provided? && find_by_id
  facility = find_patient_facility_by_patient
  facility ||= create_patient_facility(find_by_id)  # auto-register
  return success({ patient: find_by_id, patient_facility: facility })
end

This is the standard healthcare pattern — the act of providing care at a facility establishes the patient-facility relationship. After this fix: View works, appointments carry proper facility context, and the user experience is consistent.

Bug #44: Appointment Duration Not Validated — Allows Overlapping BookingsCopy Anchor Link

Description: Two related issues in duration handling:

Issue 1 — Duration not enforced: Zod has max(120) but per-step validateCurrentStep() bypasses it (only checks doctor + time slot). Backend CreateService has no duration validation at all. User can set 500+ minutes and booking succeeds.

Issue 2 — Overlap check uses hardcoded 15-min, not actual duration: AvailabilityService#slot_conflict? had slot_duration = 15 hardcoded. Books 6:45 with 120 min → only checks 6:45 is free, ignores 7:00 and 7:15 which are already booked. Full 6:45→8:45 window overlaps booked slots but validation passes → double-booking.

Resolution (3-part fix):

1. UTC timezone fix — utc_datetime helper builds UTC Time directly instead of Time.zone.parse, which re-interpreted UTC HH:MM strings as server local time, shifting the overlap window by the timezone offset.
2. Appointment conflict check — Added conflicting_appointments method to check standalone appointment rows (not just encounters). Freshly booked CMS appointments have no encounter yet, so the old encounter-only check missed them.
3. Proper overlap formula — existing.start < new.end AND existing.end > new.start instead of BETWEEN, which falsely flagged back-to-back non-overlapping slots as conflicts.

Files changed: availability_service.rb

Bug #48: Out-of-Queue Split Inconsistent — Finished Patients Stay in QueueCopy Anchor Link

Description: The queue API splits patients inconsistently:

Three issues:

1. Finished (encounter) never moves to out_of_queue — "finished" status stays in the main queue as a read-only badge. Only manual "Completed" triggers the OoQ split.
2. No path from finished → completed — once encounter finishes, status becomes read-only. No dropdown to transition to completed.
3. Cancelled disappears entirely — removed from both lists. Staff has no visibility into cancelled appointments.

Fix: Backend should consistently split based on status — finished AND fulfilled → out_of_queue[]. Encounter-finish flow should auto-transition appointment status to fulfilled so it moves naturally. Cancelled should appear in out_of_queue[] instead of disappearing.

# QueueService — consistent split logic
active_statuses = %w[proposed pending booked arrived]
out_of_queue_statuses = %w[fulfilled finished cancelled noshow]

Bug #49: No Couple Session Indicator in Queue RowCopy Anchor Link

Description: API returns couple_session: true + spouse info but QueueRow renders nothing — no icon, badge, or spouse name. Staff can't tell it's a couple session from the queue.

Fix: Add indicator when item.couple_session === true — Users icon + "Couple" badge, or show spouse name under patient.

Bug #45: Invite Role Mismatch — Registered User Only Sees Matching Role InvitesCopy Anchor Link

Description: Admin sends staff invite to a phone registered as "staff". If admin selects role "staff" → invite appears ✅. If admin selects any other role (doctor/admin/vendor) → invite does NOT appear for the user ❌.

Steps: 1) User registered as "staff" 2) Admin sends invite with role "doctor" 3) User checks invites → empty.

Expected: All invites to the user's phone should be visible, or block mismatched invites at creation time.

Bug #46: Invite Role Overwritten at Signup — Always Registers as StaffCopy Anchor Link

Description: Admin selects role "doctor" for an unregistered user invite. When user signs up via invite link, role is always "staff" — the selected role is not carried through to signup.

Steps: 1) Admin invites unregistered user as "doctor" 2) User completes signup 3) Role = "staff".

Expected: Invite role should be assigned at signup.

Bug #47: Registered User Receives Signup Link Instead of Accept/Join LinkCopy Anchor Link

Description: When inviting an already registered phone number, SMS always contains a signup link. User is already registered — should receive an "accept invite" link to add the clinic role, not re-register.

Steps: 1) User registered in Clinic A 2) Admin in Clinic B invites same phone 3) SMS = signup link 4) User sees signup form, not accept flow.

Expected: Registered users → "Accept Invite" link. Unregistered users → "Signup" link.

Bug #50: Gateway Payment Method Returns 500 Internal Server ErrorCopy Anchor Link

Description: Gateway payment method crashes with 500. Cash/Card/UPI/Bank work.

API: POST /billing/patient_facilities/:id/payments with payment_method: "gateway" → 500.

Bug #51: Next Visit — Specific Date Fails "Outside Working Hours"Copy Anchor Link

Description: Absolute date mode fails — "Appointment time is outside working hours". Interval mode works.

API: next_visit_date: "2026-06-20" → 422. next_visit_value: 7, next_visit_units: "weeks" → 200.

Fix: Absolute mode should default to a working-hour time or skip time validation for follow-ups.

Bug #52: Delete/Cancel Dialog — Reason Not Cleared on CloseCopy Anchor Link

Description: Click outside delete dialog → closes → reopen → previous reason text still filled.

Fix: Reset deleteReason/cancelReason state in dialog's onOpenChange handler.

Bug #53: Phone Not Shown in Follow-ups ListCopy Anchor Link

Description: Appointment API returns patient: { display, mrn } — no phone field. Frontend tries to show phone via formatPatientPhone() but has no data.

Fix: Include patient.phone_number in appointment blueprint or make a separate patient lookup.

Bug #54: ✓ Icon = Edit, Not Confirm — Confusing UXCopy Anchor Link

Description: Green ✓ (check) icon on follow-up rows opens UpdateAppointmentModal — it edits, not confirms. The icon suggests "done/completed" but actually edits. Users expect check = complete, not check = edit.

Fix: Change icon to ✏️ Pencil for edit, or add a separate Confirm flow that marks as completed.

Bug #55: Telemedicine Follow-ups DisappearCopy Anchor Link

Description: follow_up=true filters by by_type('fixed') in controller. Changing follow-up to telemedicine type → removed from list. The filter is hardcoded to fixed only.

Fix: Include telemedicine in follow_up filter: scope.by_type(['fixed', 'telemedicine']) if params[:follow_up] == 'true'

Bug #56: Patient Reports Row Click — Wrong URL (patientId Used Twice)Copy Anchor Link

Description: Clicking a patient row in Patient Reports navigates to /cms/patient/v2/{patientId}/{patientId} — uses patientId for both URL segments instead of patientId + patientFacilityId. The detail page can't load.

Code: PatientReportsPageV2.tsx line 106:

navigate(`/cms/patient/v2/${patientId}/${patientId}`)
// Should be:
navigate(`/cms/patient/v2/${patientId}/${patientFacilityId}`)

Bug #57: Revenue Summary — Payments Not Reflected (All Zeros)Copy Anchor Link

Description: Summary returns zero for all payment fields despite ₹2600 in actual payments (₹2500 cash + ₹100 card). Services list is correct, but earnings + billing_summary show zeros.

API Evidence: bills[].amount all ₹0, billing_summary.{paid,unpaid,billed}_amount all ₹0, earnings.{total_revenue,amount_received,amount_pending} all ₹0. Only earnings.billed_amount = ₹7390 is correct.

Root cause: SummaryService#calculate_billing_summary or bills_by_payment_mode not aggregating from Payment/PaymentAllocation tables.

Bug #58: Revenue Summary — Case-Sensitive Service GroupingCopy Anchor Link

Description: "Sugar Test" and "sugar test" counted separately. Should be case-insensitive grouped.

API Evidence: services[] shows Sugar Test (count: 3, ₹6000) + sugar test (count: 2, ₹390).

Bug #59: Revenue Summary — Visit Type Breakdown IncorrectCopy Anchor Link

Description: All ₹7390 shown under "Walkin" — services from fixed/telemedicine appointments also counted as Walkin.

API Evidence: visit_types[] = Walkin: ₹7390, Virtual: ₹0, Fixed: ₹0 but services exist across walk_in, fixed, and telemedicine appointments.

Bug #60: Revenue Export — Bill Report API FailsCopy Anchor Link

Description: POST /billing/report_exports/bill_report fails. Revenue export generates no report.

API Evidence: Request with facility_id, from_date, to_date → error response.

Bug #61: Services Tab — Focus Lost on Debounced SearchCopy Anchor Link

Description: After typing in service name search and debounce triggers API call, the input loses focus when data reloads. User gets interrupted mid-typing.

Bug #62: Services Tab — Patient Name Null Causes NA Display + Search 500Copy Anchor Link

Description: useAllServices API returns patient.name: null for all services. This causes:

• Patient column shows "NA" in the table
• Patient name search (?patient_name=) returns 500 Internal Server Error
• Delete modal shows {{patientName}} template instead of actual name

Root cause: Service creation via billing panel doesn't populate patient.name in the service record.

Bug Status LegendCopy Anchor Link

Sprint 1 Resolutions (2026-06-23)Copy Anchor Link

Bug #10: Cross-App Authentication Not Enforced — ✅ RESOLVEDCopy Anchor Link

Fix: Added ALLOWED_APPS role-to-app mapping in SessionsController. Login now rejects users whose signed_up_as doesn't match the requesting app. PasswordsController also gated.

Files changed: sessions_controller.rb, passwords_controller.rb

Bug #17: Cross-App Forgot Password — ✅ RESOLVEDCopy Anchor Link

Fix: Same app gate applied to PasswordsController#reset. Returns generic success message to avoid leaking user existence.

Files changed: passwords_controller.rb

Bug #24: Invite Sent to Registered Email — ✅ RESOLVEDCopy Anchor Link

Fix: InviteService now runs check_existing_membership before creating invites. Blocks if user already has an active membership in the tenant.

Files changed: invite_service.rb

Bug #26: Invite to Active User — ✅ RESOLVEDCopy Anchor Link

Fix: Same as #24 — check_existing_membership blocks invites to users who already have active memberships.

Files changed: invite_service.rb, staff_services/invite_service.rb

Bug #21: Practitioner Invite to Existing Patient — ✅ RESOLVEDCopy Anchor Link

Fix: check_existing_membership also checks signed_up_as. Patient accounts blocked from receiving practitioner invites with message "Cannot invite a patient account as a practitioner".

Files changed: invite_service.rb

Bug #45: Invite Role Mismatch — ✅ RESOLVEDCopy Anchor Link

Fix: check_existing_membership blocks invites when user's signed_up_as is incompatible with the invite (e.g., staff user receiving practitioner invite).

Files changed: invite_service.rb, staff_services/invite_service.rb

Bug #46: Invite Role Overwritten at Signup — ✅ RESOLVEDCopy Anchor Link

Fix: VerificationWithProfileService now checks for invite_token during OTP verification. If present, overrides the user's signed_up_as to match the invite's intended role before profile creation.

Files changed: verification_with_profile_service.rb, registrations_controller.rb

Bug #47: Registered User Gets Signup Link Instead of Accept Link — ✅ RESOLVEDCopy Anchor Link

Fix: send_sms_notification now branches: if the target user already has an account → sends /signin?next=/identity/my/invites link. If no account → sends the signup link with invite token.

Files changed: invite_service.rb, staff_services/invite_service.rb

Bug #19: Backend Validation Error Not Displayed — ✅ RESOLVEDCopy Anchor Link

Fix: AddDoctorModal and AddStaffModal catch blocks now surface error.response?.data?.error?.message instead of generic "Failed to send invite."

Files changed: AddDoctorModal.tsx, AddStaffModal.tsx

Bug #20: Whitespace-Only Names Allowed — ✅ RESOLVEDCopy Anchor Link

Fix: Zod schemas in both modals now use .refine(val => val.trim().length > 0) to reject whitespace-only names.

Files changed: AddDoctorModal.tsx, AddStaffModal.tsx

Bug #25: Invite Modal Form State Not Reset — ✅ RESOLVEDCopy Anchor Link

Fix: Added handleOpenChange handler that resets the form when the dialog closes (via outside click, Escape, or Cancel button).

Files changed: AddDoctorModal.tsx, AddStaffModal.tsx

Bug #23: Duplicate Invite with Same Email — ✅ RESOLVEDCopy Anchor Link

Fix: Covered by the existing check_existing_invite + new check_existing_membership. Duplicate invites to the same phone/email in the same clinic are blocked before creation.

Files changed: invite_service.rb

🔴 Critical Bugs (Block Production) — 4 Remaining, 1 ResolvedCopy Anchor Link

🧪 Sprint 1 Testing ChecklistCopy Anchor Link

Use this to verify each fix on staging before marking bugs as Closed.

Auth — Cross-App Enforcement (#10, #17)Copy Anchor Link

Invite — Backend Validation (#24, #26, #21, #23, #45)Copy Anchor Link

Invite — Role Carry-Through (#46)Copy Anchor Link

Invite — SMS Links (#47)Copy Anchor Link

Frontend — Error Messages (#19)Copy Anchor Link

Frontend — Whitespace Names (#20)Copy Anchor Link

Frontend — Form Reset (#25)Copy Anchor Link

Already Fixed — Verify (#29)Copy Anchor Link

Sprint 2 Resolutions (2026-06-23)Copy Anchor Link

Bug #36: Phone Search Returns No Results — ✅ RESOLVEDCopy Anchor Link

Fix: Added phone_number to search_columns in PatientsController#index. Was searching only first_name, last_name, display_name, mrn — now also matches phone.

Files changed: patients_controller.rb (line 27)

Bug #56: Patient Reports Row Click — Wrong URL — ✅ RESOLVEDCopy Anchor Link

Fix: handlePatientClick now accepts patientFacilityId as second argument. Navigates to /cms/patient/v2/{patientId}/{patientFacilityId} instead of /{patientId}/{patientId}. Updated types in PatientReportsTableV2 and PatientTableSection.

Files changed: PatientReportsPageV2.tsx, PatientReportsTableV2.tsx, PatientTableSection.tsx

Bug #55: Telemedicine Follow-Ups Disappear — ✅ RESOLVEDCopy Anchor Link

Fix: Changed follow_up filter from by_type('fixed') to by_type(%w[fixed telemedicine]) so telemedicine follow-ups appear in the list.

Files changed: appointments_controller.rb (line 169)

Bug #32: DOB Not Auto-Filled When Importing from Kulcare — ✅ RESOLVEDCopy Anchor Link

Fix: Auto-fill approximate birth date from the age field returned by federated search API. The API intentionally excludes exact DOB for privacy — age-based year is a reasonable starting point. Applied in both AddPatientModal and appointment booking PatientInformation step.

Files changed: AddPatientModal.tsx, PatientInformation.tsx

Bug #38: Cross-Clinic Patient Flow Incomplete — ✅ RESOLVEDCopy Anchor Link

Fix: Two-part fix:

1. FindOrCreateService#auto_register_patient_facility — auto-creates facility link when a patient is searched for or viewed from a different clinic within the same tenant (commit 47118d2a9).
2. PatientsController#auto_register_facility_links — batch-registers missing facility links on the patient LIST page before returning results. Uses a NOT IN subquery to find unlinked patients and creates one PatientFacility record each (idempotent — skips on subsequent requests). This ensures the patient list never shows rows with null patient_facility_id, and all patients are clickable without crashing the detail view.

Files changed: find_or_create_service.rb, patients_controller.rb

Bug #44: Appointment Duration/Overlap Not Validated — ✅ RESOLVEDCopy Anchor Link

Fix (3-part):

1. utc_datetime helper — builds UTC Time from UTC HH:MM instead of Time.zone.parse which re-interpreted UTC strings as local time, shifting the overlap window by the server timezone offset.
2. conflicting_appointments — added appointment overlap check alongside the existing encounter check. Previously only encounters were checked, but freshly booked CMS appointments have no encounter yet.
3. Proper overlap formula — existing.start < new.end AND existing.end > new.start instead of BETWEEN which falsely flagged back-to-back slots.

Files changed: availability_service.rb

🧪 Sprint 2 Testing ChecklistCopy Anchor Link

Phone Search (#36)Copy Anchor Link

Patient Reports URL (#56)Copy Anchor Link

Telemedicine Follow-Ups (#55)Copy Anchor Link

DOB Auto-Fill (#32)Copy Anchor Link

Cross-Clinic Patient Auto-Registration (#38)Copy Anchor Link

Appointment Duration / Overlap (#44)Copy Anchor Link

Sprint 3 Resolutions (2026-06-23)Copy Anchor Link

Bug #5: DOB Allows Future Dates — ✅ RESOLVEDCopy Anchor Link

Fix: Added birth_date_not_in_future validation to Clinical::Patient model.

Files changed: patient.rb

Bug #34: No Backend Validation for Patient Form — ✅ RESOLVEDCopy Anchor Link

Fix: Added phone digit-only format validation to Clinical::Patient. Future DOB blocked by #5 fix.

Files changed: patient.rb

Bug #14+#15: Duplicate Category Names (Case-Insensitive) — ✅ RESOLVEDCopy Anchor Link

Fix: Added case_sensitive: false to FacilityCategory uniqueness validation.

Files changed: facility_category.rb

Bug #48: Out-of-Queue Split Inconsistent — ✅ RESOLVEDCopy Anchor Link

Fix: GenerateToday now includes finished/cancelled/noshow in out_of_queue. Removed .not_cancelled filter.

Files changed: generate_today.rb

Bug #53: Phone Not Shown in Follow-Ups List — ✅ RESOLVEDCopy Anchor Link

Fix: Added phone field to appointment blueprint queue view.

Files changed: appointment_blueprint.rb

Bug #18: Practitioner API Missing Phone — ✅ RESOLVEDCopy Anchor Link

Fix: Added phone_number + phone_country_code to PractitionerBlueprint (from identifiers JSONB).

Files changed: practitioner_blueprint.rb

Bug #22: Cancelled Invites Not Visible — ✅ RESOLVEDCopy Anchor Link

Fix: Removed hardcoded status: 'pending' filter from DoctorsTab + StaffTab queries.

Files changed: DoctorsTab.tsx, StaffTab.tsx

Bug #49: No Couple Session Indicator in Queue — ✅ RESOLVEDCopy Anchor Link

Fix: Added "Couple" badge with Users icon in QueueRow when couple_session is true.

Files changed: QueueRow.tsx

Bug #54: ✓ Icon = Edit, Not Confirm — ✅ RESOLVEDCopy Anchor Link

Fix: Changed Check→Pencil icon in FollowUpsTableRow + neutral styling (was green/success).

Files changed: FollowUpsTableRow.tsx

🧪 Sprint 3 Testing ChecklistCopy Anchor Link

Validation (#5, #34)Copy Anchor Link

Duplicate Categories (#14, #15)Copy Anchor Link

Out-of-Queue (#48)Copy Anchor Link

Phone in Follow-Ups + Practitioner API (#53, #18)Copy Anchor Link

Cancelled Invites (#22)Copy Anchor Link

Couple Session Indicator (#49)Copy Anchor Link

Edit Icon (#54)Copy Anchor Link

Sprint 3.5 — Extra Fixes (2026-06-23)Copy Anchor Link

Bug #31: Federated Search — Full Name Now Works — ✅ RESOLVEDCopy Anchor Link

Fix: FederatedSearchService now splits name into words. "Mohit Goyal" matches first_name + last_name separately. Applied to both in_clinic and in_kulcare paths.

Files changed: federated_search_service.rb

Bug #52: Delete Dialog — Reason Cleared on Overlay Click — ✅ RESOLVEDCopy Anchor Link

Fix: Overlay backdrop click now resets deleteReason + closes modal. Previously only Cancel button cleared state.

Files changed: ServicesTabV2.tsx

Bug #1: Error Messages on Signup (Patient) — ✅ RESOLVEDCopy Anchor Link

Fix: SignUpPage catch block now extracts err?.response?.data?.error?.message from API response instead of showing generic Axios error text. The auth service's parseBackendError already maps technical messages to user-friendly text.

Files changed: SignUpPage.tsx

Bug #8: Error Messages on Signup (Clinic) — ✅ RESOLVEDCopy Anchor Link

Fix: SignInPage already uses parseBackendError which extracts and maps API error messages to user-friendly text. SignUpPage now has the same fallback. Both pages show actual backend errors instead of generic messages.

Files changed: SignUpPage.tsx (SignInPage.tsx already correct)

Bug #51: Next Visit — Absolute Date Now Works — ✅ RESOLVEDCopy Anchor Link

Root cause (v1): Time.parse interpreted date-only strings as midnight UTC, which is never within any practitioner's working hours — availability check always rejected.

Root cause (v2): parse_date parsed the date in server timezone first via Time.parse, then converted to facility timezone via in_time_zone. When server TZ ≠ facility TZ (e.g. server IST, facility UTC), the date shifted backwards by the offset — landing on the previous day, which is always in the past.

Fix (final): Time.use_zone(facility_timezone) { Time.zone.parse("2026-06-25 09:00:00") } — parses 9 AM directly in the facility's timezone with no conversion hop. Frontend date pickers now enforce min={tomorrow} to prevent selecting today's date (which would be in the past by the time the user submits).

Files changed: next_visit/create_service.rb, NextVisitModal.tsx, NextVisitSection.tsx

Bug #2: Resend OTP Not Working (Patient) — ✅ RESOLVEDCopy Anchor Link

Root cause: RegistrationsController#find_user_for_resend called User.find_by_phone(country_code, phone_number) — a method that doesn't exist. Rails' dynamic find_by_* only works for single columns, not two args. Result: NoMethodError → 500.

Fix: Changed to User.by_phone(...).first — uses the existing scope. Same fix applied to email lookup (find_by_email → by_email(...).first).

Files changed: registrations_controller.rb, passwords_controller.rb

Bug #9: Resend OTP 500 Error (Clinic) — ✅ RESOLVEDCopy Anchor Link

Root cause: Same as #2 — User.find_by_phone doesn't exist. Both clinic and patient apps hit the same /identity/registrations/resend_otp endpoint.

Fix: Same as #2.

Files changed: registrations_controller.rb, passwords_controller.rb

Testing: Schedule a next visit with absolute date → should succeed (no more "outside working hours"). Relative mode should still work unchanged.

🧪 Sprint 3.5 Testing ChecklistCopy Anchor Link

Updating Bug StatusCopy Anchor Link

1. Edit this file
2. Update status field
3. Add resolution notes with date

Adding New BugCopy Anchor Link

1. Add to appropriate severity section
2. Include all required fields
3. Link to session file
4. Update bug summary table

Document Status: Active Last Updated: 2026-06-25

✅ All Bugs — Verified & Closed StatusCopy Anchor Link

🔴 Critical Bugs — ALL CLOSED ✅Copy Anchor Link

🟡 High Priority Bugs — CLOSED ✅Copy Anchor Link

🟠 Medium Priority Bugs — CLOSED ✅Copy Anchor Link

Patient App Bug Fixes (2026-06-25) — ALL VERIFIED ✅Copy Anchor Link

Ready for Testing (Historical - See Above for Verified Status)Copy Anchor Link

67 test cases across 4 checklists.

🔴 Pending — Needs DevOps (1 bug)Copy Anchor Link

⏭️ Deferred — New Billing Flow (5 bugs)Copy Anchor Link

🟢 Pending — Architecture (2 bugs)Copy Anchor Link

✅ Not Bugs (2)Copy Anchor Link