Merge branch 'master' into improvements/subscription-v1

Reviewed-on: #74
Reviewed-by: admin <admin@localhost>

.gitea/workflows/prod-tag-deploy.yml

@@ -44,8 +44,6 @@ defaults:
 jobs:
   build-and-push:
     runs-on: windows
-    outputs:
-      image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout (this Gitea)
         run: |
@@ -75,6 +73,7 @@ jobs:
           }
           $env:GIT_TERMINAL_PROMPT = '0'
           git clone --depth 1 --branch $Branch $cloneUrl .
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Resolve image tag (v*.*.* only)
         id: meta
@@ -90,10 +89,7 @@ jobs:
             Write-Host "Production images must be tagged vMAJOR.MINOR.PATCH (got: $tag)"
             exit 1
           }
-          $utf8 = New-Object System.Text.UTF8Encoding $false
-          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$tag`n", $utf8)
           $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
-          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
           Write-Host "image_tag=$tag REGISTRY_PREFIX=$prefix"
 
       - name: Log in to container registry
@@ -103,13 +99,43 @@ jobs:
           ${{ secrets.REGISTRY_PASSWORD }}
           '@
           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      - name: Resolve node:20-alpine (Gitea, then mirrors, Hub last)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          $extra = '${{ vars.NODE_IMAGE_SOURCE }}'.Trim()
+          if ($extra -like '*NODE_IMAGE_SOURCE*') { $extra = '' }
+          # Do not nest powershell -File: empty -ExtraSources "$extra" is dropped and PS5.1 errors MissingArgument.
+          $scriptArgs = @{ RegistryPrefix = $prefix }
+          if (-not [string]::IsNullOrWhiteSpace($extra)) { $scriptArgs['ExtraSources'] = $extra }
+          & .\infrastructure\scripts\ci-resolve-node-image.ps1 @scriptArgs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push backend (tag only, not :latest)
         run: |
           $ErrorActionPreference = 'Stop'
-          $tag = "${{ steps.meta.outputs.image_tag }}"
-          docker build -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" ./backend
-          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          $nodeImage = ([System.IO.File]::ReadAllText((Join-Path (Get-Location) '.ci-node-image'))).Trim()
+          if ([string]::IsNullOrWhiteSpace($nodeImage)) {
+            Write-Host "Missing .ci-node-image"
+            exit 1
+          }
+          if (Test-Path '.ci-use-legacy-builder') { $env:DOCKER_BUILDKIT = '0' }
+          Write-Host "Building $prefix/dyolink-backend:$tag (NODE_IMAGE=$nodeImage)"
+          $ok = $false
+          for ($i = 1; $i -le 3; $i++) {
+            Write-Host "docker build attempt $i/3"
+            docker build --build-arg "NODE_IMAGE=$nodeImage" -t "$prefix/dyolink-backend:$tag" ./backend
+            if ($LASTEXITCODE -eq 0) { $ok = $true; break }
+            if ($i -lt 3) { Start-Sleep -Seconds (20 * $i) }
+          }
+          if (-not $ok) { exit 1 }
+          docker push "$prefix/dyolink-backend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push frontend (nudentic.ir baked in)
         env:
@@ -117,19 +143,37 @@ jobs:
           NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
         run: |
           $ErrorActionPreference = 'Stop'
-          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          $nodeImage = ([System.IO.File]::ReadAllText((Join-Path (Get-Location) '.ci-node-image'))).Trim()
+          if ([string]::IsNullOrWhiteSpace($nodeImage)) {
+            Write-Host "Missing .ci-node-image"
+            exit 1
+          }
+          if (Test-Path '.ci-use-legacy-builder') { $env:DOCKER_BUILDKIT = '0' }
           $base = $env:PROD_PUBLIC_BASE_URL.Trim()
           if ([string]::IsNullOrWhiteSpace($base)) { $base = 'https://nudentic.ir' }
           $base = $base.TrimEnd('/')
+          Write-Host "Building $prefix/dyolink-frontend:$tag (NODE_IMAGE=$nodeImage)"
+          $ok = $false
+          for ($i = 1; $i -le 3; $i++) {
+            Write-Host "docker build attempt $i/3"
             docker build `
               --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
               --build-arg "NEXT_PUBLIC_APP_URL=$base" `
               --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
               --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
               --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=production" `
-            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
+              --build-arg "NODE_IMAGE=$nodeImage" `
+              -t "$prefix/dyolink-frontend:$tag" `
               ./frontend
-          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
+            if ($LASTEXITCODE -eq 0) { $ok = $true; break }
+            if ($i -lt 3) { Start-Sleep -Seconds (20 * $i) }
+          }
+          if (-not $ok) { exit 1 }
+          docker push "$prefix/dyolink-frontend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
   deploy:
     needs: build-and-push
@@ -163,6 +207,7 @@ jobs:
           }
           $env:GIT_TERMINAL_PROMPT = '0'
           git clone --depth 1 --branch $Branch $cloneUrl .
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Write SSH key
         run: |
@@ -193,19 +238,25 @@ jobs:
           if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
           $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
           ssh.exe @ssh -p $port "${user}@${hostName}" "mkdir -p $infra/scripts $infra/nginx"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           scp.exe @ssh -P $port `
             infrastructure/docker-compose.prod.yml `
             "${user}@${hostName}:${infra}/docker-compose.prod.yml"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           scp.exe @ssh -P $port `
             infrastructure/scripts/prod-remote-deploy.sh `
             "${user}@${hostName}:${infra}/scripts/prod-remote-deploy.sh"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           scp.exe @ssh -P $port `
             infrastructure/scripts/render-nginx-ssl.sh `
             "${user}@${hostName}:${infra}/scripts/render-nginx-ssl.sh"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           scp.exe @ssh -P $port `
             infrastructure/nginx/nginx.ssl.conf.template `
             "${user}@${hostName}:${infra}/nginx/nginx.ssl.conf.template"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           ssh.exe @ssh -p $port "${user}@${hostName}" "chmod +x $infra/scripts/prod-remote-deploy.sh $infra/scripts/render-nginx-ssl.sh"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Login on Linux and deploy tag
         run: |
@@ -218,7 +269,8 @@ jobs:
           if ([string]::IsNullOrWhiteSpace($infra)) { $infra = '/opt/dyolink/infrastructure' }
           $regHost = '${{ vars.PROD_REGISTRY_HOST }}'.Trim()
           if ([string]::IsNullOrWhiteSpace($regHost)) { $regHost = 'wixur.ir:3000' }
-          $tag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $dispatchTag = '${{ github.event.inputs.tag }}'.Trim()
+          if (-not [string]::IsNullOrWhiteSpace($dispatchTag)) { $tag = $dispatchTag } else { $tag = "${{ github.ref_name }}" }
           $pass = @'
           ${{ secrets.REGISTRY_PASSWORD }}
           '@
@@ -226,3 +278,4 @@ jobs:
           $ssh = @('-i', $env:PROD_SSH_KEY_PATH, '-o', 'StrictHostKeyChecking=accept-new')
           $remote = "docker login $regHost -u $regUser --password-stdin && PROD_INFRA_DIR=$infra $infra/scripts/prod-remote-deploy.sh $tag"
           $pass.Trim() | ssh.exe @ssh -p $port "${user}@${hostName}" $remote
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

.gitea/workflows/registry-build-deploy.yml

@@ -17,6 +17,8 @@
 #   STAGING_HTTP_PORT    public HTTP port (default 80) — Windows portproxy listens here → 18088
 #   STAGING_LOCAL_PORT   Docker bind on 127.0.0.1 (default 18088) — must not equal the public port if portproxy owns it
 #   CLONE_HOST           git clone host when runner = Gitea host → 127.0.0.1:3000
+#   NODE_IMAGE_SOURCE    extra base-image ref(s), comma-separated, tried before built-in mirrors
+#                        e.g. docker.arvancloud.ir/library/node:20-alpine
 #
 # Same Windows PC runs Gitea + runner + deploy:
 #   CLONE_HOST           → 127.0.0.1:3000  (git runs on Windows host)
@@ -33,6 +35,7 @@
 # Docker on runner: insecure-registries e.g. ["host.docker.internal:3000","wixur.ir:3000"]
 #
 # Runner: self-hosted with Docker + git. Default shell is powershell (Windows act_runner).
+# Windows PowerShell 5.1 does not fail a step when docker/git return non-zero — always check $LASTEXITCODE.
 
 name: Registry — build, push, deploy
 
@@ -48,8 +51,6 @@ defaults:
 jobs:
   build-and-push:
     runs-on: windows
-    outputs:
-      image_tag: ${{ steps.meta.outputs.image_tag }}
     steps:
       - name: Checkout (clone from this Gitea — no gitea.com)
         run: |
@@ -74,16 +75,7 @@ jobs:
           }
           $env:GIT_TERMINAL_PROMPT = '0'
           git clone --depth 1 --branch $Branch $cloneUrl .
-
-      - name: Image tag and registry prefix
-        id: meta
-        run: |
-          $ErrorActionPreference = 'Stop'
-          $short = (git rev-parse --short HEAD).Trim()
-          $utf8 = New-Object System.Text.UTF8Encoding $false
-          [System.IO.File]::AppendAllText($env:GITHUB_OUTPUT, "image_tag=$short`n", $utf8)
-          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}"
-          [System.IO.File]::AppendAllText($env:GITHUB_ENV, "REGISTRY_PREFIX=$prefix`n", $utf8)
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Log in to container registry
         run: |
@@ -92,17 +84,52 @@ jobs:
           ${{ secrets.REGISTRY_PASSWORD }}
           '@
           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+      - name: Resolve node:20-alpine (Gitea, then mirrors, Hub last)
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          $extra = '${{ vars.NODE_IMAGE_SOURCE }}'.Trim()
+          if ($extra -like '*NODE_IMAGE_SOURCE*') { $extra = '' }
+          # Do not nest powershell -File: empty -ExtraSources "$extra" is dropped and PS5.1 errors MissingArgument.
+          $scriptArgs = @{ RegistryPrefix = $prefix }
+          if (-not [string]::IsNullOrWhiteSpace($extra)) { $scriptArgs['ExtraSources'] = $extra }
+          & .\infrastructure\scripts\ci-resolve-node-image.ps1 @scriptArgs
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push backend
         run: |
           $ErrorActionPreference = 'Stop'
-          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $tag = "${{ github.sha }}".Substring(0, 7)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          if ([string]::IsNullOrWhiteSpace($tag) -or [string]::IsNullOrWhiteSpace($prefix)) {
+            Write-Host "Missing github.sha, REGISTRY_HOST, or REGISTRY_OWNER"
+            exit 1
+          }
+          $nodeImage = ([System.IO.File]::ReadAllText((Join-Path (Get-Location) '.ci-node-image'))).Trim()
+          if ([string]::IsNullOrWhiteSpace($nodeImage)) {
+            Write-Host "Missing .ci-node-image"
+            exit 1
+          }
+          if (Test-Path '.ci-use-legacy-builder') { $env:DOCKER_BUILDKIT = '0' }
+          Write-Host "Building $prefix/dyolink-backend:$tag (NODE_IMAGE=$nodeImage)"
+          $ok = $false
+          for ($i = 1; $i -le 3; $i++) {
+            Write-Host "docker build attempt $i/3"
             docker build `
-            -t "$env:REGISTRY_PREFIX/dyolink-backend:$tag" `
-            -t "$env:REGISTRY_PREFIX/dyolink-backend:latest" `
+              --build-arg "NODE_IMAGE=$nodeImage" `
+              -t "$prefix/dyolink-backend:$tag" `
+              -t "$prefix/dyolink-backend:latest" `
               ./backend
-          docker push "$env:REGISTRY_PREFIX/dyolink-backend:$tag"
-          docker push "$env:REGISTRY_PREFIX/dyolink-backend:latest"
+            if ($LASTEXITCODE -eq 0) { $ok = $true; break }
+            if ($i -lt 3) { Start-Sleep -Seconds (20 * $i) }
+          }
+          if (-not $ok) { exit 1 }
+          docker push "$prefix/dyolink-backend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          docker push "$prefix/dyolink-backend:latest"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Build and push frontend
         env:
@@ -110,19 +137,37 @@ jobs:
           NEXT_PUBLIC_SENTRY_DSN: ${{ vars.NEXT_PUBLIC_SENTRY_DSN }}
         run: |
           $ErrorActionPreference = 'Stop'
-          $tag = "${{ steps.meta.outputs.image_tag }}"
+          $tag = "${{ github.sha }}".Substring(0, 7)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
           $base = $env:PUBLIC_BASE_URL
+          $nodeImage = ([System.IO.File]::ReadAllText((Join-Path (Get-Location) '.ci-node-image'))).Trim()
+          if ([string]::IsNullOrWhiteSpace($nodeImage)) {
+            Write-Host "Missing .ci-node-image"
+            exit 1
+          }
+          if (Test-Path '.ci-use-legacy-builder') { $env:DOCKER_BUILDKIT = '0' }
+          Write-Host "Building $prefix/dyolink-frontend:$tag (NODE_IMAGE=$nodeImage)"
+          $ok = $false
+          for ($i = 1; $i -le 3; $i++) {
+            Write-Host "docker build attempt $i/3"
             docker build `
               --build-arg "NEXT_PUBLIC_API_URL=$base/api" `
               --build-arg "NEXT_PUBLIC_APP_URL=$base" `
               --build-arg "NEXT_PUBLIC_APP_NAME=Dyolink" `
               --build-arg "NEXT_PUBLIC_SENTRY_DSN=$env:NEXT_PUBLIC_SENTRY_DSN" `
               --build-arg "NEXT_PUBLIC_SENTRY_ENVIRONMENT=staging" `
-            -t "$env:REGISTRY_PREFIX/dyolink-frontend:$tag" `
-            -t "$env:REGISTRY_PREFIX/dyolink-frontend:latest" `
+              --build-arg "NODE_IMAGE=$nodeImage" `
+              -t "$prefix/dyolink-frontend:$tag" `
+              -t "$prefix/dyolink-frontend:latest" `
               ./frontend
-          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:$tag"
-          docker push "$env:REGISTRY_PREFIX/dyolink-frontend:latest"
+            if ($LASTEXITCODE -eq 0) { $ok = $true; break }
+            if ($i -lt 3) { Start-Sleep -Seconds (20 * $i) }
+          }
+          if (-not $ok) { exit 1 }
+          docker push "$prefix/dyolink-frontend:$tag"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          docker push "$prefix/dyolink-frontend:latest"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
   deploy:
     needs: build-and-push
@@ -151,6 +196,7 @@ jobs:
           }
           $env:GIT_TERMINAL_PROMPT = '0'
           git clone --depth 1 --branch $Branch $cloneUrl .
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Write deploy.registry.env and validate secrets path
         run: |
@@ -173,16 +219,19 @@ jobs:
           if ([string]::IsNullOrWhiteSpace($stagingPort)) { $stagingPort = '80' }
           $localPort = '${{ vars.STAGING_LOCAL_PORT }}'.Trim()
           if ([string]::IsNullOrWhiteSpace($localPort)) { $localPort = '18088' }
-          $imageTag = "${{ needs.build-and-push.outputs.image_tag }}"
+          $imageTag = "${{ github.sha }}".Substring(0, 7)
+          $prefix = "${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}".Trim()
+          Write-Host "IMAGE_TAG=$imageTag REGISTRY_PREFIX=$prefix"
           $lines = @(
-            "REGISTRY_PREFIX=${{ vars.REGISTRY_HOST }}/${{ vars.REGISTRY_OWNER }}",
+            "REGISTRY_PREFIX=$prefix",
             "IMAGE_TAG=$imageTag",
             "STAGING_HTTP_PORT=$stagingPort",
             "STAGING_LOCAL_PORT=$localPort",
             "DEPLOY_SECRETS_DIR=$SD"
           )
           Set-Location infrastructure
-          $lines | Set-Content -Path deploy.registry.env -Encoding utf8
+          $utf8 = New-Object System.Text.UTF8Encoding $false
+          [System.IO.File]::WriteAllText((Join-Path (Get-Location) 'deploy.registry.env'), ($lines -join "`n") + "`n", $utf8)
 
       - name: Log in to container registry (for pull)
         run: |
@@ -191,10 +240,13 @@ jobs:
           ${{ secrets.REGISTRY_PASSWORD }}
           '@
           $pass.Trim() | docker login "${{ vars.REGISTRY_HOST }}" -u "${{ secrets.REGISTRY_USERNAME }}" --password-stdin
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
       - name: Pull and start stack
         run: |
           $ErrorActionPreference = 'Stop'
           Set-Location infrastructure
           docker compose -f docker-compose.registry.yml --env-file deploy.registry.env pull backend frontend
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
           docker compose -f docker-compose.registry.yml --env-file deploy.registry.env up -d
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

backend/Dockerfile

@@ -1,7 +1,10 @@
+# CI can pass a Gitea-hosted mirror when Docker Hub TLS fails (see ci-resolve-node-image.ps1).
+ARG NODE_IMAGE=node:20-alpine
+
 # ============================================
 # STAGE 1: BUILDER STAGE
 # ============================================
-FROM node:20-alpine AS builder
+FROM ${NODE_IMAGE} AS builder
 
 WORKDIR /app
 
@@ -30,7 +33,7 @@ RUN npm prune --omit=dev
 # ============================================
 # STAGE 2: PRODUCTION STAGE
 # ============================================
-FROM node:20-alpine
+FROM ${NODE_IMAGE}
 
 RUN apk add --no-cache dumb-init
 

backend/src/common/errors/error-codes.ts

@@ -84,6 +84,7 @@ export const ErrorCode = {
   APPOINTMENT_NOT_PROVIDER: 'APPOINTMENT_NOT_PROVIDER',
 
   PATIENT_NOT_FOUND: 'PATIENT_NOT_FOUND',
+  PATIENT_MOBILE_UNAVAILABLE: 'PATIENT_MOBILE_UNAVAILABLE',
 
   WORKING_HOURS_INVALID: 'WORKING_HOURS_INVALID',
   WORKING_HOURS_OWNER_NOT_ALLOWED: 'WORKING_HOURS_OWNER_NOT_ALLOWED',
@@ -110,6 +111,8 @@ export const ErrorCode = {
   STAFF_CANNOT_ENABLE_OWNER: 'STAFF_CANNOT_ENABLE_OWNER',
   STAFF_CANNOT_DISABLE_OWNER: 'STAFF_CANNOT_DISABLE_OWNER',
   STAFF_CANNOT_REMOVE_OWNER: 'STAFF_CANNOT_REMOVE_OWNER',
+  STAFF_CANNOT_CLEAR_OWN_PASSWORD: 'STAFF_CANNOT_CLEAR_OWN_PASSWORD',
+  STAFF_PASSWORD_CLEAR_ACTIVE_ONLY: 'STAFF_PASSWORD_CLEAR_ACTIVE_ONLY',
 
   ORG_CANNOT_LINK_SELF: 'ORG_CANNOT_LINK_SELF',
   ORG_LINK_WRONG_TYPE: 'ORG_LINK_WRONG_TYPE',

backend/src/modules/appointments/appointments.service.ts

@@ -341,12 +341,16 @@ export class AppointmentsService {
     }
   }
 
-  private async ensurePatientInOrg(patientId: string, _organizationId: string) {
-    const patient = await this.prisma.patient.findUnique({
-      where: { id: patientId },
-      select: { id: true, isWalkIn: true },
+  private async ensurePatientInOrg(patientId: string, organizationId: string) {
+    const patient = await this.prisma.patient.findFirst({
+      where: {
+        id: patientId,
+        isWalkIn: false,
+        createdByOrganizationId: organizationId,
+      },
+      select: { id: true },
     });
-    if (!patient || patient.isWalkIn) {
+    if (!patient) {
       throw new AppException(ErrorCode.PATIENT_NOT_FOUND, HttpStatus.NOT_FOUND);
     }
   }

backend/src/modules/patients/patients.controller.ts

@@ -25,16 +25,17 @@ export class PatientsController {
   constructor(private readonly patientsService: PatientsService) {}
 
   @Post()
-  @ApiOperation({ summary: 'Create or return existing global patient by mobile' })
+  @ApiOperation({ summary: 'Create or return this clinic’s patient by mobile' })
   create(@Body() createPatientDto: CreatePatientDto, @Req() req) {
     const organizationId = this.patientsService.getOrganizationIdFromUser(req.user);
     return this.patientsService.create(createPatientDto, organizationId);
   }
 
   @Get()
-  @ApiOperation({ summary: 'Search all patients globally' })
-  findAll(@Query() query: ListPatientsDto) {
-    return this.patientsService.findAll(query);
+  @ApiOperation({ summary: 'Search patients created by the current clinic' })
+  findAll(@Query() query: ListPatientsDto, @Req() req) {
+    const organizationId = this.patientsService.getOrganizationIdFromUser(req.user);
+    return this.patientsService.findAll(query, organizationId);
   }
 
   @Get(':id/appointments')
@@ -48,14 +49,20 @@ export class PatientsController {
   }
 
   @Get(':id')
-  @ApiOperation({ summary: 'Get one patient by id' })
-  findOne(@Param('id') id: string) {
-    return this.patientsService.findOne(id);
+  @ApiOperation({ summary: 'Get one patient created by the current clinic' })
+  findOne(@Param('id') id: string, @Req() req) {
+    const organizationId = this.patientsService.getOrganizationIdFromUser(req.user);
+    return this.patientsService.findOne(id, organizationId);
   }
 
   @Patch(':id')
-  @ApiOperation({ summary: 'Update global patient record' })
-  update(@Param('id') id: string, @Body() updatePatientDto: UpdatePatientDto) {
-    return this.patientsService.update(id, updatePatientDto);
+  @ApiOperation({ summary: 'Update a patient created by the current clinic' })
+  update(
+    @Param('id') id: string,
+    @Body() updatePatientDto: UpdatePatientDto,
+    @Req() req,
+  ) {
+    const organizationId = this.patientsService.getOrganizationIdFromUser(req.user);
+    return this.patientsService.update(id, updatePatientDto, organizationId);
   }
 }

backend/src/modules/patients/patients.service.ts

@@ -21,8 +21,14 @@ export class PatientsService {
     });
 
     if (existing) {
+      if (
+        !existing.isWalkIn &&
+        existing.createdByOrganizationId === organizationId
+      ) {
         return { success: true, data: existing, existing: true as const };
       }
+      throw new AppException(ErrorCode.PATIENT_MOBILE_UNAVAILABLE, HttpStatus.CONFLICT);
+    }
 
     const patient = await this.prisma.patient.create({
       data: {
@@ -39,12 +45,13 @@ export class PatientsService {
     return { success: true, data: patient, existing: false as const };
   }
 
-  async findAll(query: ListPatientsDto) {
+  async findAll(query: ListPatientsDto, organizationId: string) {
     const { page = 1, limit = 10, q } = query;
     const skip = (page - 1) * limit;
 
     const where = {
       isWalkIn: false,
+      createdByOrganizationId: organizationId,
       ...(q?.trim() ? this.buildSearchWhere(q.trim()) : {}),
     };
 
@@ -72,27 +79,13 @@ export class PatientsService {
     };
   }
 
-  async findOne(id: string) {
-    const patient = await this.prisma.patient.findUnique({
-      where: { id },
-    });
-
-    if (!patient || patient.isWalkIn) {
-      throw new AppException(ErrorCode.PATIENT_NOT_FOUND, HttpStatus.NOT_FOUND);
-    }
-
+  async findOne(id: string, organizationId: string) {
+    const patient = await this.findNamedPatientInOrg(id, organizationId);
     return { success: true, data: patient };
   }
 
-  async update(id: string, updatePatientDto: UpdatePatientDto) {
-    await this.ensurePatient(id);
-    const patient = await this.prisma.patient.findUnique({
-      where: { id },
-      select: { isWalkIn: true },
-    });
-    if (patient?.isWalkIn) {
-      throw new AppException(ErrorCode.PATIENT_NOT_FOUND, HttpStatus.NOT_FOUND);
-    }
+  async update(id: string, updatePatientDto: UpdatePatientDto, organizationId: string) {
+    await this.findNamedPatientInOrg(id, organizationId);
 
     const data: {
       firstName?: string;
@@ -110,7 +103,15 @@ export class PatientsService {
       data.lastName = this.requireNonEmptyName(updatePatientDto.lastName, 'lastName');
     }
     if (updatePatientDto.mobile !== undefined) {
-      data.mobile = this.resolveMobile(updatePatientDto.mobile);
+      const mobile = this.resolveMobile(updatePatientDto.mobile);
+      const taken = await this.prisma.patient.findUnique({
+        where: { mobile },
+        select: { id: true, createdByOrganizationId: true, isWalkIn: true },
+      });
+      if (taken && taken.id !== id) {
+        throw new AppException(ErrorCode.PATIENT_MOBILE_UNAVAILABLE, HttpStatus.CONFLICT);
+      }
+      data.mobile = mobile;
     }
     if (updatePatientDto.email !== undefined) {
       data.email = updatePatientDto.email?.trim() || null;
@@ -138,7 +139,7 @@ export class PatientsService {
     actorUserId: string,
   ) {
     await this.assertCanViewPatients(actorUserId, organizationId);
-    await this.ensurePatient(patientId);
+    await this.findNamedPatientInOrg(patientId, organizationId);
 
     const items = await this.prisma.appointment.findMany({
       where: { organizationId, patientId },
@@ -241,14 +242,18 @@ export class PatientsService {
     }
   }
 
-  private async ensurePatient(id: string) {
-    const patient = await this.prisma.patient.findUnique({
-      where: { id },
-      select: { id: true },
+  private async findNamedPatientInOrg(id: string, organizationId: string) {
+    const patient = await this.prisma.patient.findFirst({
+      where: {
+        id,
+        isWalkIn: false,
+        createdByOrganizationId: organizationId,
+      },
     });
 
     if (!patient) {
       throw new AppException(ErrorCode.PATIENT_NOT_FOUND, HttpStatus.NOT_FOUND);
     }
+    return patient;
   }
 }

backend/src/modules/staff/staff.controller.ts

@@ -61,6 +61,20 @@ export class StaffController {
     return this.staffService.invite(req.user.id, organizationId, dto);
   }
 
+  @Post('members/:membershipId/clear-password')
+  @UseGuards(JwtAuthGuard)
+  @ApiOperation({
+    summary:
+      'Clear a staff member password and return a setup link (owner or TAB_STAFF_EDIT; active members only)',
+  })
+  clearPassword(
+    @Req() req: { user: { id: string; organizationId?: string } },
+    @Param('membershipId') membershipId: string,
+  ) {
+    const organizationId = this.staffService.getOrganizationIdFromUser(req.user);
+    return this.staffService.clearPassword(req.user.id, organizationId, membershipId);
+  }
+
   @Post('members/:membershipId/invitation-link')
   @UseGuards(JwtAuthGuard)
   @ApiOperation({

backend/src/modules/staff/staff.service.ts

@@ -49,7 +49,7 @@ export class StaffService {
       this.prisma.membership.findMany({
         where: { organizationId },
         include: {
-          user: { select: { id: true, email: true, name: true } },
+          user: { select: { id: true, email: true, name: true, passwordHash: true } },
           permissions: { include: { permission: true } },
           invitations: {
             orderBy: { createdAt: 'desc' },
@@ -80,6 +80,7 @@ export class StaffService {
           isOwner: m.isOwner,
           isActive: m.isOwner ? true : m.isActive,
           invitationStatus: this.getInvitationStatus(m),
+          hasPassword: Boolean(m.user.passwordHash),
           invitedAt: m.invitations[0]?.createdAt?.toISOString() || null,
           acceptedAt: m.invitations[0]?.acceptedAt?.toISOString() || null,
           permissions: m.isOwner
@@ -310,6 +311,77 @@ export class StaffService {
         organizationName: org.name,
         expiresAt: invitation.expiresAt.toISOString(),
         status: invitation.acceptedAt ? 'ACCEPTED' : 'PENDING',
+        mode: invitation.membership.isActive ? 'password_setup' : 'join',
+      },
+    };
+  }
+
+  async clearPassword(
+    actorUserId: string,
+    organizationId: string,
+    membershipId: string,
+  ) {
+    const actor = await this.getActorMembership(actorUserId, organizationId);
+    if (!actor || !this.canEditStaff(actor)) {
+      throw new AppException(ErrorCode.PERMISSION_EDIT_STAFF, HttpStatus.FORBIDDEN);
+    }
+
+    const membership = await this.prisma.membership.findFirst({
+      where: { id: membershipId, organizationId },
+      include: {
+        user: { select: { id: true, email: true } },
+      },
+    });
+
+    if (!membership) {
+      throw new AppException(ErrorCode.STAFF_MEMBER_NOT_FOUND, HttpStatus.NOT_FOUND);
+    }
+    if (membership.isOwner) {
+      throw new AppException(ErrorCode.STAFF_CANNOT_EDIT_OWNER, HttpStatus.FORBIDDEN);
+    }
+    if (membership.userId === actorUserId) {
+      throw new AppException(ErrorCode.STAFF_CANNOT_CLEAR_OWN_PASSWORD, HttpStatus.BAD_REQUEST);
+    }
+    if (!membership.isActive) {
+      throw new AppException(ErrorCode.STAFF_PASSWORD_CLEAR_ACTIVE_ONLY, HttpStatus.BAD_REQUEST);
+    }
+
+    const plainToken = this.generateInviteToken();
+    const tokenHash = this.hashInviteToken(plainToken);
+
+    const invitation = await this.prisma.$transaction(async (tx) => {
+      await tx.user.update({
+        where: { id: membership.userId },
+        data: { passwordHash: null },
+      });
+      await tx.session.deleteMany({
+        where: { userId: membership.userId },
+      });
+      await tx.staffInvitation.updateMany({
+        where: {
+          membershipId: membership.id,
+          acceptedAt: null,
+          revokedAt: null,
+        },
+        data: { revokedAt: new Date() },
+      });
+      return tx.staffInvitation.create({
+        data: {
+          membershipId: membership.id,
+          invitedById: actorUserId,
+          tokenHash,
+          expiresAt: this.getInviteExpiryDate(),
+        },
+      });
+    });
+
+    return {
+      success: true,
+      data: {
+        membershipId: membership.id,
+        invitationId: invitation.id,
+        email: membership.user.email,
+        invitationUrl: this.buildInviteUrl(plainToken),
       },
     };
   }

backend/src/modules/treatments/treatments.service.ts

@@ -222,14 +222,7 @@ export class TreatmentsService {
       const sentinel = await ensureWalkInPatient(this.prisma, organizationId);
       patientId = sentinel.id;
     } else {
-      await this.ensurePatientExists(dto.patientId!);
-      const patient = await this.prisma.patient.findUnique({
-        where: { id: dto.patientId! },
-        select: { isWalkIn: true },
-      });
-      if (patient?.isWalkIn) {
-        throw new AppException(ErrorCode.TREATMENT_PATIENT_OR_WALK_IN, HttpStatus.BAD_REQUEST);
-      }
+      await this.ensurePatientInOrg(dto.patientId!, organizationId);
       patientId = dto.patientId!;
     }
 
@@ -1670,6 +1663,20 @@ export class TreatmentsService {
     }
   }
 
+  private async ensurePatientInOrg(patientId: string, organizationId: string) {
+    const patient = await this.prisma.patient.findFirst({
+      where: {
+        id: patientId,
+        isWalkIn: false,
+        createdByOrganizationId: organizationId,
+      },
+      select: { id: true },
+    });
+    if (!patient) {
+      throw new AppException(ErrorCode.PATIENT_NOT_FOUND, HttpStatus.NOT_FOUND);
+    }
+  }
+
   private async ensureTreatmentProvider(
     treatmentId: string,
     organizationId: string,

frontend/Dockerfile

@@ -1,5 +1,8 @@
+# CI can pass a Gitea-hosted mirror when Docker Hub TLS fails (see ci-resolve-node-image.ps1).
+ARG NODE_IMAGE=node:20-alpine
+
 # Build stage — produces `.next/standalone` (see next.config.ts output: standalone)
-FROM node:20-alpine AS builder
+FROM ${NODE_IMAGE} AS builder
 
 WORKDIR /app
 
@@ -32,7 +35,7 @@ ENV NEXT_PUBLIC_SENTRY_ENVIRONMENT=${NEXT_PUBLIC_SENTRY_ENVIRONMENT}
 RUN npm run build
 
 # Production — minimal runtime using Next.js standalone bundle
-FROM node:20-alpine AS runner
+FROM ${NODE_IMAGE} AS runner
 
 RUN apk add --no-cache dumb-init
 

frontend/messages/en.json

@@ -122,6 +122,9 @@
     "labelCreatePassword": "Create password",
     "labelConfirmPassword": "Confirm password",
     "activateAccount": "Activate account",
+    "setPasswordTitle": "Set your password",
+    "setPasswordSubmit": "Set password",
+    "passwordSetupAlreadyDone": "This password setup link is no longer valid. You can log in now.",
     "invitationAcceptedRedirect": "Invitation accepted. Opening your workspace...",
     "invitationAcceptedSignInFailed": "Account activated, but sign-in failed. Please log in with your password.",
     "errorAcceptInvitation": "Could not accept invitation",
@@ -322,6 +325,18 @@
     "disableBullet3": "Disabling frees one seat on your plan so you can invite someone else.",
     "disableMemberButton": "Disable member",
     "editModalTitle": "Edit member",
+    "removePassword": "Remove password",
+    "copyPasswordSetupLink": "Copy password setup link",
+    "removePasswordModalTitle": "Remove password",
+    "removePasswordConfirm": "Remove the password for {name} ({email})?",
+    "removePasswordBullet1": "They will not be able to sign in until they set a new password with the setup link.",
+    "removePasswordBullet2": "You cannot choose their new password. Share the setup link with them.",
+    "removePasswordBullet3": "This signs them out of every organization they belong to.",
+    "removePasswordButton": "Remove password and copy link",
+    "passwordSetupLinkHeading": "Password setup link",
+    "passwordSetupShareHint": "Share this link so they can set a new password. Login will fail until they finish.",
+    "successPasswordCleared": "Password removed for {name}. Share the setup link with them.",
+    "errorClearPassword": "Could not remove the password.",
     "loadingWorkingHours": "Loading working hours…",
     "errorLoadStaff": "Failed to load staff.",
     "errorCopyInvite": "Could not copy invitation link.",
@@ -1214,6 +1229,7 @@
     "APPOINTMENT_NOT_FOUND": "Appointment not found.",
     "APPOINTMENT_NOT_PROVIDER": "You are not the provider for this appointment.",
     "PATIENT_NOT_FOUND": "Patient not found.",
+    "PATIENT_MOBILE_UNAVAILABLE": "This mobile number cannot be added for this clinic.",
     "WORKING_HOURS_INVALID": "Working hours are invalid. Check that shifts do not overlap.",
     "WORKING_HOURS_OWNER_NOT_ALLOWED": "Set owner working hours from account settings.",
     "WORKING_HOURS_CONFLICTS_WITH_APPOINTMENTS": "These hours conflict with upcoming appointments. Reschedule or remove those appointments first.",
@@ -1237,6 +1253,8 @@
     "STAFF_CANNOT_ENABLE_OWNER": "The organization owner cannot be enabled this way.",
     "STAFF_CANNOT_DISABLE_OWNER": "The organization owner cannot be disabled.",
     "STAFF_CANNOT_REMOVE_OWNER": "The organization owner cannot be removed.",
+    "STAFF_CANNOT_CLEAR_OWN_PASSWORD": "You cannot remove your own password here. Use account settings or forgot password.",
+    "STAFF_PASSWORD_CLEAR_ACTIVE_ONLY": "Password can only be removed for active members. Pending members use the invitation link.",
     "ORG_CANNOT_LINK_SELF": "You cannot link an organization to itself.",
     "ORG_LINK_WRONG_TYPE": "You can only link to the matching organization type (clinic or lab).",
     "ORG_TARGET_NO_SUBSCRIPTION": "The other organization does not have an active subscription.",

frontend/messages/fa.json

@@ -122,6 +122,9 @@
     "labelCreatePassword": "ایجاد رمز عبور",
     "labelConfirmPassword": "تأیید رمز عبور",
     "activateAccount": "فعال‌سازی حساب",
+    "setPasswordTitle": "رمز عبور خود را تنظیم کنید",
+    "setPasswordSubmit": "تنظیم رمز عبور",
+    "passwordSetupAlreadyDone": "این لینک تنظیم رمز دیگر معتبر نیست. اکنون می‌توانید وارد شوید.",
     "invitationAcceptedRedirect": "دعوتنامه پذیرفته شد. در حال ورود به فضای کاری...",
     "invitationAcceptedSignInFailed": "حساب فعال شد، اما ورود انجام نشد. لطفاً با رمز عبور خود وارد شوید.",
     "errorAcceptInvitation": "پذیرش دعوتنامه امکان‌پذیر نبود",
@@ -322,6 +325,18 @@
     "disableBullet3": "غیرفعال‌سازی یک مجوز در طرح شما را آزاد می‌کند تا بتوانید شخص دیگری را دعوت کنید.",
     "disableMemberButton": "غیرفعال‌سازی عضو",
     "editModalTitle": "ویرایش عضو",
+    "removePassword": "حذف رمز عبور",
+    "copyPasswordSetupLink": "کپی لینک تنظیم رمز",
+    "removePasswordModalTitle": "حذف رمز عبور",
+    "removePasswordConfirm": "رمز عبور {name} ({email}) حذف شود؟",
+    "removePasswordBullet1": "تا وقتی با لینک تنظیم، رمز جدید نگذارند، نمی‌توانند وارد شوند.",
+    "removePasswordBullet2": "شما رمز جدید را انتخاب نمی‌کنید. لینک تنظیم را برایشان بفرستید.",
+    "removePasswordBullet3": "از همه سازمان‌هایی که عضو آن هستند خارج می‌شوند.",
+    "removePasswordButton": "حذف رمز و کپی لینک",
+    "passwordSetupLinkHeading": "لینک تنظیم رمز عبور",
+    "passwordSetupShareHint": "این لینک را به اشتراک بگذارید تا رمز جدید بگذارند. تا تکمیل این کار ورود ناموفق است.",
+    "successPasswordCleared": "رمز {name} حذف شد. لینک تنظیم را برایشان بفرستید.",
+    "errorClearPassword": "حذف رمز عبور امکان‌پذیر نبود.",
     "loadingWorkingHours": "در حال بارگذاری ساعات کاری...",
     "errorLoadStaff": "بارگذاری کارکنان ناموفق بود.",
     "errorCopyInvite": "کپی لینک دعوتنامه امکان‌پذیر نبود.",
@@ -1215,6 +1230,7 @@
     "APPOINTMENT_NOT_FOUND": "نوبت یافت نشد.",
     "APPOINTMENT_NOT_PROVIDER": "شما ارائه‌دهنده این نوبت نیستید.",
     "PATIENT_NOT_FOUND": "بیمار یافت نشد.",
+    "PATIENT_MOBILE_UNAVAILABLE": "این شماره موبایل را نمی‌توان برای این کلینیک ثبت کرد.",
     "WORKING_HOURS_INVALID": "ساعات کاری نامعتبر است. هم‌پوشانی شیفت‌ها را بررسی کنید.",
     "WORKING_HOURS_OWNER_NOT_ALLOWED": "ساعات کاری مالک را از تنظیمات حساب تنظیم کنید.",
     "WORKING_HOURS_CONFLICTS_WITH_APPOINTMENTS": "این ساعات با نوبت‌های آینده تداخل دارد. ابتدا آن نوبت‌ها را تغییر دهید یا حذف کنید.",
@@ -1238,6 +1254,8 @@
     "STAFF_CANNOT_ENABLE_OWNER": "مالک سازمان را نمی‌توان این‌گونه فعال کرد.",
     "STAFF_CANNOT_DISABLE_OWNER": "مالک سازمان را نمی‌توان غیرفعال کرد.",
     "STAFF_CANNOT_REMOVE_OWNER": "مالک سازمان را نمی‌توان حذف کرد.",
+    "STAFF_CANNOT_CLEAR_OWN_PASSWORD": "نمی‌توانید رمز عبور خود را از اینجا حذف کنید. از تنظیمات حساب یا فراموشی رمز استفاده کنید.",
+    "STAFF_PASSWORD_CLEAR_ACTIVE_ONLY": "رمز عبور را فقط برای اعضای فعال می‌توان حذف کرد. اعضای در انتظار از لینک دعوت استفاده می‌کنند.",
     "ORG_CANNOT_LINK_SELF": "نمی‌توانید سازمان را به خودش متصل کنید.",
     "ORG_LINK_WRONG_TYPE": "فقط می‌توانید به نوع سازمان متناظر (کلینیک یا لابراتوار) متصل شوید.",
     "ORG_TARGET_NO_SUBSCRIPTION": "سازمان مقابل اشتراک فعال ندارد.",

frontend/messages/nl.json

@@ -122,6 +122,9 @@
     "labelCreatePassword": "Wachtwoord aanmaken",
     "labelConfirmPassword": "Bevestig wachtwoord",
     "activateAccount": "Account activeren",
+    "setPasswordTitle": "Stel uw wachtwoord in",
+    "setPasswordSubmit": "Wachtwoord instellen",
+    "passwordSetupAlreadyDone": "Deze wachtwoordlink is niet meer geldig. U kunt nu inloggen.",
     "invitationAcceptedRedirect": "Uitnodiging geaccepteerd. Uw werkruimte wordt geopend...",
     "invitationAcceptedSignInFailed": "Account geactiveerd, maar aanmelden is mislukt. Log in met uw wachtwoord.",
     "errorAcceptInvitation": "Kon uitnodiging niet accepteren",
@@ -322,6 +325,18 @@
     "disableBullet3": "Uitschakelen maakt één plaats vrij in uw abonnement, zodat u iemand anders kunt uitnodigen.",
     "disableMemberButton": "Lid uitschakelen",
     "editModalTitle": "Lid bewerken",
+    "removePassword": "Wachtwoord verwijderen",
+    "copyPasswordSetupLink": "Wachtwoordlink kopiëren",
+    "removePasswordModalTitle": "Wachtwoord verwijderen",
+    "removePasswordConfirm": "Wachtwoord van {name} ({email}) verwijderen?",
+    "removePasswordBullet1": "Zij kunnen niet inloggen tot ze via de instellink een nieuw wachtwoord kiezen.",
+    "removePasswordBullet2": "U kunt hun nieuwe wachtwoord niet kiezen. Deel de instellink met hen.",
+    "removePasswordBullet3": "Dit meldt hen af bij elke organisatie waar zij lid van zijn.",
+    "removePasswordButton": "Wachtwoord verwijderen en link kopiëren",
+    "passwordSetupLinkHeading": "Wachtwoord-instellink",
+    "passwordSetupShareHint": "Deel deze link zodat zij een nieuw wachtwoord kunnen instellen. Inloggen mislukt tot dat is afgerond.",
+    "successPasswordCleared": "Wachtwoord van {name} is verwijderd. Deel de instellink met hen.",
+    "errorClearPassword": "Kon het wachtwoord niet verwijderen.",
     "loadingWorkingHours": "Werktijden laden...",
     "errorLoadStaff": "Medewerkers laden mislukt.",
     "errorCopyInvite": "Kon uitnodigingslink niet kopiëren.",
@@ -1214,6 +1229,7 @@
     "APPOINTMENT_NOT_FOUND": "Afspraak niet gevonden.",
     "APPOINTMENT_NOT_PROVIDER": "U bent niet de zorgverlener van deze afspraak.",
     "PATIENT_NOT_FOUND": "Patiënt niet gevonden.",
+    "PATIENT_MOBILE_UNAVAILABLE": "Dit mobiele nummer kan niet voor deze kliniek worden toegevoegd.",
     "WORKING_HOURS_INVALID": "De werktijden zijn ongeldig. Controleer of diensten niet overlappen.",
     "WORKING_HOURS_OWNER_NOT_ALLOWED": "Stel werktijden van de eigenaar in via accountinstellingen.",
     "WORKING_HOURS_CONFLICTS_WITH_APPOINTMENTS": "Deze tijden conflicteren met aankomende afspraken. Plan die eerst om of verwijder ze.",
@@ -1237,6 +1253,8 @@
     "STAFF_CANNOT_ENABLE_OWNER": "De eigenaar kan op deze manier niet worden ingeschakeld.",
     "STAFF_CANNOT_DISABLE_OWNER": "De eigenaar kan niet worden uitgeschakeld.",
     "STAFF_CANNOT_REMOVE_OWNER": "De eigenaar kan niet worden verwijderd.",
+    "STAFF_CANNOT_CLEAR_OWN_PASSWORD": "U kunt hier uw eigen wachtwoord niet verwijderen. Gebruik accountinstellingen of wachtwoord vergeten.",
+    "STAFF_PASSWORD_CLEAR_ACTIVE_ONLY": "Het wachtwoord kan alleen voor actieve leden worden verwijderd. Leden in afwachting gebruiken de uitnodigingslink.",
     "ORG_CANNOT_LINK_SELF": "U kunt een organisatie niet aan zichzelf koppelen.",
     "ORG_LINK_WRONG_TYPE": "U kunt alleen koppelen aan het bijbehorende type (kliniek of lab).",
     "ORG_TARGET_NO_SUBSCRIPTION": "De andere organisatie heeft geen actief abonnement.",

frontend/src/app/[locale]/(public)/accept-invite/page.tsx

@@ -30,6 +30,7 @@ function AcceptInviteContent() {
     organizationName: string;
     expiresAt: string;
     status: 'PENDING' | 'ACCEPTED';
+    mode: 'join' | 'password_setup';
   } | null>(null);
 
   const [name, setName] = useState('');
@@ -48,10 +49,17 @@ function AcceptInviteContent() {
       setError('');
       try {
         const res = await staffApi.previewInvite(token);
-        setInviteInfo(res.data);
+        setInviteInfo({
+          ...res.data,
+          mode: res.data.mode === 'password_setup' ? 'password_setup' : 'join',
+        });
         setName(res.data.name || '');
         if (res.data.status === 'ACCEPTED') {
-          setSuccess(t('invitationAlreadyAccepted'));
+          setSuccess(
+            res.data.mode === 'password_setup'
+              ? t('passwordSetupAlreadyDone')
+              : t('invitationAlreadyAccepted'),
+          );
         }
       } catch (e: unknown) {
         setError(getUserFacingError(e, tErrors, t('errorLoadInvitation')));
@@ -65,7 +73,9 @@ function AcceptInviteContent() {
     if (!token) return;
     setError('');
     setSuccess('');
-    if (!name.trim()) {
+    const isPasswordSetup = inviteInfo?.mode === 'password_setup';
+    const nameToSubmit = isPasswordSetup ? (inviteInfo?.name || '').trim() : name.trim();
+    if (!isPasswordSetup && !nameToSubmit) {
       setError(t('nameRequired'));
       return;
     }
@@ -83,7 +93,7 @@ function AcceptInviteContent() {
     try {
       await staffApi.acceptInvite({
         token,
-        name: name.trim(),
+        name: nameToSubmit || inviteInfo?.name || '',
         password,
       });
       accepted = true;
@@ -115,7 +125,9 @@ function AcceptInviteContent() {
   return (
     <div className="min-h-[100dvh] app-web-bg flex items-center justify-center px-4 py-8">
       <div className="w-full max-w-md surface-card p-4 sm:p-6 space-y-5">
-        <h1 className="text-lg sm:text-xl font-semibold text-text-primary">{t('acceptInviteTitle')}</h1>
+        <h1 className="text-lg sm:text-xl font-semibold text-text-primary">
+          {inviteInfo?.mode === 'password_setup' ? t('setPasswordTitle') : t('acceptInviteTitle')}
+        </h1>
 
         {loading ? (
           <p className="text-sm text-text-secondary">{t('loadingInvitation')}</p>
@@ -147,7 +159,9 @@ function AcceptInviteContent() {
 
             {inviteInfo?.status !== 'ACCEPTED' && (
               <div className="space-y-3">
+                {inviteInfo?.mode !== 'password_setup' && (
                   <Input label={t('labelName')} value={name} onChange={(e) => setName(e.target.value)} />
+                )}
                 <Input
                   label={t('labelCreatePassword')}
                   type="password"
@@ -163,7 +177,7 @@ function AcceptInviteContent() {
                   passwordToggleLabels={passwordToggleLabels}
                 />
                 <Button type="button" fullWidth isLoading={submitting} onClick={() => onAccept()}>
-                  {t('activateAccount')}
+                  {inviteInfo?.mode === 'password_setup' ? t('setPasswordSubmit') : t('activateAccount')}
                 </Button>
               </div>
             )}

frontend/src/components/ui/staff/StaffPage.tsx

@@ -79,6 +79,10 @@ function canShareStaffInviteLink(member: StaffMemberDto): boolean {
   );
 }
 
+function canIssuePasswordSetup(member: StaffMemberDto, actorUserId?: string): boolean {
+  return !member.isOwner && member.isActive && member.userId !== actorUserId;
+}
+
 function canDisableStaff(member: StaffMemberDto): boolean {
   return !member.isOwner && member.isActive;
 }
@@ -189,6 +193,12 @@ export function StaffPage() {
     invitationStatus: 'PENDING' | 'ACCEPTED';
   } | null>(null);
   const [pendingInviteLinks, setPendingInviteLinks] = useState<Record<string, StoredInviteLink>>({});
+  const [lastPasswordSetupInfo, setLastPasswordSetupInfo] = useState<{
+    membershipId: string;
+    name: string;
+    email: string;
+    invitationUrl: string;
+  } | null>(null);
 
   const [editing, setEditing] = useState<StaffMemberDto | null>(null);
   const [editStep, setEditStep] = useState<1 | 2>(1);
@@ -205,6 +215,8 @@ export function StaffPage() {
   const [disablingMembershipId, setDisablingMembershipId] = useState<string | null>(null);
   const [enableTarget, setEnableTarget] = useState<StaffMemberDto | null>(null);
   const [enablingMembershipId, setEnablingMembershipId] = useState<string | null>(null);
+  const [clearPasswordTarget, setClearPasswordTarget] = useState<StaffMemberDto | null>(null);
+  const [clearingMembershipId, setClearingMembershipId] = useState<string | null>(null);
 
   const canEdit = useMemo(() => canEditStaff(currentOrganization), [currentOrganization]);
   const highlightMembershipIds = useMemo(
@@ -520,6 +532,45 @@ export function StaffPage() {
     }
   }
 
+  async function issuePasswordSetupLink(member: StaffMemberDto, copyToClipboard: boolean) {
+    setClearingMembershipId(member.id);
+    toast.setError('');
+    try {
+      const res = await staffApi.clearPassword(member.id);
+      setLastPasswordSetupInfo({
+        membershipId: member.id,
+        name: member.name,
+        email: member.email,
+        invitationUrl: res.data.invitationUrl,
+      });
+      setClearPasswordTarget(null);
+      setEditing(null);
+      setEditStep(1);
+      await load();
+      toast.showSuccess(t('successPasswordCleared', { name: member.name }));
+      if (copyToClipboard) {
+        try {
+          await navigator.clipboard.writeText(res.data.invitationUrl);
+          setCopiedInviteMembershipId(member.id);
+          setTimeout(() => setCopiedInviteMembershipId(null), 1500);
+        } catch {
+          /* banner still shows the URL */
+        }
+      }
+    } catch (e) {
+      toast.showError(getUserFacingError(e, tErrors, t('errorClearPassword')));
+    } finally {
+      setClearingMembershipId(null);
+    }
+  }
+
+  async function confirmClearPassword() {
+    if (!clearPasswordTarget || !canIssuePasswordSetup(clearPasswordTarget, user?.id)) {
+      return;
+    }
+    await issuePasswordSetupLink(clearPasswordTarget, true);
+  }
+
   if (!currentOrganization || !canViewStaff(currentOrganization)) {
     return (
       <p className="text-sm text-text-secondary">{t('redirecting')}</p>
@@ -640,6 +691,54 @@ export function StaffPage() {
         </div>
       )}
 
+      {lastPasswordSetupInfo && (
+        <div className="relative rounded-[var(--radius-md)] border border-border-strong bg-background-secondary/90 px-4 py-3 pr-12 shadow-[inset_0_1px_0_rgba(255,255,255,0.04)] space-y-3">
+          <button
+            type="button"
+            className="absolute right-2 top-2 p-1.5 rounded-[var(--radius-sm)] text-text-muted hover:text-text-primary hover:bg-background-card/80"
+            aria-label={tCommon('dismiss')}
+            onClick={() => setLastPasswordSetupInfo(null)}
+          >
+            <X className="w-4 h-4" />
+          </button>
+          <p className="text-sm text-text-primary pr-6">
+            {t('successPasswordCleared', { name: lastPasswordSetupInfo.name })}
+          </p>
+          <div className="space-y-2 pt-1 border-t border-border/60">
+            <p className="text-xs font-medium text-text-secondary uppercase tracking-wide">
+              {t('passwordSetupLinkHeading')}
+            </p>
+            <code className="block text-sm px-2 py-1.5 rounded-[var(--radius-sm)] bg-background-card border border-border font-mono break-all">
+              {lastPasswordSetupInfo.invitationUrl}
+            </code>
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              isLoading={clearingMembershipId === lastPasswordSetupInfo.membershipId}
+              onClick={async () => {
+                setClearingMembershipId(lastPasswordSetupInfo.membershipId);
+                toast.setError('');
+                try {
+                  await navigator.clipboard.writeText(lastPasswordSetupInfo.invitationUrl);
+                  setCopiedInviteMembershipId(lastPasswordSetupInfo.membershipId);
+                  setTimeout(() => setCopiedInviteMembershipId(null), 1500);
+                } catch (e) {
+                  toast.showError(getUserFacingError(e, tErrors, t('errorClearPassword')));
+                } finally {
+                  setClearingMembershipId(null);
+                }
+              }}
+            >
+              {copiedInviteMembershipId === lastPasswordSetupInfo.membershipId
+                ? tCommon('copied')
+                : tCommon('copyLink')}
+            </Button>
+            <p className="text-xs text-text-muted">{t('passwordSetupShareHint')}</p>
+          </div>
+        </div>
+      )}
+
       {loading ? (
         <p className="text-sm text-text-secondary">{t('loadingTeam')}</p>
       ) : (
@@ -1061,6 +1160,59 @@ export function StaffPage() {
         </div>
       )}
 
+      {clearPasswordTarget && (
+        <div className="fixed inset-0 z-[60] flex items-end sm:items-center justify-center p-0 sm:p-4 bg-black/55">
+          <div
+            className="surface-card w-full sm:max-w-md max-h-[90dvh] overflow-y-auto p-4 sm:p-5 space-y-4 shadow-xl rounded-t-[var(--radius-lg)] sm:rounded-[var(--radius-lg)]"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="clear-password-title"
+          >
+            <div className="flex items-start justify-between gap-2">
+              <h2 id="clear-password-title" className="text-lg font-semibold text-text-primary pr-2">
+                {t('removePasswordModalTitle')}
+              </h2>
+              <DialogCloseButton
+                onClick={() => {
+                  if (clearingMembershipId) return;
+                  setClearPasswordTarget(null);
+                }}
+              />
+            </div>
+            <p className="text-sm text-text-secondary">
+              {t('removePasswordConfirm', {
+                name: clearPasswordTarget.name,
+                email: clearPasswordTarget.email,
+              })}
+            </p>
+            <ul className="text-sm text-text-secondary space-y-2 list-disc ps-5">
+              <li>{t('removePasswordBullet1')}</li>
+              <li>{t('removePasswordBullet2')}</li>
+              <li>{t('removePasswordBullet3')}</li>
+            </ul>
+            <div className="flex flex-col-reverse sm:flex-row sm:justify-end gap-2 pt-1">
+              <Button
+                type="button"
+                variant="outline"
+                disabled={Boolean(clearingMembershipId)}
+                onClick={() => setClearPasswordTarget(null)}
+              >
+                {tCommon('cancel')}
+              </Button>
+              <Button
+                type="button"
+                variant="danger"
+                isLoading={clearingMembershipId === clearPasswordTarget.id}
+                disabled={Boolean(clearingMembershipId)}
+                onClick={() => confirmClearPassword()}
+              >
+                {t('removePasswordButton')}
+              </Button>
+            </div>
+          </div>
+        </div>
+      )}
+
       {editing && (
         <div className="fixed inset-0 z-50 flex items-end sm:items-center justify-center p-0 sm:p-4 bg-black/50">
           <div
@@ -1099,6 +1251,31 @@ export function StaffPage() {
                     organizationType={currentOrganization?.type}
                   />
                 </div>
+                {canEdit && canIssuePasswordSetup(editing, user?.id) && (
+                  <div className="pt-3 border-t border-border/60">
+                    {editing.hasPassword ? (
+                      <Button
+                        type="button"
+                        variant="danger"
+                        size="sm"
+                        disabled={Boolean(clearingMembershipId)}
+                        onClick={() => setClearPasswordTarget(editing)}
+                      >
+                        {t('removePassword')}
+                      </Button>
+                    ) : (
+                      <Button
+                        type="button"
+                        variant="outline"
+                        size="sm"
+                        isLoading={clearingMembershipId === editing.id}
+                        onClick={() => void issuePasswordSetupLink(editing, true)}
+                      >
+                        {t('copyPasswordSetupLink')}
+                      </Button>
+                    )}
+                  </div>
+                )}
               </>
             ) : editLoadingWorkingHours ? (
               <p className="text-sm text-text-secondary">{t('loadingWorkingHours')}</p>

frontend/src/lib/api/staff.ts

@@ -11,6 +11,7 @@ export interface StaffMemberDto {
   invitationStatus: 'ACTIVE' | 'PENDING' | 'EXPIRED' | 'DISABLED';
   invitedAt: string | null;
   acceptedAt: string | null;
+  hasPassword: boolean;
   permissions: string[] | null;
 }
 
@@ -46,6 +47,7 @@ export interface PreviewInviteResponse {
     organizationName: string;
     expiresAt: string;
     status: 'PENDING' | 'ACCEPTED';
+    mode: 'join' | 'password_setup';
   };
 }
 
@@ -79,6 +81,21 @@ export const staffApi = {
     return response.data;
   },
 
+  clearPassword: async (
+    membershipId: string,
+  ): Promise<{
+    success: boolean;
+    data: {
+      membershipId: string;
+      invitationId: string;
+      email: string;
+      invitationUrl: string;
+    };
+  }> => {
+    const response = await apiClient.post(`/staff/members/${membershipId}/clear-password`);
+    return response.data;
+  },
+
   previewInvite: async (token: string): Promise<PreviewInviteResponse> => {
     const response = await apiClient.get(`/staff/invitations/preview?token=${encodeURIComponent(token)}`);
     return response.data;

infrastructure/STAGING-DEPLOY.md

@@ -300,6 +300,7 @@ On the Windows host, from repo `infrastructure/`:
 | Runner can't register on public IP | Use `http://127.0.0.1:3000` for `--instance` |
 | Variable name rejected in Gitea | No `GITEA_*` / `GITHUB_*` prefixes; use `CLONE_HOST` |
 | `413 Request Entity Too Large` on `docker push` to `https://gitea.wixur.ir/v2/…/blobs/uploads` | Nginx (or Cloudflare) in front of Gitea is rejecting the image layer. **Fix the proxy** (then `nginx -s reload`): in the `server { server_name gitea.wixur.ir; }` block set `client_max_body_size 0;` and `proxy_request_buffering off;` — snippet: [`nginx/windows-gitea.wixur.snippet.conf`](nginx/windows-gitea.wixur.snippet.conf). **Or skip the proxy:** set `REGISTRY_HOST=host.docker.internal:3000` (and Gitea `ROOT_URL`) so CI pushes to `:3000`. If the hostname is orange-clouded on Cloudflare, grey-cloud it (free plan caps uploads at 100MB). |
+| `TLS handshake timeout` to `registry-1.docker.io` / `node:20-alpine` | Docker Hub is blocked or slow from the Windows runner. CI pulls `node:20-alpine` from **Arvan / ECR Public / GCR**, then pushes `<REGISTRY_PREFIX>/node:20-alpine` to Gitea (later builds skip Hub). Optional variable `NODE_IMAGE_SOURCE` (comma-separated image refs). One-time on the runner: `docker pull docker.arvancloud.ir/library/node:20-alpine` then tag/push to Gitea. |
 | `docker login` connection refused on `127.0.0.1:3000` | **Docker Desktop on Windows:** set `REGISTRY_HOST=host.docker.internal:3000`, add it to insecure-registries, set Gitea `ROOT_URL=http://host.docker.internal:3000/`. Keep `CLONE_HOST=127.0.0.1:3000` for git. |
 | `docker login` / push denied, redirect to public IP | Set Gitea `ROOT_URL` to a host Docker can reach (`host.docker.internal:3000` on Windows Docker Desktop). |
 | `server gave HTTP response to HTTPS client` | Add registry host to Docker **insecure-registries**, restart Docker |
@@ -330,6 +331,7 @@ docker logs dyolink_frontend_staging --tail 50
 | Path | Role |
 |------|------|
 | `.gitea/workflows/registry-build-deploy.yml` | CI: build, push, deploy |
+| `infrastructure/scripts/ci-resolve-node-image.ps1` | CI: cache `node:20-alpine` on Gitea so builds do not depend on Docker Hub |
 | `infrastructure/docker-compose.registry.yml` | Staging stack (pull-only images) |
 | `infrastructure/deploy.registry.env.example` | Manual deploy env template |
 | `infrastructure/database.staging.env.example` | Postgres secrets template |

infrastructure/scripts/ci-resolve-node-image.ps1

@@ -0,0 +1,100 @@
+# Prefer a Gitea-hosted node:20-alpine so docker build does not HEAD registry-1.docker.io.
+# Order: Gitea -> optional NODE_IMAGE_SOURCE -> regional/official mirrors -> Docker Hub last.
+# ASCII only: Windows PowerShell 5.1 + act_runner mis-parses backtick escapes in this file.
+param(
+  [Parameter(Mandatory = $true)][string]$RegistryPrefix,
+  [string]$OutFile = '.ci-node-image',
+  [string]$HubImage = 'node:20-alpine',
+  [AllowEmptyString()]
+  [string]$ExtraSources = ''
+)
+
+$ErrorActionPreference = 'Continue'
+$mirror = "$RegistryPrefix/node:20-alpine"
+$nl = [char]10
+
+function Test-Image([string]$Name) {
+  docker image inspect $Name 2>&1 | Out-Null
+  return ($LASTEXITCODE -eq 0)
+}
+
+function Invoke-Pull([string]$Name, [int]$Attempts) {
+  for ($i = 1; $i -le $Attempts; $i++) {
+    Write-Host "docker pull $Name (attempt $i/$Attempts)"
+    docker pull $Name
+    if ($LASTEXITCODE -eq 0) { return $true }
+    if ($i -lt $Attempts) { Start-Sleep -Seconds 5 }
+  }
+  return $false
+}
+
+function Save-Choice([string]$Name) {
+  $utf8 = New-Object System.Text.UTF8Encoding $false
+  $path = Join-Path (Get-Location) $OutFile
+  [System.IO.File]::WriteAllText($path, ($Name + $nl), $utf8)
+  Write-Host "NODE_IMAGE=$Name"
+}
+
+function Publish-Mirror([string]$Src) {
+  Write-Host "Tagging $Src as $mirror"
+  docker tag $Src $mirror
+  if ($LASTEXITCODE -ne 0) { return $false }
+  docker push $mirror
+  if ($LASTEXITCODE -ne 0) {
+    Write-Host "Could not push $mirror - docker build will use the local tag (legacy builder)."
+    $flag = Join-Path (Get-Location) '.ci-use-legacy-builder'
+    New-Item -ItemType File -Path $flag -Force | Out-Null
+  }
+  Save-Choice $mirror
+  return $true
+}
+
+if (Test-Image $mirror) {
+  Write-Host "Using local $mirror"
+  Save-Choice $mirror
+  exit 0
+}
+
+if (Invoke-Pull $mirror 1) {
+  Save-Choice $mirror
+  exit 0
+}
+
+$sources = New-Object System.Collections.ArrayList
+if (-not [string]::IsNullOrWhiteSpace($ExtraSources)) {
+  foreach ($part in ($ExtraSources -split ',')) {
+    $src = $part.Trim()
+    if ($src.Length -gt 0) { [void]$sources.Add($src) }
+  }
+}
+# Iran-reachable proxy of Docker Hub official images, then public official mirrors, Hub last.
+foreach ($src in @(
+    'docker.arvancloud.ir/library/node:20-alpine',
+    'public.ecr.aws/docker/library/node:20-alpine',
+    'mirror.gcr.io/library/node:20-alpine',
+    $HubImage
+  )) {
+  if (-not $sources.Contains($src)) { [void]$sources.Add($src) }
+}
+
+foreach ($src in $sources) {
+  if (Test-Image $src) {
+    Write-Host "Found local $src"
+    if (Publish-Mirror $src) { exit 0 }
+  }
+}
+
+foreach ($src in $sources) {
+  if (Invoke-Pull $src 2) {
+    if (Publish-Mirror $src) { exit 0 }
+  }
+}
+
+Write-Host "Could not pull node:20-alpine from Gitea, mirrors, or Docker Hub."
+Write-Host "Set repository variable NODE_IMAGE_SOURCE to a reachable image, for example:"
+Write-Host "  docker.arvancloud.ir/library/node:20-alpine"
+Write-Host "Or on the Windows runner:"
+Write-Host "  docker pull docker.arvancloud.ir/library/node:20-alpine"
+Write-Host "  docker tag docker.arvancloud.ir/library/node:20-alpine $mirror"
+Write-Host "  docker push $mirror"
+exit 1