Changelog

Patched CVE-2026-23869 (CVSS 7.5 HIGH) — Next.js App Router Server Function DoS vulnerability. Upgraded Next.js 15.5.14 → 15.5.15.

Fixed infinite loading on lab verification page for staff with multiple roles (e.g. owner + lab scientist)

Hardened 60+ clinic staff lookups across middleware, dashboard pages, and API routes to prevent crashes for multi-role users

New canonical helper (getActiveStaffRow) ensures consistent, safe staff role lookups platform-wide

ESI-5 Emergency Triage Scoring — automated 5-level severity assessment with paediatric age-adjusted vital sign thresholds

NEWS2 Early Warning Score — continuous physiological monitoring with automatic doctor notification on scores ≥5

5-Rights Medication Verification — server-side safety gate at pharmacy dispensing (right patient, drug, dose, route, time)

Regional Manager multi-clinic oversight — per-staff, per-clinic role assignments with consolidated reporting

Chat file attachments — upload and share documents, images, and test results in clinic chat

Offline detection rewritten with HTTP health pings — fewer false offline warnings

IPD workflow: GCS capture from consultation, admission field parity, unique bed numbers per ward

37 error boundary components added for graceful crash handling across all dashboard modules

22 bugs resolved from production dogfood sweep — data integrity, clinical workflows, platform stability, and UX polish

Payment wall integrated: addon modules locked until subscription activated

Theatre utilisation analytics — procedures, surgeon metrics, complication rates, monthly trends

PageSkeleton and EmptyState components for consistent loading/empty states across all modules

Error boundaries on all pages — friendly error messages, no raw errors exposed to users

Mobile overflow fixes across Eye Clinic and Staff Management pages

Pre-deploy checklist script for production readiness verification

Super Admin platform analytics — pre-seed trigger progress (10 clinics / ₦160k MRR), MRR chart with target line, plan distribution, module adoption

Clinic analytics dashboard — revenue trends, patient growth, appointment breakdown, top diagnoses

CSV exports — revenue, patients, appointments (date-range filtered)

analytics-service.ts with 12 server-side data functions

platform_analytics database view for cross-clinic aggregation

Patient portal at /portal/[slug] — clinic-branded, mobile-first

OTP-based login via phone number (no password, 10-min expiry, rate limited 3/hour)

Appointment booking from portal (pending clinic confirmation)

Lab results visibility (completed tests, no raw values)

Invoice viewing and online payment via Paystack inline checkout

Prescription history and printable payment receipts

Clinic settings: enable portal, set slug, branding, feature toggles

httpOnly session cookie, 24-hour expiry, activity logging

WhatsApp BYOW — clinics connect their own WhatsApp Business account (Twilio or Meta Cloud API)

Email BYOE — clinics connect their own email provider (Resend, Brevo, SendGrid, or SMTP)

Automatic triggers: appointment confirmation/reminder, lab result ready, prescription dispensed, payment receipt, welcome email

DNS verification: SPF, DKIM, MX checks via Google DNS API

5 professional HTML email templates

Daily crons: WhatsApp reminders 9am WAT, email reminders 8am WAT

Patient consent management (NDPR compliant, opt-out in every message, 90-day log purge)

Initial assessment: pain (VAS), posture, gait, range of motion

ROM measurement (JSONB) with normal range comparison and deficit calculation

Muscle strength grading (MRC 0-5) with visual colour-coded grid

Functional tests: TUG (<12s), Berg Balance (>45 low risk), FIM

Treatment session recording with modality checklist (TENS, ultrasound, exercise, manual therapy)

Progress tracking charts across all metrics (pain, ROM, strength)

Printable Home Exercise Program (HEP) sheet for patients

Discharge planning and summary report

Mental State Examination (MSE) — all 8 domains documented

Risk assessment: suicidal ideation (5 levels), harm to others (mandatory)

Auto crisis detection → 🚨 Telegram alert on active_with_plan or active_intent ideation

PHQ-9 (depression), GAD-7 (anxiety), AUDIT (alcohol) with auto-scoring and severity classification

Therapy sessions: CBT, DBT, psychodynamic, motivational interviewing

Care plans with goals, interventions, review scheduling

Score trend charts over time

Records immutable (no DELETE), doctor/owner-only access, enhanced confidentiality controls

Visual acuity OD/OS/OU (Snellen 6/6 to NPL scale)

Refraction: sphere, cylinder, axis, add (OD/OS, dry + cycloplegic)

IOP monitoring with alert >21 mmHg (suspect glaucoma)

Cup/disc ratio alert >0.6 (glaucoma screening)

Full slit lamp and fundus examination documentation

Optical prescriptions (spectacles, contact lens, bifocal, progressive)

Printable optical prescription — unique in Nigerian market

2-year prescription validity tracking with expiry alert

FDI notation (ISO 3950) — standard used worldwide including Nigeria (two-digit: 11-48)

Interactive 32-tooth SVG dental chart — colour-coded by status (decayed/filled/RCT/crowned/missing)

Click tooth → update status, surfaces (M/D/O/B/L/I), notes

Auto-update chart on procedure: extraction→missing, filling→filled, RCT→rct, crown→crowned

Treatment plan with cost estimates and patient acceptance workflow

Blood thinner alert before extraction procedures

High BP alert ≥180/110 mmHg (defer elective procedures)

Dental price list (clinic configures per procedure)

Real-time messaging via Supabase Realtime subscriptions

Default channels: All Staff, Doctors, Nurses, Pharmacy

Typing indicators via Supabase Presence

Unread message badge in sidebar navigation

Message history with pagination

NDPR 90-day auto-purge via daily pg_cron job

Claude Haiku 4.5 integration (~$0.002 per query)

AI Clinical Notes — draft SOAP notes from consultation data

Drug Interaction Checker — real-time alerts on dangerous prescription combinations

Differential Diagnosis — AI-powered suggestion from symptoms

Prescription Validator — dosage and contraindication checks

Monthly usage limits by plan: 500 (Starter) / 1000 (Pro) / 2000 (Enterprise)

AI usage dashboard — queries remaining, monthly reset

All non-clinical requests blocked by system prompt

Antenatal registration with EDD calculation (Naegele's rule)

WHO 8-visit ANC schedule

Partograph with WHO alert and action lines

High BP alert ≥140/90 mmHg during antenatal visits

Foetal heart rate tracking

Postnatal visit documentation. Add-on: ₦20,000/location/month

146 Playwright E2E tests across 10 test phases (A–J)

GitHub Actions workflow auto-runs on staging push

Supabase session injection for test authentication

Vercel ISR build-timeout fix (force-dynamic on pricing routes)

Nurse's Chart — real-time vitals, medications, fluid balance, nursing notes per shift

Ventilator Chart — mode, PEEP, FiO2, tidal volume, respiratory rate, alarm documentation

Theatre Module — pre-op assessment, surgical team booking, intra-op documentation, anaesthesia record, post-op recovery notes

Dialysis Unit — session parameters (Qb, Qd, UF goal), access site management, complication recording. Add-on: ₦12,000/location/month

41 owner-level RLS policies confirmed on production

Pharmacy seed gap resolved (prescriptions use uppercase status: PENDING, DISPENSED, CANCELLED)

Three critical RLS migrations applied — cross-clinic data isolation verified across all tables

clinic_id resolution standardised — getClinicId() used in all routes

IPD invoices auto-created on patient admission — billing starts the moment a bed is assigned

Invoice linked to admission record for full billing traceability across the patient journey

Discharge automatically reconciles invoice status to unpaid, ready for settlement

Length of stay recorded in invoice notes on discharge for audit and claims reference

Ward daily bed rate now configurable from ward settings — drives admission invoice amount

Allergy badge added to patient list cards — shows allergy count at a glance

Badge displays drug names on hover for quick reference without opening the patient record

Reads structured drug_allergies JSONB data from medical history — no extra DB calls (parallelised fetch)

Drug billing now occurs at dispense time, not prescription time — prevents phantom charges on pending prescriptions

Declining a prescription now automatically removes drug charges from the patient invoice

New clinic onboarding now seeds default consultation fee (₦5,000) on account creation

Full patient history panel added to consultation page — allergies, chronic conditions, surgical and family history at a glance

Medical history column mismatches and ghost fields resolved — data now saves and displays correctly

Consultation fee fixed for non-owner staff accounts (was showing ₦0)

Drug interaction checker now reads real patient allergy data instead of placeholder values

Double Dr. prefix eliminated across 16 locations in the clinical UI

Antenatal Care (ANC) module — gestational tracking, ANC visits, high-risk flags, postnatal follow-up

Module management system — admin can enable/disable individual modules per clinic

Plan-based staff account limits enforced on invitation (Starter: 5, Professional: 10, Enterprise: unlimited)

Clinical Calculators — BMI, paediatric dosing, gestational age, eGFR, GCS, APGAR and more

Fraud Detection module — duplicate prescriptions, billing spike alerts, HMO claim anomalies

Chronic Disease Tracking — HTN, DM, CKD, Asthma, HIV registers with trend charts

HMO Management module — batch claims, pre-authorisation, capitation and FFS billing

IPD: admission detail page with nursing notes, ward rounds, and discharge summary tabs

Lab catalog: 40 default tests auto-seeded on clinic creation; global catalog visible via RLS fix

Staff invite notification now shows inviter name and invitee name (not raw email)

Register page updated to match DawaHQ Clay Morphism design — "Get Started"

BUG-12: Lab tests RLS policy now includes clinic_id IS NULL for global catalog visibility

M7: Staff invitation notification showed raw email instead of human-readable names

M6: Added consultations → clinic_settings FK constraint migration (idempotent)

Pharmacy add-on per-location billing validated server-side on subscription events

Referral Network module — outgoing referrals, secure record sharing, status tracking, referral analytics

Patient background profiles — allergies, chronic conditions, family history, social history

Lab test catalog with 40+ pre-configured Nigerian standard test templates

Sidebar restructured into 6 logical sections with sign-out at bottom

Add-location flow redesigned with clear billing impact explanation

Billing locations card shows correct message per plan (Starter/Pro/Enterprise)

Admin dashboard: pending onboarding requests with modal detail view and approve/reject actions

BUG-13: Onboarding approve route return type mismatch (provisionClinic)

BUG-10: Duplicate clinic slug collision on re-approval after previous test

BUG-08: Role guard on stub pages — correct access denied page shown for unauthorised roles

RLS subquery applied to all 27 data tables — cross-clinic data isolation verified

Removed hardcoded Telegram credentials from source code

Rate limiting added to /api/auth and /api/staff/invite endpoints

Inpatient Department (IPD) — admissions, bed management, ward notes, doctor rounds, discharge summaries

Paediatrics module — age/weight drug dosing, WHO growth charts, immunisation records, paediatric templates

Nurse Module — triage, nursing notes, MAR, fluid balance, wound care, handover notes

Pharmacy Add-on launched — ₦10,000/location/month as standalone add-on to any plan

Lab & Diagnostics: critical value flagging and Telegram alerts added

Appointment booking: recurring appointment support and calendar export (iCal)

Billing: partial payment and instalment tracking added

Queue: multi-doctor queue routing and queue analytics dashboard

BUG-015: Fixed deployment blocked by corrupted files in staging commit

BUG-014b: Fixed "Plan not found" error on upgrade flow — staging uses test PLN codes

BUG-011: Fixed onboarding confirmation email import (createClient → createAdminClient)

Complete public website — landing page, pricing, features, security, about, changelog pages

Full pricing page with feature comparison table and FAQ accordion

Features page with 15 detailed module breakdowns and quick-jump navigation

Security page — NDPR compliance, encryption, RBAC, audit logs, and incident response

Legal pages (Privacy Policy, Terms of Service, Refund Policy, SLA) publicly accessible

About page with company mission, values, and founding story

Middleware updated to exclude all public pages from auth protection

Navigation updated with links to all public pages

Paystack plan codes now validated server-side — client cannot override plan selection

Security hardening for staging and test billing environments

BUG-015: Fixed deployment blocked by corrupted files in staging commit

BUG-014b: Fixed "Plan not found" error on upgrade flow — staging now uses test PLN codes

Dawa AI — AI Clinical Note Drafting (Professional+ plans)

Drug Interaction Checker — real-time alerts when new prescription conflicts with existing medications

AI Revenue Analyst — automatic detection of billing gaps and unpaid invoice patterns

AI Inventory Predictor — forecast drug stock-outs based on dispensing patterns

Radiology module — request workflow, structured report templates, critical findings Telegram alerts

Pricing page with DB-fetched plans and Pharmacy Add-on display

Pharmacy Add-on — full drug inventory, purchase orders, batch tracking

Billing UI redesigned with clay morphism cards and upgrade error handling

Paystack subscription flow — full redirect-based checkout with callback_url

Admin dashboard — pending onboarding requests with modal detail view

Clinic approval flow — automated email notifications on approve and reject

BUG-013: Fixed onboarding approve route — provisionClinic return type mismatch

BUG-012: Fixed rejection email prop names (camelCase vs snake_case mismatch)

BUG-011: Fixed onboarding confirmation email import (createClient → createAdminClient)

BUG-010: Fixed duplicate clinic slug collision on re-approval after previous test

Electronic Medical Records (EMR) — full patient profiles, medical history, allergies, visit notes

Appointments & Scheduling — multi-doctor calendar, walk-ins, SMS reminders, calendar export

Queue Management — digital check-in, live queue display, nurse triage, vitals capture

Billing & Invoicing — itemised invoices, Paystack payments, outstanding balance tracking

Lab & Diagnostics — digital test requests, result entry, physician sign-off, patient notifications

Prescriptions — digital prescription generation, auto-dispense to pharmacy

Nurse Module — triage, vitals, nursing notes, medication administration record

Staff & Role Management — 7 roles, invitation workflow, full audit logging

Analytics & Reports — live dashboard, revenue reports, patient flow, inventory analytics

Referral Network — digital referral creation, status tracking, record sharing

Admin Dashboard — super admin with clinic approval/rejection, onboarding management

Onboarding Flow — multi-step clinic setup wizard, staff invitation, settings configuration

Mirth Connect integration (HL7/ASTM) for lab instrument data (Enterprise)

Telegram alert system for critical events (radiology findings, system alerts)

Automated email delivery for confirmations, reminders, and notifications

Trial + subscription management with billing gate on trial expiry

Row-level security — clinics cannot access each other's data

NDPR-compliant data architecture with encryption at rest and in transit