[DevRushd]

Consolidates issues #48 and #49 into a single PR.

Issue #48 — Idempotency-Key support

Persistent IdempotencyKey model with unique (userId, key). Canonical request hashing over method, concrete path, and body. Optional Idempotency-Key on booking and payment mutations. Replays completed responses, returns 422 IDEMPOTENCY_KEY_REUSED for a different request, 409 IN_PROGRESS while running, rejects malformed keys, avoids caching 5xx, per-user isolation, stale in-progress recovery, bounded cached bodies, expiration/pruning.

Issue #49 — Optimistic concurrency

version Int @default(1) on User, PatientProfile, DoctorProfile, FacilityProfile, FacilityCapability, Appointment, PaymentIntent. Shared middleware: setVersionEtag, requireIfMatch, expectedVersion, versionConflict. Missing If-Match → 428 IF_MATCH_REQUIRED; invalid/weak/unquoted/multiple → 400 INVALID_IF_MATCH; stale → 412 VERSION_CONFLICT. Atomic conditional writes (WHERE id = ? AND version = ?). PATCH /doctors/me reference implementation with strict validation. System-driven updates (email verification, payment transitions) increment version. Existing status-conflict 409 behavior preserved.

Closes #48

Closes #49

[drips-wave]

@DevRushd Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[afeezorobsco-cyber]

@DevRushd Thanks for the PR. It can't be merged yet. To unblock it:

Merge conflicts: this branch conflicts with main. Please rebase onto the latest main (git fetch upstream && git rebase upstream/main), resolve the conflicts (often ROADMAP.md, ARCHITECTURE*.md or prisma/schema.prisma), and force-push.

Push to this same branch and CI will re-run. Once it's green and conflict-free, it'll be reviewed for merge.

[github-actions]

@DevRushd This PR now has merge conflicts with main, most likely because #156 (feat(patients): account deletion with clinical-record retention: anonymise identity, keep the audit trail) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

@DevRushd This PR now has merge conflicts with main, most likely because #247 (Add consultation order creation endpoints for prescriptions and lab orders) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@DevRushd CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Backend (typecheck + test + build)

src/middleware/idempotency.ts(247,34): error TS2339: Property 'idempotency' does not exist on type '{ readonly port: number; readonly databaseUrl: string; readonly jwt: { readonly accessSecret: string; readonly refreshSecret: string; readonly accessTtl: "15m";
src/middleware/idempotency.ts(308,21): error TS2339: Property 'idempotency' does not exist on type '{ readonly port: number; readonly databaseUrl: string; readonly jwt: { readonly accessSecret: string; readonly refreshSecret: string; readonly accessTtl: "15m";
src/middleware/idempotency.ts(309,35): error TS2339: Property 'idempotency' does not exist on type '{ readonly port: number; readonly databaseUrl: string; readonly jwt: { readonly accessSecret: string; readonly refreshSecret: string; readonly accessTtl: "15m";
src/server.ts(71,8): error TS2304: Cannot find name 'pruneIdempotencyKeys'.
src/server.ts(72,12): error TS7006: Parameter 'removed' implicitly has an 'any' type.
src/server.ts(78,13): error TS7006: Parameter 'err' implicitly has an 'any' type.
src/server.ts(82,11): error TS2339: Property 'idempotency' does not exist on type '{ readonly port: number; readonly databaseUrl: string; readonly jwt: { readonly accessSecret: string; readonly refreshSecret: string; readonly accessTtl: "15m"; readonly refresh
tests/integration/idempotency.test.mts(99,82): error TS2353: Object literal may only specify known properties, and 'orderId' does not exist in type 'PaymentIntentWhereInput'.
tests/integration/idempotency.test.mts(181,46): error TS2353: Object literal may only specify known properties, and 'facilityId' does not exist in type '((Without<WalletLinkCreateInput, WalletLinkUncheckedCreateInput> & WalletLinkUncheckedCreateInput) | (Witho

config.idempotency doesn't exist, so add it to the config schema (with env parsing) on this branch. pruneIdempotencyKeys is used in server.ts but never defined or imported. The integration test uses PaymentIntent.orderId and WalletLink.facilityId, which aren't in the schema on main.

[afeezorobsco-cyber]

@DevRushd CI is failing at npm run typecheck:

src/middleware/idempotency.ts(247,34): error TS2339: Property 'idempotency' does not exist on type '{ readonly port: number; ... }'   (config)
src/server.ts(72,8): error TS2304: Cannot find name 'pruneIdempotencyKeys'.
src/server.ts(73,12): error TS7006: Parameter 'removed' implicitly has an 'any' type.
tests/integration/idempotency.test.mts(99,82): error TS2353: ... 'orderId' does not exist in type 'PaymentIntentWhereInput'.

The idempotency config block and the pruneIdempotencyKeys import were lost (likely in the merge from main), and the test filters on orderId, which PaymentIntent doesn't have. Please fix, run npm run typecheck in backend/, and push.

[github-actions]

@DevRushd This PR now has merge conflicts with main, most likely because #164 (Implement cancellation policy (issue #56), waitlist with time-boxed offers (issue #55), and reschedule (issue #54)) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@DevRushd After the latest merge from main, CI still fails at npm run typecheck with the same errors as in my earlier comment. The merge didn't bring back the missing pieces. The idempotency config block is still missing (config.idempotency in src/middleware/idempotency.ts), and tests/integration/idempotency.test.mts still uses orderId (PaymentIntent) and facilityId (WalletLink), which main's schema doesn't have. Please fix those, run npm run typecheck in backend/, and push.

[afeezorobsco-cyber]

Sweep: malware scan clean, CI green.