1. 12 Aug, 2026 4 commits
    • Mahmoud Aglan's avatar
      fix(pool-reservations): add pool_reservation to cashier payment queue whitelist · 66ed84c2
      Mahmoud Aglan authored
      The PoolReservationService already called PaymentRequestService::createRequest()
      but with member_id=0 and payment_type='pool_reservation' — which was silently
      rejected because 'pool_reservation' wasn't in the non-member whitelist.
      
      - Added 'pool_reservation' to PaymentRequestService whitelist
      - Added payment type label (حجز حارة سباحة)
      - Added payment completion handler → marks reservation as paid
      - Added void handler → reverts reservation to pending
      Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
      66ed84c2
    • Mahmoud Aglan's avatar
      feat(games): integrate game tickets with cashier payment queue + session lifecycle · d1e9d443
      Mahmoud Aglan authored
      - Game tickets now create payment requests (sa_game_ticket type) sent to
        the cashier sub-queue, matching pool ticket and booking patterns
      - Added session lifecycle actions: start, complete, cancel with UI buttons
      - Fixed session status bug: allow issuing tickets during 'in_progress' sessions
      - Fixed GuestEntryService crash when no carnet exists (skip UPDATE on id=0)
      - Added payment completion/void handlers for game and pool tickets
      - Extended PaymentRequestService whitelist for sa_game_ticket/sa_pool_ticket
      - Added comprehensive tutorial sections 9-14 covering entertainment workflows
      Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
      d1e9d443
    • Mahmoud Aglan's avatar
      fix(service-desk): fix CSRF token field name for ticket issuance · 92bc017a
      Mahmoud Aglan authored
      The ticket form and lookup in service-desk sent '_token' but the CSRF
      middleware expects '_csrf_token'. This caused HTTP 419 on every ticket
      issuance attempt.
      Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
      92bc017a
    • Mahmoud Aglan's avatar
      fix(registration): prevent double form-fee charge + NID-swap exploit + profile actions · db92e175
      Mahmoud Aglan authored
      Critical fixes:
      - submitFormPayment() now checks sa_players.registration_fee_paid as
        a safety net before creating any payment request
      - startRegistration() member_id fallback only used when NID matches
        the member's actual national_id (prevents NID-swap fee bypass)
      - lookupPlayer() validates NID-to-member consistency before proceeding
      - Existing registration lookup now includes 'pending_payment' status
      - Frontend clears membership_number when NID is manually changed
        after auto-fill
      
      Feature:
      - Player profile page now shows "Print Form" and "Generate Card"
        buttons for completing registration steps outside the wizard
      Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
      db92e175
  2. 11 Aug, 2026 12 commits
  3. 10 Aug, 2026 1 commit
    • Mahmoud Aglan's avatar
      feat(members): show subscription status, transfer details, and overdue amounts · 28433036
      Mahmoud Aglan authored
      1. Subscription badge: shows if active (paid), overdue, or awaiting renewal
      2. Overdue table: lists all unpaid subscriptions with amounts needed to renew
      3. Transfer origin card: shows who transferred, when, and actual amount paid
      4. Financial summary: shows actual paid amount (not original membership_value) for transferred members
      5. Payment history link for deceased member (accessible from transferee's page)
      6. Redirect /members/{id} to archive page if member is archived
      Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
      28433036
  4. 09 Aug, 2026 5 commits
  5. 08 Aug, 2026 18 commits