From e2b22df2d65fa320d0292acf81793f8fc033bff7 Mon Sep 17 00:00:00 2001 From: hamid Date: Sun, 5 Jul 2026 14:57:05 +0330 Subject: [PATCH] include product files --- product/business/01-actors-and-onboarding.html | 1 + 1 file changed, 1 insertion(+) diff --git a/product/business/01-actors-and-onboarding.html b/product/business/01-actors-and-onboarding.html index 0e804c3..59153e7 100644 --- a/product/business/01-actors-and-onboarding.html +++ b/product/business/01-actors-and-onboarding.html @@ -30,6 +30,7 @@
  • Each successful login creates a refresh-token session that can be revoked (logout, stolen-token detection).
  • As-built decisions (backend-phase-2): each refresh rotates the session (old revoked, new pair issued); a refresh token presented against an already-revoked session is treated as stolen-token reuse → all of the user's sessions are revoked and the call returns 401. Logout rotates the security stamp, so every outstanding access token dies (other devices recover by refreshing). OTP request/verify never reveal whether a phone already has an account; one OTP per phone per resend window (auth_otp_resend_seconds), and after auth_otp_max_attempts wrong codes verification refuses until a fresh OTP. customer/nurse are the only self-selectable roles (a user may hold both; grants audited via granted_by/granted_at); any admin sub-role self-assign attempt returns 403 — admin provisioning is internal-only.
    • +
  • As-built decisions (frontend-phase-2 — onboarding UI): the "who is care for?" onboarding step captures the patient's relation to the payer as a stable enum — parent | spouse | child | self (the self case still creates a distinct patient row; the customer is never collapsed into the patient). It also collects optional condition chips (elderly/post_surgery/diabetes/mobility/dementia). Neither relation nor conditions exists on the patients table yet — they are carried client-side and requested for the backend as REQ-005 (frontend requests/for-backend.md); confirm/adjust the enum values when persisting.

    • (b) Iran-specific considerations