HEALME DENTAL CLINIC - SECURITY UPDATE PATCH
================================================

IMPORTANT
- This is a patch set, not a full replacement project.
- It does not include your .env, database, uploaded images, or vendor directory.
- Take a full project + database backup before applying it.
- Do NOT run migrate:fresh, db:wipe, or rollback on the live database.

PATCH CONTENTS
1) Public self-registration routes removed from routes/auth.php.
2) New users.is_admin boolean migration (default false).
3) New admin middleware; dashboard and all /admin routes require auth + is_admin.
4) Explicit JPG/JPEG/PNG/WEBP validation for doctor, gallery, banner, page, and site images.
5) Appointment form validation tightened; doctor schedule is revalidated server-side and doctor row is locked in a transaction while booking.
6) Production environment example only; your real .env is intentionally not included.

APPLYING THE PATCH
1. Back up the live files and database.
2. Copy the files/folders from this patch over the matching paths in the project.
3. Review routes/auth.php: registration URLs are intentionally disabled. Existing admin login remains.
4. Run migration locally first, then on hosting:
      php artisan migrate --force
   This adds only users.is_admin; it does not delete existing tables or rows.
5. IMPORTANT: the migration does not automatically make every existing user an administrator.
   After migration, promote ONLY the trusted clinic administrator in phpMyAdmin:
      UPDATE users SET is_admin = 1 WHERE email = 'YOUR-ADMIN-EMAIL';
   Verify exactly one intended account was changed. Do not promote unknown/public accounts.
6. Verify login using that admin account. Other authenticated users will receive HTTP 403 for /dashboard and /admin.
7. Production .env values (merge into your existing file; preserve the existing APP_KEY and DB credentials):
      APP_ENV=production
      APP_DEBUG=false
      APP_URL=https://YOUR-DOMAIN
      SESSION_SECURE_COOKIE=true
      SESSION_HTTP_ONLY=true
      SESSION_SAME_SITE=lax
   Set APP_DEBUG=false before public launch. Never upload .env into public_html.
8. Run:
      php artisan optimize:clear
      php artisan config:cache
      php artisan route:cache
      php artisan view:cache
   If route:cache reports a route issue, do not force it; use optimize:clear and test.

ADMIN ACCESS / USER MANAGEMENT
- Registration is disabled intentionally. Do not re-enable it for public visitors.
- Create additional admin users through a trusted, private process only, then set is_admin=1 for the verified email.
- Keep the admin email private and use a unique long password. Add MFA through the hosting/identity layer if supported.

DATABASE & DATA SAFETY
- Existing data is preserved by the migration. No table is dropped.
- Keep database backups outside public_html.
- Do not share .env, APP_KEY, database passwords, cookies, or production logs.

UPLOAD SECURITY
- Upload controllers now validate allowed image formats and size.
- Ensure storage/app/public is not configured to execute PHP. Keep public storage limited to images.
- Keep Laravel project files (app, bootstrap, config, database, resources, routes, storage, vendor, .env) outside public_html; expose only the contents of Laravel's public directory.

APPOINTMENT SECURITY
- Public appointment form remains available.
- Doctor availability is rechecked on the server; concurrent bookings for a doctor are serialized by a row lock.
- Confirm your MySQL storage engine is InnoDB for transaction/row-lock behavior.
- If bookings without a doctor are intentionally allowed by your current form, that behavior is preserved.

DEPENDENCY AUDIT
- This patch does not silently change composer.json or upgrade Laravel. The project is Laravel 9 and must be upgraded separately after testing because major-version upgrades can break existing functionality.
- In a local development copy, run:
      composer validate
      composer audit
      composer outdated --direct
- Save the output and review each advisory before updating packages. Do not run composer update blindly on the live server.
- Plan a tested upgrade to a currently supported Laravel release compatible with your hosting PHP version.

TEST CHECKLIST
[ ] Admin login works
[ ] /register returns 404
[ ] Non-admin account cannot access /dashboard or /admin (403)
[ ] Promoted admin can access all existing admin sections
[ ] Public pages, services, doctors, gallery and dynamic pages still render
[ ] Valid image uploads work; SVG/PHP/HTML files are rejected
[ ] Appointment slots show correctly
[ ] Two simultaneous attempts for the same doctor/time do not both book
[ ] Existing appointment records remain visible
[ ] Production error pages do not expose stack traces

LIMITATIONS
This patch is based on the supplied source archive and is not a live penetration test.
Run tests on a staging copy before production. No website can be guaranteed 100% hack-proof.