Keep cabinet data private per patient, email new accounts after a request, and store gallery photos as files.

Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Формат основан на [Keep a Changelog](https://keepachangelog.com/ru/1.1.0/), версии — [SemVer](https://semver.org/lang/ru/).
 
+## [1.0.10] — 2026-09-17
+
+### Сайт
+
+- Личный кабинет больше не показывает чужие демо-записи: без входа разделы пустые, у каждого пациента только свои заявки, документы и счета
+- После заявки на запись создаётся кабинет (если пациента ещё не было) и на почту уходит письмо со сводкой услуги, стоимостью и полезной информацией
+- В галерее четыре фото КДЦ МОНИКИ как загруженные файлы, не ссылки
+
 ## [1.0.9] — 2026-09-17
 
 ### Сайт
@@ -86,6 +94,7 @@
 - Docker Compose для локальной БД
 - Секреты и логины в git не входят
 
+[1.0.10]: https://git.myunion.pro/Alex/Moniki_uslugi/src/tag/v1.0.10
 [1.0.9]: https://git.myunion.pro/Alex/Moniki_uslugi/src/tag/v1.0.9
 [1.0.8]: https://git.myunion.pro/Alex/Moniki_uslugi/src/tag/v1.0.8
 [1.0.7]: https://git.myunion.pro/Alex/Moniki_uslugi/src/tag/v1.0.7

README.md

@@ -4,7 +4,7 @@
 
 Репозиторий: [Moniki_uslugi](https://git.myunion.pro/Alex/Moniki_uslugi) на [git.myunion.pro](https://git.myunion.pro/).
 
-Текущая версия: **v1.0.9** (см. [CHANGELOG.md](CHANGELOG.md)).
+Текущая версия: **v1.0.10** (см. [CHANGELOG.md](CHANGELOG.md)).
 
 ## Что внутри
 

apps/cms/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moniki/cms",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "private": true,
   "type": "module",
   "scripts": {
@@ -19,6 +19,7 @@
     "seed:news": "tsx src/seed/import-news.ts",
     "seed:pages": "tsx src/seed/site-pages.ts",
     "seed:documents": "tsx src/seed/public-documents.ts",
+    "seed:gallery": "tsx src/seed/gallery-photos.ts",
     "seed:i18n": "python3 src/seed/translate_locales.py",
     "lint": "next lint"
   },

apps/cms/src/app/(payload)/api/custom/inquiries/route.ts

@@ -2,6 +2,7 @@ import configPromise from '@payload-config'
 import { getPayload } from 'payload'
 import { NextResponse } from 'next/server'
 import { isValidEmailAddress, isValidFullName, isValidRuPhone, normalizeRuPhone } from '@/lib/contact-fields'
+import { findOrCreatePatient, notifyInquiry } from '@/lib/inquiry-account'
 
 function asText(value: unknown) {
   return typeof value === "string" ? value.trim() : ""
@@ -31,6 +32,18 @@ export async function POST(req: Request) {
 
   try {
     const payload = await getPayload({ config: configPromise })
+    let patientId: string | number | undefined
+    let cabinetCreated = false
+    let password: string | undefined
+    try {
+      const account = await findOrCreatePatient(payload, { email, name, phone })
+      patientId = account.id
+      cabinetCreated = account.created
+      password = account.password
+    } catch (error) {
+      payload.logger.error({ err: error }, 'Failed to create patient cabinet from inquiry')
+    }
+
     const doc = await payload.create({
       collection: "inquiries",
       overrideAccess: true,
@@ -41,10 +54,23 @@ export async function POST(req: Request) {
         branch,
         ...(service != null ? { service } : {}),
         ...(doctor != null ? { doctor } : {}),
+        ...(patientId != null ? { patient: patientId } : {}),
         status: "new",
       },
     })
-    return NextResponse.json({ id: String(doc.id) })
+
+    notifyInquiry(payload, {
+      inquiryId: doc.id,
+      patientName: name,
+      email,
+      phone,
+      cabinetCreated,
+      password,
+    }).catch((error) => {
+      payload.logger.error({ err: error }, 'Failed to send inquiry email')
+    })
+
+    return NextResponse.json({ id: String(doc.id), cabinetCreated })
   } catch (error) {
     const message = error instanceof Error ? error.message : "failed"
     return NextResponse.json({ error: message }, { status: 400 })

apps/cms/src/collections/Inquiries.ts

@@ -13,7 +13,11 @@ export const Inquiries: CollectionConfig = {
   },
   access: {
     create: () => true,
-    read: ({ req: { user } }) => user?.role === 'admin',
+    read: ({ req: { user } }) => {
+      if (!user) return false
+      if (user.role === 'admin') return true
+      return { patient: { equals: user.id } }
+    },
     update: ({ req: { user } }) => user?.role === 'admin',
     delete: ({ req: { user } }) => user?.role === 'admin',
   },
@@ -59,6 +63,7 @@ export const Inquiries: CollectionConfig = {
     { name: 'service', type: 'relationship', relationTo: 'services', label: 'Услуга' },
     { name: 'doctor', type: 'relationship', relationTo: 'doctors', label: 'Врач' },
     { name: 'branch', type: 'relationship', relationTo: 'branches', required: true, label: 'Филиал' },
+    { name: 'patient', type: 'relationship', relationTo: 'users', label: 'Пациент' },
     {
       name: 'status',
       type: 'select',

apps/cms/src/lib/ensure-inquiries-schema.ts

@@ -40,6 +40,20 @@ export async function ensureInquiriesSchema(payload: Payload) {
   `,
   )
 
+  await exec(
+    payload,
+    sql`
+    ALTER TABLE inquiries
+      ADD COLUMN IF NOT EXISTS patient_id integer
+  `,
+  )
+  await exec(
+    payload,
+    sql`
+    CREATE INDEX IF NOT EXISTS inquiries_patient_idx ON inquiries (patient_id)
+  `,
+  )
+
   await exec(
     payload,
     sql`

apps/cms/src/lib/inquiry-account.ts

@@ -0,0 +1,105 @@
+import { randomBytes } from 'crypto'
+import type { Payload } from 'payload'
+import { buildInquiryEmail } from './inquiry-email'
+import { sendNotification } from './notifications'
+
+function siteUrl() {
+  return (process.env.CORS_ORIGINS || 'http://localhost:3000').split(',')[0]?.trim() || 'http://localhost:3000'
+}
+
+function generateCabinetPassword() {
+  const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789'
+  const bytes = randomBytes(10)
+  let out = 'Mk-'
+  for (const byte of bytes) out += alphabet[byte % alphabet.length]
+  return out
+}
+
+function relRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === 'object' ? (value as Record<string, unknown>) : null
+}
+
+function relText(value: unknown, key: string) {
+  const rec = relRecord(value)
+  const raw = rec?.[key]
+  return typeof raw === 'string' ? raw.trim() : ''
+}
+
+export async function findOrCreatePatient(
+  payload: Payload,
+  input: { email: string; name: string; phone: string },
+): Promise<{ id: string | number; created: boolean; password?: string }> {
+  const email = input.email.trim().toLowerCase()
+  const existing = await payload.find({
+    collection: 'users',
+    where: { email: { equals: email } },
+    limit: 1,
+    overrideAccess: true,
+  })
+  if (existing.docs[0]) {
+    const user = existing.docs[0]
+    if (!user.phone && input.phone) {
+      await payload.update({
+        collection: 'users',
+        id: user.id,
+        overrideAccess: true,
+        data: { phone: input.phone },
+      })
+    }
+    return { id: user.id, created: false }
+  }
+
+  const password = generateCabinetPassword()
+  const created = await payload.create({
+    collection: 'users',
+    overrideAccess: true,
+    data: {
+      email,
+      password,
+      fullName: input.name,
+      phone: input.phone,
+      role: 'patient',
+      emailOptIn: true,
+    },
+  })
+  return { id: created.id, created: true, password }
+}
+
+export async function notifyInquiry(
+  payload: Payload,
+  input: {
+    inquiryId: string | number
+    patientName: string
+    email: string
+    phone: string
+    cabinetCreated: boolean
+    password?: string
+  },
+) {
+  const inquiry = await payload.findByID({
+    collection: 'inquiries',
+    id: input.inquiryId,
+    depth: 2,
+    overrideAccess: true,
+  })
+  const message = buildInquiryEmail({
+    patientName: input.patientName,
+    email: input.email,
+    phone: input.phone,
+    serviceTitle: relText(inquiry.service, 'title').replace(/^\d+(?:\.\d+)*\.?\s+/, '').trim(),
+    servicePrice: Number(relRecord(inquiry.service)?.price) || undefined,
+    doctorName: relText(inquiry.doctor, 'fullName'),
+    branchName: relText(inquiry.branch, 'name'),
+    branchAddress: relText(inquiry.branch, 'address'),
+    cabinetCreated: input.cabinetCreated,
+    password: input.password,
+    loginUrl: `${siteUrl()}/ru/login`,
+  })
+  await sendNotification(payload, {
+    channel: 'email',
+    to: input.email,
+    subject: message.subject,
+    body: message.text,
+    html: message.html,
+  })
+}

apps/cms/src/lib/inquiry-email.ts

@@ -0,0 +1,149 @@
+function escapeHtml(text: string) {
+  return text
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+}
+
+function row(label: string, value: string) {
+  if (!value.trim()) return ''
+  return `<tr>
+    <td style="padding:8px 0;color:#64748b;font-size:14px;width:40%;vertical-align:top;">${escapeHtml(label)}</td>
+    <td style="padding:8px 0;color:#0f172a;font-size:14px;font-weight:600;">${escapeHtml(value)}</td>
+  </tr>`
+}
+
+export type InquiryEmailInput = {
+  patientName: string
+  email: string
+  phone: string
+  serviceTitle?: string
+  servicePrice?: number
+  doctorName?: string
+  branchName?: string
+  branchAddress?: string
+  cabinetCreated: boolean
+  password?: string
+  loginUrl: string
+}
+
+function formatPrice(amount?: number) {
+  if (amount == null || !Number.isFinite(amount) || amount <= 0) return ''
+  return new Intl.NumberFormat('ru-RU', {
+    style: 'currency',
+    currency: 'RUB',
+    maximumFractionDigits: 0,
+  }).format(amount)
+}
+
+export function buildInquiryEmail(input: InquiryEmailInput) {
+  const firstName = input.patientName.trim().split(/\s+/)[1] || input.patientName.trim()
+  const price = formatPrice(input.servicePrice)
+  const subject = input.cabinetCreated
+    ? 'Личный кабинет и заявка на запись — МОНИКИ'
+    : 'Ваша заявка на запись принята — МОНИКИ'
+
+  const cabinetBlock = input.cabinetCreated
+    ? `
+      <div style="margin:24px 0;padding:20px;border-radius:16px;background:#eef6fb;border:1px solid #cfe3f2;">
+        <p style="margin:0 0 8px;font-size:16px;font-weight:700;color:#163a56;">Для вас создан личный кабинет</p>
+        <p style="margin:0 0 16px;font-size:14px;line-height:1.55;color:#334155;">
+          В кабинете будут ваши заявки, документы и счета. Войти можно по почте, которую вы указали в заявке.
+        </p>
+        <table role="presentation" width="100%" cellspacing="0" cellpadding="0">
+          ${row('Логин', input.email)}
+          ${input.password ? row('Пароль', input.password) : ''}
+        </table>
+        <p style="margin:16px 0 0;">
+          <a href="${escapeHtml(input.loginUrl)}" style="display:inline-block;background:#1b4b73;color:#ffffff;text-decoration:none;padding:12px 20px;border-radius:999px;font-size:14px;font-weight:700;">
+            Войти в личный кабинет
+          </a>
+        </p>
+      </div>`
+    : `
+      <p style="margin:0 0 20px;font-size:14px;line-height:1.55;color:#334155;">
+        Заявка сохранена в вашем личном кабинете. Войти можно по адресу
+        <a href="${escapeHtml(input.loginUrl)}" style="color:#1b4b73;font-weight:700;">${escapeHtml(input.loginUrl)}</a>.
+      </p>`
+
+  const html = `<!doctype html>
+<html lang="ru">
+  <body style="margin:0;padding:0;background:#f4f7fb;font-family:'Segoe UI',Arial,sans-serif;">
+    <table role="presentation" width="100%" cellspacing="0" cellpadding="0" style="background:#f4f7fb;padding:24px 12px;">
+      <tr>
+        <td align="center">
+          <table role="presentation" width="640" cellspacing="0" cellpadding="0" style="max-width:640px;width:100%;background:#ffffff;border-radius:20px;overflow:hidden;box-shadow:0 10px 30px rgba(15,23,42,0.06);">
+            <tr>
+              <td style="background:linear-gradient(135deg,#163a56,#1b4b73);padding:28px 32px;color:#ffffff;">
+                <p style="margin:0;font-size:12px;letter-spacing:.12em;text-transform:uppercase;opacity:.8;">КДЦ МОНИКИ</p>
+                <h1 style="margin:8px 0 0;font-size:24px;line-height:1.3;">Заявка принята</h1>
+              </td>
+            </tr>
+            <tr>
+              <td style="padding:32px;">
+                <p style="margin:0 0 16px;font-size:16px;color:#0f172a;">Здравствуйте, ${escapeHtml(firstName)}!</p>
+                <p style="margin:0 0 20px;font-size:15px;line-height:1.6;color:#334155;">
+                  Спасибо, что выбрали платные медицинские услуги КДЦ МОНИКИ им. М. Ф. Владимирского.
+                  Мы получили вашу заявку и свяжемся с вами, чтобы уточнить удобную дату и время.
+                </p>
+                <div style="padding:4px 20px 8px;border-radius:16px;background:#f8fafc;border:1px solid #e2e8f0;">
+                  <p style="margin:16px 0 4px;font-size:13px;font-weight:700;letter-spacing:.04em;text-transform:uppercase;color:#1b4b73;">Сводка заявки</p>
+                  <table role="presentation" width="100%" cellspacing="0" cellpadding="0">
+                    ${row('Пациент', input.patientName)}
+                    ${row('Услуга', input.serviceTitle || '')}
+                    ${row('Стоимость', price)}
+                    ${row('Врач', input.doctorName || '')}
+                    ${row('Филиал', input.branchName || '')}
+                    ${row('Адрес', input.branchAddress || '')}
+                    ${row('Телефон для связи', input.phone)}
+                    ${row('E-mail', input.email)}
+                  </table>
+                </div>
+                ${cabinetBlock}
+                <div style="margin-top:8px;padding:20px;border-radius:16px;background:#fff8ef;border:1px solid #f1e0c3;">
+                  <p style="margin:0 0 10px;font-size:16px;font-weight:700;color:#9a6700;">Полезная информация</p>
+                  <ul style="margin:0;padding-left:18px;color:#57534e;font-size:14px;line-height:1.65;">
+                    <li>Возьмите паспорт. Если есть полис ОМС или результаты обследований — их тоже полезно иметь при себе.</li>
+                    <li>Приходите за 10–15 минут до приёма, чтобы оформить документы на стойке регистрации.</li>
+                    <li>Точное время визита подтвердит администратор: +7 (499) 674-07-09 или 122.</li>
+                    <li>Основной филиал: ул. Щепкина, 61/2, метро «Проспект Мира».</li>
+                    <li>Если планы изменятся, напишите нам или позвоните — заявку можно уточнить или перенести.</li>
+                  </ul>
+                </div>
+                <p style="margin:24px 0 0;font-size:13px;line-height:1.6;color:#64748b;">
+                  С заботой о вашем здоровье,<br>
+                  <strong style="color:#163a56;">КДЦ МОНИКИ</strong><br>
+                  Платные медицинские услуги
+                </p>
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+  </body>
+</html>`
+
+  const textLines = [
+    `Здравствуйте, ${firstName}!`,
+    '',
+    'Мы получили вашу заявку на запись в КДЦ МОНИКИ и свяжемся с вами, чтобы уточнить дату и время.',
+    '',
+    input.serviceTitle ? `Услуга: ${input.serviceTitle}` : '',
+    price ? `Стоимость: ${price}` : '',
+    input.doctorName ? `Врач: ${input.doctorName}` : '',
+    input.branchName ? `Филиал: ${input.branchName}` : '',
+    input.branchAddress ? `Адрес: ${input.branchAddress}` : '',
+    `Телефон: ${input.phone}`,
+    `E-mail: ${input.email}`,
+    '',
+    input.cabinetCreated
+      ? `Для вас создан личный кабинет.\nЛогин: ${input.email}\nПароль: ${input.password || ''}\nВход: ${input.loginUrl}`
+      : `Личный кабинет: ${input.loginUrl}`,
+    '',
+    'Возьмите паспорт, приходите за 10–15 минут. Телефон: +7 (499) 674-07-09, 122.',
+  ].filter(Boolean)
+
+  return { subject, html, text: textLines.join('\n') }
+}

apps/cms/src/lib/notifications.ts

@@ -9,6 +9,7 @@ export type NotifyInput = {
   to: string
   subject: string
   body: string
+  html?: string
 }
 
 function escapeHtml(text: string) {
@@ -36,7 +37,7 @@ export async function sendNotification(
     const result = await payload.sendEmail({
       to: input.to,
       subject: input.subject,
-      html: `<p>${escapeHtml(input.body)}</p>`,
+      html: input.html || `<p>${escapeHtml(input.body)}</p>`,
       text: input.body,
     })
     if (result && typeof result === 'object' && 'skipped' in result && result.skipped) {

apps/cms/src/payload.config.ts

@@ -96,6 +96,12 @@ export default buildConfig({
     } catch (err) {
       payload.logger.error({ err }, 'Failed to seed public documents')
     }
+    try {
+      const { seedGalleryPhotos } = await import('./seed/gallery-photos')
+      await seedGalleryPhotos(payload)
+    } catch (err) {
+      payload.logger.error({ err }, 'Failed to seed gallery photos')
+    }
   },
   editor: lexicalEditor(),
   i18n: {

apps/cms/src/seed/gallery-photos.ts

@@ -0,0 +1,110 @@
+import 'dotenv/config'
+import fs from 'fs'
+import path from 'path'
+import { fileURLToPath } from 'url'
+import type { Payload } from 'payload'
+
+export const GALLERY_PHOTOS = [
+  {
+    filename: 'photo-6.jpg',
+    mime: 'image/jpeg',
+    title: 'Ресепшен КДЦ МОНИКИ',
+    alt: 'Стойка регистрации КДЦ МОНИКИ',
+    sortOrder: 10,
+  },
+  {
+    filename: 'photo69.jpeg',
+    mime: 'image/jpeg',
+    title: 'Администратор на ресепшене',
+    alt: 'Администратор КДЦ МОНИКИ за стойкой регистрации',
+    sortOrder: 20,
+  },
+  {
+    filename: 'photo68.jpg',
+    mime: 'image/jpeg',
+    title: 'Зона ожидания',
+    alt: 'Зал ожидания отделения платных медицинских услуг КДЦ МОНИКИ',
+    sortOrder: 30,
+  },
+  {
+    filename: 'photo-9.jpg',
+    mime: 'image/jpeg',
+    title: 'Стойка регистрации',
+    alt: 'Интерьер стойки регистрации КДЦ МОНИКИ',
+    sortOrder: 40,
+  },
+]
+
+function filePath(filename: string) {
+  const here = path.dirname(fileURLToPath(import.meta.url))
+  const bundled = path.join(here, 'files', 'gallery', filename)
+  return fs.existsSync(bundled) ? bundled : null
+}
+
+export async function seedGalleryPhotos(payload: Payload) {
+  for (const item of GALLERY_PHOTOS) {
+    const source = filePath(item.filename)
+    if (!source) {
+      payload.logger.warn(`Gallery photo not found: ${item.filename}`)
+      continue
+    }
+
+    const already = await payload.find({
+      collection: 'gallery',
+      where: { title: { equals: item.title } },
+      locale: 'ru',
+      limit: 1,
+    })
+    if (already.docs.length) continue
+
+    const existingMedia = await payload.find({
+      collection: 'media',
+      where: { filename: { equals: item.filename } },
+      limit: 1,
+    })
+
+    let mediaId = existingMedia.docs[0]?.id
+    if (!mediaId) {
+      const buf = fs.readFileSync(source)
+      const media = await payload.create({
+        collection: 'media',
+        locale: 'ru',
+        data: { alt: item.alt },
+        file: {
+          data: buf,
+          mimetype: item.mime,
+          name: item.filename,
+          size: buf.length,
+        },
+      })
+      mediaId = media.id
+    }
+
+    await payload.create({
+      collection: 'gallery',
+      locale: 'ru',
+      data: {
+        title: item.title,
+        image: mediaId,
+        category: 'clinic',
+        sortOrder: item.sortOrder,
+      },
+    })
+    payload.logger.info(`Seeded gallery photo ${item.filename}`)
+  }
+}
+
+async function main() {
+  const { getPayload } = await import('payload')
+  const config = (await import('../payload.config')).default
+  const payload = await getPayload({ config })
+  await seedGalleryPhotos(payload)
+  process.exit(0)
+}
+
+if (process.argv[1]?.includes('gallery-photos')) {
+  main().catch((err) => {
+    console.error(err)
+    process.exit(1)
+  })
+}

apps/web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moniki/web",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "private": true,
   "scripts": {
     "dev": "next dev -p 3000",

apps/web/src/app/[locale]/cabinet/documents/page.tsx

@@ -1,3 +1,5 @@
+import { getMyDocuments } from "@/lib/api";
+import { formatDate } from "@/lib/utils";
 import { getTranslations, setRequestLocale } from "next-intl/server";
 
 export default async function CabinetDocumentsPage({
@@ -8,11 +10,27 @@ export default async function CabinetDocumentsPage({
   const { locale } = await params;
   setRequestLocale(locale);
   const t = await getTranslations("cabinet");
+  const documents = await getMyDocuments();
 
   return (
     <div>
       <h2 className="mb-4 text-xl font-semibold">{t("documents")}</h2>
-      <p className="text-[var(--text-muted)]">{t("emptyDocuments")}</p>
+      {documents.length === 0 ? (
+        <p className="text-[var(--text-muted)]">{t("emptyDocuments")}</p>
+      ) : (
+        <ul className="space-y-3">
+          {documents.map((doc) => (
+            <li key={doc.id} className="rounded-[12px] border border-[var(--border)] bg-white px-4 py-3">
+              <a href={doc.href} className="font-semibold text-[var(--brand-700)]" target="_blank" rel="noreferrer">
+                {doc.title}
+              </a>
+              {doc.issuedAt ? (
+                <p className="mt-1 text-sm text-[var(--text-muted)]">{formatDate(doc.issuedAt, locale)}</p>
+              ) : null}
+            </li>
+          ))}
+        </ul>
+      )}
     </div>
   );
 }

apps/web/src/app/[locale]/cabinet/invoices/page.tsx

@@ -1,6 +1,6 @@
 import { Card } from "@/components/ui/Card";
-import { getMyBookings } from "@/lib/api";
-import { formatPrice } from "@/lib/utils";
+import { getMyInvoices } from "@/lib/api";
+import { formatDate, formatPrice } from "@/lib/utils";
 import { getTranslations, setRequestLocale } from "next-intl/server";
 
 export default async function CabinetInvoicesPage({
@@ -11,24 +11,27 @@ export default async function CabinetInvoicesPage({
   const { locale } = await params;
   setRequestLocale(locale);
   const t = await getTranslations("cabinet");
-  const bookings = await getMyBookings();
+  const invoices = await getMyInvoices();
 
   return (
     <div>
       <h2 className="mb-4 text-xl font-semibold">{t("invoices")}</h2>
-      {bookings.length === 0 ? (
+      {invoices.length === 0 ? (
         <p className="text-[var(--text-muted)]">{t("emptyInvoices")}</p>
       ) : (
         <div className="space-y-3">
-          {bookings.map((b) => (
-            <Card key={b.id} className="flex items-center justify-between gap-4">
+          {invoices.map((invoice) => (
+            <Card key={invoice.id} className="flex items-center justify-between gap-4">
               <div>
-                <p className="font-semibold">{b.serviceTitle}</p>
-                <p className="text-sm text-[var(--text-muted)]">{b.datetime}</p>
+                <p className="font-semibold">{invoice.title}</p>
+                <p className="text-sm text-[var(--text-muted)]">
+                  {invoice.number}
+                  {invoice.datetime ? ` · ${formatDate(invoice.datetime, locale)}` : ""}
+                </p>
               </div>
               <div className="text-right">
-                <p className="font-bold text-[var(--brand-700)]">{formatPrice(b.price, locale)}</p>
-                <p className="text-xs text-[var(--neutral-500)]">{b.paid ? t("paid") : t("unpaid")}</p>
+                <p className="font-bold text-[var(--brand-700)]">{formatPrice(invoice.amount, locale)}</p>
+                <p className="text-xs text-[var(--neutral-500)]">{invoice.paid ? t("paid") : t("unpaid")}</p>
               </div>
             </Card>
           ))}

apps/web/src/app/[locale]/cabinet/layout.tsx

@@ -1,5 +1,7 @@
 import { CabinetNav } from "@/components/cabinet/CabinetNav";
 import { namedPageMetadata } from "@/lib/page-metadata";
+import { me } from "@/lib/api";
+import { Link } from "@/i18n/routing";
 import { getTranslations, setRequestLocale } from "next-intl/server";
 import type { ReactNode } from "react";
 
@@ -22,6 +24,20 @@ export default async function CabinetLayout({
   const { locale } = await params;
   setRequestLocale(locale);
   const t = await getTranslations("cabinet");
+  const auth = await getTranslations("auth");
+  const user = await me();
+
+  if (!user) {
+    return (
+      <div className="mx-auto max-w-xl px-4 py-12 sm:px-6">
+        <h1 className="text-3xl font-bold text-[var(--neutral-900)]">{t("title")}</h1>
+        <p className="mt-4 text-[var(--text-muted)]">{t("loginHint")}</p>
+        <Link href="/login" className="mt-4 inline-block font-semibold text-[var(--brand-700)]">
+          {auth("login")}
+        </Link>
+      </div>
+    );
+  }
 
   return (
     <div className="mx-auto max-w-6xl px-4 py-12 sm:px-6">

apps/web/src/app/[locale]/gallery/page.tsx

@@ -35,7 +35,7 @@ export default async function GalleryPage({
               {/* eslint-disable-next-line @next/next/no-img-element */}
               <img src={item.image} alt={item.title} className="mx-auto block w-full object-cover object-center" />
               <figcaption className="bg-white px-3 py-2 text-sm text-[var(--neutral-600)]">
-                {item.title} · {item.category}
+                {item.title}
               </figcaption>
             </figure>
           ))}

apps/web/src/app/api/auth/login/route.ts

@@ -24,19 +24,6 @@ export async function POST(request: Request) {
     });
     return response;
   } catch {
-    // Demo login fallback when CMS is down
-    if (body.email && body.password) {
-      const response = NextResponse.json({
-        user: { id: "demo", email: body.email, name: "Пациент" },
-      });
-      response.cookies.set(AUTH_COOKIE, "demo-token", {
-        httpOnly: true,
-        sameSite: "lax",
-        path: "/",
-        maxAge: 60 * 60 * 24 * 7,
-      });
-      return response;
-    }
     return NextResponse.json({ message: "Login failed" }, { status: 500 });
   }
 }

apps/web/src/app/api/auth/me/route.ts

@@ -5,13 +5,7 @@ import { NextResponse } from "next/server";
 export async function GET() {
   const store = await cookies();
   const token = store.get(AUTH_COOKIE)?.value;
-  if (!token) return NextResponse.json({ user: null }, { status: 401 });
-
-  if (token === "demo-token") {
-    return NextResponse.json({
-      user: { id: "demo", email: "patient@example.com", name: "Пациент", phone: "+7" },
-    });
-  }
+  if (!token || token === "demo-token") return NextResponse.json({ user: null }, { status: 401 });
 
   try {
     const res = await fetch(`${CMS_URL}/api/users/me`, {
@@ -21,21 +15,21 @@ export async function GET() {
     const data = await res.json();
     return NextResponse.json(data, { status: res.status });
   } catch {
-    return NextResponse.json({
-      user: { id: "demo", email: "patient@example.com", name: "Пациент" },
-    });
+    return NextResponse.json({ user: null }, { status: 401 });
   }
 }
 
 export async function PATCH(request: Request) {
   const store = await cookies();
   const token = store.get(AUTH_COOKIE)?.value;
-  if (!token) return NextResponse.json({ message: "Unauthorized" }, { status: 401 });
+  if (!token || token === "demo-token") return NextResponse.json({ message: "Unauthorized" }, { status: 401 });
 
   const body = await request.json();
-  if (token === "demo-token") {
-    return NextResponse.json({ user: { id: "demo", ...body } });
-  }
+  const payload = {
+    ...body,
+    fullName: body.fullName || body.name,
+  };
+  delete payload.name;
 
   try {
     const res = await fetch(`${CMS_URL}/api/users/me`, {
@@ -44,11 +38,11 @@ export async function PATCH(request: Request) {
         Authorization: `Bearer ${token}`,
         "Content-Type": "application/json",
       },
-      body: JSON.stringify(body),
+      body: JSON.stringify(payload),
     });
     const data = await res.json();
     return NextResponse.json(data, { status: res.status });
   } catch {
-    return NextResponse.json({ user: { id: "demo", ...body } });
+    return NextResponse.json({ message: "Update failed" }, { status: 500 });
   }
 }

apps/web/src/app/api/auth/register/route.ts

@@ -4,24 +4,33 @@ import { NextResponse } from "next/server";
 export async function POST(request: Request) {
   const body = await request.json();
   try {
+    const payload = {
+      email: body.email,
+      password: body.password,
+      fullName: body.fullName || body.name,
+      phone: body.phone,
+      role: "patient",
+    };
     const res = await fetch(`${CMS_URL}/api/users`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body),
+      body: JSON.stringify(payload),
     });
     const data = await res.json();
     if (!res.ok) {
       return NextResponse.json(data, { status: res.status });
     }
 
-    // Auto-login after register
     const loginRes = await fetch(`${CMS_URL}/api/users/login`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ email: body.email, password: body.password }),
     });
     const loginData = await loginRes.json().catch(() => ({}));
-    const token = loginData.token || data.token || "demo-token";
+    const token = loginData.token || data.token;
+    if (!token) {
+      return NextResponse.json({ message: "Register succeeded but login failed" }, { status: 500 });
+    }
 
     const response = NextResponse.json({ user: data.doc || data.user || { email: body.email } });
     response.cookies.set(AUTH_COOKIE, token, {
@@ -33,15 +42,6 @@ export async function POST(request: Request) {
     });
     return response;
   } catch {
-    const response = NextResponse.json({
-      user: { id: "demo", email: body.email, name: body.name },
-    });
-    response.cookies.set(AUTH_COOKIE, "demo-token", {
-      httpOnly: true,
-      sameSite: "lax",
-      path: "/",
-      maxAge: 60 * 60 * 24 * 7,
-    });
-    return response;
+    return NextResponse.json({ message: "Register failed" }, { status: 500 });
   }
 }

apps/web/src/components/cabinet/BookingActions.tsx

@@ -95,15 +95,20 @@ export function BookingActions({ booking }: { booking: Booking }) {
           <p className="mt-1 text-sm text-[var(--text-muted)]">{booking.doctorName}</p>
           <p className="text-sm text-[var(--text-muted)]">{booking.branchName}</p>
           <p className="mt-2 text-sm font-medium">{formatDate(booking.datetime, locale)}</p>
+          {booking.source === "inquiry" ? (
+            <p className="mt-2 text-sm text-[var(--text-muted)]">{t("requestPending")}</p>
+          ) : null}
         </div>
         <div className="text-right">
           <p className="text-sm font-semibold text-[var(--brand-700)]">{statusLabel}</p>
-          <p className="mt-1 text-sm">{formatPrice(booking.price, locale)}</p>
-          <p className="text-xs text-[var(--neutral-500)]">{paid ? t("paid") : t("unpaid")}</p>
+          {booking.price ? <p className="mt-1 text-sm">{formatPrice(booking.price, locale)}</p> : null}
+          {booking.source === "inquiry" ? null : (
+            <p className="text-xs text-[var(--neutral-500)]">{paid ? t("paid") : t("unpaid")}</p>
+          )}
         </div>
       </div>
 
-      {status === "upcoming" ? (
+      {status === "upcoming" && booking.source !== "inquiry" ? (
         <div className="mt-4 flex flex-wrap gap-2">
           {!paid ? (
             <Button size="sm" onClick={pay} disabled={pending}>
@@ -161,7 +166,7 @@ export function BookingActions({ booking }: { booking: Booking }) {
 
       {reviewDone ? <p className="mt-3 text-sm text-[var(--success)]">{tr("thanks")}</p> : null}
 
-      {status === "upcoming" ? (
+      {status === "upcoming" && booking.source !== "inquiry" ? (
         <p className="mt-3 text-xs text-[var(--neutral-500)]">
           <Link href="/booking" className="underline">
             {t("reschedule")}

apps/web/src/lib/api.ts

@@ -1,7 +1,6 @@
 import { cookies } from "next/headers";
 import {
   demoBanners,
-  demoBookings,
   demoBranches,
   demoDoctors,
   demoGallery,
@@ -170,6 +169,83 @@ function asText(value: unknown): string {
   return "";
 }
 
+function isPatientToken(token: string | null): token is string {
+  return Boolean(token) && token !== "demo-token";
+}
+
+function relRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" ? (value as Record<string, unknown>) : null;
+}
+
+function mapInquiryBooking(raw: Record<string, unknown>): Booking {
+  const service = relRecord(raw.service);
+  const doctor = relRecord(raw.doctor);
+  const branch = relRecord(raw.branch);
+  return {
+    id: `inquiry-${raw.id}`,
+    serviceTitle: stripPriceListIndex(asText(service?.title)) || (doctor ? "Приём врача" : "Заявка на запись"),
+    doctorName: asText(doctor?.fullName) || "—",
+    branchName: asText(branch?.name),
+    datetime: asText(raw.createdAt),
+    status: asText(raw.status) === "done" ? "completed" : "upcoming",
+    price: Number(service?.price) || 0,
+    paid: false,
+    source: "inquiry",
+  };
+}
+
+function mapCmsBooking(raw: Record<string, unknown>): Booking {
+  const service = relRecord(raw.service);
+  const doctor = relRecord(raw.doctor);
+  const branch = relRecord(raw.branch);
+  const statusRaw = asText(raw.status);
+  const status: Booking["status"] =
+    statusRaw === "completed" ? "completed" : statusRaw === "cancelled" || statusRaw === "expired" ? "cancelled" : "upcoming";
+  return {
+    id: String(raw.id ?? ""),
+    serviceTitle: stripPriceListIndex(asText(service?.title)) || "Услуга",
+    doctorName: asText(doctor?.fullName) || "—",
+    branchName: asText(branch?.name),
+    datetime: asText(raw.startsAt) || asText(raw.createdAt),
+    status,
+    price: Number(raw.price) || Number(service?.price) || 0,
+    paid: asText(raw.paymentStatus) === "paid",
+    source: "booking",
+  };
+}
+
+function mapFavorite(raw: Record<string, unknown>): Service | Doctor | null {
+  const doctor = relRecord(raw.doctor);
+  if (doctor) {
+    return {
+      id: String(doctor.id ?? raw.id ?? ""),
+      slug: asText(doctor.slug),
+      name: asText(doctor.fullName) || asText(doctor.name),
+      specialty: asText(doctor.specialty) || asText(doctor.position),
+      experienceYears: Number(doctor.experienceYears) || 0,
+      photo: mediaSrc(doctor.photo),
+      bio: asText(doctor.bio),
+      rating: Number(doctor.rating) || 0,
+      reviewsCount: Number(doctor.reviewsCount) || 0,
+      services: [],
+      branchIds: [],
+    };
+  }
+  const service = relRecord(raw.service);
+  if (service) {
+    return {
+      id: String(service.id ?? raw.id ?? ""),
+      slug: asText(service.slug),
+      title: asText(service.title),
+      category: asText(service.groupTitle) || asText(service.category),
+      price: Number(service.price) || 0,
+      durationMin: Number(service.durationMin) || 0,
+      description: asText(service.description),
+    };
+  }
+  return null;
+}
+
 function mapIds(value: unknown): string[] {
   if (!Array.isArray(value)) return [];
   return value.map((item) => {
@@ -664,10 +740,24 @@ export async function getNewsBySlug(slug: string, locale = "ru"): Promise<NewsIt
 }
 
 export async function getGallery(locale = "ru"): Promise<GalleryItem[]> {
-  const query = withLocale(new URLSearchParams({ limit: "100", depth: "1" }), locale);
-  return cmsFetch<GalleryItem[]>(`/api/gallery?${query}`, { fallback: demoGallery }).then((data) =>
-    unwrapList(data as PayloadList<GalleryItem> | GalleryItem[]),
-  );
+  const query = withLocale(new URLSearchParams({ limit: "100", depth: "1", sort: "sortOrder" }), locale);
+  try {
+    const data = await cmsFetch<PayloadList<Record<string, unknown>>>(`/api/gallery?${query}`, {
+      cache: "no-store",
+    });
+    const items = unwrapList(data)
+      .map((raw) => ({
+        id: String(raw.id ?? ""),
+        title: asText(raw.title),
+        image: mediaSrc(raw.image),
+        category: asText(raw.category),
+      }))
+      .filter((item) => item.id && item.image);
+    if (items.length) return items;
+  } catch {
+    // fall through to demo
+  }
+  return demoGallery;
 }
 
 export async function getReviews(
@@ -788,7 +878,7 @@ export async function createInquiry(payload: {
     method: "POST",
     body: JSON.stringify(data),
     cache: "no-store",
-    timeoutMs: 20000,
+    timeoutMs: 30000,
   });
 }
 
@@ -852,11 +942,16 @@ export async function createReview(payload: {
 
 export async function getFavorites(): Promise<(Service | Doctor)[]> {
   const token = await getAuthToken();
-  return cmsFetch(`/api/favorites`, {
+  if (!isPatientToken(token)) return [];
+  return cmsFetch(`/api/favorites?depth=1&limit=50`, {
     token,
     cache: "no-store",
-    fallback: [],
-  }).then((data) => unwrapList(data as PayloadList<Service | Doctor> | (Service | Doctor)[]));
+    fallback: { docs: [] },
+  }).then((data) =>
+    unwrapList(data as PayloadList<Record<string, unknown>> | Record<string, unknown>[])
+      .map(mapFavorite)
+      .filter((item): item is Service | Doctor => Boolean(item)),
+  );
 }
 
 export async function addFavorite(payload: {
@@ -885,11 +980,78 @@ export async function removeFavorite(id: string): Promise<void> {
 
 export async function getMyBookings(): Promise<Booking[]> {
   const token = await getAuthToken();
-  return cmsFetch<Booking[]>(`/api/bookings?mine=true`, {
-    token,
-    cache: "no-store",
-    fallback: demoBookings,
-  }).then((data) => unwrapList(data as PayloadList<Booking> | Booking[]));
+  if (!isPatientToken(token)) return [];
+  const [inquiries, bookings] = await Promise.all([
+    cmsFetch<PayloadList<Record<string, unknown>>>(`/api/inquiries?limit=50&depth=2&sort=-createdAt`, {
+      token,
+      cache: "no-store",
+      fallback: { docs: [] },
+    }).catch(() => ({ docs: [] })),
+    cmsFetch<PayloadList<Record<string, unknown>>>(`/api/bookings?limit=50&depth=2&sort=-startsAt`, {
+      token,
+      cache: "no-store",
+      fallback: { docs: [] },
+    }).catch(() => ({ docs: [] })),
+  ]);
+  return [
+    ...unwrapList(inquiries).map(mapInquiryBooking),
+    ...unwrapList(bookings).map(mapCmsBooking),
+  ].sort((a, b) => Date.parse(b.datetime) - Date.parse(a.datetime));
+}
+
+export type CabinetDocument = {
+  id: string;
+  title: string;
+  href: string;
+  issuedAt?: string;
+};
+
+export async function getMyDocuments(): Promise<CabinetDocument[]> {
+  const token = await getAuthToken();
+  if (!isPatientToken(token)) return [];
+  const data = await cmsFetch<PayloadList<Record<string, unknown>>>(
+    `/api/documents?depth=1&limit=50&sort=-issuedAt&where[isPublic][equals]=false`,
+    { token, cache: "no-store", fallback: { docs: [] } },
+  ).catch(() => ({ docs: [] as Record<string, unknown>[] }));
+  return unwrapList(data)
+    .map((raw) => {
+      const file = raw.file && typeof raw.file === "object" ? (raw.file as Record<string, unknown>) : null;
+      const href = mediaSrc(file);
+      const title = asText(raw.title);
+      if (!title || !href) return null;
+      return { id: String(raw.id ?? ""), title, href, issuedAt: asText(raw.issuedAt) || undefined };
+    })
+    .filter((item): item is CabinetDocument => Boolean(item));
+}
+
+export type CabinetInvoice = {
+  id: string;
+  number: string;
+  title: string;
+  amount: number;
+  paid: boolean;
+  datetime: string;
+};
+
+export async function getMyInvoices(): Promise<CabinetInvoice[]> {
+  const token = await getAuthToken();
+  if (!isPatientToken(token)) return [];
+  const data = await cmsFetch<PayloadList<Record<string, unknown>>>(
+    `/api/invoices?depth=2&limit=50&sort=-createdAt`,
+    { token, cache: "no-store", fallback: { docs: [] } },
+  ).catch(() => ({ docs: [] as Record<string, unknown>[] }));
+  return unwrapList(data).map((raw) => {
+    const booking = relRecord(raw.booking);
+    const service = booking ? relRecord(booking.service) : null;
+    return {
+      id: String(raw.id ?? ""),
+      number: asText(raw.number) || String(raw.id ?? ""),
+      title: asText(service?.title) || asText(raw.number) || "Счёт",
+      amount: Number(raw.amount) || 0,
+      paid: asText(raw.status) === "paid",
+      datetime: asText(raw.paidAt) || asText(raw.createdAt),
+    };
+  });
 }
 
 export async function me(): Promise<{
@@ -899,13 +1061,22 @@ export async function me(): Promise<{
   phone?: string;
 } | null> {
   const token = await getAuthToken();
-  if (!token) return null;
+  if (!isPatientToken(token)) return null;
   try {
-    return await cmsFetch(`/api/users/me`, {
+    const data = await cmsFetch<Record<string, unknown>>(`/api/users/me`, {
       token,
       cache: "no-store",
-      fallback: { id: "demo", email: "patient@example.com", name: "Пациент", phone: "+7" },
     });
+    const user = relRecord(data.user) || data;
+    const email = asText(user.email);
+    const id = user.id != null ? String(user.id) : "";
+    if (!email || !id || id === "demo") return null;
+    return {
+      id,
+      email,
+      name: asText(user.fullName) || asText(user.name) || undefined,
+      phone: asText(user.phone) || undefined,
+    };
   } catch {
     return null;
   }

apps/web/src/lib/demo-data.ts

@@ -131,6 +131,7 @@ export type Booking = {
   status: "upcoming" | "completed" | "cancelled";
   price: number;
   paid: boolean;
+  source?: "inquiry" | "booking";
 };
 
 export const demoServices: Service[] = [

apps/web/src/messages/be.json

@@ -236,6 +236,8 @@
     "emptyFavorites": "Абранае пустое",
     "emptyDocuments": "Дакументаў пакуль няма",
     "emptyInvoices": "Рахункаў пакуль няма",
+    "loginHint": "Увайдзіце ў асабісты кабінет, каб убачыць свае запісы, дакументы і рахункі.",
+    "requestPending": "Заяўка прынята. Мы звяжамся з вамі, каб удакладніць дату і час.",
     "save": "Захаваць",
     "saved": "Захавана"
   },

apps/web/src/messages/en.json

@@ -236,6 +236,8 @@
     "emptyFavorites": "No favorites yet",
     "emptyDocuments": "No documents yet",
     "emptyInvoices": "No invoices yet",
+    "loginHint": "Sign in to see your bookings, documents and invoices. Each patient has a personal account.",
+    "requestPending": "Your request was received. We will contact you to confirm the date and time.",
     "save": "Save",
     "saved": "Saved"
   },

apps/web/src/messages/ky.json

@@ -236,6 +236,8 @@
     "emptyFavorites": "Тандалмалар бош",
     "emptyDocuments": "Азырынча документ жок",
     "emptyInvoices": "Азырынча эсеп жок",
+    "loginHint": "Жазууларыңызды, документтерди жана эсептерди көрүү үчүн жеке кабинетке кириңиз.",
+    "requestPending": "Өтүнмө кабыл алынды. Биз дата менен убакытты тактоо үчүн байланышабыз.",
     "save": "Сактоо",
     "saved": "Сакталды"
   },

apps/web/src/messages/ru.json

@@ -236,6 +236,8 @@
     "emptyFavorites": "Избранное пусто",
     "emptyDocuments": "Документов пока нет",
     "emptyInvoices": "Счетов пока нет",
+    "loginHint": "Войдите в личный кабинет, чтобы увидеть свои записи, документы и счета. У каждого пациента свой кабинет.",
+    "requestPending": "Заявка принята. Мы свяжемся с вами, чтобы уточнить дату и время визита.",
     "save": "Сохранить",
     "saved": "Сохранено"
   },

apps/web/src/messages/tg.json

@@ -236,6 +236,8 @@
     "emptyFavorites": "Дӯстдоштаҳо холӣ",
     "emptyDocuments": "Ҳанӯз ҳуҷҷат нест",
     "emptyInvoices": "Ҳанӯз ҳисоб нест",
+    "loginHint": "Ба кабинети шахсӣ ворид шавед, то дархостҳо, ҳуҷҷатҳо ва ҳисобҳои худро бубинед.",
+    "requestPending": "Дархост қабул шуд. Мо барои дақиқ кардани сана ва вақт бо шумо тамос мегирем.",
     "save": "Нигоҳ доштан",
     "saved": "Нигоҳ дошта шуд"
   },

apps/web/src/messages/zh.json

@@ -236,6 +236,8 @@
     "emptyFavorites": "暂无收藏",
     "emptyDocuments": "暂无文件",
     "emptyInvoices": "暂无账单",
+    "loginHint": "请登录个人账户查看您的预约、文件和账单。每位患者都有独立账户。",
+    "requestPending": "申请已受理。我们会联系您确认就诊日期和时间。",
     "save": "保存",
     "saved": "已保存"
   },

package.json

@@ -1,6 +1,6 @@
 {
   "name": "moniki-platnye-uslugi",
-  "version": "1.0.9",
+  "version": "1.0.10",
   "private": true,
   "scripts": {
     "dev": "pnpm -r --parallel dev",