Release Notes

v0.7.601

Native booking engine, session improvements, and UI refinements

This release introduces a fully native appointment booking engine across the admin portal, client portal, and public booking widget, replacing the previous third-party scheduling integration. It also brings meaningful session security improvements — including an idle screen lock instead of forced logout and a corrected Remember Me duration — along with a range of interface refinements across scheduling, search, and custom fields.

Features

  • Native appointment booking: Scheduling is now fully owned by Praxium across the admin portal, client portal, and public booking widget, replacing the previous third-party integration, with the system checking staff availability, location assignments, required skills, and service offerings before confirming any slot.
  • Appointment calendar views: The admin portal now includes a day and multi-day calendar view for appointments, with staff and location columns, a current-time indicator, status badges, and a quick-create slot popover, and staff and client detail pages also show their own appointment calendars.
  • Client portal booking with slot holds: When a client selects a slot in the portal, it is temporarily reserved so the same slot cannot be double-booked by another visitor at the same time.
  • Public booking widget: Visitors on the practice website can search for available slots by service, location, and staff member, verify their identity with a one-time code sent by email, and receive a confirmation with manage and reschedule links.
  • Services in global search: The admin command palette (Cmd-K) now includes a Services section alongside Clients and Staff, and location-scoped admins only see services offered at their locations.
  • Idle screen lock instead of forced logout: When a session is idle for 15 minutes, the screen is now locked with a password prompt rather than ending the session entirely, so work can be resumed without a full re-login after entering the password.
  • Remember Me shortened to 14 days: The maximum remembered session duration has been reduced from 30 to 14 days to limit exposure if a device is lost or stolen.
  • On-leave validation for custom fields: Required custom fields now show their first validation error as soon as the field is left, rather than waiting until the form is saved, across all field types in client, staff, appointment, service, and profile forms.
  • Unified slot grid across booking surfaces: Available appointment slots are now displayed through a shared component across admin creation, client portal booking, and the public widget, with consistent staff photos, grouped time intervals, and clear selection states.
  • Consistent control heights in list views: Search inputs, filter dropdowns, and action buttons in admin list views are now all the same height, giving the interface a more uniform appearance.
  • Phone prefix picker headings: The phone number country prefix picker now shows both a heading for suggested countries and a heading for all countries, matching the layout of the address country picker.

Fixes

  • Blank rates page on practice websites: Services without an explicit location link — meaning they are offered at all locations — were incorrectly hidden from the public rates and pricing pages, and the rates page now shows all applicable services at each location.
  • Date and time fields empty on edit: Date and date-time custom fields that had a stored value appeared empty when opening the edit form, and the stored value is now correctly pre-filled.
  • Remember Me sessions shortened unexpectedly: Every background session refresh was silently resetting the session to an 8-hour window, so a remembered session would expire far earlier than expected, and session refreshes now preserve the original duration.
  • Phone field format hint removed: The phone number field previously showed a format hint about international prefixes that no longer applied to the split-entry phone input, and the hint has been removed while the encryption notice still appears where applicable.
  • MFA session continuity after verification: Completing multi-factor authentication could leave the session in an inconsistent state requiring an extra login step, and session tokens are now correctly synchronized after MFA verification.
  • Login error messages in client portal: Certain failed login attempts in the client portal showed an overly specific error message, and the message is now generic to avoid revealing account details.

Security and reliability

  • Improved session protection: Several hardening measures were applied to session handling, including tighter controls around session token updates and more consistent behavior across all portals, reducing the risk of session-related issues without affecting normal use.
  • Reduced exposure window for remembered sessions: The maximum duration for a remembered login has been shortened, limiting the potential impact if a device or browser session is compromised.
  • Startup information tightened: A diagnostic detail that was logged at every server start has been removed, keeping internal system information more contained.