Session log — Doctor authentication for medilearn.africa recordings

12 June 2026, morning · Medilearn · Hasmukh with Claude · auto-published from the local journal entry. A polished narrative version can be requested in any future Claude session.

Summary

An overnight-and-afternoon session that took the medilearn.africa doctor verification system from "built but quietly broken" to live and public. It began as a planning question, but inspection showed the 9 June build was already in place and that the 10 June platform update had silently broken all doctor sign-in, sign-up and approval buttons; the ML Doctors plugin was repaired, rebuilt as passwordless (emailed code or link, no passwords ever) at Hasmukh's request, and then extended with twelve hardening improvements as version 0.5.0. The session also published the missing privacy notice, confirmed the Vimeo recordings were already properly locked (correcting an earlier wrong claim made that same morning), patched the broken activity log, and added Doctors to the main menu, so real doctors can now find the page and register. Catch-up note reconstructed on 12 June 2026 from the saved conversation.

Decisions

Doctors will never set a password. Sign-in is by emailed six-digit code or one-click link, with the manual HPCSA check unchanged (Hasmukh chose this over repairing the password-based flow).
Keep the proven parts of the existing ML Doctors build (sign-up capture, approval list, recording lock) and replace only the sign-in layer.
The sign-up form captures First name and Surname separately, to match how the HPCSA register is searched, with matching columns in the approval list.
All twelve proposed registration and verification improvements approved in one go ("Run 1 to 12").
Hasmukh approved scheduling the weekly reminder on the hosting, and deleting the test applicants Dr Test and Dr Jane Smith (his and Kenn's accounts kept deliberately).
Hasmukh instructed that the broken activity log be fixed directly rather than left for Kenn, and that the Doctors page go into the site menu.
The site connection is to carry the name Hasmukh gave the token, so it was renamed from "novamira-medilearn-africa" to "newpagemotor-medilearn".

Changes made

Repaired the ML Doctors plugin on medilearn.africa after the 10 June platform update had silently killed sign-in, sign-up and the Approve and Decline buttons (no real doctors affected; previous version backed up on the hosting; every flow retested live).
Changed the sign-up form at medilearn.africa/doctors to ask First name and Surname separately; the ML Doctors approval list now shows First name, Surname, Email and MP number as separate columns.
Rebuilt the plugin passwordless (v0.4.0): registration with no password; sign-in by emailed six-digit code or one-click link; codes work once, expire after 15 minutes and lock after five wrong guesses; approval emails a seven-day sign-in link; all plugin email moved to the site's proper email account, which fixed the missing approval emails. Proven on two real inboxes (Kenn and Hasmukh both signed in).
Reworked the Revoke button to confirm on itself ("Sure? Click again") instead of a browser pop-up; traced the admin lockout to a doctor test sign-in replacing the admin session in the same browser, and removed the "Hasmukh Mobilearn" test account to restore admin access.
Deployed v0.5.0 with the twelve improvements: one account per MP number; MP numbers tidied and validated at entry; instant "new doctor application" alert email; polite decline email with a resubmission path (reopens as "corrected"); a Check on HPCSA button beside each applicant; a verification note saved with each approval; and warning flags for throwaway email addresses, shared internet addresses and odd MP numbers.
Published the privacy notice at medilearn.africa/privacy, so the consent tick box on the sign-up form finally links to a real page.
Scheduled the weekly reminder on the hosting: every Monday at 08:00 South African time, an email lists anyone still awaiting approval.
Deleted the test applicants Dr Test and Dr Jane Smith; the doctors list now holds only Hasmukh and Kenn.
Checked Vimeo from inside the account: the recordings were already hidden from Vimeo and embeddable only on medilearn.africa, with account defaults stricter still, so nothing needed changing. The morning's claim that they were publicly watchable was wrong, and the plan document and notes were corrected.
Patched the EP Audit Log plugin broken by the same 10 June platform update and proved it recording again; backup kept on the hosting and a copy saved in the Doctor Verification folder.
Added "Doctors" to the main site menu, between Contact and the Register button, checked live on the home and past events pages.
Renamed the site connection to newpagemotor-medilearn in the settings (backup taken first).
Saved the operator one-pager "Doctor Approvals Checklist" in the Doctor Verification folder, set a yearly calendar reminder (every 12 June) to re-check approved doctors against the HPCSA register, and confirmed the domain carries all three email vouching records.

Follow-ups

Tell Kenn about the activity log fault so a proper fix lands upstream; an official update could overwrite the local patch, and the saved copy in the Doctor Verification folder can be re-applied if the symptoms return.
Hasmukh to read the published privacy notice and say if any wording should change.
Tighten the domain's email policy a notch once real mail has flowed for a while.
Optional small addition if wanted: an email to a doctor when their access is revoked (revoking is currently silent).
Keep an eye on the plugin's page-load work as doctor numbers grow; fine at current scale.