remember me with max age 30 days :).

Reviewed-on: http://178.131.50.201:3000/admin/dyolink/pulls/50
Reviewed-by: admin <admin@localhost>

README.md

@@ -1,6 +1,6 @@
 # Dyolink
 
-Monorepo: **NestJS** backend (`backend/`), **Next.js** frontend (`frontend/`), **Docker** stack under `infrastructure/`.
+Monorepo: **NestJS** backend (`backend/`), **Next.js** frontend (`frontend/`), **Docker** stack under `infrastructure/`..
 
 Local development: see **`backend/README.md`** and **`frontend/README.md`**.
 

backend/src/modules/auth/auth.controller.ts

@@ -11,6 +11,7 @@ import {
   HttpStatus,
   Get,
   Patch,
+  UnauthorizedException,
 } from '@nestjs/common';
 import type { Response } from 'express';
 import {
@@ -34,6 +35,8 @@ import { UpdateLanguageDto } from './dto/update-language.dto';
 @ApiTags('auth')
 @Controller('auth')
 export class AuthController {
+  private static readonly REMEMBER_ME_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+
   constructor(private readonly authService: AuthService) {}
 
   // =========================
@@ -55,9 +58,14 @@ export class AuthController {
     console.log('Login endpoint hit');
 
     const result = await this.authService.login(loginDto, req.user);
+    const rememberMe = Boolean(loginDto.rememberMe);
 
-    // ✅ SET COOKIES HERE
+    this.setAuthCookies(
-    this.setAuthCookies(res, result.data.accessToken, result.data.refreshToken);
+      res,
+      result.data.accessToken,
+      result.data.refreshToken,
+      rememberMe,
+    );
 
     return {
       success: true,
@@ -112,8 +120,11 @@ export class AuthController {
       organizationId
     );
 
-    // 🔥 Replace access token with org-scoped token
+    this.setAccessToken(
-    this.setAccessToken(res, result.data.accessToken);
+      res,
+      result.data.accessToken,
+      this.isPersistentSession(req),
+    );
 
     return {
       success: true,
@@ -173,6 +184,37 @@ export class AuthController {
     );
   }
 
+  // =========================
+  // REFRESH
+  // =========================
+  @Post('refresh')
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Refresh access token using refresh cookie' })
+  @ApiResponse({ status: 200, description: 'Access token refreshed' })
+  @ApiUnauthorizedResponse({ description: 'Invalid or missing refresh token' })
+  async refresh(@Req() req, @Res({ passthrough: true }) res: Response) {
+    const refreshToken = req?.cookies?.refreshToken;
+
+    if (!refreshToken) {
+      throw new UnauthorizedException('Refresh token not found');
+    }
+
+    const result = await this.authService.refreshToken(refreshToken);
+
+    this.setAccessToken(
+      res,
+      result.data.accessToken,
+      this.isPersistentSession(req),
+    );
+
+    return {
+      success: true,
+      data: {
+        accessToken: result.data.accessToken,
+      },
+    };
+  }
+
   // =========================
   // LOGOUT
   // =========================
@@ -207,45 +249,64 @@ export class AuthController {
   // =========================
   // 🔥 COOKIE HELPERS
   // =========================
+  private isPersistentSession(req: { cookies?: Record<string, string> }): boolean {
+    return req?.cookies?.authRemember === '1';
+  }
+
+  private baseCookieOptions() {
+    return {
+      httpOnly: true,
+      secure: false, // ⚠️ true in production (HTTPS)
+      sameSite: 'lax' as const,
+      path: '/',
+    };
+  }
+
   private setAuthCookies(
     res: Response,
     accessToken: string,
-    refreshToken: string
+    refreshToken: string,
+    rememberMe = false,
   ) {
-    this.setAccessToken(res, accessToken);
+    this.setAccessToken(res, accessToken, rememberMe);
-    this.setRefreshToken(res, refreshToken);
+    this.setRefreshToken(res, refreshToken, rememberMe);
+    this.setRememberMeFlag(res, rememberMe);
   }
 
-  private setAccessToken(res: Response, token: string) {
+  private setAccessToken(res: Response, token: string, rememberMe = false) {
     res.cookie('accessToken', token, {
-      httpOnly: true,
+      ...this.baseCookieOptions(),
-      secure: false, // ⚠️ true in production (HTTPS)
+      ...(rememberMe
-      sameSite: 'lax',
+        ? { maxAge: AuthController.REMEMBER_ME_MAX_AGE_MS }
-      path: '/',
+        : {}),
     });
   }
 
-  private setRefreshToken(res: Response, token: string) {
+  private setRefreshToken(res: Response, token: string, rememberMe = false) {
     res.cookie('refreshToken', token, {
-      httpOnly: true,
+      ...this.baseCookieOptions(),
-      secure: false,
+      ...(rememberMe
-      sameSite: 'lax',
+        ? { maxAge: AuthController.REMEMBER_ME_MAX_AGE_MS }
-      path: '/',
+        : {}),
     });
   }
 
+  private setRememberMeFlag(res: Response, rememberMe: boolean) {
+    if (rememberMe) {
+      res.cookie('authRemember', '1', {
+        ...this.baseCookieOptions(),
+        maxAge: AuthController.REMEMBER_ME_MAX_AGE_MS,
+      });
+      return;
+    }
+
+    res.clearCookie('authRemember', this.baseCookieOptions());
+  }
+
   private clearAuthCookies(res: Response) {
-    res.clearCookie('accessToken', {
+    const options = this.baseCookieOptions();
-      httpOnly: true,
+    res.clearCookie('accessToken', options);
-      secure: false,
+    res.clearCookie('refreshToken', options);
-      sameSite: 'lax',
+    res.clearCookie('authRemember', options);
-      path: '/',
-    });
-    res.clearCookie('refreshToken', {
-      httpOnly: true,
-      secure: false,
-      sameSite: 'lax',
-      path: '/',
-    });
   }
 }

backend/src/modules/auth/dto/login.dto.ts

@@ -1,5 +1,5 @@
 // backend/src/modules/auth/dto/login.dto.ts
-import { IsEmail, IsString, MinLength } from 'class-validator';
+import { IsBoolean, IsEmail, IsOptional, IsString, MinLength } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
 
 export class LoginDto {
@@ -20,4 +20,13 @@ export class LoginDto {
   @IsString()
   @MinLength(6, { message: 'Password must be at least 6 characters long' })
   password: string;
+
+  @ApiProperty({
+    description: 'Keep the user signed in for 30 days on this device',
+    required: false,
+    default: false,
+  })
+  @IsOptional()
+  @IsBoolean()
+  rememberMe?: boolean;
 }

backend/src/modules/organization/organization.controller.ts

@@ -64,6 +64,14 @@ export class OrganizationController {
     return this.organizationService.searchCounterpartOrganizations(req.user.id, organizationId, q);
   }
 
+  @Get('connections/pending-count')
+  @UseGuards(JwtAuthGuard)
+  @ApiOperation({ summary: 'Count incoming pending connection requests for sidebar badge' })
+  countPendingConnections(@Req() req: { user: { id: string; organizationId?: string } }) {
+    const organizationId = this.organizationService.getOrganizationIdFromUser(req.user);
+    return this.organizationService.countIncomingPendingConnections(req.user.id, organizationId);
+  }
+
   @Get('connections')
   @UseGuards(JwtAuthGuard)
   @ApiOperation({ summary: 'List counterpart connections for current organization' })

backend/src/modules/organization/organization.service.ts

@@ -160,6 +160,29 @@ export class OrganizationService {
     };
   }
 
+  /** Lightweight count for sidebar badge — incoming PENDING requests only. */
+  async countIncomingPendingConnections(userId: string, organizationId: string) {
+    const actor = await this.getActorMembership(userId, organizationId);
+    if (!actor || !this.canEditOrganizations(actor)) {
+      throw new ForbiddenException('You do not have permission to manage organizations');
+    }
+
+    const links = await this.prisma.organizationLink.findMany({
+      where: {
+        status: LinkStatus.PENDING,
+        OR: [{ organizationAId: organizationId }, { organizationBId: organizationId }],
+      },
+      select: { sharedDataTypes: true },
+    });
+
+    const count = links.filter((link) => {
+      const requesterOrgId = this.getRequesterOrganizationId(link.sharedDataTypes);
+      return requesterOrgId !== null && requesterOrgId !== organizationId;
+    }).length;
+
+    return { success: true, data: { count } };
+  }
+
   async listInvitationHistory(userId: string, organizationId: string) {
     const actor = await this.getActorMembership(userId, organizationId);
     if (!actor || !this.canEditOrganizations(actor)) {

frontend/package-lock.json

@@ -77,7 +77,6 @@
       "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.0",
         "@babel/generator": "^7.29.0",
@@ -2173,7 +2172,6 @@
       "integrity": "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "csstype": "^3.2.2"
       }
@@ -2233,7 +2231,6 @@
       "integrity": "sha512-XZzOmihLIr8AD1b9hL9ccNMzEMWt/dE2u7NyTY9jJG6YNiNthaD5XtUHVF2uCXZ15ng+z2hT3MVuxnUYhq6k1g==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@typescript-eslint/scope-manager": "8.57.0",
         "@typescript-eslint/types": "8.57.0",
@@ -2759,7 +2756,6 @@
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -3063,7 +3059,6 @@
       "integrity": "sha512-Ixm8tFfoKKIPYdCCKYTsqv+Fd4IJ0DQqMyEimo+pxUOMUR9cVPlwTrFt9Avu+3cb6Zp3mAzl+t1MrG2fxxKsxw==",
       "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@babel/types": "^7.26.0"
       }
@@ -3131,7 +3126,6 @@
         }
       ],
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.9.0",
         "caniuse-lite": "^1.0.30001759",
@@ -3714,7 +3708,6 @@
       "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
@@ -3900,7 +3893,6 @@
       "integrity": "sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@rtsao/scc": "^1.1.0",
         "array-includes": "^3.1.9",
@@ -5873,6 +5865,17 @@
         }
       }
     },
+    "node_modules/next-intl/node_modules/@swc/helpers": {
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "license": "Apache-2.0",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "tslib": "^2.8.0"
+      }
+    },
     "node_modules/next/node_modules/postcss": {
       "version": "8.4.31",
       "resolved": "https://registry.npmmirror.com/postcss/-/postcss-8.4.31.tgz",
@@ -6292,7 +6295,6 @@
       "resolved": "https://registry.npmmirror.com/react/-/react-19.2.3.tgz",
       "integrity": "sha512-Ku/hhYbVjOQnXDZFv2+RibmLFGwFdeeKHFcOTlrt7xplBnya5OGn/hIRDsqDiSUcfORsDC7MPxwork8jBwsIWA==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -6302,7 +6304,6 @@
       "resolved": "https://registry.npmmirror.com/react-dom/-/react-dom-19.2.3.tgz",
       "integrity": "sha512-yELu4WmLPw5Mr/lmeEpox5rw3RETacE++JgHqQzd2dg+YbJuat3jH4ingc+WPZhxaoFzdv9y33G+F7Nl5O0GBg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "scheduler": "^0.27.0"
       },
@@ -6315,7 +6316,6 @@
       "resolved": "https://registry.npmmirror.com/react-hook-form/-/react-hook-form-7.71.2.tgz",
       "integrity": "sha512-1CHvcDYzuRUNOflt4MOq3ZM46AronNJtQ1S7tnX6YN4y72qhgiUItpacZUAQ0TyWYci3yz1X+rXaSxiuEm86PA==",
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=18.0.0"
       },
@@ -7008,7 +7008,6 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -7171,7 +7170,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -7467,7 +7465,6 @@
       "resolved": "https://registry.npmmirror.com/zod/-/zod-4.3.6.tgz",
       "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }

frontend/src/app/[locale]/(dashboard)/organizations/page.tsx

@@ -5,6 +5,7 @@ import { useTranslations } from 'next-intl';
 import { useToast } from '@/lib/hooks/useToast';
 import { Check, Trash2, UserPlus, X } from 'lucide-react';
 import { useAuth } from '@/lib/hooks/useAuth';
+import { notifyPendingConnectionsChanged } from '@/lib/hooks/usePendingConnectionsCount';
 import { useOrganizationInviteLinkCopy } from '@/lib/hooks/useOrganizationInviteLinkCopy';
 import {
   organizationApi,
@@ -254,6 +255,7 @@ export default function OrganizationsPage() {
       toast.showSuccess(
         action === 'ACCEPT' ? t('successAccepted') : t('successDeclined'),
       );
+      notifyPendingConnectionsChanged();
       await loadList();
     } catch (e) {
       toast.showError(formatApiMessage(e));

frontend/src/app/[locale]/(public)/login/page.tsx

@@ -9,6 +9,7 @@ import { useTranslations } from 'next-intl';
 import { Link } from '@/i18n/navigation';
 import { Mail, Lock } from 'lucide-react';
 import { useAuth } from '@/lib/hooks/useAuth';
+import { getRememberedEmail } from '@/lib/auth/rememberMe';
 import { Button } from '@/components/ui/shared/Button';
 import { Input } from '@/components/ui/shared/Input';
 import { TopBarControls } from '@/components/ui/shared/TopBarControls';
@@ -16,6 +17,7 @@ import { TopBarControls } from '@/components/ui/shared/TopBarControls';
 type LoginForm = {
   email: string;
   password: string;
+  rememberMe: boolean;
 };
 
 export default function LoginPage() {
@@ -25,12 +27,14 @@ export default function LoginPage() {
   const { login, isLoading, user, isAuthReady } = useAuth();
   const router = useRouter();
   const [error, setError] = useState<string | null>(null);
+  const [savedEmail] = useState(() => getRememberedEmail());
 
   const loginSchema = useMemo(
     () =>
       z.object({
         email: z.string().email(tValidation('emailInvalid')),
         password: z.string().min(1, tValidation('passwordRequired')),
+        rememberMe: z.boolean(),
       }),
     [tValidation],
   );
@@ -47,12 +51,16 @@ export default function LoginPage() {
     formState: { errors },
   } = useForm<LoginForm>({
     resolver: zodResolver(loginSchema),
+    defaultValues: {
+      email: savedEmail,
+      rememberMe: Boolean(savedEmail),
+    },
   });
 
   const onSubmit = async (data: LoginForm) => {
     try {
       setError(null);
-      await login(data.email, data.password);
+      await login(data.email, data.password, data.rememberMe);
     } catch (err: unknown) {
       const message = err instanceof Error ? err.message : t('invalidCredentials');
       setError(message || t('invalidCredentials'));
@@ -112,9 +120,9 @@ export default function LoginPage() {
               <div className="flex items-center">
                 <input
                   id="remember-me"
-                  name="remember-me"
                   type="checkbox"
                   className="h-4 w-4 rounded border-border bg-background-secondary text-primary focus:ring-primary/40"
+                  {...register('rememberMe')}
                 />
                 <label htmlFor="remember-me" className="ml-2 block text-sm text-text-secondary">
                   {t('rememberMe')}

frontend/src/components/ui/organizations/InvitationHistoryDialog.tsx

@@ -53,7 +53,7 @@ export function InvitationHistoryDialog({
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-black/50">
       <div
-        className="w-full max-w-[min(56rem,calc(100vw-17rem))] max-h-[90vh] overflow-y-auto rounded-[var(--radius-md)] border border-border bg-background-secondary p-6 shadow-xl space-y-4"
+        className="w-full max-w-[min(56rem,calc(100vw-15rem))] max-h-[90vh] overflow-y-auto rounded-[var(--radius-md)] border border-border bg-background-secondary p-6 shadow-xl space-y-4"
         role="dialog"
         aria-modal="true"
         aria-labelledby="invitation-history-title"

frontend/src/components/ui/patient/CreatePatientModal.tsx

@@ -107,7 +107,7 @@ export function CreatePatientModal({
         }}
       >
         <div
-          className="surface-card w-full max-w-[min(56rem,calc(100vw-17rem))] p-5 space-y-4 shadow-xl"
+          className="surface-card w-full max-w-[min(56rem,calc(100vw-15rem))] p-5 space-y-4 shadow-xl"
           role="dialog"
           aria-modal="true"
           aria-labelledby="create-patient-dialog-title"

frontend/src/components/ui/shared/Sidebar.tsx

@@ -13,6 +13,7 @@ import {
   CreditCard,
 } from 'lucide-react';
 import { useAuth } from '@/lib/hooks/useAuth';
+import { usePendingConnectionsCount } from '@/lib/hooks/usePendingConnectionsCount';
 import { canAccessAppointmentsSection, canViewTab } from '@/components/shared/permissions';
 import {
   counterpartOrganizationType,
@@ -24,6 +25,8 @@ function Sidebar() {
   const tCommon = useTranslations('common');
   const pathname = usePathname();
   const { currentOrganization } = useAuth();
+  const pendingConnectionsCount = usePendingConnectionsCount();
+
 
   const menu = useMemo(
     () => [
@@ -56,7 +59,7 @@ function Sidebar() {
   );
 
   return (
-    <aside className="w-64 bg-background-secondary/90 border-r border-border text-text-primary flex flex-col">
+    <aside className="w-56 min-w-56 shrink-0 bg-background-secondary/90 border-r border-border text-text-primary flex flex-col">
       <div className="h-[71px] px-4 flex items-center">
         <h1 className="text-lg font-medium tracking-tight">{tCommon('appName')}</h1>
       </div>
@@ -66,6 +69,8 @@ function Sidebar() {
         {visibleMenu.map((item) => {
           const Icon = item.icon;
           const isActive = pathname === item.path;
+          const showPendingBadge =
+            item.path === '/organizations' && pendingConnectionsCount > 0;
 
           return (
             <Link
@@ -79,7 +84,15 @@ function Sidebar() {
               }`}
             >
               <Icon className="w-[18px] h-[18px] icon-flat" />
-              <span className="text-sm">{item.name}</span>
+              <span className="text-sm flex-1">{item.name}</span>
+              {showPendingBadge && (
+                <span
+                  className="min-w-[1.25rem] rounded-full bg-badge-warning-bg px-1.5 py-0.5 text-center text-xs font-medium tabular-nums text-badge-warning-fg border border-badge-warning-border"
+                  aria-label={`${pendingConnectionsCount} pending connection requests`}
+                >
+                  {pendingConnectionsCount}
+                </span>
+              )}
             </Link>
           );
         })}

frontend/src/components/ui/treatment/TreatmentPreviewDialog.tsx

@@ -66,7 +66,7 @@ export function TreatmentPreviewDialog({
   return (
     <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-black/50">
       <div
-        className="w-full max-w-[min(56rem,calc(100vw-17rem))] max-h-[90vh] overflow-y-auto rounded-[var(--radius-md)] border border-border bg-background-secondary p-6 shadow-xl space-y-4"
+        className="w-full max-w-[min(56rem,calc(100vw-15rem))] max-h-[90vh] overflow-y-auto rounded-[var(--radius-md)] border border-border bg-background-secondary p-6 shadow-xl space-y-4"
         role="dialog"
         aria-modal="true"
         aria-labelledby="treatment-preview-title"

frontend/src/lib/api/client.ts

@@ -26,6 +26,18 @@ function isPublicInvitationRequest(url: string | undefined): boolean {
   );
 }
 
+/** Session bootstrap / auth endpoints where 401 means "not logged in", not "retry refresh". */
+function shouldSkipRefreshRetry(url: string | undefined): boolean {
+  if (!url) return false;
+  return (
+    url.includes('/auth/profile') ||
+    url.includes('/auth/refresh') ||
+    url.includes('/auth/login') ||
+    url.includes('/auth/register') ||
+    url.includes('/auth/logout')
+  );
+}
+
 // ❌ REMOVE request interceptor completely (no Authorization header)
 
 // ✅ Response interceptor
@@ -37,7 +49,8 @@ apiClient.interceptors.response.use(
     if (
       error.response?.status === 401 &&
       !originalRequest._retry &&
-      !isPublicInvitationRequest(originalRequest.url)
+      !isPublicInvitationRequest(originalRequest.url) &&
+      !shouldSkipRefreshRetry(originalRequest.url)
     ) {
       originalRequest._retry = true;
 

frontend/src/lib/api/organization.ts

@@ -46,6 +46,11 @@ export const organizationApi = {
     return response.data;
   },
 
+  pendingIncomingCount: async (): Promise<{ success: boolean; data: { count: number } }> => {
+    const response = await apiClient.get('/organizations/connections/pending-count');
+    return response.data;
+  },
+
   listInvitations: async (): Promise<{
     success: boolean;
     data: { items: OrganizationInvitationHistoryItemDto[] };

frontend/src/lib/auth/rememberMe.ts

@@ -0,0 +1,14 @@
+const REMEMBERED_EMAIL_KEY = 'rememberedEmail';
+
+export function getRememberedEmail(): string {
+  if (typeof window === 'undefined') return '';
+  return localStorage.getItem(REMEMBERED_EMAIL_KEY) ?? '';
+}
+
+export function setRememberedEmail(email: string): void {
+  localStorage.setItem(REMEMBERED_EMAIL_KEY, email);
+}
+
+export function clearRememberedEmail(): void {
+  localStorage.removeItem(REMEMBERED_EMAIL_KEY);
+}

frontend/src/lib/hooks/useAuth.tsx

@@ -4,6 +4,11 @@ import React, { createContext, useCallback, useContext, useEffect, useMemo, useS
 import { useTranslations } from 'next-intl';
 import { useRouter } from '@/i18n/navigation';
 import { authApi } from '@/lib/api/auth';
+import {
+  clearRememberedEmail,
+  getRememberedEmail,
+  setRememberedEmail,
+} from '@/lib/auth/rememberMe';
 import { User, Organization } from '@/types/organization';
 import { isAppLocale, getLocaleFromPathname } from '@/i18n/routing';
 
@@ -22,7 +27,7 @@ interface AuthContextType {
     organizationEmail: string,
     organizationType: 'CLINIC' | 'LAB'
   ) => Promise<void>;
-  login: (email: string, password: string) => Promise<void>;
+  login: (email: string, password: string, rememberMe?: boolean) => Promise<void>;
   logout: () => Promise<void>;
   selectOrganization: (orgId: string) => Promise<void>;
   createOrganization: (
@@ -107,8 +112,16 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
           setCurrentOrganization(null);
         }
       }
-    } catch (err) {
+    } catch (err: unknown) {
+      const status =
+        (err as { statusCode?: number })?.statusCode ??
+        (err as { response?: { status?: number } })?.response?.status;
+
+      // 401 on profile is expected when there is no session — not an application error.
+      if (status !== 401) {
         console.error('Auth check failed:', err);
+      }
+
       // Only clear state — DO NOT redirect here
       setUser(null);
       setOrganizations([]);
@@ -188,12 +201,22 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   }, [applyUrlLocaleToUser, router, t]);
 
   // ✅ LOGIN
-  const login = useCallback(async (email: string, password: string) => {
+  const login = useCallback(async (
+    email: string,
+    password: string,
+    rememberMe = false,
+  ) => {
     try {
       setIsLoading(true);
       setError(null);
 
-      const response = await authApi.login({ email, password });
+      const response = await authApi.login({ email, password, rememberMe });
+
+      if (rememberMe) {
+        setRememberedEmail(email);
+      } else {
+        clearRememberedEmail();
+      }
 
       const userData = await applyUrlLocaleToUser(response.data.user);
       setUser(userData);
@@ -227,7 +250,11 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     } catch (err) {
       console.error('Logout API failed:', err);
     } finally {
+      const rememberedEmail = getRememberedEmail();
       localStorage.clear();
+      if (rememberedEmail) {
+        setRememberedEmail(rememberedEmail);
+      }
       setUser(null);
       setOrganizations([]);
       setCurrentOrganization(null);

frontend/src/lib/hooks/usePendingConnectionsCount.ts

@@ -0,0 +1,48 @@
+'use client';
+
+import { useCallback, useEffect, useState } from 'react';
+import { usePathname } from 'next/navigation';
+import { canViewTab } from '@/components/shared/permissions';
+import { organizationApi } from '@/lib/api/organization';
+import { useAuth } from '@/lib/hooks/useAuth';
+
+/** Tell the sidebar badge to refetch after accept/decline on the organizations page. */
+export function notifyPendingConnectionsChanged() {
+  window.dispatchEvent(new Event('pending-connections-changed'));
+}
+
+/**
+ * Sidebar-only: fetches GET /organizations/connections/pending-count.
+ * Independent from the organizations tab list API.
+ */
+export function usePendingConnectionsCount(): number {
+  const pathname = usePathname();
+  const { currentOrganization } = useAuth();
+  const [count, setCount] = useState(0);
+
+  const fetchCount = useCallback(async () => {
+    if (!currentOrganization?.id || !canViewTab(currentOrganization, 'TAB_ORGANIZATIONS_READ')) {
+      setCount(0);
+      return;
+    }
+
+    try {
+      const res = await organizationApi.pendingIncomingCount();
+      setCount(res.data.count);
+    } catch {
+      setCount(0);
+    }
+  }, [currentOrganization]);
+
+  useEffect(() => {
+    void fetchCount();
+  }, [fetchCount, pathname]);
+
+  useEffect(() => {
+    const onChanged = () => void fetchCount();
+    window.addEventListener('pending-connections-changed', onChanged);
+    return () => window.removeEventListener('pending-connections-changed', onChanged);
+  }, [fetchCount]);
+
+  return count;
+}

frontend/src/types/auth.ts

@@ -22,4 +22,5 @@ export interface TrialRegistrationData {
 export interface LoginData {
   email: string;
   password: string;
+  rememberMe?: boolean;
 }