refactor(tenant): make EntityContextResolver the single context resolver
Phase 1 of the tenant-marking series. The "which environment is this user working in?" decision was reimplemented in six places, each reading UserActiveContext.db_uuid and then guessing whether the uuid belongs to a clinic or a doctor. Every copy was a place the roles could silently diverge. EntityContextResolver already encoded the right precedence (explicit clinic_uuid > stored active context > role) but only five files used it, and it did not recognise secretaries at all: canActInClinic accepted admins, clinic owners and member doctors, so a secretary's active clinic context always collapsed to unknown. That gap is why SecretaryAccessChecker carried its own copy of the logic. - canActInClinic now also accepts an active DoctorSecretary relation, and a matching canActForDoctor covers the personal-practice branch. - AppointmentAccessChecker, ClinicDoctorAccessChecker, SecretaryAccessChecker, PatientRecordScopeResolver, MyAppointmentsController and the secretary dashboard all resolve through it now. - PatientRecordScopeResolver keeps only its real responsibility: which doctors' patients are visible inside the resolved environment. - The resolver answers "where"; ClinicDoctorPermissionChecker and SecretaryPermissionChecker still answer "what may you do". Left deliberately untouched, with the reason recorded at each site: SubscriptionController, InventoryController and TenantTagController check ROLE_DOCTOR unconditionally and ignore the active context, so a member doctor sees personal inventory/tags/subscription even inside a clinic. Switching them changes what users see, which is a product decision, not a refactor. AuthController keeps its repository because it writes the active context. tests/ApiTestCase now seeds the "free" subscription plan. db_test had no such row, so getEffectivePlan returned null, every hasFeature() was false and 83 tests across Patient, ClinicService, Insurance and Appointment failed with 403. No schema, route, request, response or error code changed. Tests: 813 passing (was 730 passing / 83 failing). PHPStan clean on all changed files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
hamed
@@ -3,18 +3,20 @@
|
||||
namespace App\Patient\Security;
|
||||
|
||||
use App\Auth\Entity\User;
|
||||
use App\Auth\Repository\UserActiveContextRepository;
|
||||
use App\Clinic\Repository\ClinicRepository;
|
||||
use App\Clinic\Entity\Clinic;
|
||||
use App\Clinic\Security\ClinicDoctorPermissionChecker;
|
||||
use App\Doctor\Repository\DoctorRepository;
|
||||
use App\Secretary\Repository\DoctorSecretaryRepository;
|
||||
use App\Shared\Context\EntityContext;
|
||||
use App\Shared\Context\EntityContextResolver;
|
||||
|
||||
/**
|
||||
* «پروندههای کدام محیط را این کاربر میبیند؟»
|
||||
* «پروندههای کدام محیط را این کاربر میبیند، و درون آن محیط محدود به بیمارانِ
|
||||
* کدام پزشکان؟»
|
||||
*
|
||||
* پیش از این، نگاشت تکمقصدی بود: نقش پزشک همیشه به پروندهٔ مطب شخصی میرسید، پس
|
||||
* پزشکِ دعوتشده به کلینیک پروندههای بیمارانش در آن کلینیک را اصلاً نمیدید. محیط
|
||||
* فعال (UserActiveContext) تعیینکننده است، دقیقاً مثل EntityContextResolver.
|
||||
* پرسش اول را EntityContextResolver جواب میدهد؛ مسئولیت منحصربهفرد این کلاس
|
||||
* فقط پرسش دوم است. پروندهٔ کلینیکی per-بیمار است نه per-پزشک، پس محدودسازیِ
|
||||
* پزشکِ عضو و منشی نمیتواند روی خودِ محیط باشد.
|
||||
*
|
||||
* «پایان همکاری» منبع حقیقتِ جدا ندارد: ClinicDoctorPermission/DoctorSecretary با
|
||||
* active=false خودشان رد میکنند.
|
||||
@@ -24,79 +26,52 @@ class PatientRecordScopeResolver
|
||||
private const RESOURCE = 'patients';
|
||||
|
||||
public function __construct(
|
||||
private readonly EntityContextResolver $contextResolver,
|
||||
private readonly DoctorRepository $doctorRepo,
|
||||
private readonly ClinicRepository $clinicRepo,
|
||||
private readonly UserActiveContextRepository $contextRepo,
|
||||
private readonly DoctorSecretaryRepository $secretaryRepo,
|
||||
private readonly ClinicDoctorPermissionChecker $clinicPermissions,
|
||||
) {}
|
||||
|
||||
public function resolve(User $user): PatientRecordScope
|
||||
{
|
||||
if ($user->hasRole('ROLE_DOCTOR')) {
|
||||
return $this->forDoctorUser($user);
|
||||
$context = $this->contextResolver->resolve($user);
|
||||
|
||||
if ($context->isClinic()) {
|
||||
return $this->restrictionInClinic($user, $context->clinic);
|
||||
}
|
||||
|
||||
if ($user->hasRole('ROLE_CLINIC')) {
|
||||
$clinic = $this->clinicRepo->findByUser($user);
|
||||
|
||||
return PatientRecordScope::forClinic($clinic?->getId());
|
||||
}
|
||||
|
||||
if ($user->hasRole('ROLE_SECRETARY')) {
|
||||
return $this->forSecretary($user);
|
||||
}
|
||||
|
||||
return PatientRecordScope::unknown();
|
||||
// پزشکی که هنوز رکورد Doctor ندارد، محیطش «doctor» با شناسهٔ تهی است —
|
||||
// assertPatientGate همان را ۴۰۳ میکند.
|
||||
return $context->type === EntityContext::TYPE_DOCTOR
|
||||
? PatientRecordScope::forDoctor($context->id)
|
||||
: PatientRecordScope::unknown();
|
||||
}
|
||||
|
||||
/**
|
||||
* پزشک در محیط کلینیکِ فعالش پروندههای همان کلینیک را میبیند — محدود به
|
||||
* بیمارانِ خودش. بیرون از آن محیط، فقط پروندهٔ مطب شخصی.
|
||||
* مالک کلینیک همهٔ پروندهها را میبیند؛ پزشکِ عضو فقط بیمارانِ خودش؛ منشی
|
||||
* فقط بیمارانِ پزشکانِ تخصیصیافته به او — عضویت در کلینیک بهتنهایی یعنی
|
||||
* منشیِ یک پزشک پروندهٔ بیماران پزشک دیگر را ببیند.
|
||||
*/
|
||||
private function forDoctorUser(User $user): PatientRecordScope
|
||||
private function restrictionInClinic(User $user, Clinic $clinic): PatientRecordScope
|
||||
{
|
||||
$doctor = $this->doctorRepo->findByUser($user);
|
||||
if ($doctor === null) {
|
||||
return PatientRecordScope::forDoctor(null);
|
||||
}
|
||||
|
||||
$dbUuid = $this->contextRepo->findByUser($user)?->getDbUuid();
|
||||
$clinic = $dbUuid !== null ? $this->clinicRepo->findByUuid($dbUuid) : null;
|
||||
|
||||
if ($clinic === null || !$clinic->hasDoctor($doctor)) {
|
||||
return PatientRecordScope::forDoctor($doctor->getId());
|
||||
}
|
||||
|
||||
// مالک کلینیکی که خودش پزشک هم هست، محدود نمیشود.
|
||||
if ($clinic->getUser()->getId() === $user->getId()) {
|
||||
return PatientRecordScope::forClinic($clinic->getId());
|
||||
}
|
||||
|
||||
if (!$this->clinicPermissions->can($user, $clinic, self::RESOURCE, 'view')) {
|
||||
return PatientRecordScope::forDoctor($doctor->getId());
|
||||
}
|
||||
|
||||
return PatientRecordScope::forClinicRestrictedToDoctors($clinic->getId(), [$doctor->getId()]);
|
||||
}
|
||||
|
||||
/**
|
||||
* منشی در محیط فعالش. در کلینیک، فقط بیمارانِ پزشکانِ تخصیصیافته به او —
|
||||
* عضویت در کلینیک بهتنهایی یعنی منشیِ یک پزشک پروندهٔ بیماران پزشک دیگر را ببیند.
|
||||
*/
|
||||
private function forSecretary(User $user): PatientRecordScope
|
||||
{
|
||||
$dbUuid = $this->contextRepo->findByUser($user)?->getDbUuid();
|
||||
if ($dbUuid === null) {
|
||||
return PatientRecordScope::unknown();
|
||||
}
|
||||
|
||||
$clinic = $this->clinicRepo->findByUuid($dbUuid);
|
||||
if ($clinic !== null) {
|
||||
if ($this->secretaryRepo->findActiveBySecretaryForClinic($user, $clinic) === null) {
|
||||
if ($user->hasRole('ROLE_DOCTOR')) {
|
||||
$doctor = $this->doctorRepo->findByUser($user);
|
||||
if ($doctor === null) {
|
||||
return PatientRecordScope::unknown();
|
||||
}
|
||||
|
||||
if (!$this->clinicPermissions->can($user, $clinic, self::RESOURCE, 'view')) {
|
||||
return PatientRecordScope::forDoctor($doctor->getId());
|
||||
}
|
||||
|
||||
return PatientRecordScope::forClinicRestrictedToDoctors($clinic->getId(), [$doctor->getId()]);
|
||||
}
|
||||
|
||||
if ($user->hasRole('ROLE_SECRETARY')) {
|
||||
$doctorIds = array_map(
|
||||
fn($d) => $d->getId(),
|
||||
$this->secretaryRepo->findDoctorsBySecretaryInClinic($user, $clinic),
|
||||
@@ -105,11 +80,6 @@ class PatientRecordScopeResolver
|
||||
return PatientRecordScope::forClinicRestrictedToDoctors($clinic->getId(), $doctorIds);
|
||||
}
|
||||
|
||||
$doctor = $this->doctorRepo->findByUuid($dbUuid);
|
||||
if ($doctor !== null && $this->secretaryRepo->findActiveBySecretaryForDoctor($user, $doctor) !== null) {
|
||||
return PatientRecordScope::forDoctor($doctor->getId());
|
||||
}
|
||||
|
||||
return PatientRecordScope::unknown();
|
||||
return PatientRecordScope::forClinic($clinic->getId());
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user