feat(permissions): single registry for secretary and clinic-doctor permissions
The list of permissionable resources was duplicated in six places that had already diverged: both permission entities, three admin UI files and the SecretaryPermissions TypeScript interface. Adding a resource meant editing all of them, so new pages borrowed an unrelated resource instead — five resource pages sat on appointment_settings.view and treatment-cases on appointments.view. PermissionCatalog is now the only place that says which resources and actions exist. Each entity keeps its own DEFAULT_PERMISSIONS, but as role policy only; a test asserts those defaults never name a resource the registry doesn't have. getPermissions() merges the stored JSON over the role defaults, so a resource added to the registry later resolves to the role default instead of silently false for every existing row. Explicitly stored values are never overwritten, and no data migration is needed. Two asymmetries fixed along the way: - ClinicDoctorPermission validated writes against its own DEFAULT_PERMISSIONS, so services.create/delete could never be stored for an invited doctor. - DoctorSecretary had no validation at all and would store any key, and it only read $patch['resources'] — the admin SecretariesPage sends a flat map, so its permission edit silently did nothing. Both entities now accept either shape and filter through the registry. New resources 'resources' and 'treatment' are registered with defaults chosen to preserve today's effective access, since both pages are currently gated on a borrowed resource. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
hamed
@@ -4,6 +4,7 @@ namespace App\Clinic\Entity;
|
||||
|
||||
use App\Clinic\Repository\ClinicDoctorPermissionRepository;
|
||||
use App\Doctor\Entity\Doctor;
|
||||
use App\Shared\Security\PermissionCatalog;
|
||||
use Doctrine\ORM\Mapping as ORM;
|
||||
use Symfony\Component\Uid\Uuid;
|
||||
|
||||
@@ -18,22 +19,35 @@ use Symfony\Component\Uid\Uuid;
|
||||
#[ORM\UniqueConstraint(name: 'uniq_clinic_doctor_permission', columns: ['clinic_id', 'doctor_id'])]
|
||||
class ClinicDoctorPermission
|
||||
{
|
||||
/**
|
||||
* پیشفرضِ نقشِ «پزشکِ عضو کلینیک» — سیاست، نه ساختار. فهرستِ منابع و اکشنها
|
||||
* در PermissionCatalog است و PermissionCatalogTest اجبار میکند این آرایه از
|
||||
* آن بیرون نزند.
|
||||
*
|
||||
* پیشفرضِ resources و treatment طوری انتخاب شده که دسترسیِ امروزِ پزشک عوض
|
||||
* نشود: تا پیش از این، صفحاتِ منابع روی appointment_settings و پروندهٔ درمان
|
||||
* روی appointments سوار بودند و هر دو برای این نقش روشناند.
|
||||
*/
|
||||
public const DEFAULT_PERMISSIONS = [
|
||||
'version' => 1,
|
||||
'resources' => [
|
||||
'appointments' => ['view' => true, 'create' => true, 'cancel' => true, 'update_status' => true],
|
||||
'appointment_settings' => ['view' => true, 'update' => true],
|
||||
'patients' => ['view' => true, 'create' => true, 'update' => true, 'delete' => false],
|
||||
'treatment' => ['view' => true, 'update' => true],
|
||||
'payments' => ['view' => true, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'services' => ['view' => true, 'update' => false],
|
||||
'services' => ['view' => true, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'clinic_info' => ['view' => true, 'update' => false],
|
||||
'insurances' => ['view' => true, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'addresses' => ['view' => true, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'resources' => ['view' => true, 'create' => true, 'update' => true, 'delete' => true],
|
||||
'inventory' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'tags' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'staff' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'discounts' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'sms' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'clinic_doctors' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'subscription' => ['view' => false, 'create' => false],
|
||||
],
|
||||
];
|
||||
|
||||
@@ -79,7 +93,11 @@ class ClinicDoctorPermission
|
||||
public function getUuid(): string { return $this->uuid; }
|
||||
public function getClinic(): Clinic { return $this->clinic; }
|
||||
public function getDoctor(): Doctor { return $this->doctor; }
|
||||
public function getPermissions(): array { return $this->permissions; }
|
||||
/** همیشه شکلِ کاملِ رجیستری — منبعی که بعد از ساختِ این ردیف اضافه شده، پیشفرضِ نقش را میگیرد. */
|
||||
public function getPermissions(): array
|
||||
{
|
||||
return PermissionCatalog::merge($this->permissions, self::DEFAULT_PERMISSIONS);
|
||||
}
|
||||
public function isActive(): bool { return $this->active; }
|
||||
public function getCreatedAt(): int { return $this->createdAt; }
|
||||
public function getUpdatedAt(): int { return $this->updatedAt; }
|
||||
@@ -92,24 +110,17 @@ class ClinicDoctorPermission
|
||||
return false;
|
||||
}
|
||||
|
||||
return (bool) ($this->permissions['resources'][$resource][$action] ?? false);
|
||||
return (bool) ($this->getPermissions()['resources'][$resource][$action] ?? false);
|
||||
}
|
||||
|
||||
/** ادغام عمقی — فقط منابع/اکشنهایی که ارسال شدهاند تغییر میکنند. */
|
||||
public function mergePermissions(array $patch): void
|
||||
{
|
||||
$current = $this->permissions;
|
||||
$resources = $patch['resources'] ?? $patch;
|
||||
$current = $this->getPermissions();
|
||||
|
||||
foreach ($resources as $resource => $actions) {
|
||||
if (!is_array($actions) || !isset(self::DEFAULT_PERMISSIONS['resources'][$resource])) {
|
||||
continue;
|
||||
}
|
||||
foreach (PermissionCatalog::filterPatch($patch['resources'] ?? $patch) as $resource => $actions) {
|
||||
foreach ($actions as $action => $value) {
|
||||
if (!array_key_exists($action, self::DEFAULT_PERMISSIONS['resources'][$resource])) {
|
||||
continue;
|
||||
}
|
||||
$current['resources'][$resource][$action] = (bool) $value;
|
||||
$current['resources'][$resource][$action] = $value;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -131,7 +142,7 @@ class ClinicDoctorPermission
|
||||
'doctor_uuid' => $this->doctor->getUuid(),
|
||||
'doctor_name' => $this->doctor->getName(),
|
||||
'active' => $this->active,
|
||||
'permissions' => $this->permissions,
|
||||
'permissions' => $this->getPermissions(),
|
||||
'created_at' => $this->createdAt,
|
||||
'updated_at' => $this->updatedAt,
|
||||
];
|
||||
|
||||
@@ -7,6 +7,7 @@ use App\Clinic\Entity\Clinic;
|
||||
use App\Doctor\Entity\Doctor;
|
||||
use App\Secretary\Repository\DoctorSecretaryRepository;
|
||||
use App\Shared\Context\EntityContext;
|
||||
use App\Shared\Security\PermissionCatalog;
|
||||
use App\Shared\Tenant\TenantOwnedTrait;
|
||||
use Doctrine\ORM\Mapping as ORM;
|
||||
use Symfony\Component\Uid\Uuid;
|
||||
@@ -23,11 +24,20 @@ class DoctorSecretary
|
||||
public const OWNER_DOCTOR = EntityContext::TYPE_DOCTOR;
|
||||
public const OWNER_CLINIC = EntityContext::TYPE_CLINIC;
|
||||
|
||||
/**
|
||||
* پیشفرضِ نقشِ منشی — سیاست، نه ساختار. فهرستِ منابع و اکشنها در
|
||||
* PermissionCatalog است.
|
||||
*
|
||||
* treatment روشن و resources خاموش است تا دسترسیِ امروز عوض نشود: پروندهٔ درمان
|
||||
* تا پیش از این روی appointments.view سوار بود (روشن) و صفحاتِ منابع روی
|
||||
* appointment_settings.view (خاموش).
|
||||
*/
|
||||
public const DEFAULT_PERMISSIONS = [
|
||||
'version' => 1,
|
||||
'resources' => [
|
||||
'appointments' => ['view' => true, 'create' => true, 'cancel' => false, 'update_status' => true],
|
||||
'patients' => ['view' => true, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'treatment' => ['view' => true, 'update' => false],
|
||||
'payments' => ['view' => true, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'insurances' => ['view' => true, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'addresses' => ['view' => true, 'create' => false, 'update' => false, 'delete' => false],
|
||||
@@ -38,6 +48,7 @@ class DoctorSecretary
|
||||
'staff' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'discounts' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'sms' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'resources' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'appointment_settings' => ['view' => false, 'update' => false],
|
||||
'clinic_doctors' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
|
||||
'subscription' => ['view' => false, 'create' => false],
|
||||
@@ -115,7 +126,11 @@ class DoctorSecretary
|
||||
public function getSecretary(): User { return $this->secretary; }
|
||||
public function getOwnerType(): string { return $this->entityType; }
|
||||
public function getClinic(): ?Clinic { return $this->clinic; }
|
||||
public function getPermissions(): array { return $this->permissions ?? self::DEFAULT_PERMISSIONS; }
|
||||
/** همیشه شکلِ کاملِ رجیستری — منبعی که بعد از ساختِ این ردیف اضافه شده، پیشفرضِ نقش را میگیرد. */
|
||||
public function getPermissions(): array
|
||||
{
|
||||
return PermissionCatalog::merge($this->permissions ?? [], self::DEFAULT_PERMISSIONS);
|
||||
}
|
||||
public function getNationalCode(): ?string { return $this->nationalCode; }
|
||||
public function getAddress(): ?string { return $this->address; }
|
||||
public function isActive(): bool { return $this->active; }
|
||||
@@ -136,16 +151,23 @@ class DoctorSecretary
|
||||
public function setOnlineShareEnabled(bool $v): self { $this->onlineShareEnabled = $v; $this->touch(); return $this; }
|
||||
public function setOnlineSharePercent(float $v): self { $this->onlineSharePercent = (string) $v; $this->touch(); return $this; }
|
||||
|
||||
/** Deep merge: only provided resources/actions are updated */
|
||||
/**
|
||||
* Deep merge: only provided resources/actions are updated.
|
||||
*
|
||||
* هر دو شکلِ ورودی پذیرفته میشود — با envelope و بدون آن. صفحهٔ ادمین نقشهٔ
|
||||
* تخت میفرستد و تا پیش از این بیصدا نادیده گرفته میشد؛ قرینهٔ همین منطق در
|
||||
* ClinicDoctorPermission::mergePermissions است.
|
||||
*/
|
||||
public function mergePermissions(array $patch): void
|
||||
{
|
||||
$current = $this->getPermissions();
|
||||
$current = $this->getPermissions();
|
||||
$resources = $patch['resources'] ?? $patch;
|
||||
|
||||
if (isset($patch['resources']) && is_array($patch['resources'])) {
|
||||
foreach ($patch['resources'] as $resource => $actions) {
|
||||
if (!is_array($actions)) continue;
|
||||
// قبلاً هر کلیدی پذیرفته و ذخیره میشد؛ حالا مثل پزشک فقط منابعِ رجیستری.
|
||||
if (is_array($resources)) {
|
||||
foreach (PermissionCatalog::filterPatch($resources) as $resource => $actions) {
|
||||
foreach ($actions as $action => $value) {
|
||||
$current['resources'][$resource][$action] = (bool) $value;
|
||||
$current['resources'][$resource][$action] = $value;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,273 @@
|
||||
<?php
|
||||
|
||||
namespace App\Shared\Security;
|
||||
|
||||
/**
|
||||
* فهرست واحدِ منابع و اکشنهای قابلمجوزدهی.
|
||||
*
|
||||
* این کلاس فقط میگوید «چه چیزهایی وجود دارند»، نه «چه کسی چه دارد». پیشفرضِ هر
|
||||
* نقش در Entity خودش میماند (DoctorSecretary / ClinicDoctorPermission) چون سیاست
|
||||
* است، نه ساختار.
|
||||
*
|
||||
* قبلاً همین فهرست شش جا تکرار شده بود — دو Entity، سه فایل UI و یک interface
|
||||
* تایپاسکریپت — و از هم واگرا شده بودند. صفحهٔ تازه بهجای منبع خودش، مجوز
|
||||
* نزدیکترین صفحهٔ موجود را قرض میگرفت. با یک منبعِ واحد، افزودن صفحه یعنی یک
|
||||
* ردیف اینجا و بس.
|
||||
*/
|
||||
final class PermissionCatalog
|
||||
{
|
||||
/**
|
||||
* ترتیب کلیدها ترتیبِ نمایش در UI است.
|
||||
*
|
||||
* @var array<string, array{label: string, clinicOnly?: bool, actions: array<string, string>}>
|
||||
*/
|
||||
public const RESOURCES = [
|
||||
'appointments' => [
|
||||
'label' => 'مدیریت نوبتها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده نوبتها',
|
||||
'create' => 'ایجاد نوبت',
|
||||
'cancel' => 'لغو نوبت',
|
||||
'update_status' => 'تغییر وضعیت نوبت',
|
||||
],
|
||||
],
|
||||
'patients' => [
|
||||
'label' => 'پرونده بیماران',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده بیماران',
|
||||
'create' => 'ایجاد بیمار',
|
||||
'update' => 'ویرایش بیمار',
|
||||
'delete' => 'حذف بیمار',
|
||||
],
|
||||
],
|
||||
'treatment' => [
|
||||
'label' => 'دورههای درمان',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده دورههای درمان',
|
||||
'update' => 'ویرایش دوره درمان',
|
||||
],
|
||||
],
|
||||
'payments' => [
|
||||
'label' => 'مدیریت پرداختها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده پرداختها',
|
||||
'create' => 'ثبت پرداخت',
|
||||
'update' => 'ویرایش پرداخت',
|
||||
'delete' => 'حذف پرداخت',
|
||||
],
|
||||
],
|
||||
'insurances' => [
|
||||
'label' => 'مدیریت بیمهها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده بیمهها',
|
||||
'create' => 'ایجاد بیمه',
|
||||
'update' => 'ویرایش بیمه',
|
||||
'delete' => 'حذف بیمه',
|
||||
],
|
||||
],
|
||||
'addresses' => [
|
||||
'label' => 'آدرسها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده آدرسها',
|
||||
'create' => 'ایجاد آدرس',
|
||||
'update' => 'ویرایش آدرس',
|
||||
'delete' => 'حذف آدرس',
|
||||
],
|
||||
],
|
||||
'clinic_info' => [
|
||||
'label' => 'اطلاعات کلینیک',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده اطلاعات',
|
||||
'update' => 'ویرایش اطلاعات',
|
||||
],
|
||||
],
|
||||
'services' => [
|
||||
'label' => 'خدمات و تعرفهها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده خدمات',
|
||||
'create' => 'ایجاد خدمت',
|
||||
'update' => 'ویرایش خدمت',
|
||||
'delete' => 'حذف خدمت',
|
||||
],
|
||||
],
|
||||
'inventory' => [
|
||||
'label' => 'انبار',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده انبار',
|
||||
'create' => 'ایجاد کالا/بسته',
|
||||
'update' => 'ویرایش انبار',
|
||||
'delete' => 'حذف از انبار',
|
||||
],
|
||||
],
|
||||
'staff' => [
|
||||
'label' => 'پرسنل',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده پرسنل',
|
||||
'create' => 'افزودن پرسنل',
|
||||
'update' => 'ویرایش پرسنل',
|
||||
'delete' => 'حذف پرسنل',
|
||||
],
|
||||
],
|
||||
'tags' => [
|
||||
'label' => 'تگها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده تگها',
|
||||
'create' => 'ایجاد تگ',
|
||||
'update' => 'ویرایش تگ',
|
||||
'delete' => 'حذف تگ',
|
||||
],
|
||||
],
|
||||
'discounts' => [
|
||||
'label' => 'تخفیفها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده تخفیفها',
|
||||
'create' => 'ایجاد تخفیف',
|
||||
'update' => 'ویرایش تخفیف',
|
||||
'delete' => 'حذف تخفیف',
|
||||
],
|
||||
],
|
||||
'sms' => [
|
||||
'label' => 'پیامکها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده پیامک/کیف پول',
|
||||
'create' => 'شارژ/ارسال',
|
||||
'update' => 'ویرایش تنظیمات',
|
||||
'delete' => 'حذف',
|
||||
],
|
||||
],
|
||||
'appointment_settings' => [
|
||||
'label' => 'تنظیمات نوبتدهی',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده تنظیمات',
|
||||
'update' => 'ویرایش تنظیمات',
|
||||
],
|
||||
],
|
||||
'resources' => [
|
||||
'label' => 'منابع و دستگاهها',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده منابع',
|
||||
'create' => 'ایجاد منبع',
|
||||
'update' => 'ویرایش منبع',
|
||||
'delete' => 'حذف منبع',
|
||||
],
|
||||
],
|
||||
'clinic_doctors' => [
|
||||
'label' => 'مدیریت پزشکان کلینیک',
|
||||
'clinicOnly' => true,
|
||||
'actions' => [
|
||||
'view' => 'مشاهده پزشکان',
|
||||
'create' => 'افزودن پزشک',
|
||||
'update' => 'ویرایش پزشک',
|
||||
'delete' => 'حذف پزشک',
|
||||
],
|
||||
],
|
||||
'subscription' => [
|
||||
'label' => 'خرید اشتراک',
|
||||
'actions' => [
|
||||
'view' => 'مشاهده اشتراک',
|
||||
'create' => 'خرید/فعالسازی اشتراک',
|
||||
],
|
||||
],
|
||||
];
|
||||
|
||||
public const VERSION = 1;
|
||||
|
||||
public static function hasResource(string $resource): bool
|
||||
{
|
||||
return isset(self::RESOURCES[$resource]);
|
||||
}
|
||||
|
||||
public static function hasAction(string $resource, string $action): bool
|
||||
{
|
||||
return isset(self::RESOURCES[$resource]['actions'][$action]);
|
||||
}
|
||||
|
||||
/** شکلِ کاملِ رجیستری با همهٔ اکشنها خاموش. */
|
||||
public static function blank(): array
|
||||
{
|
||||
$resources = [];
|
||||
foreach (self::RESOURCES as $resource => $meta) {
|
||||
foreach (array_keys($meta['actions']) as $action) {
|
||||
$resources[$resource][$action] = false;
|
||||
}
|
||||
}
|
||||
|
||||
return ['version' => self::VERSION, 'resources' => $resources];
|
||||
}
|
||||
|
||||
/**
|
||||
* مقدارِ ذخیرهشده را روی پیشفرضِ نقش مینشاند و نتیجه را به شکلِ رجیستری کامل میکند.
|
||||
*
|
||||
* منبعی که در رجیستری هست ولی در JSONِ ذخیرهشده نیست (یعنی بعد از ساختِ آن
|
||||
* ردیف اضافه شده) مقدارِ پیشفرضِ نقش را میگیرد، نه false — وگرنه هر منبع تازه
|
||||
* برای همهٔ ردیفهای موجود خاموش میماند و «داینامیک بودن» روی دادهٔ واقعی
|
||||
* کار نمیکند. مقدارِ ذخیرهشده هرگز بازنویسی نمیشود.
|
||||
*
|
||||
* @param array $stored envelope ذخیرهشده یا فقط resources
|
||||
* @param array $roleDefaults envelope پیشفرضِ نقش
|
||||
*/
|
||||
public static function merge(array $stored, array $roleDefaults): array
|
||||
{
|
||||
$storedResources = $stored['resources'] ?? $stored;
|
||||
$defaultResources = $roleDefaults['resources'] ?? $roleDefaults;
|
||||
$resources = [];
|
||||
|
||||
foreach (self::RESOURCES as $resource => $meta) {
|
||||
foreach (array_keys($meta['actions']) as $action) {
|
||||
$resources[$resource][$action] = (bool) (
|
||||
$storedResources[$resource][$action]
|
||||
?? $defaultResources[$resource][$action]
|
||||
?? false
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
return [
|
||||
'version' => (int) ($stored['version'] ?? self::VERSION),
|
||||
'resources' => $resources,
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* فقط کلیدهای شناختهشده را نگه میدارد — برای patchهایی که از کلاینت میآیند.
|
||||
* کلیدِ ناشناخته بیصدا کنار گذاشته میشود، همان رفتاری که کلاینتهای فعلی
|
||||
* روی آن حساب کردهاند.
|
||||
*/
|
||||
public static function filterPatch(array $resources): array
|
||||
{
|
||||
$clean = [];
|
||||
foreach ($resources as $resource => $actions) {
|
||||
if (!is_array($actions) || !self::hasResource($resource)) {
|
||||
continue;
|
||||
}
|
||||
foreach ($actions as $action => $value) {
|
||||
if (!self::hasAction($resource, $action)) {
|
||||
continue;
|
||||
}
|
||||
$clean[$resource][$action] = (bool) $value;
|
||||
}
|
||||
}
|
||||
|
||||
return $clean;
|
||||
}
|
||||
|
||||
/** شکلِ API — آرایه است نه object تا ترتیبِ نمایش قرارداد باشد. */
|
||||
public static function toApiArray(): array
|
||||
{
|
||||
$out = [];
|
||||
foreach (self::RESOURCES as $key => $meta) {
|
||||
$actions = [];
|
||||
foreach ($meta['actions'] as $action => $label) {
|
||||
$actions[] = ['key' => $action, 'label' => $label];
|
||||
}
|
||||
$out[] = [
|
||||
'key' => $key,
|
||||
'label' => $meta['label'],
|
||||
'clinic_only' => $meta['clinicOnly'] ?? false,
|
||||
'actions' => $actions,
|
||||
];
|
||||
}
|
||||
|
||||
return $out;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user