feat(permissions): single registry for secretary and clinic-doctor permissions

The list of permissionable resources was duplicated in six places that had already diverged: both permission entities, three admin UI files and the SecretaryPermissions TypeScript interface. Adding a resource meant editing all of them, so new pages borrowed an unrelated resource instead — five resource pages sat on appointment_settings.view and treatment-cases on appointments.view. PermissionCatalog is now the only place that says which resources and actions exist. Each entity keeps its own DEFAULT_PERMISSIONS, but as role policy only; a test asserts those defaults never name a resource the registry doesn't have. getPermissions() merges the stored JSON over the role defaults, so a resource added to the registry later resolves to the role default instead of silently false for every existing row. Explicitly stored values are never overwritten, and no data migration is needed. Two asymmetries fixed along the way: - ClinicDoctorPermission validated writes against its own DEFAULT_PERMISSIONS, so services.create/delete could never be stored for an invited doctor. - DoctorSecretary had no validation at all and would store any key, and it only read $patch['resources'] — the admin SecretariesPage sends a flat map, so its permission edit silently did nothing. Both entities now accept either shape and filter through the registry. New resources 'resources' and 'treatment' are registered with defaults chosen to preserve today's effective access, since both pages are currently gated on a borrowed resource. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-07 17:32:28 +03:30
parent 0360a5e46f
commit 1d1efd7a85
7 changed files with 954 additions and 22 deletions
@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Tests\Shared;
+
+use App\Clinic\Entity\ClinicDoctorPermission;
+use App\Secretary\Entity\DoctorSecretary;
+use App\Shared\Security\PermissionCatalog;
+use PHPUnit\Framework\TestCase;
+
+class PermissionCatalogTest extends TestCase
+{
+    public function testBlankCoversEveryResourceAndActionAsFalse(): void
+    {
+        $blank = PermissionCatalog::blank();
+
+        $this->assertSame(
+            array_keys(PermissionCatalog::RESOURCES),
+            array_keys($blank['resources']),
+            'blank() باید دقیقاً همان منابع رجیستری را داشته باشد',
+        );
+
+        foreach (PermissionCatalog::RESOURCES as $resource => $meta) {
+            foreach (array_keys($meta['actions']) as $action) {
+                $this->assertFalse(
+                    $blank['resources'][$resource][$action],
+                    "{$resource}.{$action} باید در blank خاموش باشد",
+                );
+            }
+        }
+    }
+
+    public function testMergeKeepsStoredValuesUntouched(): void
+    {
+        $stored = ['version' => 1, 'resources' => [
+            'appointments' => ['view' => true, 'create' => false],
+        ]];
+        $defaults = ['version' => 1, 'resources' => [
+            'appointments' => ['view' => false, 'create' => true],
+        ]];
+
+        $merged = PermissionCatalog::merge($stored, $defaults);
+
+        $this->assertTrue($merged['resources']['appointments']['view']);
+        $this->assertFalse(
+            $merged['resources']['appointments']['create'],
+            'مقدارِ صریحِ false در stored نباید با پیش‌فرضِ true بازنویسی شود',
+        );
+    }
+
+    public function testMergeFillsResourceMissingFromStoredWithRoleDefault(): void
+    {
+        $stored   = ['version' => 1, 'resources' => ['appointments' => ['view' => true]]];
+        $defaults = ['version' => 1, 'resources' => ['treatment' => ['view' => true, 'update' => false]]];
+
+        $merged = PermissionCatalog::merge($stored, $defaults);
+
+        $this->assertTrue(
+            $merged['resources']['treatment']['view'],
+            'منبعی که بعد از ساختِ ردیف به رجیستری اضافه شده باید پیش‌فرضِ نقش را بگیرد',
+        );
+        $this->assertFalse($merged['resources']['treatment']['update']);
+    }
+
+    public function testMergeFallsBackToFalseWhenNeitherStoredNorDefaultHasIt(): void
+    {
+        $merged = PermissionCatalog::merge([], []);
+
+        foreach (PermissionCatalog::RESOURCES as $resource => $meta) {
+            foreach (array_keys($meta['actions']) as $action) {
+                $this->assertFalse($merged['resources'][$resource][$action]);
+            }
+        }
+    }
+
+    public function testFilterPatchDropsUnknownResourcesAndActions(): void
+    {
+        $clean = PermissionCatalog::filterPatch([
+            'appointments'  => ['view' => true, 'teleport' => true],
+            'unknown_thing' => ['view' => true],
+            'patients'      => 'not-an-array',
+        ]);
+
+        $this->assertSame(['appointments' => ['view' => true]], $clean);
+    }
+
+    /** پیش‌فرضِ هر نقش فقط حق دارد از منابعِ رجیستری حرف بزند. */
+    public function testRoleDefaultsUseOnlyKnownResourcesAndActions(): void
+    {
+        $roles = [
+            'secretary'     => DoctorSecretary::DEFAULT_PERMISSIONS,
+            'clinic_doctor' => ClinicDoctorPermission::DEFAULT_PERMISSIONS,
+        ];
+
+        foreach ($roles as $role => $defaults) {
+            foreach ($defaults['resources'] as $resource => $actions) {
+                $this->assertTrue(
+                    PermissionCatalog::hasResource($resource),
+                    "منبع «{$resource}» در پیش‌فرضِ {$role} هست ولی در رجیستری نیست",
+                );
+                foreach (array_keys($actions) as $action) {
+                    $this->assertTrue(
+                        PermissionCatalog::hasAction($resource, $action),
+                        "اکشن «{$resource}.{$action}» در پیش‌فرضِ {$role} هست ولی در رجیستری نیست",
+                    );
+                }
+            }
+        }
+    }
+
+    public function testApiArrayKeepsRegistryOrder(): void
+    {
+        $api = PermissionCatalog::toApiArray();
+
+        $this->assertSame(
+            array_keys(PermissionCatalog::RESOURCES),
+            array_column($api, 'key'),
+        );
+        $this->assertTrue(
+            $api[array_search('clinic_doctors', array_column($api, 'key'), true)]['clinic_only'],
+        );
+    }
+}