feat(resource): update permissions for resource access and enhance booking logic

src/Resource/Controller/ResourceBookingSlotController.php

@@ -44,7 +44,7 @@ class ResourceBookingSlotController extends BaseController
     #[Route('/api/v1/resource/{uuid}/day-slots', name: 'resource_day_slots', methods: ['GET'])]
     public function daySlots(#[CurrentUser] User $user, string $uuid, Request $request): JsonResponse
     {
-        $this->denyUnlessGranted($user, 'view');
+        $this->denyUnlessGrantedForBooking($user);
 
         $resource = $this->context->resource($user, $uuid);
         $date     = $this->requireDate($request);
@@ -77,7 +77,7 @@ class ResourceBookingSlotController extends BaseController
     #[Route('/api/v1/resource/{uuid}/service-slots', name: 'resource_service_slots', methods: ['GET'])]
     public function serviceSlots(#[CurrentUser] User $user, string $uuid, Request $request): JsonResponse
     {
-        $this->denyUnlessGranted($user, 'view');
+        $this->denyUnlessGrantedForBooking($user);
 
         $resource = $this->context->resource($user, $uuid);
         $date     = $this->requireDate($request);

src/Resource/Controller/ResourceController.php

@@ -40,7 +40,7 @@ class ResourceController extends BaseController
     #[Route('/api/v1/resources', name: 'resource_list', methods: ['GET'])]
     public function list(#[CurrentUser] User $user, Request $request): JsonResponse
     {
-        $this->denyUnlessGranted($user, 'view');
+        $this->denyUnlessGrantedForBooking($user);
 
         [$entityType, $entityId] = $this->context->pair($user);
 
@@ -155,7 +155,7 @@ class ResourceController extends BaseController
     #[Route('/api/v1/resource/{uuid}/services', name: 'resource_services_list', methods: ['GET'])]
     public function services(#[CurrentUser] User $user, string $uuid): JsonResponse
     {
-        $this->denyUnlessGranted($user, 'view');
+        $this->denyUnlessGrantedForBooking($user);
 
         return $this->success($this->serviceOfferings->listFor($this->context->resource($user, $uuid)));
     }

src/Resource/Controller/ResourcePermissionTrait.php

@@ -5,6 +5,8 @@ namespace App\Resource\Controller;
 use App\Auth\Entity\User;
 use App\Clinic\Security\ClinicDoctorAccessChecker;
 use App\Secretary\Security\SecretaryAccessChecker;
+use App\Shared\Constant\ErrorCodes;
+use App\Shared\Exception\AppException;
 use Symfony\Contracts\Service\Attribute\Required;
 
 /**
@@ -34,4 +36,26 @@ trait ResourcePermissionTrait
         $this->secretaryAccess->denyUnlessGranted($user, 'appointment_settings', $action);
         $this->clinicDoctorAccess->denyUnlessGranted($user, 'appointment_settings', $action);
     }
+
+    /**
+     * خواندنِ منبع **برای نوبت‌دهی** — نه برای پیکربندی‌اش.
+     *
+     * فهرست منابع، سرویس‌هایشان و وقت‌های آزادشان ورودیِ ثبت نوبت‌اند، پس مجوزِ
+     * `appointments.view` هم برایشان کافی است: منشی‌ای که اجازهٔ ثبت نوبت دارد ولی
+     * تنظیمات نوبت‌دهی برایش بسته است، وگرنه نمی‌توانست همان نوبتی را که مجاز است
+     * ثبت کند — ۴۰۳ روی خواندنِ فهرست، کلِ نوبت‌دهی منبع‌محور را برایش می‌بست.
+     * نوشتن همچنان فقط با `appointment_settings.update`.
+     */
+    private function denyUnlessGrantedForBooking(User $user): void
+    {
+        $allowed =
+            ($this->secretaryAccess->canOrNonSecretary($user, 'appointment_settings', 'view')
+                && $this->clinicDoctorAccess->canOrNonMember($user, 'appointment_settings', 'view'))
+            || ($this->secretaryAccess->canOrNonSecretary($user, 'appointments', 'view')
+                && $this->clinicDoctorAccess->canOrNonMember($user, 'appointments', 'view'));
+
+        if (!$allowed) {
+            throw new AppException(ErrorCodes::ERR_FORBIDDEN_001, null, 403);
+        }
+    }
 }