feat(resource): update permissions for resource access and enhance booking logic

tests/Secretary/SecretaryResourceEnforcementTest.php

@@ -226,6 +226,52 @@ class SecretaryResourceEnforcementTest extends ApiTestCase
         $this->assertSame(200, $this->responseCode());
     }
 
+    /**
+     * فهرست منابع ورودیِ ثبت نوبت است: منشیِ دارای `appointments.view` — که پیش‌فرض
+     * است — باید بتواند بخواندش، حتی وقتی `appointment_settings.view` بسته است.
+     * وگرنه نوبت‌دهی منبع‌محور برایش کاملاً بسته می‌شد.
+     */
+    public function testResourceListReadableWithAppointmentsPermissionOnly(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => [
+            'appointments'         => ['view' => true],
+            'appointment_settings' => ['view' => false, 'update' => false],
+        ]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/resources', $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    /** نوشتن همچنان فقط با تنظیمات نوبت‌دهی — مجوز نوبت‌ها درش را باز نمی‌کند. */
+    public function testResourceWriteStillNeedsAppointmentSettings(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => [
+            'appointments'         => ['view' => true, 'create' => true],
+            'appointment_settings' => ['view' => false, 'update' => false],
+        ]]);
+        $this->em->flush();
+
+        $this->authJson('POST', '/api/v1/resource', $secretary, ['type_uuid' => 'x']);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    /** بدون هیچ‌کدام از دو مجوز، فهرست منابع همچنان ۴۰۳ است. */
+    public function testResourceListDeniedWithoutAnyPermission(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => [
+            'appointments'         => ['view' => false],
+            'appointment_settings' => ['view' => false],
+        ]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/resources', $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
     public function testSubscriptionDeniedByDefault(): void
     {
         [$secretary] = $this->makeClinicSecretary();