feat(secretary): implement scope separation for secretaries in clinics and personal practices

- Added `owner_type` and `clinic_id` fields to `DoctorSecretary` entity to distinguish between clinic and personal practice relationships.
- Updated repository methods to be scope-aware, allowing for specific queries based on the context of the secretary's relationship (clinic or doctor).
- Modified `SecretaryController` to handle secretary creation with appropriate scope based on the current user's role.
- Enhanced `AuthController` to build contexts that reflect the scope of the secretary's access.
- Updated `DashboardController` and `PatientController` to respect the new scope logic when retrieving data.
- Created migration to update the database schema accordingly, dropping the old unique constraint and adding the new fields and constraints.

src/Patient/Controller/PatientController.php

@@ -3,6 +3,7 @@
 namespace App\Patient\Controller;
 
 use App\Auth\Entity\User;
+use App\Auth\Repository\UserActiveContextRepository;
 use App\Auth\Repository\UserRepository;
 use App\Clinic\Repository\ClinicRepository;
 use App\Doctor\Repository\DoctorRepository;
@@ -25,14 +26,15 @@ use Symfony\Component\Security\Http\Attribute\IsGranted;
 class PatientController extends BaseController
 {
     public function __construct(
-        private readonly PatientRecordRepository   $recordRepo,
-        private readonly PatientSessionRepository  $sessionRepo,
-        private readonly PatientService            $patientService,
-        private readonly SubscriptionService       $subscriptionService,
-        private readonly UserRepository            $userRepo,
-        private readonly DoctorRepository          $doctorRepo,
-        private readonly ClinicRepository          $clinicRepo,
-        private readonly DoctorSecretaryRepository $secretaryRepo,
+        private readonly PatientRecordRepository     $recordRepo,
+        private readonly PatientSessionRepository    $sessionRepo,
+        private readonly PatientService              $patientService,
+        private readonly SubscriptionService         $subscriptionService,
+        private readonly UserRepository              $userRepo,
+        private readonly DoctorRepository            $doctorRepo,
+        private readonly ClinicRepository            $clinicRepo,
+        private readonly DoctorSecretaryRepository   $secretaryRepo,
+        private readonly UserActiveContextRepository $contextRepo,
     ) {}
 
     #[Route('/api/v1/patients', methods: ['GET'])]
@@ -173,9 +175,22 @@ class PatientController extends BaseController
         }
 
         if ($user->hasRole('ROLE_SECRETARY')) {
-            $secretary = $this->secretaryRepo->findActiveBySecretary($user);
-            if ($secretary !== null && ($secretary->getPermissions()['appointments']['view'] ?? false)) {
-                return ['doctor', $secretary->getDoctor()->getId()];
+            $dbUuid = $this->contextRepo->findByUser($user)?->getDbUuid();
+            if ($dbUuid !== null) {
+                $clinic = $this->clinicRepo->findByUuid($dbUuid);
+                if ($clinic !== null) {
+                    $rel = $this->secretaryRepo->findActiveBySecretaryForClinic($user, $clinic);
+                    if ($rel !== null) {
+                        return ['clinic', $clinic->getId()];
+                    }
+                }
+                $doctor = $this->doctorRepo->findByUuid($dbUuid);
+                if ($doctor !== null) {
+                    $rel = $this->secretaryRepo->findActiveBySecretaryForDoctor($user, $doctor);
+                    if ($rel !== null) {
+                        return ['doctor', $doctor->getId()];
+                    }
+                }
             }
         }