hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(secretary): settings menu structure, clinic timeline access, patient delete gate

Browse Source 
Three reported secretary-access bugs.

1) Settings menu structure. Phase B flat-listed staff/discounts/sms/tags/
   appointment_settings/clinic_doctors in the secretary's main sidebar. Mirror
   the doctor/clinic layout instead: only inventory + services stay in the main
   «مدیریت» nav; the rest live under a single «تنظیمات» entry
   (→ /admin/account-settings). Made both settings navs permission-aware for
   secretaries: SETTINGS_MENU (menuForRole now takes `can`) and
   PurchaseSubscriptionSidebar filter by a per-item `perm`/`alwaysOpen` instead
   of role only, so a secretary sees exactly their permitted settings pages and
   owner-only items (subscription, secretary-management) stay hidden.

2) Clinic secretary appointment timeline. AppointmentsPage treated a
   clinic-scoped secretary as a single-doctor profile: the doctor list was
   fetched/shown only for isClinic/isAdmin, so no doctor tabs, timeline, or
   booking. Now a clinic-scoped secretary is multi-doctor: fetches the doctor
   list, shows tabs, auto-selects the first doctor. The list comes from a new
   authenticated endpoint GET /api/v1/my/clinic-doctors returning only the
   secretary's ASSIGNED doctors — /clinic/doctor-list is on the public (no-JWT)
   firewall and cannot scope by user, so it would have leaked unbookable doctors.

3) Patient record delete. The `patients.delete` toggle was dead: every record
   delete (note/medical-record/attachment/call/message) was gated as
   `patients.update`. Mapped them to `patients.delete` so the toggle is honored
   and delete is controllable separately from edit.

New SecretaryAccessChecker::assignedClinicDoctorIds. Tests: doctor-list scoping,
patients.delete separation (denied/allowed). docs/api secretary.md +
appointment.md updated. Backend 286 + frontend 25 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
hamed
2026-07-23 18:01:32 +03:30
co-authored by Claude Opus 4.8
parent 653dd57300
commit 54c8b008bf
14 changed files with 274 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
assets/admin/components/layout/PurchaseSubscriptionSidebar.tsx
+35 -15
View File
@@ -2,6 +2,7 @@ import React, { useMemo, useState } from 'react';
import { Link } from 'react-router-dom';
import { SearchHeaderP } from '../../pages/subscriptionIcons';
import { useAuthStore } from '../../stores/authStore';
import { usePermissions } from '../../hooks/usePermissions';
/**
* Settings sub-navigation for the subscription page — item list and order copied
@@ -13,33 +14,52 @@ import { useAuthStore } from '../../stores/authStore';
* This list is intentionally separate from SETTINGS_MENU (SettingsLayout) so the
* other settings pages are not affected.
*/
/** `roles`: when set, the item is only shown to those roles (omit = every role). */
type NavItem = { key: string; label: string; to?: string; roles?: string[] };
/**
* `roles`: when set, the item is only shown to those roles (omit = every role).
* `perm`: [resource, action] — منشی فقط با داشتن این مجوز آیتم را می‌بیند.
* `alwaysOpen`: برای منشی همیشه نمایش داده می‌شود (حساب/تنظیمات پایه).
* آیتم‌های owner-only (خرید اشتراک، مدیریت منشی) نه `perm` دارند نه `alwaysOpen`
* → برای منشی پنهان می‌شوند.
*/
type NavItem = {
key: string;
label: string;
to?: string;
roles?: string[];
perm?: [string, string];
alwaysOpen?: boolean;
};
const NAV_ITEMS: NavItem[] = [
{ key: 'subscription', label: 'خرید اشتراک', to: '/admin/subscription' },
{ key: 'payment', label: 'مدیریت پرداخت', to: '/admin/my-financial' },
{ key: 'appointment', label: 'مدیریت نوبت دهی', to: '/admin/appointment-settings', roles: ['doctor'] },
{ key: 'appointment', label: 'مدیریت نوبت دهی', to: '/admin/settings/appointment-settings', roles: ['clinic'] },
{ key: 'insurance', label: 'مدیریت بیمه', to: '/admin/insurance-pricing' },
{ key: 'discounts', label: 'مدیریت تخفیف‌ها', to: '/admin/discounts', roles: ['doctor', 'clinic'] },
{ key: 'tags', label: 'تگ ها', to: '/admin/tags-settings' },
{ key: 'sms', label: 'پیامک ها', to: '/admin/sms-wallet' },
{ key: 'clinic-doctors', label: 'پزشکان کلینیک', to: '/admin/settings/clinic-doctors', roles: ['clinic'] },
{ key: 'payment', label: 'مدیریت پرداخت', to: '/admin/my-financial', perm: ['payments', 'view'] },
{ key: 'appointment', label: 'مدیریت نوبت دهی', to: '/admin/appointment-settings', roles: ['doctor'], perm: ['appointment_settings', 'view'] },
{ key: 'appointment', label: 'مدیریت نوبت دهی', to: '/admin/settings/appointment-settings', roles: ['clinic'], perm: ['appointment_settings', 'view'] },
{ key: 'insurance', label: 'مدیریت بیمه', to: '/admin/insurance-pricing', perm: ['insurances', 'view'] },
{ key: 'discounts', label: 'مدیریت تخفیف‌ها', to: '/admin/discounts', roles: ['doctor', 'clinic'], perm: ['discounts', 'view'] },
{ key: 'tags', label: 'تگ ها', to: '/admin/tags-settings', perm: ['tags', 'view'] },
{ key: 'sms', label: 'پیامک ها', to: '/admin/sms-wallet', perm: ['sms', 'view'] },
{ key: 'clinic-doctors', label: 'پزشکان کلینیک', to: '/admin/settings/clinic-doctors', roles: ['clinic'], perm: ['clinic_doctors', 'view'] },
{ key: 'secretary', label: 'مدیریت منشی', to: '/admin/my-secretaries' },
{ key: 'staff', label: 'پرسنل', to: '/admin/staff' },
{ key: 'account', label: 'حساب کاربری', to: '/admin/account-settings' },
{ key: 'security', label: 'تنظیمات' },
{ key: 'staff', label: 'پرسنل', to: '/admin/staff', perm: ['staff', 'view'] },
{ key: 'account', label: 'حساب کاربری', to: '/admin/account-settings', alwaysOpen: true },
{ key: 'security', label: 'تنظیمات', alwaysOpen: true },
];
export default function PurchaseSubscriptionSidebar({ active }: { active: string }) {
const [query, setQuery] = useState('');
const primaryRole = useAuthStore((s) => s.primaryRole);
const { can } = usePermissions();
const items = useMemo(
() => NAV_ITEMS
.filter((i) => !i.roles || (primaryRole != null && i.roles.includes(primaryRole)))
// منشی: بر اساس مجوز، نه نقش. آیتمِ بدونِ perm/alwaysOpen برای منشی پنهان است.
.filter((i) =>
primaryRole === 'secretary'
? (i.alwaysOpen || (i.perm ? can(i.perm[0], i.perm[1]) : false))
: (!i.roles || (primaryRole != null && i.roles.includes(primaryRole))),
)
.filter((i) => i.label.includes(query.trim())),
[query, primaryRole],
[query, primaryRole, can],
);
return (