hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(secretary): settings menu structure, clinic timeline access, patient delete gate

Browse Source 
Three reported secretary-access bugs.

1) Settings menu structure. Phase B flat-listed staff/discounts/sms/tags/
   appointment_settings/clinic_doctors in the secretary's main sidebar. Mirror
   the doctor/clinic layout instead: only inventory + services stay in the main
   «مدیریت» nav; the rest live under a single «تنظیمات» entry
   (→ /admin/account-settings). Made both settings navs permission-aware for
   secretaries: SETTINGS_MENU (menuForRole now takes `can`) and
   PurchaseSubscriptionSidebar filter by a per-item `perm`/`alwaysOpen` instead
   of role only, so a secretary sees exactly their permitted settings pages and
   owner-only items (subscription, secretary-management) stay hidden.

2) Clinic secretary appointment timeline. AppointmentsPage treated a
   clinic-scoped secretary as a single-doctor profile: the doctor list was
   fetched/shown only for isClinic/isAdmin, so no doctor tabs, timeline, or
   booking. Now a clinic-scoped secretary is multi-doctor: fetches the doctor
   list, shows tabs, auto-selects the first doctor. The list comes from a new
   authenticated endpoint GET /api/v1/my/clinic-doctors returning only the
   secretary's ASSIGNED doctors — /clinic/doctor-list is on the public (no-JWT)
   firewall and cannot scope by user, so it would have leaked unbookable doctors.

3) Patient record delete. The `patients.delete` toggle was dead: every record
   delete (note/medical-record/attachment/call/message) was gated as
   `patients.update`. Mapped them to `patients.delete` so the toggle is honored
   and delete is controllable separately from edit.

New SecretaryAccessChecker::assignedClinicDoctorIds. Tests: doctor-list scoping,
patients.delete separation (denied/allowed). docs/api secretary.md +
appointment.md updated. Backend 286 + frontend 25 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
hamed
2026-07-23 18:01:32 +03:30
co-authored by Claude Opus 4.8
parent 653dd57300
commit 54c8b008bf
14 changed files with 274 additions and 122 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Secretary/SecretaryResourceEnforcementTest.php
+51
View File
@@ -226,6 +226,57 @@ class SecretaryResourceEnforcementTest extends ApiTestCase
$this->assertSame(200, $this->responseCode());
}
public function testPatientDeleteSeparateFromUpdate(): void
{
// منشی با patients.update ولی بدون patients.delete نباید بتواند حذف کند.
// گیتِ delete پیش از واکشیِ رکورد اجرا می‌شود، پس uuidِ ناموجود هم ۴۰۳ می‌دهد.
[$secretary, $rel] = $this->makeClinicSecretary();
$rel->mergePermissions(['resources' => ['patients' => ['view' => true, 'update' => true, 'delete' => false]]]);
$this->em->flush();
$this->authJson('DELETE', '/api/v1/patient/note/00000000-0000-0000-0000-000000000000', $secretary);
$this->assertSame(403, $this->responseCode(), 'حذف باید جدا از ویرایش کنترل شود');
}
public function testPatientDeleteAllowedWhenGranted(): void
{
// با patients.delete، گیت عبور می‌کند و به «یافت نشد» می‌رسد (نه ۴۰۳).
[$secretary, $rel] = $this->makeClinicSecretary();
$rel->mergePermissions(['resources' => ['patients' => ['view' => true, 'delete' => true]]]);
$this->em->flush();
$this->authJson('DELETE', '/api/v1/patient/note/00000000-0000-0000-0000-000000000000', $secretary);
$this->assertSame(404, $this->responseCode());
}
public function testDoctorListReturnsOnlyAssignedDoctors(): void
{
// کلینیک با دو پزشک؛ منشی فقط به یکی تخصیص داده شده.
$owner = $this->createUser(['ROLE_CLINIC']);
$clinic = new Clinic($owner);
$this->em->persist($clinic);
$assigned = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تخصیص‌یافته');
$unassigned = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر دیگر');
$this->em->persist($assigned);
$this->em->persist($unassigned);
$clinic->getDoctors()->add($assigned);
$clinic->getDoctors()->add($unassigned);
$secretary = $this->createUser(['ROLE_SECRETARY']);
$this->em->persist(new DoctorSecretary($assigned, $secretary, DoctorSecretary::OWNER_CLINIC, $clinic));
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid()));
$this->em->flush();
// اندپوینتِ احرازشدهٔ پنل (نه /clinic/doctor-list که عمومی است).
$body = $this->authJson('GET', '/api/v1/my/clinic-doctors', $secretary);
$this->assertSame(200, $this->responseCode());
$names = array_map(static fn($d) => $d['name'], $body['data']['data']);
$this->assertContains('دکتر تخصیص‌یافته', $names);
$this->assertNotContains('دکتر دیگر', $names, 'منشی نباید پزشکِ تخصیص‌نیافته را ببیند');
}
/** مثل makeClinicSecretary اما clinic و doctor را هم برمی‌گرداند. */
private function makeClinicSecretaryWithClinic(): array
{