feat: Implement secretary permissions enforcement across multiple resources

- Added SecretaryAccessChecker to manage resource access for secretaries.
- Integrated permission checks for payments, inventory, and tags in relevant controllers.
- Updated PaymentController and PaymentMethodController to enforce secretary permissions.
- Enhanced TenantTagController to check permissions for tag management actions.
- Introduced tests for secretary resource enforcement, ensuring proper access control.
- Updated DoctorSecretary entity to include inventory and tags permissions.
- Created a comprehensive audit document for secretary permissions coverage and enforcement.
- Fixed potential crashes in SecretaryDashboard when rendering without doctor data.

src/Tag/Controller/TenantTagController.php

@@ -6,8 +6,10 @@ use App\Auth\Entity\User;
 use App\Auth\Repository\UserActiveContextRepository;
 use App\Clinic\Repository\ClinicRepository;
 use App\Doctor\Repository\DoctorRepository;
+use App\Secretary\Security\SecretaryAccessChecker;
 use App\Shared\Constant\ErrorCodes;
 use App\Shared\Controller\BaseController;
+use App\Shared\Exception\AppException;
 use App\Tag\Entity\TenantTag;
 use App\Tag\Repository\TenantTagRepository;
 use Symfony\Component\HttpFoundation\JsonResponse;
@@ -32,11 +34,22 @@ class TenantTagController extends BaseController
         private readonly DoctorRepository            $doctorRepo,
         private readonly ClinicRepository            $clinicRepo,
         private readonly UserActiveContextRepository $contextRepo,
+        private readonly SecretaryAccessChecker      $secretaryAccess,
     ) {}
 
+    /** تگ‌ها ابزار پروندهٔ بیمار هم هستند؛ مشاهده با tags.view یا patients.view مجاز است. */
+    private function guardTagView(User $user): void
+    {
+        if (!$this->secretaryAccess->canOrNonSecretary($user, 'tags', 'view')
+            && !$this->secretaryAccess->canOrNonSecretary($user, 'patients', 'view')) {
+            throw new AppException(ErrorCodes::ERR_FORBIDDEN_001, null, 403);
+        }
+    }
+
     #[Route('/api/v1/tenant-tags', methods: ['GET'])]
     public function list(#[CurrentUser] User $user): JsonResponse
     {
+        $this->guardTagView($user);
         [$type, $id] = $this->resolveEntity($user);
         if ($id === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -51,6 +64,7 @@ class TenantTagController extends BaseController
     #[Route('/api/v1/tenant-tag', methods: ['POST'])]
     public function create(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'tags', 'create');
         [$type, $id] = $this->resolveEntity($user);
         if ($id === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -79,6 +93,7 @@ class TenantTagController extends BaseController
     #[Route('/api/v1/tenant-tag/{uuid}', methods: ['PATCH'])]
     public function update(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'tags', 'update');
         $tag = $this->ownedTag($uuid, $user);
         if ($tag === null) {
             return $this->error(ErrorCodes::ERR_NOT_FOUND_001, 'برچسب یافت نشد', 404);
@@ -111,6 +126,7 @@ class TenantTagController extends BaseController
     #[Route('/api/v1/tenant-tag/{uuid}', methods: ['DELETE'])]
     public function delete(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'tags', 'delete');
         $tag = $this->ownedTag($uuid, $user);
         if ($tag === null) {
             return $this->error(ErrorCodes::ERR_NOT_FOUND_001, 'برچسب یافت نشد', 404);