feat: add BlogBodySanitizer for HTML sanitization on article save

- Implemented BlogBodySanitizer to clean HTML content before saving articles, ensuring security against XSS attacks.
- Added tests for BlogBodySanitizer to verify that unsafe tags and attributes are stripped from the content.
- Introduced ApiLeastPrivilegeTest to ensure that unauthorized users cannot access sensitive API routes, maintaining strict access control.

src/Treatment/Controller/TreatmentProtocolController.php

@@ -3,9 +3,11 @@
 namespace App\Treatment\Controller;
 
 use App\Auth\Entity\User;
+use App\Clinic\Security\ClinicDoctorAccessChecker;
 use App\ClinicService\Entity\ServiceItem;
 use App\ClinicService\Repository\ServiceItemRepository;
 use App\Doctor\Service\AddressResolver;
+use App\Secretary\Security\SecretaryAccessChecker;
 use App\Shared\Constant\ErrorCodes;
 use App\Shared\Controller\BaseController;
 use App\Shared\Exception\AppException;
@@ -31,12 +33,31 @@ class TreatmentProtocolController extends BaseController
         private readonly ResourceServiceOfferingRepository $offerings,
         private readonly AddressResolver             $branches,
         private readonly EntityManagerInterface      $em,
+        private readonly SecretaryAccessChecker      $secretaryAccess,
+        private readonly ClinicDoctorAccessChecker   $clinicDoctorAccess,
     ) {}
 
+    /**
+     * پروتکل یک خاصیتِ سرویس است، پس مجوزش هم همان `services` است — قرینهٔ
+     * ServiceCatalogController و ClinicServiceController.
+     *
+     * حذف پروتکل `update` می‌گیرد نه `delete`: سرویس حذف نمی‌شود، فقط سوییچِ
+     * «طول درمان» روی همان سرویس خاموش می‌شود.
+     *
+     * @param 'view'|'update' $action
+     */
+    private function denyUnlessGranted(User $user, string $action): void
+    {
+        $this->secretaryAccess->denyUnlessGranted($user, 'services', $action);
+        $this->clinicDoctorAccess->denyUnlessGranted($user, 'services', $action);
+    }
+
     /** `null` یعنی سوییچ «طول درمان» خاموش است، نه اینکه چیزی پیدا نشد. */
     #[Route('/api/v1/service-item/{uuid}/treatment-protocol', name: 'treatment_protocol_show', methods: ['GET'])]
     public function show(#[CurrentUser] User $user, string $uuid): JsonResponse
     {
+        $this->denyUnlessGranted($user, 'view');
+
         $service  = $this->requireItem($user, $uuid);
         $protocol = $this->protocols->findForService($service);
 
@@ -57,6 +78,8 @@ class TreatmentProtocolController extends BaseController
     #[Route('/api/v1/service-item/{uuid}/treatment-protocol', name: 'treatment_protocol_replace', methods: ['PUT'])]
     public function replace(#[CurrentUser] User $user, string $uuid, Request $request): JsonResponse
     {
+        $this->denyUnlessGranted($user, 'update');
+
         $data = json_decode($request->getContent(), true);
 
         if (!is_array($data)) {
@@ -72,6 +95,8 @@ class TreatmentProtocolController extends BaseController
     #[Route('/api/v1/service-item/{uuid}/treatment-protocol', name: 'treatment_protocol_delete', methods: ['DELETE'])]
     public function delete(#[CurrentUser] User $user, string $uuid): JsonResponse
     {
+        $this->denyUnlessGranted($user, 'update');
+
         $protocol = $this->protocols->findForService($this->requireItem($user, $uuid));
 
         if ($protocol !== null) {