hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(tenant): mark the financial tables with their owning environment

Browse Source 
Phase 6 of the tenant series. GlobalTables::DEFERRED is now empty and the
coverage test asserts it stays that way.

payments carries the (entity_type, entity_id) pair and belongs to the
receiving side, never the payer: an appointment payment takes the
appointment's environment, a subscription takes the environment its buyer
owns, and an SMS wallet top-up takes the wallet's. The patient never chose
an environment, so TenantFilter stays off for them and they still see their
own payment.

Three corrections to the analysis the phase was planned on, each backed by
the code or the data rather than the plan:

- A third payment type exists. Payment::TYPE_SMS_WALLET is created in
  SmsWalletController and already carries its environment in the metadata;
  without assigning it the write would fail at flush.
- clinic_subscriptions has no user_id, and its trial rows carry no payment,
  so it cannot drive the subscription backfill. The environment is derived
  the way handleSubscriptionActivation derives it — and that method now
  reads the pair off the payment instead of re-deriving it, so a payment and
  the subscription it buys can no longer land on different environments.
- WalletTransaction is not a child of Payment. payment_id is nullable and
  none of the four creation sites set it; the wallet is a person's, with a
  running balance per user. It and Settlement, which withdraws from that same
  wallet, are global with a recorded reason instead.

bank_accounts and pos_devices move from the registering user to the
environment. Their pair is deliberately nullable: nothing in the existing
data says which of a multi-environment owner's cards belongs where, and
guessing would point real money at the wrong account. Ambiguous rows stay
unassigned and the migration reports how many. The cost is that such a row
is invisible in every environment, so the owner reaches it through a
user-scoped lookup that runs outside the filter, and assigns it with
PATCH .../{uuid}/environment. The admin panel marks those rows and offers
the assignment.

Tests: 896 backend (+11), 570 frontend (+4). PHPStan unchanged at its 17
pre-existing errors.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
hamed
2026-07-28 15:06:28 +03:30
co-authored by Claude Opus 5
parent d2f4b5c428
commit c9d4348c46
40 changed files with 1582 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/PaymentMethod/PaymentMethodTest.php
+64 -34
View File
@@ -2,21 +2,49 @@
namespace App\Tests\PaymentMethod;
use App\Auth\Entity\User;
use App\Auth\Entity\UserActiveContext;
use App\Clinic\Entity\Clinic;
use App\Doctor\Entity\Doctor;
use App\Secretary\Entity\DoctorSecretary;
use App\Shared\Context\EntityContext;
use App\Tests\ApiTestCase;
/**
* Functional coverage for the per-clinic payment methods API
* Functional coverage for the per-environment payment methods API
* (bank accounts + POS devices). Success, error and boundary cases.
*
* اسکوپ از فاز ۶ به بعد **محیط** است نه کاربر، پس هر تست به یک محیط واقعی
* (پزشک یا کلینیک) نیاز دارد؛ کاربری با نقش کلینیک ولی بدون کلینیک، محیطی ندارد.
*/
class PaymentMethodTest extends ApiTestCase
{
/** کاربری با نقش کلینیک و یک کلینیک واقعی — یعنی محیط دارد. */
private function clinicOwner(): User
{
$owner = $this->createUser(['ROLE_CLINIC']);
$clinic = new Clinic($owner);
$clinic->setName('کلینیک روش پرداخت');
$this->em->persist($clinic);
$this->em->flush();
return $owner;
}
private function doctorOwner(): User
{
$user = $this->createUser(['ROLE_DOCTOR']);
$this->em->persist(new Doctor($user, 'دکتر روش پرداخت'));
$this->em->flush();
return $user;
}
// ---- Bank accounts -----------------------------------------------------
public function testEmptyBankAccountListForNewClinic(): void
{
$user = $this->createUser(['ROLE_CLINIC']);
$res = $this->authJson('GET', '/api/v1/my/payment-methods/bank-accounts', $user);
$res = $this->authJson('GET', '/api/v1/my/payment-methods/bank-accounts', $this->clinicOwner());
$this->assertSame(200, $this->responseCode());
$this->assertTrue($res['success']);
@@ -25,7 +53,7 @@ class PaymentMethodTest extends ApiTestCase
public function testCreateAndListBankAccount(): void
{
$user = $this->createUser(['ROLE_CLINIC']);
$user = $this->clinicOwner();
$created = $this->authJson('POST', '/api/v1/my/payment-methods/bank-accounts', $user, [
'bank_name' => 'ملی',
@@ -38,6 +66,7 @@ class PaymentMethodTest extends ApiTestCase
$this->assertSame('ملی', $created['data']['bank_name']);
$this->assertTrue($created['data']['is_active']);
$this->assertNotEmpty($created['data']['uuid']);
$this->assertSame('clinic', $created['data']['entity_type'], 'حساب باید به محیط فعال بچسبد');
$list = $this->authJson('GET', '/api/v1/my/payment-methods/bank-accounts', $user);
$this->assertCount(1, $list['data']);
@@ -46,9 +75,7 @@ class PaymentMethodTest extends ApiTestCase
public function testCreateBankAccountValidationErrorWhenBankNameMissing(): void
{
$user = $this->createUser(['ROLE_CLINIC']);
$res = $this->authJson('POST', '/api/v1/my/payment-methods/bank-accounts', $user, [
$res = $this->authJson('POST', '/api/v1/my/payment-methods/bank-accounts', $this->clinicOwner(), [
'account_number' => '0101234567890',
]);
@@ -59,7 +86,7 @@ class PaymentMethodTest extends ApiTestCase
public function testUpdateBankAccount(): void
{
$user = $this->createUser(['ROLE_CLINIC']);
$user = $this->clinicOwner();
$created = $this->authJson('POST', '/api/v1/my/payment-methods/bank-accounts', $user, [
'bank_name' => 'ملی',
'account_number' => '0101234567890',
@@ -78,7 +105,7 @@ class PaymentMethodTest extends ApiTestCase
public function testToggleBankAccountStatus(): void
{
$user = $this->createUser(['ROLE_CLINIC']);
$user = $this->clinicOwner();
$created = $this->authJson('POST', '/api/v1/my/payment-methods/bank-accounts', $user, [
'bank_name' => 'ملی',
'account_number' => '0101234567890',
@@ -94,9 +121,11 @@ class PaymentMethodTest extends ApiTestCase
public function testToggleUnknownBankAccountReturns404(): void
{
$user = $this->createUser(['ROLE_CLINIC']);
$res = $this->authJson('PATCH', '/api/v1/my/payment-methods/bank-accounts/does-not-exist/status', $user);
$res = $this->authJson(
'PATCH',
'/api/v1/my/payment-methods/bank-accounts/does-not-exist/status',
$this->clinicOwner(),
);
$this->assertSame(404, $this->responseCode());
$this->assertFalse($res['success']);
@@ -104,8 +133,8 @@ class PaymentMethodTest extends ApiTestCase
public function testCannotTouchAnotherClinicsBankAccount(): void
{
$owner = $this->createUser(['ROLE_CLINIC']);
$other = $this->createUser(['ROLE_CLINIC']);
$owner = $this->clinicOwner();
$other = $this->clinicOwner();
$created = $this->authJson('POST', '/api/v1/my/payment-methods/bank-accounts', $owner, [
'bank_name' => 'ملی',
'account_number' => '0101234567890',
@@ -120,9 +149,15 @@ class PaymentMethodTest extends ApiTestCase
public function testBankAccountForbiddenForPlainUser(): void
{
$user = $this->createUser(['ROLE_USER']);
$this->authJson('GET', '/api/v1/my/payment-methods/bank-accounts', $this->createUser(['ROLE_USER']));
$this->authJson('GET', '/api/v1/my/payment-methods/bank-accounts', $user);
$this->assertSame(403, $this->responseCode());
}
/** ❌ نقشِ کلینیک بدون کلینیکِ واقعی محیطی ندارد، پس کارتی هم ندارد. */
public function testRoleWithoutAnActualEnvironmentIsRejected(): void
{
$this->authJson('GET', '/api/v1/my/payment-methods/bank-accounts', $this->createUser(['ROLE_CLINIC']));
$this->assertSame(403, $this->responseCode());
}
@@ -131,7 +166,7 @@ class PaymentMethodTest extends ApiTestCase
public function testCreateAndListPos(): void
{
$user = $this->createUser(['ROLE_DOCTOR']);
$user = $this->doctorOwner();
$created = $this->authJson('POST', '/api/v1/my/payment-methods/pos', $user, [
'bank_name' => 'ملت',
@@ -143,6 +178,7 @@ class PaymentMethodTest extends ApiTestCase
$this->assertSame('ملت', $created['data']['bank_name']);
$this->assertSame('123456', $created['data']['terminal_number']);
$this->assertTrue($created['data']['is_active']);
$this->assertSame('doctor', $created['data']['entity_type']);
$list = $this->authJson('GET', '/api/v1/my/payment-methods/pos', $user);
$this->assertCount(1, $list['data']);
@@ -150,9 +186,7 @@ class PaymentMethodTest extends ApiTestCase
public function testCreatePosValidationErrorWhenTerminalMissing(): void
{
$user = $this->createUser(['ROLE_DOCTOR']);
$res = $this->authJson('POST', '/api/v1/my/payment-methods/pos', $user, [
$res = $this->authJson('POST', '/api/v1/my/payment-methods/pos', $this->doctorOwner(), [
'bank_name' => 'ملت',
]);
@@ -163,7 +197,7 @@ class PaymentMethodTest extends ApiTestCase
public function testTogglePosStatus(): void
{
// منشی به روش‌های پرداخت فقط با مجوز payments از طریق رابطهٔ فعال دسترسی دارد.
$user = $this->createSecretaryWithPayments(['view' => true, 'create' => true, 'update' => true]);
$user = $this->createSecretaryWithPayments(['view' => true, 'create' => true, 'update' => true]);
$created = $this->authJson('POST', '/api/v1/my/payment-methods/pos', $user, [
'bank_name' => 'تجارت',
'terminal_number' => '345678',
@@ -189,34 +223,30 @@ class PaymentMethodTest extends ApiTestCase
}
/** منشی با رابطهٔ فعالِ کلینیک + context + مجوز payments مشخص. */
private function createSecretaryWithPayments(array $payments): \App\Auth\Entity\User
private function createSecretaryWithPayments(array $payments): User
{
$owner = $this->createUser(['ROLE_CLINIC']);
$clinic = new \App\Clinic\Entity\Clinic($owner);
$clinic = new Clinic($owner);
$this->em->persist($clinic);
$doctor = new \App\Doctor\Entity\Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
$this->em->persist($doctor);
$clinic->getDoctors()->add($doctor);
$secretary = $this->createUser(['ROLE_SECRETARY']);
$rel = new \App\Secretary\Entity\DoctorSecretary($doctor, $secretary, $clinic);
$rel = new DoctorSecretary($doctor, $secretary, $clinic);
$rel->mergePermissions(['resources' => ['payments' => $payments]]);
$this->em->persist($rel);
$this->em->persist(new \App\Auth\Entity\UserActiveContext(
$secretary,
$clinic->getUuid(),
\App\Shared\Context\EntityContext::TYPE_CLINIC,
));
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid(), EntityContext::TYPE_CLINIC));
$this->em->flush();
return $secretary;
}
public function testPosListIsolatedPerUser(): void
public function testPosListIsolatedPerEnvironment(): void
{
$a = $this->createUser(['ROLE_CLINIC']);
$b = $this->createUser(['ROLE_CLINIC']);
$a = $this->clinicOwner();
$b = $this->clinicOwner();
$this->authJson('POST', '/api/v1/my/payment-methods/pos', $a, [
'bank_name' => 'صادرات',
'terminal_number' => '901234',