fix(permissions): apply the patient and tag read gates to invited clinic doctors

PatientController::resolveScope and TenantTagController::guardTagView only ever checked the secretary, while every write in both controllers already ran through both checkers. So an invited clinic doctor with patients.view off got 200 with an empty list where a secretary got 403 — one permission, two behaviours. No data was exposed either way; tenant scoping emptied the result. The fix is not canOrNonMember. That collapses two different situations: a membership row switched to active=false means the collaboration ended, and ClinicDoctorPermission::can() returns false for everything in that case too. Routing it through the permission gate turned the existing 404 on a single record into a 403, which confirms the record exists to someone who just lost access. ClinicRecordAccessTest caught it. isActiveMemberDenied() answers the narrower question — active member, permission off — and leaves a deactivated row to the data scope, which closes it with a 404 and discloses nothing. A test now pins that distinction so it cannot be collapsed again. Tags keep the tags.view OR patients.view rule, now for both roles. Verified live in three states: active with both off 403/403, deactivated not 403, active with patients.view on 200/200. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-07 19:30:52 +03:30
parent 6a6852379d
commit d6de746938
7 changed files with 152 additions and 4 deletions
@@ -89,4 +89,89 @@ class ClinicDoctorPermissionEnforcementTest extends ApiTestCase
        $this->authJson('GET', '/api/v1/inventory-items', $doctorUser);
        $this->assertSame(200, $this->responseCode());
    }
+    // ── خواندنِ پرونده و تگ — قرینهٔ منشی ────────────────────────────────────
+
+    /**
+     * تا پیش از این فقط منشی در PatientController::resolveScope بررسی می‌شد، پس
+     * پزشکِ عضو با `patients.view` خاموش به‌جای ۴۰۳، ۲۰۰ با فهرست خالی می‌گرفت.
+     */
+    public function testPatientListDeniedWhenPatientsViewOff(): void
+    {
+        [$doctorUser, $perm] = $this->makeMemberDoctor();
+        $perm->mergePermissions(['resources' => ['patients' => ['view' => false]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/patients', $doctorUser);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    /** پیش‌فرضِ پزشکِ عضو `patients.view = true` است. */
+    public function testPatientListAllowedByDefault(): void
+    {
+        [$doctorUser] = $this->makeMemberDoctor();
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/patients', $doctorUser);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    /** تگ‌ها با tags.view یا patients.view باز می‌شوند — همان قاعدهٔ منشی. */
+    public function testTagListAllowedViaPatientsViewEvenWhenTagsViewOff(): void
+    {
+        [$doctorUser, $perm] = $this->makeMemberDoctor();
+        $perm->mergePermissions(['resources' => [
+            'patients' => ['view' => true],
+            'tags'     => ['view' => false],
+        ]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/tenant-tags', $doctorUser);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testTagListDeniedWhenNeitherTagsNorPatientsViewGranted(): void
+    {
+        [$doctorUser, $perm] = $this->makeMemberDoctor();
+        $perm->mergePermissions(['resources' => [
+            'patients' => ['view' => false],
+            'tags'     => ['view' => false],
+        ]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/tenant-tags', $doctorUser);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testTagListAllowedWithTagsViewAlone(): void
+    {
+        [$doctorUser, $perm] = $this->makeMemberDoctor();
+        $perm->mergePermissions(['resources' => [
+            'patients' => ['view' => false],
+            'tags'     => ['view' => true],
+        ]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/tenant-tags', $doctorUser);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    /**
+     * «پایان همکاری» با «مجوز خاموش» یکی نیست: ردیفِ غیرفعال نباید ۴۰۳ بدهد،
+     * وگرنه وجودِ پرونده لو می‌رود. دامنهٔ داده خودش آن را می‌بندد.
+     */
+    public function testDeactivatedMemberIsNotAnswered403OnTheList(): void
+    {
+        [$doctorUser, $perm] = $this->makeMemberDoctor();
+        $perm->setActive(false);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/patients', $doctorUser);
+
+        $this->assertNotSame(
+            403,
+            $this->responseCode(),
+            'ردیفِ غیرفعال باید از مسیرِ دامنهٔ داده بسته شود، نه با ۴۰۳ مجوز',
+        );
+    }
+
 }