feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Extends the secretary permission system to five previously owner-only modules,
so a clinic/doctor can delegate each page to a secretary. All were unreachable
by secretaries before (role-based tenant resolution returned "unknown" → 403).

New permission resources (default-deny, three-place add: entity default,
SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage):
staff, discounts, sms, appointment_settings (view/update only), clinic_doctors
(clinic-only — hidden from independent doctors via `clinicOnly` section filter).

Backend enforcement (SecretaryAccessChecker, three new reusable helpers):
- resolveOwnerEntity(): owner pair from active context — used by StaffController,
  DiscountController, SmsWalletController (now secretary-aware resolveEntity).
- canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into
  AppointmentSettingsController::denyDoctorAccess.
- canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor,
  ClinicDoctorPermissionController (view/update), ClinicInvitationController
  (create/view/update/delete). clinic_doctors is clinic-context only.
Guards run ahead of any subscription gate; non-secretary roles pass unchanged.

Frontend:
- RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic
  variants), settings/clinic-doctors routes accept secretary + permission gate.
- Sidebar (secretary branch): five new items gated by can(); appointment_settings
  route follows active scope; clinic_doctors only in clinic scope.

Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted
for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope
rule. docs/api/secretary.md resource list, enforcement map, JSON example updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/App.tsx

@@ -209,8 +209,8 @@ export default function App() {
         <Route path="settings" element={<RoleRoute roles={['admin']}><SettingsPage /></RoleRoute>} />
 
         {/* پزشکان کلینیک — تب تنظیماتِ مالک کلینیک */}
-        <Route path="settings/clinic-doctors" element={<RoleRoute roles={['clinic']} blockClinicScope><ClinicDoctorsPage /></RoleRoute>} />
-        <Route path="settings/appointment-settings" element={<RoleRoute roles={['clinic']}><ClinicAppointmentSettingsPage /></RoleRoute>} />
+        <Route path="settings/clinic-doctors" element={<RoleRoute roles={['clinic', 'secretary']} blockClinicScope permission={['clinic_doctors', 'view']}><ClinicDoctorsPage /></RoleRoute>} />
+        <Route path="settings/appointment-settings" element={<RoleRoute roles={['clinic', 'secretary']} permission={['appointment_settings', 'view']}><ClinicAppointmentSettingsPage /></RoleRoute>} />
         {/* مسیر قدیمی «مدیریت مطب» → ریدایرکت به تب جدید */}
         <Route path="my-clinic" element={<Navigate to="/admin/settings/clinic-doctors" replace />} />
 
@@ -248,18 +248,18 @@ export default function App() {
         <Route path="my-financial" element={<RoleRoute roles={['doctor', 'secretary', 'clinic']}><MyFinancialPage /></RoleRoute>} />
 
         {/* فاز ۲ — دکتر / کلینیک */}
-        <Route path="staff" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><StaffPage /></RoleRoute>} />
+        <Route path="staff" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['staff', 'view']}><StaffPage /></RoleRoute>} />
         <Route path="settings-menu" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><SettingsMenuPage /></RoleRoute>} />
         <Route path="account-settings" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']}><AccountSettingsPage /></RoleRoute>} />
         <Route path="tags-settings" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['tags', 'view']}><TagsSettingsPage /></RoleRoute>} />
-        <Route path="appointment-settings" element={<RoleRoute roles={['doctor']} blockClinicScope><AppointmentSettingsPage /></RoleRoute>} />
+        <Route path="appointment-settings" element={<RoleRoute roles={['doctor', 'secretary']} blockClinicScope permission={['appointment_settings', 'view']}><AppointmentSettingsPage /></RoleRoute>} />
         <Route path="subscription" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><SubscriptionPage /></RoleRoute>} />
-        <Route path="discounts" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><DiscountsPage /></RoleRoute>} />
+        <Route path="discounts" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['discounts', 'view']}><DiscountsPage /></RoleRoute>} />
         <Route path="subscription/success" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><PaymentSuccessPage /></RoleRoute>} />
         <Route path="clinic-services" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['services', 'view']}><ClinicServicesPage /></RoleRoute>} />
         <Route path="clinic-services/:uuid" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['services', 'view']}><ServiceDetailPage /></RoleRoute>} />
         <Route path="inventory" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['inventory', 'view']}><InventoryPage /></RoleRoute>} />
-        <Route path="sms-wallet" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><SmsWalletPage /></RoleRoute>} />
+        <Route path="sms-wallet" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['sms', 'view']}><SmsWalletPage /></RoleRoute>} />
         <Route path="my-secretaries" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><MySecretariesPage /></RoleRoute>} />
         <Route path="admin-subscription" element={<RoleRoute roles={['admin']}><AdminSubscriptionPage /></RoleRoute>} />
 

assets/admin/components/layout/Sidebar.test.tsx

@@ -116,4 +116,43 @@ describe("Sidebar — گِیت منوی منشی بر اساس مجوز", () =>
             "/admin/tags-settings",
         );
     });
+
+    it("منابع فاز B (staff/discounts/sms/appointment_settings) با مجوز نمایش داده می‌شوند", () => {
+        setSecretary({
+            staff: { view: true },
+            discounts: { view: true },
+            sms: { view: true },
+            appointment_settings: { view: true },
+        });
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.getByText("پرسنل").closest("a")).toHaveAttribute("href", "/admin/staff");
+        expect(screen.getByText("تخفیف‌ها").closest("a")).toHaveAttribute("href", "/admin/discounts");
+        expect(screen.getByText("پیامک‌ها").closest("a")).toHaveAttribute("href", "/admin/sms-wallet");
+        // scope=clinic → مسیر تنظیمات کلینیک
+        expect(screen.getByText("تنظیمات نوبت‌دهی").closest("a")).toHaveAttribute(
+            "href",
+            "/admin/settings/appointment-settings",
+        );
+    });
+
+    it("مدیریت پزشکان کلینیک در scope=doctor حتی با مجوز دیده نمی‌شود", () => {
+        useAuthStore.setState({
+            primaryRole: "secretary",
+            dbUuid: "d1",
+            userName: "منشی",
+            availableContexts: [],
+            context: { scope: "doctor", permissions: { resources: { clinic_doctors: { view: true } } } },
+        } as any);
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.queryByText("پزشکان کلینیک")).not.toBeInTheDocument();
+    });
+
+    it("مدیریت پزشکان کلینیک در scope=clinic با مجوز دیده می‌شود", () => {
+        setSecretary({ clinic_doctors: { view: true } });
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.getByText("پزشکان کلینیک").closest("a")).toHaveAttribute(
+            "href",
+            "/admin/settings/clinic-doctors",
+        );
+    });
 });

assets/admin/components/layout/Sidebar.tsx

@@ -18,6 +18,7 @@ import {
     KeyIcon,
     LockClosedIcon,
     PlusIcon,
+    ReceiptPercentIcon,
     ShieldCheckIcon,
     StarIcon,
     TagIcon,
@@ -422,6 +423,46 @@ function buildSections(
                 label: "تگ‌ها",
             });
         }
+        if (can("staff", "view")) {
+            items.push({
+                to: "/admin/staff",
+                icon: UsersIcon,
+                label: "پرسنل",
+            });
+        }
+        if (can("discounts", "view")) {
+            items.push({
+                to: "/admin/discounts",
+                icon: ReceiptPercentIcon,
+                label: "تخفیف‌ها",
+            });
+        }
+        if (can("sms", "view")) {
+            items.push({
+                to: "/admin/sms-wallet",
+                icon: DevicePhoneMobileIcon,
+                label: "پیامک‌ها",
+            });
+        }
+        if (can("appointment_settings", "view")) {
+            items.push({
+                // مسیر بسته به محیط فعال: کلینیک vs مطب شخصی.
+                to:
+                    scope === "clinic"
+                        ? "/admin/settings/appointment-settings"
+                        : "/admin/appointment-settings",
+                icon: Cog6ToothIcon,
+                label: "تنظیمات نوبت‌دهی",
+            });
+        }
+        // مدیریت پزشکان کلینیک فقط در محیطِ کلینیک معنا دارد.
+        if (scope === "clinic" && can("clinic_doctors", "view")) {
+            items.push({
+                to: "/admin/settings/clinic-doctors",
+                icon: HeartIcon,
+                label: "پزشکان کلینیک",
+            });
+        }
 
         return [
             {

assets/admin/pages/MySecretariesPage.tsx

@@ -76,6 +76,11 @@ const EMPTY_PERMISSIONS: SecretaryPermissions = {
     inventory: { view: false, create: false, update: false, delete: false },
     tags: { view: false, create: false, update: false, delete: false },
     services: { view: false, create: false, update: false, delete: false },
+    staff: { view: false, create: false, update: false, delete: false },
+    discounts: { view: false, create: false, update: false, delete: false },
+    sms: { view: false, create: false, update: false, delete: false },
+    appointment_settings: { view: false, update: false },
+    clinic_doctors: { view: false, create: false, update: false, delete: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -83,6 +88,8 @@ type PermSection = keyof SecretaryPermissions;
 const PERMISSION_SECTIONS: {
     key: PermSection;
     title: string;
+    /** فقط برای مالکِ کلینیک نمایش داده می‌شود (پزشک مستقل نه toggle نه منو). */
+    clinicOnly?: boolean;
     items: { key: string; label: string }[];
 }[] = [
     {
@@ -173,16 +180,67 @@ const PERMISSION_SECTIONS: {
             { key: "delete", label: "حذف خدمت" },
         ],
     },
+    {
+        key: "staff",
+        title: "پرسنل",
+        items: [
+            { key: "view", label: "مشاهده پرسنل" },
+            { key: "create", label: "افزودن پرسنل" },
+            { key: "update", label: "ویرایش پرسنل" },
+            { key: "delete", label: "حذف پرسنل" },
+        ],
+    },
+    {
+        key: "discounts",
+        title: "تخفیف‌ها",
+        items: [
+            { key: "view", label: "مشاهده تخفیف‌ها" },
+            { key: "create", label: "ایجاد تخفیف" },
+            { key: "update", label: "ویرایش تخفیف" },
+            { key: "delete", label: "حذف تخفیف" },
+        ],
+    },
+    {
+        key: "sms",
+        title: "پیامک‌ها",
+        items: [
+            { key: "view", label: "مشاهده پیامک/کیف پول" },
+            { key: "create", label: "شارژ/ارسال" },
+            { key: "update", label: "ویرایش تنظیمات" },
+            { key: "delete", label: "حذف" },
+        ],
+    },
+    {
+        key: "appointment_settings",
+        title: "تنظیمات نوبت‌دهی",
+        items: [
+            { key: "view", label: "مشاهده تنظیمات" },
+            { key: "update", label: "ویرایش تنظیمات" },
+        ],
+    },
+    {
+        key: "clinic_doctors",
+        title: "مدیریت پزشکان کلینیک",
+        clinicOnly: true,
+        items: [
+            { key: "view", label: "مشاهده پزشکان" },
+            { key: "create", label: "افزودن پزشک" },
+            { key: "update", label: "ویرایش پزشک" },
+            { key: "delete", label: "حذف پزشک" },
+        ],
+    },
 ];
 
 function PermissionAccordions({
     permissions,
     onChange,
     disabled,
+    isClinic,
 }: {
     permissions: SecretaryPermissions;
     onChange: (section: PermSection, item: string, value: boolean) => void;
     disabled?: boolean;
+    isClinic: boolean;
 }) {
     const [openKeys, setOpenKeys] = useState<Set<string>>(
         new Set(["appointments", "patients"]),
@@ -196,13 +254,16 @@ function PermissionAccordions({
         });
     };
 
+    // منابع clinicOnly (مثل مدیریت پزشکان کلینیک) فقط برای مالکِ کلینیک دیده می‌شوند.
+    const sections = PERMISSION_SECTIONS.filter((s) => !s.clinicOnly || isClinic);
+
     return (
         <div className="w-full">
             <p className="text-[#525252] dark:text-[#D7D8ED] text-[16px] font-bold mb-[16px]">
                 مجوزهای دسترسی
             </p>
             <div className="flex flex-col gap-[8px] w-full items-stretch">
-                {PERMISSION_SECTIONS.map((section) => {
+                {sections.map((section) => {
                     const open = openKeys.has(section.key);
                     const sectionPerm = permissions[section.key] as Record<string, boolean>;
                     return (
@@ -490,7 +551,7 @@ function SecretaryModal({
                     <DefaultTextField placeholder="آدرس" value={form.address} onChange={(v) => setField("address", v)} disabled={disabled} multiline rows={2} />
                 </div>
 
-                <PermissionAccordions permissions={form.permission} onChange={setPermission} disabled={disabled} />
+                <PermissionAccordions permissions={form.permission} onChange={setPermission} disabled={disabled} isClinic={isClinic} />
             </div>
         </Modal>
     );

assets/admin/pages/SecretariesPage.tsx

@@ -22,6 +22,11 @@ const DEFAULT_PERMISSIONS: SecretaryPermissions = {
   inventory: { view: false, create: false, update: false, delete: false },
   tags: { view: false, create: false, update: false, delete: false },
   services: { view: false, create: false, update: false, delete: false },
+  staff: { view: false, create: false, update: false, delete: false },
+  discounts: { view: false, create: false, update: false, delete: false },
+  sms: { view: false, create: false, update: false, delete: false },
+  appointment_settings: { view: false, update: false },
+  clinic_doctors: { view: false, create: false, update: false, delete: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -106,6 +111,49 @@ const PERMISSION_LABELS: Record<PermSection, { label: string; actions: { key: st
       { key: 'delete', label: 'حذف' },
     ],
   },
+  staff: {
+    label: 'پرسنل',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  discounts: {
+    label: 'تخفیف‌ها',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  sms: {
+    label: 'پیامک‌ها',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'شارژ/ارسال' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  appointment_settings: {
+    label: 'تنظیمات نوبت‌دهی',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'update', label: 'ویرایش' },
+    ],
+  },
+  clinic_doctors: {
+    label: 'مدیریت پزشکان کلینیک',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
 };
 
 function PermissionsMatrix({

assets/admin/types/index.ts

@@ -508,6 +508,34 @@ export interface SecretaryPermissions {
         update: boolean;
         delete: boolean;
     };
+    staff: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    discounts: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    sms: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    appointment_settings: {
+        view: boolean;
+        update: boolean;
+    };
+    clinic_doctors: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
 }
 
 export interface Specialty {

docs/api/secretary.md

@@ -87,7 +87,12 @@ Create a secretary for a doctor.
                 "create": false,
                 "update": false,
                 "delete": false
-            }
+            },
+            "staff":     { "view": false, "create": false, "update": false, "delete": false },
+            "discounts": { "view": false, "create": false, "update": false, "delete": false },
+            "sms":       { "view": false, "create": false, "update": false, "delete": false },
+            "appointment_settings": { "view": false, "update": false },
+            "clinic_doctors": { "view": false, "create": false, "update": false, "delete": false }
         }
     }
 }
@@ -125,7 +130,7 @@ Create a secretary for a doctor.
 
 **Permissions Structure:**
 
-مجموعهٔ منابع (resources) بر اساس صفحات و ماژول‌های در دسترسِ منشی است: `appointments`, `patients`, `payments`, `insurances`, `addresses`, `clinic_info`, `inventory`, `tags`, `services`. `mergePermissions` هر منبع/اکشن ارسال‌شده را deep-merge می‌کند. منابع `inventory`, `tags`, `services` به‌صورت پیش‌فرض همه `false`‌اند (default-deny)؛ بقیه طبق `DEFAULT_PERMISSIONS`.
+مجموعهٔ منابع (resources) بر اساس صفحات و ماژول‌های در دسترسِ منشی است: `appointments`, `patients`, `payments`, `insurances`, `addresses`, `clinic_info`, `inventory`, `tags`, `services`, `staff`, `discounts`, `sms`, `appointment_settings`, `clinic_doctors`. `mergePermissions` هر منبع/اکشن ارسال‌شده را deep-merge می‌کند. منابعِ `inventory`, `tags`, `services`, `staff`, `discounts`, `sms`, `appointment_settings`, `clinic_doctors` به‌صورت پیش‌فرض همه `false`‌اند (default-deny)؛ بقیه طبق `DEFAULT_PERMISSIONS`. منبعِ `appointment_settings` فقط `view/update` دارد. منبعِ `clinic_doctors` **فقط در حالت کلینیک** معنا دارد (پزشک مستقل نه toggle نه منو).
 
 **اعمال (enforcement):** همهٔ منابع در بک‌اند enforce می‌شوند، نه فقط `appointments`. منبعِ حقیقت، ستون JSON `permission` روی ردیفِ فعالِ `DoctorSecretary` در محیطِ فعالِ کاربر (`UserActiveContext.db_uuid`) است؛ نقطهٔ مرکزی `App\Secretary\Security\SecretaryAccessChecker` (`can` / `canOrNonSecretary` / `denyUnlessGranted`). نبودِ مجوز → `403 ERR_FORBIDDEN_001`. نقشه:
 
@@ -138,6 +143,11 @@ Create a secretary for a doctor.
 | `inventory` | `InventoryController` (items + packages) | view/create/update/delete |
 | `tags` | `TenantTagController` (لیست با `tags.view` یا `patients.view`؛ نوشتن‌ها با `tags.*`) | view/create/update/delete |
 | `services` | `ClinicServiceController` (sections + items + tariffs). owner از محیطِ فعال با `SecretaryAccessChecker::resolveOwnerEntity` حل می‌شود چون `EntityContextResolver` منشی را نمی‌شناسد. گیتِ `services.*` پیش از گیتِ اشتراک اجرا می‌شود | view/create/update/delete |
+| `staff` | `StaffController` (resolveEntity منشی‌آگاه) | view/create/update/delete |
+| `discounts` | `DiscountController` (CRUD؛ `suggestions` جزو flowِ جلسه است و با discounts گِیت نمی‌شود) | view/create/update/delete |
+| `sms` | `SmsWalletController` (balance/charge/logs/settings). endpointهای admin (قالب/ارسال) همچنان `ROLE_ADMIN` | view/create/update |
+| `appointment_settings` | `AppointmentSettingsController::denyDoctorAccess` → `SecretaryAccessChecker::canForDoctor` (اسکوپِ پزشکِ تخصیص‌یافته + توگل). `clinic_uuid` برای محیطِ کلینیک لازم است | view/update |
+| `clinic_doctors` (فقط کلینیک) | `ClinicController::detachDoctor` (delete)، `ClinicDoctorPermissionController` (view/update)، `ClinicInvitationController` (create/view/update/delete) via `SecretaryAccessChecker::canForClinic` | view/create/update/delete |
 
 نقش‌های غیرمنشی (`ROLE_CLINIC`/`ROLE_DOCTOR`/`ROLE_ADMIN`) از این چک عبور می‌کنند (`canOrNonSecretary` برایشان `true`). منشیِ بدون رابطهٔ فعال/context هیچ مجوزی ندارد → همه‌چیز `403`.
 

src/Appointment/Controller/AppointmentSettingsController.php

@@ -39,6 +39,7 @@ class AppointmentSettingsController extends BaseController
         private readonly ClinicRepository         $clinicRepo,
         private readonly \App\ClinicService\Repository\ServiceItemRepository $itemRepo,
         private readonly \App\Clinic\Security\ClinicDoctorPermissionChecker $permChecker,
+        private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
     ) {}
 
     /**
@@ -518,6 +519,12 @@ class AppointmentSettingsController extends BaseController
             return null;
         }
 
+        // منشی: توگلِ appointment_settings + پزشکِ هدف در اسکوپِ همان منشی.
+        if ($user->hasRole('ROLE_SECRETARY')
+            && $this->secretaryAccess->canForDoctor($user, $doctor, $clinic, 'appointment_settings', $action)) {
+            return null;
+        }
+
         return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
     }
 

src/Clinic/Controller/ClinicController.php

@@ -47,6 +47,7 @@ class ClinicController extends BaseController
         private readonly \App\Clinic\Security\ClinicDoctorPermissionChecker $permChecker,
         private readonly FileValidatorService    $fileValidator,
         private readonly \App\Representation\Service\DomainContextResolver $domainResolver,
+        private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
         private readonly string                  $projectDir,
     ) {}
 
@@ -383,7 +384,8 @@ class ClinicController extends BaseController
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'کلینیک یافت نشد', 404);
         }
 
-        if (!$this->canManageClinic($clinic, $user)) {
+        if (!$this->canManageClinic($clinic, $user)
+            && !$this->secretaryAccess->canForClinic($user, $clinic, 'clinic_doctors', 'delete')) {
             return $this->error(ErrorCodes::ERR_ACCESS_DENIED, 'دسترسی مجاز نیست', 403);
         }
 

src/Clinic/Controller/ClinicDoctorPermissionController.php

@@ -27,13 +27,14 @@ class ClinicDoctorPermissionController extends BaseController
         private readonly DoctorRepository                 $doctorRepo,
         private readonly ClinicDoctorPermissionRepository $permRepo,
         private readonly EntityManagerInterface           $em,
+        private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
     ) {}
 
     #[Route('/api/v1/admin/clinic/{clinicUuid}/doctor-permissions', methods: ['GET'])]
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function listPermissions(string $clinicUuid, #[CurrentUser] User $user): JsonResponse
     {
-        $clinic = $this->resolveClinic($clinicUuid, $user);
+        $clinic = $this->resolveClinic($clinicUuid, $user, 'view');
 
         $data = array_map(
             fn(ClinicDoctorPermission $p) => $p->toArray(),
@@ -47,7 +48,7 @@ class ClinicDoctorPermissionController extends BaseController
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function showPermissions(string $clinicUuid, string $doctorUuid, #[CurrentUser] User $user): JsonResponse
     {
-        $clinic = $this->resolveClinic($clinicUuid, $user);
+        $clinic = $this->resolveClinic($clinicUuid, $user, 'view');
         $doctor = $this->resolveMember($clinic, $doctorUuid);
 
         return $this->success($this->permRepo->getOrCreate($clinic, $doctor)->toArray());
@@ -57,7 +58,7 @@ class ClinicDoctorPermissionController extends BaseController
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function updatePermissions(string $clinicUuid, string $doctorUuid, Request $request, #[CurrentUser] User $user): JsonResponse
     {
-        $clinic = $this->resolveClinic($clinicUuid, $user);
+        $clinic = $this->resolveClinic($clinicUuid, $user, 'update');
         $doctor = $this->resolveMember($clinic, $doctorUuid);
         $perm   = $this->permRepo->getOrCreate($clinic, $doctor);
 
@@ -79,7 +80,7 @@ class ClinicDoctorPermissionController extends BaseController
         return $this->success($perm->toArray());
     }
 
-    private function resolveClinic(string $clinicUuid, User $user): Clinic
+    private function resolveClinic(string $clinicUuid, User $user, string $action): Clinic
     {
         $clinic = $this->clinicRepo->findByUuid($clinicUuid);
         if ($clinic === null) {
@@ -87,7 +88,9 @@ class ClinicDoctorPermissionController extends BaseController
         }
 
         $isOwner = $clinic->getUser()->getId() === $user->getId();
-        if (!$user->hasRole('ROLE_ADMIN') && !$isOwner) {
+        // منشیِ همان کلینیک با توگلِ clinic_doctors می‌تواند مدیریت پزشکان را انجام دهد.
+        $isSecretary = $this->secretaryAccess->canForClinic($user, $clinic, 'clinic_doctors', $action);
+        if (!$user->hasRole('ROLE_ADMIN') && !$isOwner && !$isSecretary) {
             throw new AppException(ErrorCodes::ERR_ACCESS_DENIED, 'دسترسی ندارید', 403);
         }
 

src/ClinicInvitation/Controller/ClinicInvitationController.php

@@ -26,6 +26,7 @@ class ClinicInvitationController extends BaseController
         private readonly ClinicDoctorInvitationRepository $invRepo,
         private readonly ClinicRepository                 $clinicRepo,
         private readonly DoctorRepository                 $doctorRepo,
+        private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
     ) {}
 
     // ── Admin endpoints ──────────────────────────────────────────────────────
@@ -39,7 +40,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'کلینیک یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($clinic, $user);
+        $this->assertClinicAccess($clinic, $user, 'create');
 
         $body      = json_decode($request->getContent(), true) ?? [];
         $mobile    = trim($body['mobile'] ?? '');
@@ -64,7 +65,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'کلینیک یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($clinic, $user);
+        $this->assertClinicAccess($clinic, $user, 'view');
 
         $page  = max(1, (int) $request->query->get('page', 1));
         $limit = min(50, max(1, (int) $request->query->get('limit', 20)));
@@ -96,7 +97,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($inv->getClinic(), $user);
+        $this->assertClinicAccess($inv->getClinic(), $user, 'create');
         $this->invitationService->resend($inv);
 
         return $this->success(['message' => 'پیامک مجدداً ارسال شد']);
@@ -111,7 +112,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($inv->getClinic(), $user);
+        $this->assertClinicAccess($inv->getClinic(), $user, 'update');
 
         $body   = json_decode($request->getContent(), true) ?? [];
         $status = $body['status'] ?? '';
@@ -130,7 +131,7 @@ class ClinicInvitationController extends BaseController
             throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
         }
 
-        $this->assertClinicAccess($inv->getClinic(), $user);
+        $this->assertClinicAccess($inv->getClinic(), $user, 'delete');
         $this->invitationService->delete($inv);
 
         return $this->success(['message' => 'دعوتنامه حذف شد']);
@@ -193,7 +194,7 @@ class ClinicInvitationController extends BaseController
         throw new AppException('ERR_VALIDATION_001', 'action باید accept یا reject باشد', 422);
     }
 
-    private function assertClinicAccess(\App\Clinic\Entity\Clinic $clinic, User $user): void
+    private function assertClinicAccess(\App\Clinic\Entity\Clinic $clinic, User $user, string $action = 'view'): void
     {
         if ($user->hasRole('ROLE_ADMIN')) {
             return;
@@ -201,6 +202,10 @@ class ClinicInvitationController extends BaseController
         if ($user->hasRole('ROLE_CLINIC') && $clinic->getUser()->getId() === $user->getId()) {
             return;
         }
+        // منشیِ همان کلینیک با توگلِ clinic_doctors می‌تواند پزشکان را دعوت/مدیریت کند.
+        if ($this->secretaryAccess->canForClinic($user, $clinic, 'clinic_doctors', $action)) {
+            return;
+        }
         throw new AppException(ErrorCodes::ERR_ACCESS_DENIED, 'دسترسی ندارید', 403);
     }
 

src/Discount/Controller/DiscountController.php

@@ -9,6 +9,7 @@ use App\Discount\Repository\DiscountRuleRepository;
 use App\Discount\Service\DiscountEngine;
 use App\Doctor\Repository\DoctorRepository;
 use App\Patient\Repository\PatientSessionRepository;
+use App\Secretary\Security\SecretaryAccessChecker;
 use App\Shared\Constant\ErrorCodes;
 use App\Shared\Controller\BaseController;
 use Symfony\Component\HttpFoundation\JsonResponse;
@@ -25,6 +26,7 @@ class DiscountController extends BaseController
         private readonly DoctorRepository          $doctorRepo,
         private readonly ClinicRepository          $clinicRepo,
         private readonly PatientSessionRepository  $sessionRepo,
+        private readonly SecretaryAccessChecker    $secretaryAccess,
     ) {}
 
     /** @return array{0: string, 1: ?int} */
@@ -36,6 +38,10 @@ class DiscountController extends BaseController
         if ($user->hasRole('ROLE_CLINIC')) {
             return ['clinic', $this->clinicRepo->findByUser($user)?->getId()];
         }
+        // منشی روی tenantِ محیطِ فعال؛ مجوز جدا با denyUnlessGranted.
+        if ($user->hasRole('ROLE_SECRETARY')) {
+            return $this->secretaryAccess->resolveOwnerEntity($user);
+        }
         return ['unknown', null];
     }
 
@@ -45,6 +51,7 @@ class DiscountController extends BaseController
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function list(#[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'discounts', 'view');
         [$ownerType, $ownerId] = $this->resolveOwner($user);
         if ($ownerId === null) {
             return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
@@ -57,6 +64,7 @@ class DiscountController extends BaseController
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function create(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'discounts', 'create');
         [$ownerType, $ownerId] = $this->resolveOwner($user);
         if ($ownerId === null) {
             return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
@@ -84,6 +92,7 @@ class DiscountController extends BaseController
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function update(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'discounts', 'update');
         [$ownerType, $ownerId] = $this->resolveOwner($user);
         if ($ownerId === null) {
             return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
@@ -117,6 +126,7 @@ class DiscountController extends BaseController
     #[IsGranted('IS_AUTHENTICATED_FULLY')]
     public function delete(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'discounts', 'delete');
         [$ownerType, $ownerId] = $this->resolveOwner($user);
         if ($ownerId === null) {
             return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);

src/Secretary/Entity/DoctorSecretary.php

@@ -29,6 +29,11 @@ class DoctorSecretary
             'inventory'    => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'tags'         => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
             'services'     => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
+            'staff'        => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
+            'discounts'    => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
+            'sms'          => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
+            'appointment_settings' => ['view' => false, 'update' => false],
+            'clinic_doctors' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
         ],
     ];
 

src/Secretary/Security/SecretaryAccessChecker.php

@@ -85,6 +85,58 @@ class SecretaryAccessChecker
         return ['unknown', null];
     }
 
+    /**
+     * آیا منشی در محیطِ فعالِ خود، روی این پزشکِ مشخص (و کلینیکِ همان نوبت/تنظیم)
+     * مجاز به resource/action است؟ ترکیبِ «اسکوپِ پزشکِ تخصیص‌یافته» و «توگلِ مجوز».
+     * قرینهٔ AppointmentAccessChecker::secretaryCan اما برای هر resource.
+     */
+    public function canForDoctor(
+        User $user,
+        \App\Doctor\Entity\Doctor $doctor,
+        ?\App\Clinic\Entity\Clinic $clinic,
+        string $resource,
+        string $action
+    ): bool {
+        $dbUuid = $this->contextRepo->findByUser($user)?->getDbUuid();
+        if ($dbUuid === null) {
+            return false;
+        }
+
+        $ctxClinic = $this->clinicRepo->findByUuid($dbUuid);
+        if ($ctxClinic !== null) {
+            // محیطِ کلینیک: تنظیم باید در همان کلینیک باشد و پزشکش جزو پزشکانِ منشی.
+            if ($clinic === null || $ctxClinic->getId() !== $clinic->getId()) {
+                return false;
+            }
+            $relation = $this->secretaryRepo->findActiveClinicRow($user, $ctxClinic, $doctor);
+
+            return $relation !== null && $this->permissions->can($relation, $resource, $action);
+        }
+
+        // محیطِ مطب شخصی: تنظیم هم باید شخصی باشد (clinic == null).
+        if ($clinic !== null) {
+            return false;
+        }
+        $ctxDoctor = $this->doctorRepo->findByUuid($dbUuid);
+        if ($ctxDoctor === null || $ctxDoctor->getId() !== $doctor->getId()) {
+            return false;
+        }
+        $relation = $this->secretaryRepo->findActiveBySecretaryForDoctor($user, $doctor);
+
+        return $relation !== null && $this->permissions->can($relation, $resource, $action);
+    }
+
+    /**
+     * آیا منشی در محیطِ فعالِ خود — که باید همین کلینیک باشد — مجاز به resource/action است؟
+     * برای منابعِ کلینیک‌سطح مثل clinic_doctors که tenant لزوماً کلینیک است.
+     */
+    public function canForClinic(User $user, \App\Clinic\Entity\Clinic $clinic, string $resource, string $action): bool
+    {
+        [$type, $id] = $this->resolveOwnerEntity($user);
+
+        return $type === 'clinic' && $id === $clinic->getId() && $this->can($user, $resource, $action);
+    }
+
     /**
      * برای مسیرهایی که چند نقش دارند: فقط منشی را محدود کن. سایر نقش‌ها true.
      */

src/Sms/Controller/SmsWalletController.php

@@ -38,6 +38,7 @@ class SmsWalletController extends BaseController
         private readonly DoctorRepository               $doctorRepo,
         private readonly ClinicRepository               $clinicRepo,
         private readonly \App\Config\Repository\SiteConfigRepository $configRepo,
+        private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
         private readonly string $appBaseUrl,
     ) {}
 
@@ -50,6 +51,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/wallet/balance', methods: ['GET'])]
     public function balance(#[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -69,6 +71,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/wallet/charge', methods: ['POST'])]
     public function charge(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'create');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -102,6 +105,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/wallet/logs', methods: ['GET'])]
     public function logs(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -125,6 +129,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/settings', methods: ['GET'])]
     public function getSettings(#[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -149,6 +154,7 @@ class SmsWalletController extends BaseController
     #[Route('/api/v1/sms/settings', methods: ['PATCH'])]
     public function updateSettings(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'sms', 'update');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -281,6 +287,11 @@ class SmsWalletController extends BaseController
             return $clinic !== null ? ['clinic', $clinic->getId()] : ['clinic', null];
         }
 
+        // منشی روی tenantِ محیطِ فعال؛ مجوز جدا با denyUnlessGranted.
+        if ($user->hasRole('ROLE_SECRETARY')) {
+            return $this->secretaryAccess->resolveOwnerEntity($user);
+        }
+
         return ['unknown', null];
     }
 }

src/Staff/Controller/StaffController.php

@@ -5,6 +5,7 @@ namespace App\Staff\Controller;
 use App\Auth\Entity\User;
 use App\Clinic\Repository\ClinicRepository;
 use App\Doctor\Repository\DoctorRepository;
+use App\Secretary\Security\SecretaryAccessChecker;
 use App\Shared\Constant\ErrorCodes;
 use App\Shared\Controller\BaseController;
 use App\Staff\Entity\ClinicStaff;
@@ -24,11 +25,13 @@ class StaffController extends BaseController
         private readonly ClinicStaffRepository $staffRepo,
         private readonly DoctorRepository      $doctorRepo,
         private readonly ClinicRepository      $clinicRepo,
+        private readonly SecretaryAccessChecker $secretaryAccess,
     ) {}
 
     #[Route('/api/v1/staff', methods: ['GET'])]
     public function list(#[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'staff', 'view');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -45,6 +48,7 @@ class StaffController extends BaseController
     #[Route('/api/v1/staff', methods: ['POST'])]
     public function create(Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'staff', 'create');
         [$entityType, $entityId] = $this->resolveEntity($user);
         if ($entityId === null) {
             return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -71,6 +75,7 @@ class StaffController extends BaseController
     #[Route('/api/v1/staff/{uuid}', methods: ['PATCH'])]
     public function update(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'staff', 'update');
         $staff = $this->staffRepo->findByUuid($uuid);
         if ($staff === null) {
             return $this->error(ErrorCodes::ERR_STAFF_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_STAFF_NOT_FOUND), 404);
@@ -98,6 +103,7 @@ class StaffController extends BaseController
     #[Route('/api/v1/staff/{uuid}/toggle', methods: ['PATCH'])]
     public function toggle(string $uuid, #[CurrentUser] User $user): JsonResponse
     {
+        $this->secretaryAccess->denyUnlessGranted($user, 'staff', 'update');
         $staff = $this->staffRepo->findByUuid($uuid);
         if ($staff === null) {
             return $this->error(ErrorCodes::ERR_STAFF_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_STAFF_NOT_FOUND), 404);
@@ -125,6 +131,12 @@ class StaffController extends BaseController
             return $clinic !== null ? ['clinic', $clinic->getId()] : ['clinic', null];
         }
 
+        // منشی روی tenantِ محیطِ فعالِ خود (کلینیک/پزشک) عمل می‌کند؛ مجوز جدا با
+        // denyUnlessGranted بررسی شده است.
+        if ($user->hasRole('ROLE_SECRETARY')) {
+            return $this->secretaryAccess->resolveOwnerEntity($user);
+        }
+
         return ['unknown', null];
     }
 

tests/Secretary/SecretaryResourceEnforcementTest.php

@@ -114,4 +114,134 @@ class SecretaryResourceEnforcementTest extends ApiTestCase
         $this->authJson('POST', '/api/v1/service-section', $secretary, ['name' => 'بخش تست']);
         $this->assertSame(403, $this->responseCode());
     }
+
+    // ── Phase B resources ─────────────────────────────────────────────────────
+
+    public function testStaffDeniedByDefault(): void
+    {
+        [$secretary] = $this->makeClinicSecretary();
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/staff', $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testStaffAllowedWhenGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['staff' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/staff', $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testStaffCreateDeniedButViewGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['staff' => ['view' => true, 'create' => false]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/staff', $secretary);
+        $this->assertSame(200, $this->responseCode());
+
+        $this->authJson('POST', '/api/v1/staff', $secretary, ['full_name' => 'خانم تست']);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testDiscountsDeniedByDefault(): void
+    {
+        [$secretary] = $this->makeClinicSecretary();
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/admin/discount-rules', $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testDiscountsAllowedWhenGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['discounts' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/admin/discount-rules', $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testSmsDeniedByDefault(): void
+    {
+        [$secretary] = $this->makeClinicSecretary();
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/sms/wallet/balance', $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testSmsAllowedWhenGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['sms' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/sms/wallet/balance', $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testClinicDoctorsDeniedByDefault(): void
+    {
+        [$secretary, , $clinic] = $this->makeClinicSecretaryWithClinic();
+        $this->em->flush();
+
+        $this->authJson('GET', "/api/v1/admin/clinic/{$clinic->getUuid()}/doctor-permissions", $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testClinicDoctorsAllowedWhenGranted(): void
+    {
+        [$secretary, $rel, $clinic] = $this->makeClinicSecretaryWithClinic();
+        $rel->mergePermissions(['resources' => ['clinic_doctors' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', "/api/v1/admin/clinic/{$clinic->getUuid()}/doctor-permissions", $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testAppointmentSettingsDeniedByDefault(): void
+    {
+        [$secretary, , $clinic, $doctor] = $this->makeClinicSecretaryWithClinic();
+        $this->em->flush();
+
+        // clinic_uuid لازم است تا محیطِ کلینیک حل شود (مثل پزشکِ عضو کلینیک).
+        $this->authJson('GET', "/api/v1/appointment-settings/holidays/list/{$doctor->getUuid()}?clinic_uuid={$clinic->getUuid()}", $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testAppointmentSettingsAllowedWhenGranted(): void
+    {
+        [$secretary, $rel, $clinic, $doctor] = $this->makeClinicSecretaryWithClinic();
+        $rel->mergePermissions(['resources' => ['appointment_settings' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', "/api/v1/appointment-settings/holidays/list/{$doctor->getUuid()}?clinic_uuid={$clinic->getUuid()}", $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    /** مثل makeClinicSecretary اما clinic و doctor را هم برمی‌گرداند. */
+    private function makeClinicSecretaryWithClinic(): array
+    {
+        $owner  = $this->createUser(['ROLE_CLINIC']);
+        $clinic = new Clinic($owner);
+        $this->em->persist($clinic);
+
+        $doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
+        $this->em->persist($doctor);
+        $clinic->getDoctors()->add($doctor);
+
+        $secretary = $this->createUser(['ROLE_SECRETARY']);
+        $rel = new DoctorSecretary($doctor, $secretary, DoctorSecretary::OWNER_CLINIC, $clinic);
+        $this->em->persist($rel);
+        $this->em->persist(new UserActiveContext($secretary, $clinic->getUuid()));
+
+        return [$secretary, $rel, $clinic, $doctor];
+    }
 }