feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Extends the secretary permission system to five previously owner-only modules,
so a clinic/doctor can delegate each page to a secretary. All were unreachable
by secretaries before (role-based tenant resolution returned "unknown" → 403).

New permission resources (default-deny, three-place add: entity default,
SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage):
staff, discounts, sms, appointment_settings (view/update only), clinic_doctors
(clinic-only — hidden from independent doctors via `clinicOnly` section filter).

Backend enforcement (SecretaryAccessChecker, three new reusable helpers):
- resolveOwnerEntity(): owner pair from active context — used by StaffController,
  DiscountController, SmsWalletController (now secretary-aware resolveEntity).
- canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into
  AppointmentSettingsController::denyDoctorAccess.
- canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor,
  ClinicDoctorPermissionController (view/update), ClinicInvitationController
  (create/view/update/delete). clinic_doctors is clinic-context only.
Guards run ahead of any subscription gate; non-secretary roles pass unchanged.

Frontend:
- RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic
  variants), settings/clinic-doctors routes accept secretary + permission gate.
- Sidebar (secretary branch): five new items gated by can(); appointment_settings
  route follows active scope; clinic_doctors only in clinic scope.

Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted
for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope
rule. docs/api/secretary.md resource list, enforcement map, JSON example updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

assets/admin/App.tsx

@@ -209,8 +209,8 @@ export default function App() {
         <Route path="settings" element={<RoleRoute roles={['admin']}><SettingsPage /></RoleRoute>} />
 
         {/* پزشکان کلینیک — تب تنظیماتِ مالک کلینیک */}
-        <Route path="settings/clinic-doctors" element={<RoleRoute roles={['clinic']} blockClinicScope><ClinicDoctorsPage /></RoleRoute>} />
-        <Route path="settings/appointment-settings" element={<RoleRoute roles={['clinic']}><ClinicAppointmentSettingsPage /></RoleRoute>} />
+        <Route path="settings/clinic-doctors" element={<RoleRoute roles={['clinic', 'secretary']} blockClinicScope permission={['clinic_doctors', 'view']}><ClinicDoctorsPage /></RoleRoute>} />
+        <Route path="settings/appointment-settings" element={<RoleRoute roles={['clinic', 'secretary']} permission={['appointment_settings', 'view']}><ClinicAppointmentSettingsPage /></RoleRoute>} />
         {/* مسیر قدیمی «مدیریت مطب» → ریدایرکت به تب جدید */}
         <Route path="my-clinic" element={<Navigate to="/admin/settings/clinic-doctors" replace />} />
 
@@ -248,18 +248,18 @@ export default function App() {
         <Route path="my-financial" element={<RoleRoute roles={['doctor', 'secretary', 'clinic']}><MyFinancialPage /></RoleRoute>} />
 
         {/* فاز ۲ — دکتر / کلینیک */}
-        <Route path="staff" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><StaffPage /></RoleRoute>} />
+        <Route path="staff" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['staff', 'view']}><StaffPage /></RoleRoute>} />
         <Route path="settings-menu" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><SettingsMenuPage /></RoleRoute>} />
         <Route path="account-settings" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']}><AccountSettingsPage /></RoleRoute>} />
         <Route path="tags-settings" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['tags', 'view']}><TagsSettingsPage /></RoleRoute>} />
-        <Route path="appointment-settings" element={<RoleRoute roles={['doctor']} blockClinicScope><AppointmentSettingsPage /></RoleRoute>} />
+        <Route path="appointment-settings" element={<RoleRoute roles={['doctor', 'secretary']} blockClinicScope permission={['appointment_settings', 'view']}><AppointmentSettingsPage /></RoleRoute>} />
         <Route path="subscription" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><SubscriptionPage /></RoleRoute>} />
-        <Route path="discounts" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><DiscountsPage /></RoleRoute>} />
+        <Route path="discounts" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['discounts', 'view']}><DiscountsPage /></RoleRoute>} />
         <Route path="subscription/success" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><PaymentSuccessPage /></RoleRoute>} />
         <Route path="clinic-services" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['services', 'view']}><ClinicServicesPage /></RoleRoute>} />
         <Route path="clinic-services/:uuid" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['services', 'view']}><ServiceDetailPage /></RoleRoute>} />
         <Route path="inventory" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['inventory', 'view']}><InventoryPage /></RoleRoute>} />
-        <Route path="sms-wallet" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><SmsWalletPage /></RoleRoute>} />
+        <Route path="sms-wallet" element={<RoleRoute roles={['doctor', 'clinic', 'secretary']} blockClinicScope permission={['sms', 'view']}><SmsWalletPage /></RoleRoute>} />
         <Route path="my-secretaries" element={<RoleRoute roles={['doctor', 'clinic']} blockClinicScope><MySecretariesPage /></RoleRoute>} />
         <Route path="admin-subscription" element={<RoleRoute roles={['admin']}><AdminSubscriptionPage /></RoleRoute>} />
 

assets/admin/components/layout/Sidebar.test.tsx

@@ -116,4 +116,43 @@ describe("Sidebar — گِیت منوی منشی بر اساس مجوز", () =>
             "/admin/tags-settings",
         );
     });
+
+    it("منابع فاز B (staff/discounts/sms/appointment_settings) با مجوز نمایش داده می‌شوند", () => {
+        setSecretary({
+            staff: { view: true },
+            discounts: { view: true },
+            sms: { view: true },
+            appointment_settings: { view: true },
+        });
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.getByText("پرسنل").closest("a")).toHaveAttribute("href", "/admin/staff");
+        expect(screen.getByText("تخفیف‌ها").closest("a")).toHaveAttribute("href", "/admin/discounts");
+        expect(screen.getByText("پیامک‌ها").closest("a")).toHaveAttribute("href", "/admin/sms-wallet");
+        // scope=clinic → مسیر تنظیمات کلینیک
+        expect(screen.getByText("تنظیمات نوبت‌دهی").closest("a")).toHaveAttribute(
+            "href",
+            "/admin/settings/appointment-settings",
+        );
+    });
+
+    it("مدیریت پزشکان کلینیک در scope=doctor حتی با مجوز دیده نمی‌شود", () => {
+        useAuthStore.setState({
+            primaryRole: "secretary",
+            dbUuid: "d1",
+            userName: "منشی",
+            availableContexts: [],
+            context: { scope: "doctor", permissions: { resources: { clinic_doctors: { view: true } } } },
+        } as any);
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.queryByText("پزشکان کلینیک")).not.toBeInTheDocument();
+    });
+
+    it("مدیریت پزشکان کلینیک در scope=clinic با مجوز دیده می‌شود", () => {
+        setSecretary({ clinic_doctors: { view: true } });
+        renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
+        expect(screen.getByText("پزشکان کلینیک").closest("a")).toHaveAttribute(
+            "href",
+            "/admin/settings/clinic-doctors",
+        );
+    });
 });

assets/admin/components/layout/Sidebar.tsx

@@ -18,6 +18,7 @@ import {
     KeyIcon,
     LockClosedIcon,
     PlusIcon,
+    ReceiptPercentIcon,
     ShieldCheckIcon,
     StarIcon,
     TagIcon,
@@ -422,6 +423,46 @@ function buildSections(
                 label: "تگ‌ها",
             });
         }
+        if (can("staff", "view")) {
+            items.push({
+                to: "/admin/staff",
+                icon: UsersIcon,
+                label: "پرسنل",
+            });
+        }
+        if (can("discounts", "view")) {
+            items.push({
+                to: "/admin/discounts",
+                icon: ReceiptPercentIcon,
+                label: "تخفیف‌ها",
+            });
+        }
+        if (can("sms", "view")) {
+            items.push({
+                to: "/admin/sms-wallet",
+                icon: DevicePhoneMobileIcon,
+                label: "پیامک‌ها",
+            });
+        }
+        if (can("appointment_settings", "view")) {
+            items.push({
+                // مسیر بسته به محیط فعال: کلینیک vs مطب شخصی.
+                to:
+                    scope === "clinic"
+                        ? "/admin/settings/appointment-settings"
+                        : "/admin/appointment-settings",
+                icon: Cog6ToothIcon,
+                label: "تنظیمات نوبت‌دهی",
+            });
+        }
+        // مدیریت پزشکان کلینیک فقط در محیطِ کلینیک معنا دارد.
+        if (scope === "clinic" && can("clinic_doctors", "view")) {
+            items.push({
+                to: "/admin/settings/clinic-doctors",
+                icon: HeartIcon,
+                label: "پزشکان کلینیک",
+            });
+        }
 
         return [
             {

assets/admin/pages/MySecretariesPage.tsx

@@ -76,6 +76,11 @@ const EMPTY_PERMISSIONS: SecretaryPermissions = {
     inventory: { view: false, create: false, update: false, delete: false },
     tags: { view: false, create: false, update: false, delete: false },
     services: { view: false, create: false, update: false, delete: false },
+    staff: { view: false, create: false, update: false, delete: false },
+    discounts: { view: false, create: false, update: false, delete: false },
+    sms: { view: false, create: false, update: false, delete: false },
+    appointment_settings: { view: false, update: false },
+    clinic_doctors: { view: false, create: false, update: false, delete: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -83,6 +88,8 @@ type PermSection = keyof SecretaryPermissions;
 const PERMISSION_SECTIONS: {
     key: PermSection;
     title: string;
+    /** فقط برای مالکِ کلینیک نمایش داده می‌شود (پزشک مستقل نه toggle نه منو). */
+    clinicOnly?: boolean;
     items: { key: string; label: string }[];
 }[] = [
     {
@@ -173,16 +180,67 @@ const PERMISSION_SECTIONS: {
             { key: "delete", label: "حذف خدمت" },
         ],
     },
+    {
+        key: "staff",
+        title: "پرسنل",
+        items: [
+            { key: "view", label: "مشاهده پرسنل" },
+            { key: "create", label: "افزودن پرسنل" },
+            { key: "update", label: "ویرایش پرسنل" },
+            { key: "delete", label: "حذف پرسنل" },
+        ],
+    },
+    {
+        key: "discounts",
+        title: "تخفیف‌ها",
+        items: [
+            { key: "view", label: "مشاهده تخفیف‌ها" },
+            { key: "create", label: "ایجاد تخفیف" },
+            { key: "update", label: "ویرایش تخفیف" },
+            { key: "delete", label: "حذف تخفیف" },
+        ],
+    },
+    {
+        key: "sms",
+        title: "پیامک‌ها",
+        items: [
+            { key: "view", label: "مشاهده پیامک/کیف پول" },
+            { key: "create", label: "شارژ/ارسال" },
+            { key: "update", label: "ویرایش تنظیمات" },
+            { key: "delete", label: "حذف" },
+        ],
+    },
+    {
+        key: "appointment_settings",
+        title: "تنظیمات نوبت‌دهی",
+        items: [
+            { key: "view", label: "مشاهده تنظیمات" },
+            { key: "update", label: "ویرایش تنظیمات" },
+        ],
+    },
+    {
+        key: "clinic_doctors",
+        title: "مدیریت پزشکان کلینیک",
+        clinicOnly: true,
+        items: [
+            { key: "view", label: "مشاهده پزشکان" },
+            { key: "create", label: "افزودن پزشک" },
+            { key: "update", label: "ویرایش پزشک" },
+            { key: "delete", label: "حذف پزشک" },
+        ],
+    },
 ];
 
 function PermissionAccordions({
     permissions,
     onChange,
     disabled,
+    isClinic,
 }: {
     permissions: SecretaryPermissions;
     onChange: (section: PermSection, item: string, value: boolean) => void;
     disabled?: boolean;
+    isClinic: boolean;
 }) {
     const [openKeys, setOpenKeys] = useState<Set<string>>(
         new Set(["appointments", "patients"]),
@@ -196,13 +254,16 @@ function PermissionAccordions({
         });
     };
 
+    // منابع clinicOnly (مثل مدیریت پزشکان کلینیک) فقط برای مالکِ کلینیک دیده می‌شوند.
+    const sections = PERMISSION_SECTIONS.filter((s) => !s.clinicOnly || isClinic);
+
     return (
         <div className="w-full">
             <p className="text-[#525252] dark:text-[#D7D8ED] text-[16px] font-bold mb-[16px]">
                 مجوزهای دسترسی
             </p>
             <div className="flex flex-col gap-[8px] w-full items-stretch">
-                {PERMISSION_SECTIONS.map((section) => {
+                {sections.map((section) => {
                     const open = openKeys.has(section.key);
                     const sectionPerm = permissions[section.key] as Record<string, boolean>;
                     return (
@@ -490,7 +551,7 @@ function SecretaryModal({
                     <DefaultTextField placeholder="آدرس" value={form.address} onChange={(v) => setField("address", v)} disabled={disabled} multiline rows={2} />
                 </div>
 
-                <PermissionAccordions permissions={form.permission} onChange={setPermission} disabled={disabled} />
+                <PermissionAccordions permissions={form.permission} onChange={setPermission} disabled={disabled} isClinic={isClinic} />
             </div>
         </Modal>
     );

assets/admin/pages/SecretariesPage.tsx

@@ -22,6 +22,11 @@ const DEFAULT_PERMISSIONS: SecretaryPermissions = {
   inventory: { view: false, create: false, update: false, delete: false },
   tags: { view: false, create: false, update: false, delete: false },
   services: { view: false, create: false, update: false, delete: false },
+  staff: { view: false, create: false, update: false, delete: false },
+  discounts: { view: false, create: false, update: false, delete: false },
+  sms: { view: false, create: false, update: false, delete: false },
+  appointment_settings: { view: false, update: false },
+  clinic_doctors: { view: false, create: false, update: false, delete: false },
 };
 
 type PermSection = keyof SecretaryPermissions;
@@ -106,6 +111,49 @@ const PERMISSION_LABELS: Record<PermSection, { label: string; actions: { key: st
       { key: 'delete', label: 'حذف' },
     ],
   },
+  staff: {
+    label: 'پرسنل',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  discounts: {
+    label: 'تخفیف‌ها',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  sms: {
+    label: 'پیامک‌ها',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'شارژ/ارسال' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
+  appointment_settings: {
+    label: 'تنظیمات نوبت‌دهی',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'update', label: 'ویرایش' },
+    ],
+  },
+  clinic_doctors: {
+    label: 'مدیریت پزشکان کلینیک',
+    actions: [
+      { key: 'view', label: 'مشاهده' },
+      { key: 'create', label: 'ایجاد' },
+      { key: 'update', label: 'ویرایش' },
+      { key: 'delete', label: 'حذف' },
+    ],
+  },
 };
 
 function PermissionsMatrix({

assets/admin/types/index.ts

@@ -508,6 +508,34 @@ export interface SecretaryPermissions {
         update: boolean;
         delete: boolean;
     };
+    staff: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    discounts: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    sms: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
+    appointment_settings: {
+        view: boolean;
+        update: boolean;
+    };
+    clinic_doctors: {
+        view: boolean;
+        create: boolean;
+        update: boolean;
+        delete: boolean;
+    };
 }
 
 export interface Specialty {