hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Browse Source 
Extends the secretary permission system to five previously owner-only modules,
so a clinic/doctor can delegate each page to a secretary. All were unreachable
by secretaries before (role-based tenant resolution returned "unknown" → 403).

New permission resources (default-deny, three-place add: entity default,
SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage):
staff, discounts, sms, appointment_settings (view/update only), clinic_doctors
(clinic-only — hidden from independent doctors via `clinicOnly` section filter).

Backend enforcement (SecretaryAccessChecker, three new reusable helpers):
- resolveOwnerEntity(): owner pair from active context — used by StaffController,
  DiscountController, SmsWalletController (now secretary-aware resolveEntity).
- canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into
  AppointmentSettingsController::denyDoctorAccess.
- canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor,
  ClinicDoctorPermissionController (view/update), ClinicInvitationController
  (create/view/update/delete). clinic_doctors is clinic-context only.
Guards run ahead of any subscription gate; non-secretary roles pass unchanged.

Frontend:
- RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic
  variants), settings/clinic-doctors routes accept secretary + permission gate.
- Sidebar (secretary branch): five new items gated by can(); appointment_settings
  route follows active scope; clinic_doctors only in clinic scope.

Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted
for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope
rule. docs/api/secretary.md resource list, enforcement map, JSON example updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
hamed
2026-07-23 17:29:51 +03:30
co-authored by Claude Opus 4.8
parent b9189700b3
commit e8bf2ce9b1
17 changed files with 486 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Appointment/Controller/AppointmentSettingsController.php
+7
View File
@@ -39,6 +39,7 @@ class AppointmentSettingsController extends BaseController
private readonly ClinicRepository $clinicRepo,
private readonly \App\ClinicService\Repository\ServiceItemRepository $itemRepo,
private readonly \App\Clinic\Security\ClinicDoctorPermissionChecker $permChecker,
private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
) {}
/**
@@ -518,6 +519,12 @@ class AppointmentSettingsController extends BaseController
return null;
}
// منشی: توگلِ appointment_settings + پزشکِ هدف در اسکوپِ همان منشی.
if ($user->hasRole('ROLE_SECRETARY')
&& $this->secretaryAccess->canForDoctor($user, $doctor, $clinic, 'appointment_settings', $action)) {
return null;
}
return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
}
src/Clinic/Controller/ClinicController.php
+3 -1
View File
@@ -47,6 +47,7 @@ class ClinicController extends BaseController
private readonly \App\Clinic\Security\ClinicDoctorPermissionChecker $permChecker,
private readonly FileValidatorService $fileValidator,
private readonly \App\Representation\Service\DomainContextResolver $domainResolver,
private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
private readonly string $projectDir,
) {}
@@ -383,7 +384,8 @@ class ClinicController extends BaseController
return $this->error(ErrorCodes::ERR_VALIDATION_002, 'کلینیک یافت نشد', 404);
}
if (!$this->canManageClinic($clinic, $user)) {
if (!$this->canManageClinic($clinic, $user)
&& !$this->secretaryAccess->canForClinic($user, $clinic, 'clinic_doctors', 'delete')) {
return $this->error(ErrorCodes::ERR_ACCESS_DENIED, 'دسترسی مجاز نیست', 403);
}
src/Clinic/Controller/ClinicDoctorPermissionController.php
+8 -5
View File
@@ -27,13 +27,14 @@ class ClinicDoctorPermissionController extends BaseController
private readonly DoctorRepository $doctorRepo,
private readonly ClinicDoctorPermissionRepository $permRepo,
private readonly EntityManagerInterface $em,
private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
) {}
#[Route('/api/v1/admin/clinic/{clinicUuid}/doctor-permissions', methods: ['GET'])]
#[IsGranted('IS_AUTHENTICATED_FULLY')]
public function listPermissions(string $clinicUuid, #[CurrentUser] User $user): JsonResponse
{
$clinic = $this->resolveClinic($clinicUuid, $user);
$clinic = $this->resolveClinic($clinicUuid, $user, 'view');
$data = array_map(
fn(ClinicDoctorPermission $p) => $p->toArray(),
@@ -47,7 +48,7 @@ class ClinicDoctorPermissionController extends BaseController
#[IsGranted('IS_AUTHENTICATED_FULLY')]
public function showPermissions(string $clinicUuid, string $doctorUuid, #[CurrentUser] User $user): JsonResponse
{
$clinic = $this->resolveClinic($clinicUuid, $user);
$clinic = $this->resolveClinic($clinicUuid, $user, 'view');
$doctor = $this->resolveMember($clinic, $doctorUuid);
return $this->success($this->permRepo->getOrCreate($clinic, $doctor)->toArray());
@@ -57,7 +58,7 @@ class ClinicDoctorPermissionController extends BaseController
#[IsGranted('IS_AUTHENTICATED_FULLY')]
public function updatePermissions(string $clinicUuid, string $doctorUuid, Request $request, #[CurrentUser] User $user): JsonResponse
{
$clinic = $this->resolveClinic($clinicUuid, $user);
$clinic = $this->resolveClinic($clinicUuid, $user, 'update');
$doctor = $this->resolveMember($clinic, $doctorUuid);
$perm = $this->permRepo->getOrCreate($clinic, $doctor);
@@ -79,7 +80,7 @@ class ClinicDoctorPermissionController extends BaseController
return $this->success($perm->toArray());
}
private function resolveClinic(string $clinicUuid, User $user): Clinic
private function resolveClinic(string $clinicUuid, User $user, string $action): Clinic
{
$clinic = $this->clinicRepo->findByUuid($clinicUuid);
if ($clinic === null) {
@@ -87,7 +88,9 @@ class ClinicDoctorPermissionController extends BaseController
}
$isOwner = $clinic->getUser()->getId() === $user->getId();
if (!$user->hasRole('ROLE_ADMIN') && !$isOwner) {
// منشیِ همان کلینیک با توگلِ clinic_doctors می‌تواند مدیریت پزشکان را انجام دهد.
$isSecretary = $this->secretaryAccess->canForClinic($user, $clinic, 'clinic_doctors', $action);
if (!$user->hasRole('ROLE_ADMIN') && !$isOwner && !$isSecretary) {
throw new AppException(ErrorCodes::ERR_ACCESS_DENIED, 'دسترسی ندارید', 403);
}
src/ClinicInvitation/Controller/ClinicInvitationController.php
+11 -6
View File
@@ -26,6 +26,7 @@ class ClinicInvitationController extends BaseController
private readonly ClinicDoctorInvitationRepository $invRepo,
private readonly ClinicRepository $clinicRepo,
private readonly DoctorRepository $doctorRepo,
private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
) {}
// ── Admin endpoints ──────────────────────────────────────────────────────
@@ -39,7 +40,7 @@ class ClinicInvitationController extends BaseController
throw new AppException('ERR_NOT_FOUND_001', 'کلینیک یافت نشد', 404);
}
$this->assertClinicAccess($clinic, $user);
$this->assertClinicAccess($clinic, $user, 'create');
$body = json_decode($request->getContent(), true) ?? [];
$mobile = trim($body['mobile'] ?? '');
@@ -64,7 +65,7 @@ class ClinicInvitationController extends BaseController
throw new AppException('ERR_NOT_FOUND_001', 'کلینیک یافت نشد', 404);
}
$this->assertClinicAccess($clinic, $user);
$this->assertClinicAccess($clinic, $user, 'view');
$page = max(1, (int) $request->query->get('page', 1));
$limit = min(50, max(1, (int) $request->query->get('limit', 20)));
@@ -96,7 +97,7 @@ class ClinicInvitationController extends BaseController
throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
}
$this->assertClinicAccess($inv->getClinic(), $user);
$this->assertClinicAccess($inv->getClinic(), $user, 'create');
$this->invitationService->resend($inv);
return $this->success(['message' => 'پیامک مجدداً ارسال شد']);
@@ -111,7 +112,7 @@ class ClinicInvitationController extends BaseController
throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
}
$this->assertClinicAccess($inv->getClinic(), $user);
$this->assertClinicAccess($inv->getClinic(), $user, 'update');
$body = json_decode($request->getContent(), true) ?? [];
$status = $body['status'] ?? '';
@@ -130,7 +131,7 @@ class ClinicInvitationController extends BaseController
throw new AppException('ERR_NOT_FOUND_001', 'دعوتنامه یافت نشد', 404);
}
$this->assertClinicAccess($inv->getClinic(), $user);
$this->assertClinicAccess($inv->getClinic(), $user, 'delete');
$this->invitationService->delete($inv);
return $this->success(['message' => 'دعوتنامه حذف شد']);
@@ -193,7 +194,7 @@ class ClinicInvitationController extends BaseController
throw new AppException('ERR_VALIDATION_001', 'action باید accept یا reject باشد', 422);
}
private function assertClinicAccess(\App\Clinic\Entity\Clinic $clinic, User $user): void
private function assertClinicAccess(\App\Clinic\Entity\Clinic $clinic, User $user, string $action = 'view'): void
{
if ($user->hasRole('ROLE_ADMIN')) {
return;
@@ -201,6 +202,10 @@ class ClinicInvitationController extends BaseController
if ($user->hasRole('ROLE_CLINIC') && $clinic->getUser()->getId() === $user->getId()) {
return;
}
// منشیِ همان کلینیک با توگلِ clinic_doctors می‌تواند پزشکان را دعوت/مدیریت کند.
if ($this->secretaryAccess->canForClinic($user, $clinic, 'clinic_doctors', $action)) {
return;
}
throw new AppException(ErrorCodes::ERR_ACCESS_DENIED, 'دسترسی ندارید', 403);
}
src/Discount/Controller/DiscountController.php
+10
View File
@@ -9,6 +9,7 @@ use App\Discount\Repository\DiscountRuleRepository;
use App\Discount\Service\DiscountEngine;
use App\Doctor\Repository\DoctorRepository;
use App\Patient\Repository\PatientSessionRepository;
use App\Secretary\Security\SecretaryAccessChecker;
use App\Shared\Constant\ErrorCodes;
use App\Shared\Controller\BaseController;
use Symfony\Component\HttpFoundation\JsonResponse;
@@ -25,6 +26,7 @@ class DiscountController extends BaseController
private readonly DoctorRepository $doctorRepo,
private readonly ClinicRepository $clinicRepo,
private readonly PatientSessionRepository $sessionRepo,
private readonly SecretaryAccessChecker $secretaryAccess,
) {}
/** @return array{0: string, 1: ?int} */
@@ -36,6 +38,10 @@ class DiscountController extends BaseController
if ($user->hasRole('ROLE_CLINIC')) {
return ['clinic', $this->clinicRepo->findByUser($user)?->getId()];
}
// منشی روی tenantِ محیطِ فعال؛ مجوز جدا با denyUnlessGranted.
if ($user->hasRole('ROLE_SECRETARY')) {
return $this->secretaryAccess->resolveOwnerEntity($user);
}
return ['unknown', null];
}
@@ -45,6 +51,7 @@ class DiscountController extends BaseController
#[IsGranted('IS_AUTHENTICATED_FULLY')]
public function list(#[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'discounts', 'view');
[$ownerType, $ownerId] = $this->resolveOwner($user);
if ($ownerId === null) {
return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
@@ -57,6 +64,7 @@ class DiscountController extends BaseController
#[IsGranted('IS_AUTHENTICATED_FULLY')]
public function create(Request $request, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'discounts', 'create');
[$ownerType, $ownerId] = $this->resolveOwner($user);
if ($ownerId === null) {
return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
@@ -84,6 +92,7 @@ class DiscountController extends BaseController
#[IsGranted('IS_AUTHENTICATED_FULLY')]
public function update(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'discounts', 'update');
[$ownerType, $ownerId] = $this->resolveOwner($user);
if ($ownerId === null) {
return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
@@ -117,6 +126,7 @@ class DiscountController extends BaseController
#[IsGranted('IS_AUTHENTICATED_FULLY')]
public function delete(string $uuid, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'discounts', 'delete');
[$ownerType, $ownerId] = $this->resolveOwner($user);
if ($ownerId === null) {
return $this->error(ErrorCodes::ERR_AUTH_006, 'دسترسی ممنوع', 403);
src/Secretary/Entity/DoctorSecretary.php
+5
View File
@@ -29,6 +29,11 @@ class DoctorSecretary
'inventory' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
'tags' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
'services' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
'staff' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
'discounts' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
'sms' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
'appointment_settings' => ['view' => false, 'update' => false],
'clinic_doctors' => ['view' => false, 'create' => false, 'update' => false, 'delete' => false],
],
];
src/Secretary/Security/SecretaryAccessChecker.php
+52
View File
@@ -85,6 +85,58 @@ class SecretaryAccessChecker
return ['unknown', null];
}
/**
* آیا منشی در محیطِ فعالِ خود، روی این پزشکِ مشخص (و کلینیکِ همان نوبت/تنظیم)
* مجاز به resource/action است؟ ترکیبِ «اسکوپِ پزشکِ تخصیص‌یافته» و «توگلِ مجوز».
* قرینهٔ AppointmentAccessChecker::secretaryCan اما برای هر resource.
*/
public function canForDoctor(
User $user,
\App\Doctor\Entity\Doctor $doctor,
?\App\Clinic\Entity\Clinic $clinic,
string $resource,
string $action
): bool {
$dbUuid = $this->contextRepo->findByUser($user)?->getDbUuid();
if ($dbUuid === null) {
return false;
}
$ctxClinic = $this->clinicRepo->findByUuid($dbUuid);
if ($ctxClinic !== null) {
// محیطِ کلینیک: تنظیم باید در همان کلینیک باشد و پزشکش جزو پزشکانِ منشی.
if ($clinic === null || $ctxClinic->getId() !== $clinic->getId()) {
return false;
}
$relation = $this->secretaryRepo->findActiveClinicRow($user, $ctxClinic, $doctor);
return $relation !== null && $this->permissions->can($relation, $resource, $action);
}
// محیطِ مطب شخصی: تنظیم هم باید شخصی باشد (clinic == null).
if ($clinic !== null) {
return false;
}
$ctxDoctor = $this->doctorRepo->findByUuid($dbUuid);
if ($ctxDoctor === null || $ctxDoctor->getId() !== $doctor->getId()) {
return false;
}
$relation = $this->secretaryRepo->findActiveBySecretaryForDoctor($user, $doctor);
return $relation !== null && $this->permissions->can($relation, $resource, $action);
}
/**
* آیا منشی در محیطِ فعالِ خود — که باید همین کلینیک باشد — مجاز به resource/action است؟
* برای منابعِ کلینیک‌سطح مثل clinic_doctors که tenant لزوماً کلینیک است.
*/
public function canForClinic(User $user, \App\Clinic\Entity\Clinic $clinic, string $resource, string $action): bool
{
[$type, $id] = $this->resolveOwnerEntity($user);
return $type === 'clinic' && $id === $clinic->getId() && $this->can($user, $resource, $action);
}
/**
* برای مسیرهایی که چند نقش دارند: فقط منشی را محدود کن. سایر نقش‌ها true.
*/
src/Sms/Controller/SmsWalletController.php
+11
View File
@@ -38,6 +38,7 @@ class SmsWalletController extends BaseController
private readonly DoctorRepository $doctorRepo,
private readonly ClinicRepository $clinicRepo,
private readonly \App\Config\Repository\SiteConfigRepository $configRepo,
private readonly \App\Secretary\Security\SecretaryAccessChecker $secretaryAccess,
private readonly string $appBaseUrl,
) {}
@@ -50,6 +51,7 @@ class SmsWalletController extends BaseController
#[Route('/api/v1/sms/wallet/balance', methods: ['GET'])]
public function balance(#[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
[$entityType, $entityId] = $this->resolveEntity($user);
if ($entityId === null) {
return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -69,6 +71,7 @@ class SmsWalletController extends BaseController
#[Route('/api/v1/sms/wallet/charge', methods: ['POST'])]
public function charge(Request $request, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'sms', 'create');
[$entityType, $entityId] = $this->resolveEntity($user);
if ($entityId === null) {
return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -102,6 +105,7 @@ class SmsWalletController extends BaseController
#[Route('/api/v1/sms/wallet/logs', methods: ['GET'])]
public function logs(Request $request, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
[$entityType, $entityId] = $this->resolveEntity($user);
if ($entityId === null) {
return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -125,6 +129,7 @@ class SmsWalletController extends BaseController
#[Route('/api/v1/sms/settings', methods: ['GET'])]
public function getSettings(#[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'sms', 'view');
[$entityType, $entityId] = $this->resolveEntity($user);
if ($entityId === null) {
return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -149,6 +154,7 @@ class SmsWalletController extends BaseController
#[Route('/api/v1/sms/settings', methods: ['PATCH'])]
public function updateSettings(Request $request, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'sms', 'update');
[$entityType, $entityId] = $this->resolveEntity($user);
if ($entityId === null) {
return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -281,6 +287,11 @@ class SmsWalletController extends BaseController
return $clinic !== null ? ['clinic', $clinic->getId()] : ['clinic', null];
}
// منشی روی tenantِ محیطِ فعال؛ مجوز جدا با denyUnlessGranted.
if ($user->hasRole('ROLE_SECRETARY')) {
return $this->secretaryAccess->resolveOwnerEntity($user);
}
return ['unknown', null];
}
}
src/Staff/Controller/StaffController.php
+12
View File
@@ -5,6 +5,7 @@ namespace App\Staff\Controller;
use App\Auth\Entity\User;
use App\Clinic\Repository\ClinicRepository;
use App\Doctor\Repository\DoctorRepository;
use App\Secretary\Security\SecretaryAccessChecker;
use App\Shared\Constant\ErrorCodes;
use App\Shared\Controller\BaseController;
use App\Staff\Entity\ClinicStaff;
@@ -24,11 +25,13 @@ class StaffController extends BaseController
private readonly ClinicStaffRepository $staffRepo,
private readonly DoctorRepository $doctorRepo,
private readonly ClinicRepository $clinicRepo,
private readonly SecretaryAccessChecker $secretaryAccess,
) {}
#[Route('/api/v1/staff', methods: ['GET'])]
public function list(#[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'staff', 'view');
[$entityType, $entityId] = $this->resolveEntity($user);
if ($entityId === null) {
return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -45,6 +48,7 @@ class StaffController extends BaseController
#[Route('/api/v1/staff', methods: ['POST'])]
public function create(Request $request, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'staff', 'create');
[$entityType, $entityId] = $this->resolveEntity($user);
if ($entityId === null) {
return $this->error(ErrorCodes::ERR_FORBIDDEN_001, 'پروفایل یافت نشد', 403);
@@ -71,6 +75,7 @@ class StaffController extends BaseController
#[Route('/api/v1/staff/{uuid}', methods: ['PATCH'])]
public function update(string $uuid, Request $request, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'staff', 'update');
$staff = $this->staffRepo->findByUuid($uuid);
if ($staff === null) {
return $this->error(ErrorCodes::ERR_STAFF_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_STAFF_NOT_FOUND), 404);
@@ -98,6 +103,7 @@ class StaffController extends BaseController
#[Route('/api/v1/staff/{uuid}/toggle', methods: ['PATCH'])]
public function toggle(string $uuid, #[CurrentUser] User $user): JsonResponse
{
$this->secretaryAccess->denyUnlessGranted($user, 'staff', 'update');
$staff = $this->staffRepo->findByUuid($uuid);
if ($staff === null) {
return $this->error(ErrorCodes::ERR_STAFF_NOT_FOUND, ErrorCodes::message(ErrorCodes::ERR_STAFF_NOT_FOUND), 404);
@@ -125,6 +131,12 @@ class StaffController extends BaseController
return $clinic !== null ? ['clinic', $clinic->getId()] : ['clinic', null];
}
// منشی روی tenantِ محیطِ فعالِ خود (کلینیک/پزشک) عمل می‌کند؛ مجوز جدا با
// denyUnlessGranted بررسی شده است.
if ($user->hasRole('ROLE_SECRETARY')) {
return $this->secretaryAccess->resolveOwnerEntity($user);
}
return ['unknown', null];
}