feat(secretary): grant staff/discounts/sms/appointment_settings/clinic_doctors (phase B)

Extends the secretary permission system to five previously owner-only modules, so a clinic/doctor can delegate each page to a secretary. All were unreachable by secretaries before (role-based tenant resolution returned "unknown" → 403). New permission resources (default-deny, three-place add: entity default, SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage): staff, discounts, sms, appointment_settings (view/update only), clinic_doctors (clinic-only — hidden from independent doctors via `clinicOnly` section filter). Backend enforcement (SecretaryAccessChecker, three new reusable helpers): - resolveOwnerEntity(): owner pair from active context — used by StaffController, DiscountController, SmsWalletController (now secretary-aware resolveEntity). - canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into AppointmentSettingsController::denyDoctorAccess. - canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor, ClinicDoctorPermissionController (view/update), ClinicInvitationController (create/view/update/delete). clinic_doctors is clinic-context only. Guards run ahead of any subscription gate; non-secretary roles pass unchanged. Frontend: - RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic variants), settings/clinic-doctors routes accept secretary + permission gate. - Sidebar (secretary branch): five new items gated by can(); appointment_settings route follows active scope; clinic_doctors only in clinic scope. Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope rule. docs/api/secretary.md resource list, enforcement map, JSON example updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-23 17:29:51 +03:30
parent b9189700b3
commit e8bf2ce9b1
17 changed files with 486 additions and 22 deletions
@@ -114,4 +114,134 @@ class SecretaryResourceEnforcementTest extends ApiTestCase
        $this->authJson('POST', '/api/v1/service-section', $secretary, ['name' => 'بخش تست']);
        $this->assertSame(403, $this->responseCode());
    }
+
+    // ── Phase B resources ─────────────────────────────────────────────────────
+
+    public function testStaffDeniedByDefault(): void
+    {
+        [$secretary] = $this->makeClinicSecretary();
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/staff', $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testStaffAllowedWhenGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['staff' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/staff', $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testStaffCreateDeniedButViewGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['staff' => ['view' => true, 'create' => false]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/staff', $secretary);
+        $this->assertSame(200, $this->responseCode());
+
+        $this->authJson('POST', '/api/v1/staff', $secretary, ['full_name' => 'خانم تست']);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testDiscountsDeniedByDefault(): void
+    {
+        [$secretary] = $this->makeClinicSecretary();
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/admin/discount-rules', $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testDiscountsAllowedWhenGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['discounts' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/admin/discount-rules', $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testSmsDeniedByDefault(): void
+    {
+        [$secretary] = $this->makeClinicSecretary();
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/sms/wallet/balance', $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testSmsAllowedWhenGranted(): void
+    {
+        [$secretary, $rel] = $this->makeClinicSecretary();
+        $rel->mergePermissions(['resources' => ['sms' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', '/api/v1/sms/wallet/balance', $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testClinicDoctorsDeniedByDefault(): void
+    {
+        [$secretary, , $clinic] = $this->makeClinicSecretaryWithClinic();
+        $this->em->flush();
+
+        $this->authJson('GET', "/api/v1/admin/clinic/{$clinic->getUuid()}/doctor-permissions", $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testClinicDoctorsAllowedWhenGranted(): void
+    {
+        [$secretary, $rel, $clinic] = $this->makeClinicSecretaryWithClinic();
+        $rel->mergePermissions(['resources' => ['clinic_doctors' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', "/api/v1/admin/clinic/{$clinic->getUuid()}/doctor-permissions", $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    public function testAppointmentSettingsDeniedByDefault(): void
+    {
+        [$secretary, , $clinic, $doctor] = $this->makeClinicSecretaryWithClinic();
+        $this->em->flush();
+
+        // clinic_uuid لازم است تا محیطِ کلینیک حل شود (مثل پزشکِ عضو کلینیک).
+        $this->authJson('GET', "/api/v1/appointment-settings/holidays/list/{$doctor->getUuid()}?clinic_uuid={$clinic->getUuid()}", $secretary);
+        $this->assertSame(403, $this->responseCode());
+    }
+
+    public function testAppointmentSettingsAllowedWhenGranted(): void
+    {
+        [$secretary, $rel, $clinic, $doctor] = $this->makeClinicSecretaryWithClinic();
+        $rel->mergePermissions(['resources' => ['appointment_settings' => ['view' => true]]]);
+        $this->em->flush();
+
+        $this->authJson('GET', "/api/v1/appointment-settings/holidays/list/{$doctor->getUuid()}?clinic_uuid={$clinic->getUuid()}", $secretary);
+        $this->assertSame(200, $this->responseCode());
+    }
+
+    /** مثل makeClinicSecretary اما clinic و doctor را هم برمی‌گرداند. */
+    private function makeClinicSecretaryWithClinic(): array
+    {
+        $owner  = $this->createUser(['ROLE_CLINIC']);
+        $clinic = new Clinic($owner);
+        $this->em->persist($clinic);
+
+        $doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
+        $this->em->persist($doctor);
+        $clinic->getDoctors()->add($doctor);
+
+        $secretary = $this->createUser(['ROLE_SECRETARY']);
+        $rel = new DoctorSecretary($doctor, $secretary, DoctorSecretary::OWNER_CLINIC, $clinic);
+        $this->em->persist($rel);
+        $this->em->persist(new UserActiveContext($secretary, $clinic->getUuid()));
+
+        return [$secretary, $rel, $clinic, $doctor];
+    }
 }