hamedandClaude Opus 4.8
5548d79d4c
Admin-side booking (POST /api/v1/my/appointment and /api/v1/admin/appointment) resolved the patient User by mobile only, so one person booked under two mobiles produced two User rows — and two case-files, since PatientRecord is keyed on user_id. National code is the real unique identity (User.national_code is already unique); a person may have several mobiles. Booking now requires + validates patient_national_code and resolves the patient national-code-first (then mobile) via a shared PatientResolver, so the case-file stays unique per national code even across mobiles. Reusing a mobile already bound to a different national code returns 422 ERR_PROFILE_MOBILE_TAKEN. The admin create form and NewAppointmentDrawer gain a national-code field and send it; both had a dead patient-picker URL (/api/v1/patient) fixed to the real /api/v1/patients, whose payload already carries user_national_code for autofill. Docs (appointment.md, admin.md) and tests updated; new AppointmentNationalCodeTest covers success, single-file reuse, missing, invalid, and identity-conflict cases. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
58 lines
1.8 KiB
PHP
58 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Appointment;
|
|
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* POST /api/v1/my/appointment must enforce that the acting user is scoped to
|
|
* the target doctor. A doctor having the ROLE_DOCTOR role is not enough — they
|
|
* must not be able to book onto another doctor's calendar via doctor_uuid.
|
|
*/
|
|
class BookingScopeTest extends ApiTestCase
|
|
{
|
|
private function makeDoctor(): Doctor
|
|
{
|
|
$user = $this->createUser(['ROLE_USER', 'ROLE_DOCTOR']);
|
|
$doctor = new Doctor($user, 'دکتر تست');
|
|
$this->em->persist($doctor);
|
|
$this->em->flush();
|
|
|
|
return $doctor;
|
|
}
|
|
|
|
private function bookingBody(string $doctorUuid): array
|
|
{
|
|
$start = time() + 86_400;
|
|
|
|
return [
|
|
'doctor_uuid' => $doctorUuid,
|
|
'slot_start' => $start,
|
|
'slot_end' => $start + 1_800,
|
|
'patient_mobile' => '09' . str_pad((string) random_int(0, 999_999_999), 9, '0', STR_PAD_LEFT),
|
|
'patient_name' => 'بیمار تست',
|
|
'patient_national_code' => '00' . str_pad((string) random_int(0, 99_999_999), 8, '0', STR_PAD_LEFT),
|
|
];
|
|
}
|
|
|
|
public function testDoctorCannotBookOntoAnotherDoctor(): void
|
|
{
|
|
$doctorA = $this->makeDoctor();
|
|
$doctorB = $this->makeDoctor();
|
|
|
|
$this->authJson('POST', '/api/v1/my/appointment', $doctorA->getUser(), $this->bookingBody($doctorB->getUuid()));
|
|
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testDoctorCanBookOntoOwnCalendar(): void
|
|
{
|
|
$doctorA = $this->makeDoctor();
|
|
|
|
$this->authJson('POST', '/api/v1/my/appointment', $doctorA->getUser(), $this->bookingBody($doctorA->getUuid()));
|
|
|
|
$this->assertSame(201, $this->responseCode());
|
|
}
|
|
}
|