hamed
093293004a
getOverride leaked any doctor's override to any authenticated user; add the owner-or-admin check (matching the update/delete endpoints) + regression test.
41 lines
1.2 KiB
PHP
41 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Appointment;
|
|
|
|
use App\Appointment\Entity\DateOverride;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* Regression: GET date-override/{uuid} must enforce ownership (IDOR fix).
|
|
*/
|
|
class DateOverrideOwnershipTest extends ApiTestCase
|
|
{
|
|
private function makeOverride(): array
|
|
{
|
|
$owner = $this->createUser(['ROLE_DOCTOR']);
|
|
$doctor = new Doctor($owner, 'دکتر تست');
|
|
$this->em->persist($doctor);
|
|
$override = new DateOverride($doctor, time(), true);
|
|
$this->em->persist($override);
|
|
$this->em->flush();
|
|
|
|
return [$owner, $override];
|
|
}
|
|
|
|
public function testOwnerCanRead(): void
|
|
{
|
|
[$owner, $override] = $this->makeOverride();
|
|
$this->authJson('GET', '/api/v1/appointment-settings/date-override/' . $override->getUuid(), $owner);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testOtherUserIsForbidden(): void
|
|
{
|
|
[, $override] = $this->makeOverride();
|
|
$attacker = $this->createUser(['ROLE_DOCTOR']);
|
|
$this->authJson('GET', '/api/v1/appointment-settings/date-override/' . $override->getUuid(), $attacker);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
}
|