hamed
6876135a53
- Implemented BlogBodySanitizer to clean HTML content before saving articles, ensuring security against XSS attacks. - Added tests for BlogBodySanitizer to verify that unsafe tags and attributes are stripped from the content. - Introduced ApiLeastPrivilegeTest to ensure that unauthorized users cannot access sensitive API routes, maintaining strict access control.
480 lines
21 KiB
PHP
480 lines
21 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Secretary;
|
|
|
|
use App\Auth\Entity\UserActiveContext;
|
|
use App\Clinic\Entity\Clinic;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Secretary\Entity\DoctorSecretary;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* A secretary's per-resource permission JSON (DoctorSecretary.permission) must be
|
|
* enforced by the API, not only for appointments. Resources the secretary was not
|
|
* granted return 403; granted ones pass.
|
|
*/
|
|
class SecretaryResourceEnforcementTest extends ApiTestCase
|
|
{
|
|
private function makeClinicSecretary(): array
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
|
|
$this->em->persist($doctor);
|
|
$clinic->getDoctors()->add($doctor);
|
|
|
|
$secretary = $this->createUser(['ROLE_SECRETARY']);
|
|
$rel = new DoctorSecretary($doctor, $secretary, $clinic);
|
|
$this->em->persist($rel);
|
|
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid(), 'clinic'));
|
|
|
|
return [$secretary, $rel];
|
|
}
|
|
|
|
public function testInventoryDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: inventory.* = false
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testInventoryAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['inventory' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testPatientCreateDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: patients.create = false (view is true)
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('POST', '/api/v1/patient', $secretary, ['name' => 'x']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testInventoryCreateDeniedButViewGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['inventory' => ['view' => true, 'create' => false]]]);
|
|
$this->em->flush();
|
|
|
|
// مشاهده مجاز
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
// ایجاد ممنوع
|
|
$this->authJson('POST', '/api/v1/inventory-item', $secretary, ['name' => 'گاز استریل']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
// service-items (listAllItems) فقط توگلِ permission را میسنجد — برخلاف
|
|
// service-sections که پیش از آن، گیتِ اشتراک (assertServicesGate) هم دارد.
|
|
public function testServicesDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: services.* = false
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testServicesAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testServicesCreateDeniedButViewGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true, 'create' => false]]]);
|
|
$this->em->flush();
|
|
|
|
// مشاهده مجاز
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
// ایجاد ممنوع — گیتِ permission پیش از گیتِ اشتراک اجرا میشود.
|
|
$this->authJson('POST', '/api/v1/service-section', $secretary, ['name' => 'بخش تست']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
// ── Phase B resources ─────────────────────────────────────────────────────
|
|
|
|
public function testStaffDeniedByDefault(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/staff', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testStaffAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['staff' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/staff', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testStaffCreateDeniedButViewGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['staff' => ['view' => true, 'create' => false]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/staff', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
$this->authJson('POST', '/api/v1/staff', $secretary, ['full_name' => 'خانم تست']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testDiscountsDeniedByDefault(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/admin/discount-rules', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testDiscountsAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['discounts' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/admin/discount-rules', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testSmsDeniedByDefault(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/sms/wallet/balance', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testSmsAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['sms' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/sms/wallet/balance', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testClinicDoctorsDeniedByDefault(): void
|
|
{
|
|
[$secretary, , $clinic] = $this->makeClinicSecretaryWithClinic();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', "/api/v1/admin/clinic/{$clinic->getUuid()}/doctor-permissions", $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testClinicDoctorsAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel, $clinic] = $this->makeClinicSecretaryWithClinic();
|
|
$rel->mergePermissions(['resources' => ['clinic_doctors' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', "/api/v1/admin/clinic/{$clinic->getUuid()}/doctor-permissions", $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testAppointmentSettingsDeniedByDefault(): void
|
|
{
|
|
[$secretary, , $clinic, $doctor] = $this->makeClinicSecretaryWithClinic();
|
|
$this->em->flush();
|
|
|
|
// clinic_uuid لازم است تا محیطِ کلینیک حل شود (مثل پزشکِ عضو کلینیک).
|
|
$this->authJson('GET', "/api/v1/appointment-settings/holidays/list/{$doctor->getUuid()}?clinic_uuid={$clinic->getUuid()}", $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testAppointmentSettingsAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel, $clinic, $doctor] = $this->makeClinicSecretaryWithClinic();
|
|
$rel->mergePermissions(['resources' => ['appointment_settings' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', "/api/v1/appointment-settings/holidays/list/{$doctor->getUuid()}?clinic_uuid={$clinic->getUuid()}", $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
/**
|
|
* فهرست منابع ورودیِ ثبت نوبت است: منشیِ دارای `appointments.view` — که پیشفرض
|
|
* است — باید بتواند بخواندش، حتی وقتی `appointment_settings.view` بسته است.
|
|
* وگرنه نوبتدهی منبعمحور برایش کاملاً بسته میشد.
|
|
*/
|
|
public function testResourceListReadableWithAppointmentsPermissionOnly(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => [
|
|
'appointments' => ['view' => true],
|
|
'appointment_settings' => ['view' => false, 'update' => false],
|
|
]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/resources', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
/** نوشتن همچنان فقط با تنظیمات نوبتدهی — مجوز نوبتها درش را باز نمیکند. */
|
|
public function testResourceWriteStillNeedsAppointmentSettings(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => [
|
|
'appointments' => ['view' => true, 'create' => true],
|
|
'appointment_settings' => ['view' => false, 'update' => false],
|
|
]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('POST', '/api/v1/resource', $secretary, ['type_uuid' => 'x']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
/** بدون هیچکدام از دو مجوز، فهرست منابع همچنان ۴۰۳ است. */
|
|
public function testResourceListDeniedWithoutAnyPermission(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => [
|
|
'appointments' => ['view' => false],
|
|
'appointment_settings' => ['view' => false],
|
|
]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/resources', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
/**
|
|
* بدون مجوز اشتراک، `subscription/my` میماند ولی فقط قابلیتهای پلن را میدهد:
|
|
* پنل بدون این فهرست، آیتمهای feature-دار منو را قفل نشان میداد در حالی که خودِ
|
|
* API آنها را به منشی میدهد. وضعیت/تاریخ اشتراک همچنان پنهان است.
|
|
*/
|
|
public function testSubscriptionWithoutPermissionReturnsFeaturesOnly(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$res = $this->authJson('GET', '/api/v1/subscription/my', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
$this->assertNull($res['data']['subscription']);
|
|
$this->assertFalse($res['data']['used_trial']);
|
|
$this->assertArrayHasKey('features', $res['data']['effective_plan']);
|
|
$this->assertTrue($res['data']['effective_plan']['features']['patient_records']);
|
|
// فیلدهای مالی/هویتیِ پلن نباید بیایند.
|
|
$this->assertArrayNotHasKey('periods', $res['data']['effective_plan']);
|
|
$this->assertArrayNotHasKey('name', $res['data']['effective_plan']);
|
|
}
|
|
|
|
/** با مجوز، پاسخ کامل است — نه نسخهٔ کاهشیافته. */
|
|
public function testSubscriptionAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['subscription' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$res = $this->authJson('GET', '/api/v1/subscription/my', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
$this->assertArrayHasKey('name', $res['data']['effective_plan']);
|
|
$this->assertArrayHasKey('used_trial', $res['data']);
|
|
}
|
|
|
|
public function testPatientDeleteSeparateFromUpdate(): void
|
|
{
|
|
// منشی با patients.update ولی بدون patients.delete نباید بتواند حذف کند.
|
|
// گیتِ delete پیش از واکشیِ رکورد اجرا میشود، پس uuidِ ناموجود هم ۴۰۳ میدهد.
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['patients' => ['view' => true, 'update' => true, 'delete' => false]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('DELETE', '/api/v1/patient/note/00000000-0000-0000-0000-000000000000', $secretary);
|
|
$this->assertSame(403, $this->responseCode(), 'حذف باید جدا از ویرایش کنترل شود');
|
|
}
|
|
|
|
public function testPatientDeleteAllowedWhenGranted(): void
|
|
{
|
|
// با patients.delete، گیت عبور میکند و به «یافت نشد» میرسد (نه ۴۰۳).
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['patients' => ['view' => true, 'delete' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('DELETE', '/api/v1/patient/note/00000000-0000-0000-0000-000000000000', $secretary);
|
|
$this->assertSame(404, $this->responseCode());
|
|
}
|
|
|
|
public function testDoctorListReturnsOnlyAssignedDoctors(): void
|
|
{
|
|
// کلینیک با دو پزشک؛ منشی فقط به یکی تخصیص داده شده.
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$assigned = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تخصیصیافته');
|
|
$unassigned = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر دیگر');
|
|
$this->em->persist($assigned);
|
|
$this->em->persist($unassigned);
|
|
$clinic->getDoctors()->add($assigned);
|
|
$clinic->getDoctors()->add($unassigned);
|
|
|
|
$secretary = $this->createUser(['ROLE_SECRETARY']);
|
|
$this->em->persist(new DoctorSecretary($assigned, $secretary, $clinic));
|
|
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid(), 'clinic'));
|
|
$this->em->flush();
|
|
|
|
// اندپوینتِ احرازشدهٔ پنل (نه /clinic/doctor-list که عمومی است).
|
|
$body = $this->authJson('GET', '/api/v1/my/clinic-doctors', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
$names = array_map(static fn($d) => $d['name'], $body['data']['data']);
|
|
$this->assertContains('دکتر تخصیصیافته', $names);
|
|
$this->assertNotContains('دکتر دیگر', $names, 'منشی نباید پزشکِ تخصیصنیافته را ببیند');
|
|
}
|
|
|
|
/** مثل makeClinicSecretary اما clinic و doctor را هم برمیگرداند. */
|
|
private function makeClinicSecretaryWithClinic(): array
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
|
|
$this->em->persist($doctor);
|
|
$clinic->getDoctors()->add($doctor);
|
|
|
|
$secretary = $this->createUser(['ROLE_SECRETARY']);
|
|
$rel = new DoctorSecretary($doctor, $secretary, $clinic);
|
|
$this->em->persist($rel);
|
|
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid(), 'clinic'));
|
|
|
|
return [$secretary, $rel, $clinic, $doctor];
|
|
}
|
|
// ── آدرسها ──────────────────────────────────────────────────────────────
|
|
|
|
/** پیشفرضِ منشی `addresses.view = true` است. */
|
|
public function testAddressListAllowedByDefault(): void
|
|
{
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/addresses', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testAddressListDeniedWhenAddressesViewOff(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['addresses' => ['view' => false]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/addresses', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
/**
|
|
* تا پیش از این، فهرست آدرس روی `appointment_settings.view` سوار بود و توگلِ
|
|
* «آدرسها» هیچ چیزی را کنترل نمیکرد. حالا تنظیمات نوبتدهی درش را باز نمیکند.
|
|
*/
|
|
public function testAppointmentSettingsNoLongerOpensTheAddressList(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => [
|
|
'addresses' => ['view' => false],
|
|
'appointment_settings' => ['view' => true, 'update' => true],
|
|
]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/addresses', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
// ── پروتکل درمان ─────────────────────────────────────────────────────────
|
|
//
|
|
// آدیت ۲۰۲۶-۰۸-۰۷: TreatmentProtocolController هیچ گِیت مجوزی نداشت و فقط
|
|
// مالکیتِ tenant را میسنجید، پس منشیِ `services:false` میتوانست پروتکل را
|
|
// بخواند، بازنویسی کند و حذف کند. پروتکل خاصیتِ سرویس است، پس مجوزش `services`
|
|
// است. uuidِ ناموجود عمدی است: گیت پیش از واکشیِ سرویس اجرا میشود، پس ۴۰۳
|
|
// در برابر ۴۰۴ دقیقاً همان چیزی را جدا میکند که این تستها میسنجند.
|
|
|
|
private const ABSENT_SERVICE = '00000000-0000-0000-0000-000000000000';
|
|
|
|
public function testTreatmentProtocolReadDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: services.* = false
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/service-item/' . self::ABSENT_SERVICE . '/treatment-protocol', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testTreatmentProtocolReadAllowedWhenServicesGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
// گیت عبور میکند و به «سرویس یافت نشد» میرسد — نه ۴۰۳.
|
|
$this->authJson('GET', '/api/v1/service-item/' . self::ABSENT_SERVICE . '/treatment-protocol', $secretary);
|
|
$this->assertSame(404, $this->responseCode());
|
|
}
|
|
|
|
public function testTreatmentProtocolWriteNeedsServicesUpdate(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true, 'update' => false]]]);
|
|
$this->em->flush();
|
|
|
|
$path = '/api/v1/service-item/' . self::ABSENT_SERVICE . '/treatment-protocol';
|
|
|
|
// خواندن مجاز است…
|
|
$this->authJson('GET', $path, $secretary);
|
|
$this->assertSame(404, $this->responseCode());
|
|
|
|
// …ولی بازنویسی و خاموشکردنِ سوییچ نه.
|
|
$this->authJson('PUT', $path, $secretary, ['steps' => []]);
|
|
$this->assertSame(403, $this->responseCode(), 'بازنویسی پروتکل باید services.update بخواهد');
|
|
|
|
$this->authJson('DELETE', $path, $secretary);
|
|
$this->assertSame(403, $this->responseCode(), 'حذف پروتکل باید services.update بخواهد');
|
|
}
|
|
|
|
public function testTreatmentProtocolWriteAllowedWhenServicesUpdateGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true, 'update' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('DELETE', '/api/v1/service-item/' . self::ABSENT_SERVICE . '/treatment-protocol', $secretary);
|
|
$this->assertSame(404, $this->responseCode());
|
|
}
|
|
|
|
}
|