hamedandClaude Opus 5
2e0888e0ef
Phase 3 of the tenant-marking series. The same concept was written four ways, and the Doctrine filter arriving in phase 4 keys on the field name — so the tables using a different spelling would have been skipped silently, which is exactly the leak this work exists to prevent. - discount_rules: owner_type/owner_id renamed to entity_type/entity_id. Pure rename, no data moves. - doctor_secretaries: owner_type plus a nullable clinic_id replaced by the shared pair. The environment now comes from the clinic argument alone, so the inconsistent combination (owner_type='clinic', clinic_id=NULL) can no longer be constructed, and the redundant constructor parameter is gone. - user_active_context: added db_type, so resolving an environment is one lookup instead of "try clinics, then try doctors". Filled from the type already present in available_contexts. - entity_type is VARCHAR(10) in all twenty tenant tables; four of them were 20. Behaviour change, the only one in this series: the doctor_secretaries unique key went from (doctor_id, secretary_id, owner_type) to (doctor_id, secretary_id, entity_type, entity_id). With clinic_id outside the key, one secretary could not be assigned to the same doctor in two clinics — the second row collided on owner_type='clinic'. The duplicate check in SecretaryController had the same blind spot and would have rejected the request before the database saw it; both are fixed together. Correcting an assumption from the phase-3 plan: mobile_verification_otp.entity_type really is a tenant pair. NotificationMobileController validates the target against ['doctor','clinic'] and stores that entity's id, so the column was normalised with the rest rather than treated as unrelated. TenantOwnedTrait gained assignTenantPair() for callers that resolved the pair as scalars and hold no entity — building an EntityContext from scalars would produce one where isClinic() is true but ->clinic is null, breaking consumers silently. tests/ApiTestCase::createUser now retries on a duplicate mobile. db_test is never reset and already holds ~38k users, so the 9-digit random draw collided often enough to fail unrelated tests a few percent of runs. Tests: 830 passing. PHPStan reports no new errors on the changed files. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
78 lines
3.1 KiB
PHP
78 lines
3.1 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Secretary;
|
|
|
|
use App\Appointment\Entity\Appointment;
|
|
use App\Auth\Entity\UserActiveContext;
|
|
use App\Clinic\Entity\Clinic;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Secretary\Entity\DoctorSecretary;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* A clinic-owned secretary must only see the appointments of the doctors they
|
|
* are actually assigned to — not every doctor in the clinic.
|
|
*/
|
|
class SecretaryAppointmentScopeTest extends ApiTestCase
|
|
{
|
|
public function testSecretarySeesOnlyAssignedDoctorsAppointments(): void
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctorA = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر A');
|
|
$doctorB = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر B');
|
|
$this->em->persist($doctorA);
|
|
$this->em->persist($doctorB);
|
|
$clinic->getDoctors()->add($doctorA);
|
|
$clinic->getDoctors()->add($doctorB);
|
|
|
|
// منشی فقط به دکتر A تخصیص داده شده
|
|
$secretaryUser = $this->createUser(['ROLE_SECRETARY']);
|
|
$rel = new DoctorSecretary($doctorA, $secretaryUser, $clinic);
|
|
$this->em->persist($rel);
|
|
|
|
// scope فعالِ منشی = این کلینیک
|
|
$this->em->persist(new UserActiveContext($secretaryUser, $clinic->getUuid(), 'clinic'));
|
|
|
|
// یک نوبت برای هر پزشک
|
|
$patient = $this->createUser(['ROLE_USER']);
|
|
$start = time() + 3600;
|
|
$this->em->persist($this->newAppointment($doctorA, $patient, $start, $start + 900));
|
|
$this->em->persist($this->newAppointment($doctorB, $patient, $start + 1800, $start + 2700));
|
|
$this->em->flush();
|
|
|
|
$body = $this->authJson('GET', '/api/v1/my/appointments', $secretaryUser);
|
|
|
|
$this->assertSame(200, $this->responseCode());
|
|
// فقط نوبت دکتر A دیده میشود، نه دکتر B
|
|
$this->assertSame(1, $body['meta']['totalRecords']);
|
|
}
|
|
|
|
public function testSecretaryWithNoAssignmentSeesNothing(): void
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تنها');
|
|
$this->em->persist($doctor);
|
|
$clinic->getDoctors()->add($doctor);
|
|
|
|
// منشی context کلینیک دارد ولی رابطهی فعال ندارد
|
|
$secretaryUser = $this->createUser(['ROLE_SECRETARY']);
|
|
$this->em->persist(new UserActiveContext($secretaryUser, $clinic->getUuid(), 'clinic'));
|
|
|
|
$patient = $this->createUser(['ROLE_USER']);
|
|
$start = time() + 3600;
|
|
$this->em->persist($this->newAppointment($doctor, $patient, $start, $start + 900));
|
|
$this->em->flush();
|
|
|
|
$body = $this->authJson('GET', '/api/v1/my/appointments', $secretaryUser);
|
|
|
|
// بدون رابطهی فعال → resolveSecretaryFilter=null → لیست خالی
|
|
$this->assertSame(0, $body['meta']['totalRecords']);
|
|
}
|
|
}
|