hamedandClaude Opus 5
75d5052f72
Phase 4 of the tenant-marking series. Until now isolation depended on every query remembering its own WHERE clause. With 82 entities and 844 tests, that is not a guarantee — it is a hope. MariaDB has no row-level security, so the backstop has to live in Doctrine. TenantFilter appends (entity_type, entity_id) to every DQL query on a tenant-owning entity. It ships disabled and TenantFilterSubscriber turns it on per request. The filter engages only for a **chosen** environment — an explicit clinic_uuid on the request, or a stored UserActiveContext. EntityContext now records which of the two produced it. Locking a user to the role fallback instead would hide data they are entitled to: a clinic-member doctor who never switched context lost every appointment belonging to that clinic. Five tests caught exactly that before the gate was added. Admins and unauthenticated marketplace traffic stay outside the filter by design. Two findings from running it rather than reasoning about it: - Dereferencing a lazy proxy whose target the filter excluded raises EntityNotFoundException, which surfaced as 500 on four patient endpoints. ExceptionSubscriber now maps it to 404: outside your environment means it does not exist for you. It is logged at info level so a genuinely broken FK is still visible. - EntityManager::find() by primary key IS filtered in Doctrine ORM 3, contrary to the limitation carried over from older versions. The stronger guarantee is pinned by a test so a future regression is noticed, and the documented table was corrected. The filter also caught a real leak: a clinic secretary's appointment list filtered by doctor id alone, so a doctor's personal-practice booking appeared in the clinic list. The test had been asserting that behaviour. GlobalTables classifies all 82 entities into four states — carries a tenant, deliberately global, aggregate child, or recorded debt — and TenantSchemaCoverageTest fails on anything unclassified. Aggregate children declare their root explicitly, because several attach through a scalar FK rather than a Doctrine association and cannot be inferred from metadata; the test walks each chain to a tenant-owning root. Financial tables stay in DEFERRED with a ceiling assertion so the list cannot grow quietly. Deliberately not built: the prePersist assignment listener from the plan. The tenant columns are NOT NULL without a default, so a missing assignTenant() already fails loudly at flush — phase 2 surfaced 123 such failures. A listener would add silent auto-assignment where the current behaviour is an explicit crash. EXPLAIN with the filter's conditions still picks idx_appointments_tenant_slot and uniq_patient_record. Tests: 844 passing. PHPStan unchanged at its 17 pre-existing errors, none in files touched here. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
80 lines
3.3 KiB
PHP
80 lines
3.3 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Secretary;
|
|
|
|
use App\Appointment\Entity\Appointment;
|
|
use App\Auth\Entity\UserActiveContext;
|
|
use App\Clinic\Entity\Clinic;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Secretary\Entity\DoctorSecretary;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* A clinic-owned secretary must only see the appointments of the doctors they
|
|
* are actually assigned to — not every doctor in the clinic.
|
|
*/
|
|
class SecretaryAppointmentScopeTest extends ApiTestCase
|
|
{
|
|
public function testSecretarySeesOnlyAssignedDoctorsAppointments(): void
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctorA = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر A');
|
|
$doctorB = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر B');
|
|
$this->em->persist($doctorA);
|
|
$this->em->persist($doctorB);
|
|
$clinic->getDoctors()->add($doctorA);
|
|
$clinic->getDoctors()->add($doctorB);
|
|
|
|
// منشی فقط به دکتر A تخصیص داده شده
|
|
$secretaryUser = $this->createUser(['ROLE_SECRETARY']);
|
|
$rel = new DoctorSecretary($doctorA, $secretaryUser, $clinic);
|
|
$this->em->persist($rel);
|
|
|
|
// scope فعالِ منشی = این کلینیک
|
|
$this->em->persist(new UserActiveContext($secretaryUser, $clinic->getUuid(), 'clinic'));
|
|
|
|
// یک نوبت برای هر پزشک
|
|
$patient = $this->createUser(['ROLE_USER']);
|
|
$start = time() + 3600;
|
|
// نوبتها در همین کلینیک ثبت میشوند، نه در مطب شخصی — وگرنه محیطشان با
|
|
// محیط فعالِ منشی یکی نیست و اصلاً نباید در این لیست بیایند.
|
|
$this->em->persist($this->newAppointment($doctorA, $patient, $start, $start + 900, $clinic));
|
|
$this->em->persist($this->newAppointment($doctorB, $patient, $start + 1800, $start + 2700, $clinic));
|
|
$this->em->flush();
|
|
|
|
$body = $this->authJson('GET', '/api/v1/my/appointments', $secretaryUser);
|
|
|
|
$this->assertSame(200, $this->responseCode());
|
|
// فقط نوبت دکتر A دیده میشود، نه دکتر B
|
|
$this->assertSame(1, $body['meta']['totalRecords']);
|
|
}
|
|
|
|
public function testSecretaryWithNoAssignmentSeesNothing(): void
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تنها');
|
|
$this->em->persist($doctor);
|
|
$clinic->getDoctors()->add($doctor);
|
|
|
|
// منشی context کلینیک دارد ولی رابطهی فعال ندارد
|
|
$secretaryUser = $this->createUser(['ROLE_SECRETARY']);
|
|
$this->em->persist(new UserActiveContext($secretaryUser, $clinic->getUuid(), 'clinic'));
|
|
|
|
$patient = $this->createUser(['ROLE_USER']);
|
|
$start = time() + 3600;
|
|
$this->em->persist($this->newAppointment($doctor, $patient, $start, $start + 900));
|
|
$this->em->flush();
|
|
|
|
$body = $this->authJson('GET', '/api/v1/my/appointments', $secretaryUser);
|
|
|
|
// بدون رابطهی فعال → resolveSecretaryFilter=null → لیست خالی
|
|
$this->assertSame(0, $body['meta']['totalRecords']);
|
|
}
|
|
}
|