hamedandClaude Opus 4.8
54c8b008bf
Three reported secretary-access bugs. 1) Settings menu structure. Phase B flat-listed staff/discounts/sms/tags/ appointment_settings/clinic_doctors in the secretary's main sidebar. Mirror the doctor/clinic layout instead: only inventory + services stay in the main «مدیریت» nav; the rest live under a single «تنظیمات» entry (→ /admin/account-settings). Made both settings navs permission-aware for secretaries: SETTINGS_MENU (menuForRole now takes `can`) and PurchaseSubscriptionSidebar filter by a per-item `perm`/`alwaysOpen` instead of role only, so a secretary sees exactly their permitted settings pages and owner-only items (subscription, secretary-management) stay hidden. 2) Clinic secretary appointment timeline. AppointmentsPage treated a clinic-scoped secretary as a single-doctor profile: the doctor list was fetched/shown only for isClinic/isAdmin, so no doctor tabs, timeline, or booking. Now a clinic-scoped secretary is multi-doctor: fetches the doctor list, shows tabs, auto-selects the first doctor. The list comes from a new authenticated endpoint GET /api/v1/my/clinic-doctors returning only the secretary's ASSIGNED doctors — /clinic/doctor-list is on the public (no-JWT) firewall and cannot scope by user, so it would have leaked unbookable doctors. 3) Patient record delete. The `patients.delete` toggle was dead: every record delete (note/medical-record/attachment/call/message) was gated as `patients.update`. Mapped them to `patients.delete` so the toggle is honored and delete is controllable separately from edit. New SecretaryAccessChecker::assignedClinicDoctorIds. Tests: doctor-list scoping, patients.delete separation (denied/allowed). docs/api secretary.md + appointment.md updated. Backend 286 + frontend 25 pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
49 lines
2.7 KiB
TypeScript
49 lines
2.7 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import { screen } from '@testing-library/react';
|
|
import { renderWithProviders } from '../../test/utils';
|
|
import { useAuthStore } from '../../stores/authStore';
|
|
import PurchaseSubscriptionSidebar from './PurchaseSubscriptionSidebar';
|
|
|
|
describe('PurchaseSubscriptionSidebar — settings menu', () => {
|
|
it('lists secretary and staff management (moved out of the main nav)', () => {
|
|
renderWithProviders(<PurchaseSubscriptionSidebar active="staff" />, { route: '/admin/staff' });
|
|
|
|
const secretary = screen.getByRole('link', { name: 'مدیریت منشی' });
|
|
const staff = screen.getByRole('link', { name: 'پرسنل' });
|
|
|
|
expect(secretary).toHaveAttribute('href', '/admin/my-secretaries');
|
|
expect(staff).toHaveAttribute('href', '/admin/staff');
|
|
});
|
|
|
|
it('highlights the active item (aria-current) for staff', () => {
|
|
renderWithProviders(<PurchaseSubscriptionSidebar active="staff" />, { route: '/admin/staff' });
|
|
expect(screen.getByRole('link', { name: 'پرسنل' })).toHaveAttribute('aria-current', 'page');
|
|
expect(screen.getByRole('link', { name: 'مدیریت منشی' })).not.toHaveAttribute('aria-current');
|
|
});
|
|
|
|
it('برای منشی فقط آیتمهای مجاز را نشان میدهد (staff مجاز، بقیه پنهان)', () => {
|
|
useAuthStore.setState({
|
|
primaryRole: 'secretary',
|
|
context: { scope: 'clinic', permissions: { resources: { staff: { view: true } } } },
|
|
} as any);
|
|
renderWithProviders(<PurchaseSubscriptionSidebar active="staff" />, { route: '/admin/staff' });
|
|
|
|
// مجاز
|
|
expect(screen.getByRole('link', { name: 'پرسنل' })).toHaveAttribute('href', '/admin/staff');
|
|
expect(screen.getByRole('link', { name: 'حساب کاربری' })).toBeInTheDocument();
|
|
// owner-only / بدون مجوز → پنهان
|
|
expect(screen.queryByRole('link', { name: 'مدیریت منشی' })).not.toBeInTheDocument();
|
|
expect(screen.queryByRole('link', { name: 'خرید اشتراک' })).not.toBeInTheDocument();
|
|
expect(screen.queryByRole('link', { name: 'مدیریت تخفیفها' })).not.toBeInTheDocument();
|
|
useAuthStore.setState({ primaryRole: null, context: null } as any);
|
|
});
|
|
|
|
// regression: the settings menu must stay visible on mobile (was `hidden lg:block`,
|
|
// which dropped the whole menu below the lg breakpoint → no settings nav on phones).
|
|
it('is not hidden on mobile', () => {
|
|
renderWithProviders(<PurchaseSubscriptionSidebar active="staff" />, { route: '/admin/staff' });
|
|
const nav = screen.getByRole('complementary', { name: 'منوی تنظیمات' });
|
|
expect(nav.className).not.toMatch(/\bhidden\b/);
|
|
});
|
|
});
|