Files
clinicpro/assets/admin/components/layout/PurchaseSubscriptionSidebar.tsx
T
hamedandClaude Opus 4.8 54c8b008bf fix(secretary): settings menu structure, clinic timeline access, patient delete gate
Three reported secretary-access bugs.

1) Settings menu structure. Phase B flat-listed staff/discounts/sms/tags/
   appointment_settings/clinic_doctors in the secretary's main sidebar. Mirror
   the doctor/clinic layout instead: only inventory + services stay in the main
   «مدیریت» nav; the rest live under a single «تنظیمات» entry
   (→ /admin/account-settings). Made both settings navs permission-aware for
   secretaries: SETTINGS_MENU (menuForRole now takes `can`) and
   PurchaseSubscriptionSidebar filter by a per-item `perm`/`alwaysOpen` instead
   of role only, so a secretary sees exactly their permitted settings pages and
   owner-only items (subscription, secretary-management) stay hidden.

2) Clinic secretary appointment timeline. AppointmentsPage treated a
   clinic-scoped secretary as a single-doctor profile: the doctor list was
   fetched/shown only for isClinic/isAdmin, so no doctor tabs, timeline, or
   booking. Now a clinic-scoped secretary is multi-doctor: fetches the doctor
   list, shows tabs, auto-selects the first doctor. The list comes from a new
   authenticated endpoint GET /api/v1/my/clinic-doctors returning only the
   secretary's ASSIGNED doctors — /clinic/doctor-list is on the public (no-JWT)
   firewall and cannot scope by user, so it would have leaked unbookable doctors.

3) Patient record delete. The `patients.delete` toggle was dead: every record
   delete (note/medical-record/attachment/call/message) was gated as
   `patients.update`. Mapped them to `patients.delete` so the toggle is honored
   and delete is controllable separately from edit.

New SecretaryAccessChecker::assignedClinicDoctorIds. Tests: doctor-list scoping,
patients.delete separation (denied/allowed). docs/api secretary.md +
appointment.md updated. Backend 286 + frontend 25 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-23 18:01:32 +03:30

139 lines
6.4 KiB
TypeScript

import React, { useMemo, useState } from 'react';
import { Link } from 'react-router-dom';
import { SearchHeaderP } from '../../pages/subscriptionIcons';
import { useAuthStore } from '../../stores/authStore';
import { usePermissions } from '../../hooks/usePermissions';
/**
* Settings sub-navigation for the subscription page — item list and order copied
* verbatim from clinic-pro-tauri's `PurchaseSubscription.jsx` navItems, minus
* "مدیریت پزشک" (that lives in the main nav / doctor profile, not here). Shown
* ungated to mirror the tauri source. Each entry maps to a real admin route; the
* "تنظیمات" (security) section has no doctor/clinic route yet → disabled.
*
* This list is intentionally separate from SETTINGS_MENU (SettingsLayout) so the
* other settings pages are not affected.
*/
/**
* `roles`: when set, the item is only shown to those roles (omit = every role).
* `perm`: [resource, action] — منشی فقط با داشتن این مجوز آیتم را می‌بیند.
* `alwaysOpen`: برای منشی همیشه نمایش داده می‌شود (حساب/تنظیمات پایه).
* آیتم‌های owner-only (خرید اشتراک، مدیریت منشی) نه `perm` دارند نه `alwaysOpen`
* → برای منشی پنهان می‌شوند.
*/
type NavItem = {
key: string;
label: string;
to?: string;
roles?: string[];
perm?: [string, string];
alwaysOpen?: boolean;
};
const NAV_ITEMS: NavItem[] = [
{ key: 'subscription', label: 'خرید اشتراک', to: '/admin/subscription' },
{ key: 'payment', label: 'مدیریت پرداخت', to: '/admin/my-financial', perm: ['payments', 'view'] },
{ key: 'appointment', label: 'مدیریت نوبت دهی', to: '/admin/appointment-settings', roles: ['doctor'], perm: ['appointment_settings', 'view'] },
{ key: 'appointment', label: 'مدیریت نوبت دهی', to: '/admin/settings/appointment-settings', roles: ['clinic'], perm: ['appointment_settings', 'view'] },
{ key: 'insurance', label: 'مدیریت بیمه', to: '/admin/insurance-pricing', perm: ['insurances', 'view'] },
{ key: 'discounts', label: 'مدیریت تخفیف‌ها', to: '/admin/discounts', roles: ['doctor', 'clinic'], perm: ['discounts', 'view'] },
{ key: 'tags', label: 'تگ ها', to: '/admin/tags-settings', perm: ['tags', 'view'] },
{ key: 'sms', label: 'پیامک ها', to: '/admin/sms-wallet', perm: ['sms', 'view'] },
{ key: 'clinic-doctors', label: 'پزشکان کلینیک', to: '/admin/settings/clinic-doctors', roles: ['clinic'], perm: ['clinic_doctors', 'view'] },
{ key: 'secretary', label: 'مدیریت منشی', to: '/admin/my-secretaries' },
{ key: 'staff', label: 'پرسنل', to: '/admin/staff', perm: ['staff', 'view'] },
{ key: 'account', label: 'حساب کاربری', to: '/admin/account-settings', alwaysOpen: true },
{ key: 'security', label: 'تنظیمات', alwaysOpen: true },
];
export default function PurchaseSubscriptionSidebar({ active }: { active: string }) {
const [query, setQuery] = useState('');
const primaryRole = useAuthStore((s) => s.primaryRole);
const { can } = usePermissions();
const items = useMemo(
() => NAV_ITEMS
// منشی: بر اساس مجوز، نه نقش. آیتمِ بدونِ perm/alwaysOpen برای منشی پنهان است.
.filter((i) =>
primaryRole === 'secretary'
? (i.alwaysOpen || (i.perm ? can(i.perm[0], i.perm[1]) : false))
: (!i.roles || (primaryRole != null && i.roles.includes(primaryRole))),
)
.filter((i) => i.label.includes(query.trim())),
[query, primaryRole, can],
);
return (
<aside
dir="rtl"
aria-label="منوی تنظیمات"
className="settings-subnav lg:sticky"
style={{ alignSelf: 'start', top: 'calc(var(--topbar-h) + 16px)' }}
>
<div style={{
fontSize: 16, fontWeight: 800, color: 'var(--text-2)', textAlign: 'right',
marginBottom: 10, padding: '0 4px',
}}>
تنظیمات
</div>
<div style={{ marginBottom: 16 }}>
<div style={{
display: 'flex', alignItems: 'center', gap: 8,
background: 'var(--surface)', border: '1px solid var(--border)',
borderRadius: 'var(--r-sm)', padding: '8px 12px',
}}>
<SearchHeaderP />
<input
value={query}
onChange={(e) => setQuery(e.target.value)}
placeholder="جستجو در تنظیمات"
aria-label="جستجو در تنظیمات"
style={{
border: 'none', outline: 'none', background: 'transparent',
fontFamily: 'inherit', fontSize: 13, color: 'var(--text)', width: '100%',
textAlign: 'right', direction: 'rtl',
}}
/>
</div>
</div>
<nav>
{items.map((item) => {
const isActive = item.key === active;
const rowStyle: React.CSSProperties = {
borderRadius: 12, height: 44, marginBottom: 8,
display: 'flex', alignItems: 'center', justifyContent: 'flex-start',
padding: '0 14px', fontSize: 16, fontWeight: isActive ? 700 : 500,
lineHeight: 1, textAlign: 'right',
background: isActive ? 'var(--accent)' : 'transparent',
color: isActive ? '#FFFFFF' : 'var(--text-2)',
cursor: item.to ? 'pointer' : 'not-allowed',
transition: 'background .14s',
};
const inner = <span style={{ flex: 1 }}>{item.label}</span>;
if (!item.to) {
return <div key={item.key} style={{ ...rowStyle, opacity: 0.55 }}>{inner}</div>;
}
return (
<Link
key={item.key}
to={item.to}
aria-current={isActive ? 'page' : undefined}
style={rowStyle}
onMouseEnter={(e) => { if (!isActive) (e.currentTarget as HTMLElement).style.background = 'var(--surface-2)'; }}
onMouseLeave={(e) => { if (!isActive) (e.currentTarget as HTMLElement).style.background = 'transparent'; }}
>
{inner}
</Link>
);
})}
{items.length === 0 && (
<div style={{ padding: '12px 4px', fontSize: 13, color: 'var(--text-3)', textAlign: 'center' }}>
موردی یافت نشد
</div>
)}
</nav>
</aside>
);
}