Files
clinicpro/assets/admin/components/layout/Sidebar.test.tsx
T
hamedandClaude Opus 4.8 f33c7a3eab feat(clinic-doctor): full permission coverage + enforcement, parity with secretary
The clinic-member-doctor permission system (ClinicDoctorPermission) lagged the
secretary system: only 6 resources, enforced in ~6 places, dead toggles
(services.update never checked), and a sidebar showing just appointments+patients.
Bring it to parity so a clinic owner can control exactly what each member doctor
does — while an independent doctor stays completely unrestricted.

Coverage: add insurances, addresses, inventory, tags, staff, discounts, sms to
ClinicDoctorPermission::DEFAULT_PERMISSIONS + DoctorPermissionsModal
(subscription/clinic_doctors stay owner-only by design).

New App\Clinic\Security\ClinicDoctorAccessChecker (parallel to
SecretaryAccessChecker):
- denyUnlessGranted(user, resource, action): 403 only for a clinic-member doctor
  in the clinic context; owner/admin/secretary/independent-doctor pass through.
- memberClinicId(user): resolves the member doctor to the CLINIC's tenant so the
  role-based controllers (Inventory/Tag/Staff/Discount/Sms) stop showing them
  their personal tenant in clinic context.

Enforcement wired into 10 controllers alongside the existing secretary gates:
ClinicService (services), Insurance (insurances), Patient (patients+payments),
Staff, Discount, Inventory, Tag, SmsWallet, Payment, PaymentMethod.

Frontend: the guest-doctor sidebar branch now exposes every permitted resource
(gated by can()) plus a «تنظیمات» entry; both settings navs (PurchaseSubscription
Sidebar + SETTINGS_MENU) are now permission-filtered for a scope=clinic doctor,
not just secretaries; my-payments route gets the missing payments permission.
CRUD-button gating already applies (usePermissions is role-agnostic).

Tests: ClinicDoctorPermissionEnforcementTest (member denied/allowed +
independent-doctor-unrestricted); guest-doctor sidebar gating. Backend 375 pass,
frontend 503 pass. docs/api/clinic.md updated with the full resource set +
enforcement notes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-23 19:09:16 +03:30

173 lines
7.9 KiB
TypeScript

import { fireEvent, screen } from "@testing-library/react";
import { beforeEach, describe, expect, it, vi } from "vitest";
import { renderWithProviders } from "../../test/utils";
vi.mock("../../hooks/useSubscription", () => ({
useSubscription: () => ({ hasFeature: () => true }),
}));
import { useAuthStore } from "../../stores/authStore";
import Sidebar from "./Sidebar";
describe("Sidebar — expandable نوبت‌ها menu", () => {
beforeEach(() => {
useAuthStore.setState({
primaryRole: "admin",
dbUuid: "c1",
userName: "ادمین",
availableContexts: [],
context: null,
} as any);
});
it("keeps نوبت‌ها always expanded regardless of route and click", () => {
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
// منوی والد به شکل دکمه
const parent = screen.getByRole("button", { name: /نوبت‌ها/ });
expect(parent).toBeInTheDocument();
// حتی خارج از مسیر نوبت‌ها، زیرمنوها همیشه دیده می‌شوند
expect(screen.getByText("نوبت ها")).toBeInTheDocument();
expect(screen.getByText("افزودن نوبت")).toBeInTheDocument();
// کلیک روی والد آن را جمع نمی‌کند
fireEvent.click(parent);
expect(screen.getByText("نوبت ها")).toBeInTheDocument();
expect(screen.getByText("افزودن نوبت")).toBeInTheDocument();
});
it("auto-expands when a child route is active", () => {
renderWithProviders(<Sidebar />, { route: "/admin/appointments/new" });
// چون «افزودن نوبت» فعال است، منو باید خودکار باز باشد
expect(screen.getByText("افزودن نوبت")).toBeInTheDocument();
expect(screen.getByText("نوبت ها")).toBeInTheDocument();
});
});
describe("Sidebar — خدمات در منوی اصلی (نه تنظیمات)", () => {
it("shows خدمات in the clinic main menu linking to /admin/clinic-services", () => {
useAuthStore.setState({
primaryRole: "clinic",
dbUuid: "c1",
userName: "کلینیک",
availableContexts: [],
context: null,
} as any);
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
expect(screen.getByText("سرویس ها").closest("a")).toHaveAttribute(
"href",
"/admin/clinic-services",
);
});
it("shows خدمات in the doctor main menu linking to /admin/clinic-services", () => {
useAuthStore.setState({
primaryRole: "doctor",
dbUuid: null,
userName: "پزشک",
availableContexts: [],
context: null,
} as any);
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
expect(screen.getByText("سرویس ها").closest("a")).toHaveAttribute(
"href",
"/admin/clinic-services",
);
});
});
describe("Sidebar — گِیت منوی منشی بر اساس مجوز", () => {
const setSecretary = (resources: Record<string, Record<string, boolean>>) =>
useAuthStore.setState({
primaryRole: "secretary",
dbUuid: "c1",
userName: "منشی",
availableContexts: [],
context: { scope: "clinic", permissions: { resources } },
} as any);
it("منشیِ بدون مجوز، سرویس‌ها/انبار/تگ‌ها را نمی‌بیند", () => {
setSecretary({ appointments: { view: true } });
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
expect(screen.queryByText("سرویس ها")).not.toBeInTheDocument();
expect(screen.queryByText("انبارداری")).not.toBeInTheDocument();
expect(screen.queryByText("تگ‌ها")).not.toBeInTheDocument();
});
it("با مجوز services.view، آیتم «سرویس ها» به /admin/clinic-services می‌رود", () => {
setSecretary({ services: { view: true } });
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
expect(screen.getByText("سرویس ها").closest("a")).toHaveAttribute(
"href",
"/admin/clinic-services",
);
});
it("انبارداری با مجوز inventory.view در سایدبار اصلی می‌آید", () => {
setSecretary({ inventory: { view: true } });
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
expect(screen.getByText("انبارداری").closest("a")).toHaveAttribute(
"href",
"/admin/inventory",
);
});
it("آیتم «تنظیمات» همیشه برای منشی نمایش داده می‌شود", () => {
setSecretary({ appointments: { view: true } });
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
// «تنظیمات» هم عنوان بخش است هم آیتم؛ فقط لینکِ آیتم را می‌سنجیم.
expect(screen.getByRole("link", { name: "تنظیمات" })).toHaveAttribute(
"href",
"/admin/account-settings",
);
});
it("منابعِ زیرمجموعهٔ تنظیمات (staff/discounts/sms/tags/appointment/clinic_doctors) در سایدبار اصلی نمی‌آیند", () => {
// حتی با همهٔ مجوزها، این‌ها باید فقط داخل صفحهٔ تنظیمات باشند نه nav اصلی.
setSecretary({
staff: { view: true },
discounts: { view: true },
sms: { view: true },
tags: { view: true },
appointment_settings: { view: true },
clinic_doctors: { view: true },
});
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
expect(screen.queryByText("پرسنل")).not.toBeInTheDocument();
expect(screen.queryByText("تخفیف‌ها")).not.toBeInTheDocument();
expect(screen.queryByText("پیامک‌ها")).not.toBeInTheDocument();
expect(screen.queryByText("تگ‌ها")).not.toBeInTheDocument();
expect(screen.queryByText("تنظیمات نوبت‌دهی")).not.toBeInTheDocument();
expect(screen.queryByText("پزشکان کلینیک")).not.toBeInTheDocument();
});
});
describe("Sidebar — گِیت منوی پزشکِ عضوِ کلینیک بر اساس مجوز", () => {
const setMemberDoctor = (resources: Record<string, Record<string, boolean>>) =>
useAuthStore.setState({
primaryRole: "doctor",
dbUuid: "c1",
userName: "دکتر عضو",
availableContexts: [],
context: { scope: "clinic", permissions: { resources } },
} as any);
it("پزشکِ عضو فقط منابعِ مجاز را در سایدبار می‌بیند + «تنظیمات» همیشه", () => {
setMemberDoctor({ appointments: { view: true }, services: { view: true } });
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
expect(screen.getByText("نوبت‌های من")).toBeInTheDocument();
expect(screen.getByText("سرویس ها").closest("a")).toHaveAttribute("href", "/admin/clinic-services");
expect(screen.getByRole("link", { name: "تنظیمات" })).toHaveAttribute("href", "/admin/account-settings");
// بدون مجوز → پنهان
expect(screen.queryByText("انبارداری")).not.toBeInTheDocument();
expect(screen.queryByText("پرداخت‌ها")).not.toBeInTheDocument();
});
it("پزشکِ عضو بدونِ مجوزِ نوبت، آیتم نوبت را نمی‌بیند", () => {
setMemberDoctor({ services: { view: true } });
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
expect(screen.queryByText("نوبت‌های من")).not.toBeInTheDocument();
});
});