Extends the secretary permission system to five previously owner-only modules, so a clinic/doctor can delegate each page to a secretary. All were unreachable by secretaries before (role-based tenant resolution returned "unknown" → 403). New permission resources (default-deny, three-place add: entity default, SecretaryPermissions type, both MySecretariesPage + admin SecretariesPage): staff, discounts, sms, appointment_settings (view/update only), clinic_doctors (clinic-only — hidden from independent doctors via `clinicOnly` section filter). Backend enforcement (SecretaryAccessChecker, three new reusable helpers): - resolveOwnerEntity(): owner pair from active context — used by StaffController, DiscountController, SmsWalletController (now secretary-aware resolveEntity). - canForDoctor(): per-doctor-scoped check (assigned doctor + toggle) — wired into AppointmentSettingsController::denyDoctorAccess. - canForClinic(): clinic-scoped check — wired into ClinicController::detachDoctor, ClinicDoctorPermissionController (view/update), ClinicInvitationController (create/view/update/delete). clinic_doctors is clinic-context only. Guards run ahead of any subscription gate; non-secretary roles pass unchanged. Frontend: - RoleRoute: staff, discounts, sms-wallet, appointment-settings (doctor+clinic variants), settings/clinic-doctors routes accept secretary + permission gate. - Sidebar (secretary branch): five new items gated by can(); appointment_settings route follows active scope; clinic_doctors only in clinic scope. Tests: SecretaryResourceEnforcementTest — denied-by-default + allowed-when-granted for all five (18 total). Sidebar.test — B-resource gating + clinic_doctors scope rule. docs/api/secretary.md resource list, enforcement map, JSON example updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
159 lines
6.8 KiB
TypeScript
159 lines
6.8 KiB
TypeScript
import { fireEvent, screen } from "@testing-library/react";
|
|
import { beforeEach, describe, expect, it, vi } from "vitest";
|
|
import { renderWithProviders } from "../../test/utils";
|
|
|
|
vi.mock("../../hooks/useSubscription", () => ({
|
|
useSubscription: () => ({ hasFeature: () => true }),
|
|
}));
|
|
|
|
import { useAuthStore } from "../../stores/authStore";
|
|
import Sidebar from "./Sidebar";
|
|
|
|
describe("Sidebar — expandable نوبتها menu", () => {
|
|
beforeEach(() => {
|
|
useAuthStore.setState({
|
|
primaryRole: "admin",
|
|
dbUuid: "c1",
|
|
userName: "ادمین",
|
|
availableContexts: [],
|
|
context: null,
|
|
} as any);
|
|
});
|
|
|
|
it("keeps نوبتها always expanded regardless of route and click", () => {
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
|
|
// منوی والد به شکل دکمه
|
|
const parent = screen.getByRole("button", { name: /نوبتها/ });
|
|
expect(parent).toBeInTheDocument();
|
|
|
|
// حتی خارج از مسیر نوبتها، زیرمنوها همیشه دیده میشوند
|
|
expect(screen.getByText("نوبت ها")).toBeInTheDocument();
|
|
expect(screen.getByText("افزودن نوبت")).toBeInTheDocument();
|
|
|
|
// کلیک روی والد آن را جمع نمیکند
|
|
fireEvent.click(parent);
|
|
expect(screen.getByText("نوبت ها")).toBeInTheDocument();
|
|
expect(screen.getByText("افزودن نوبت")).toBeInTheDocument();
|
|
});
|
|
|
|
it("auto-expands when a child route is active", () => {
|
|
renderWithProviders(<Sidebar />, { route: "/admin/appointments/new" });
|
|
// چون «افزودن نوبت» فعال است، منو باید خودکار باز باشد
|
|
expect(screen.getByText("افزودن نوبت")).toBeInTheDocument();
|
|
expect(screen.getByText("نوبت ها")).toBeInTheDocument();
|
|
});
|
|
});
|
|
|
|
describe("Sidebar — خدمات در منوی اصلی (نه تنظیمات)", () => {
|
|
it("shows خدمات in the clinic main menu linking to /admin/clinic-services", () => {
|
|
useAuthStore.setState({
|
|
primaryRole: "clinic",
|
|
dbUuid: "c1",
|
|
userName: "کلینیک",
|
|
availableContexts: [],
|
|
context: null,
|
|
} as any);
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
expect(screen.getByText("سرویس ها").closest("a")).toHaveAttribute(
|
|
"href",
|
|
"/admin/clinic-services",
|
|
);
|
|
});
|
|
|
|
it("shows خدمات in the doctor main menu linking to /admin/clinic-services", () => {
|
|
useAuthStore.setState({
|
|
primaryRole: "doctor",
|
|
dbUuid: null,
|
|
userName: "پزشک",
|
|
availableContexts: [],
|
|
context: null,
|
|
} as any);
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
expect(screen.getByText("سرویس ها").closest("a")).toHaveAttribute(
|
|
"href",
|
|
"/admin/clinic-services",
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("Sidebar — گِیت منوی منشی بر اساس مجوز", () => {
|
|
const setSecretary = (resources: Record<string, Record<string, boolean>>) =>
|
|
useAuthStore.setState({
|
|
primaryRole: "secretary",
|
|
dbUuid: "c1",
|
|
userName: "منشی",
|
|
availableContexts: [],
|
|
context: { scope: "clinic", permissions: { resources } },
|
|
} as any);
|
|
|
|
it("منشیِ بدون مجوز، سرویسها/انبار/تگها را نمیبیند", () => {
|
|
setSecretary({ appointments: { view: true } });
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
expect(screen.queryByText("سرویس ها")).not.toBeInTheDocument();
|
|
expect(screen.queryByText("انبارداری")).not.toBeInTheDocument();
|
|
expect(screen.queryByText("تگها")).not.toBeInTheDocument();
|
|
});
|
|
|
|
it("با مجوز services.view، آیتم «سرویس ها» به /admin/clinic-services میرود", () => {
|
|
setSecretary({ services: { view: true } });
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
expect(screen.getByText("سرویس ها").closest("a")).toHaveAttribute(
|
|
"href",
|
|
"/admin/clinic-services",
|
|
);
|
|
});
|
|
|
|
it("با مجوز inventory.view و tags.view، همان آیتمها نمایش داده میشوند", () => {
|
|
setSecretary({ inventory: { view: true }, tags: { view: true } });
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
expect(screen.getByText("انبارداری").closest("a")).toHaveAttribute(
|
|
"href",
|
|
"/admin/inventory",
|
|
);
|
|
expect(screen.getByText("تگها").closest("a")).toHaveAttribute(
|
|
"href",
|
|
"/admin/tags-settings",
|
|
);
|
|
});
|
|
|
|
it("منابع فاز B (staff/discounts/sms/appointment_settings) با مجوز نمایش داده میشوند", () => {
|
|
setSecretary({
|
|
staff: { view: true },
|
|
discounts: { view: true },
|
|
sms: { view: true },
|
|
appointment_settings: { view: true },
|
|
});
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
expect(screen.getByText("پرسنل").closest("a")).toHaveAttribute("href", "/admin/staff");
|
|
expect(screen.getByText("تخفیفها").closest("a")).toHaveAttribute("href", "/admin/discounts");
|
|
expect(screen.getByText("پیامکها").closest("a")).toHaveAttribute("href", "/admin/sms-wallet");
|
|
// scope=clinic → مسیر تنظیمات کلینیک
|
|
expect(screen.getByText("تنظیمات نوبتدهی").closest("a")).toHaveAttribute(
|
|
"href",
|
|
"/admin/settings/appointment-settings",
|
|
);
|
|
});
|
|
|
|
it("مدیریت پزشکان کلینیک در scope=doctor حتی با مجوز دیده نمیشود", () => {
|
|
useAuthStore.setState({
|
|
primaryRole: "secretary",
|
|
dbUuid: "d1",
|
|
userName: "منشی",
|
|
availableContexts: [],
|
|
context: { scope: "doctor", permissions: { resources: { clinic_doctors: { view: true } } } },
|
|
} as any);
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
expect(screen.queryByText("پزشکان کلینیک")).not.toBeInTheDocument();
|
|
});
|
|
|
|
it("مدیریت پزشکان کلینیک در scope=clinic با مجوز دیده میشود", () => {
|
|
setSecretary({ clinic_doctors: { view: true } });
|
|
renderWithProviders(<Sidebar />, { route: "/admin/dashboard" });
|
|
expect(screen.getByText("پزشکان کلینیک").closest("a")).toHaveAttribute(
|
|
"href",
|
|
"/admin/settings/clinic-doctors",
|
|
);
|
|
});
|
|
});
|