hamedandClaude Opus 4.8
61981a45d0
The generic wallet/payment endpoints are bound to #[CurrentUser] (the
requester's own money), so they cannot serve a record owner viewing a patient's
finances. Add three record-owner-gated read endpoints on PatientController that
reuse the existing repositories:
GET /patient/{uuid}/payments — paginated gateway payments (?status)
GET /patient/{uuid}/wallet — balance + 10 recent transactions
GET /patient/{uuid}/wallet/transactions — full paginated ledger
Wire the previously-placeholder "پرداختها" and "کیف پول" tabs on the patient
detail page: payments via the shared TabList, wallet via a new WalletTab (balance
card + credit/debit ledger). PatientFinancialsTest covers the happy path, the
credit−debit balance, and ownership scoping (404 for a different owner).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
91 lines
3.4 KiB
PHP
91 lines
3.4 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Patient;
|
|
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Patient\Entity\PatientRecord;
|
|
use App\Payment\Entity\Payment;
|
|
use App\Settlement\Entity\WalletTransaction;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* Record-owner-gated reads of the patient's finances:
|
|
* payments list, wallet balance, and wallet-transaction ledger.
|
|
*/
|
|
class PatientFinancialsTest extends ApiTestCase
|
|
{
|
|
/** @return array{0: \App\Auth\Entity\User, 1: PatientRecord, 2: \App\Auth\Entity\User} */
|
|
private function recordFor(): array
|
|
{
|
|
$owner = $this->createUser(['ROLE_DOCTOR']);
|
|
$doctor = new Doctor($owner, 'دکتر');
|
|
$this->em->persist($doctor);
|
|
$this->em->flush();
|
|
|
|
$patient = $this->createUser(['ROLE_USER']);
|
|
$record = new PatientRecord('doctor', $doctor->getId(), $patient, 'doctor', $doctor->getId());
|
|
$this->em->persist($record);
|
|
$this->em->flush();
|
|
|
|
return [$owner, $record, $patient];
|
|
}
|
|
|
|
public function testListsPatientPayments(): void
|
|
{
|
|
[$owner, $record, $patient] = $this->recordFor();
|
|
|
|
$payment = new Payment($patient, 250000, 'mellat', 'appointment');
|
|
$payment->setStatus(Payment::STATUS_SUCCESS);
|
|
$this->em->persist($payment);
|
|
$this->em->flush();
|
|
|
|
$res = $this->authJson('GET', '/api/v1/patient/' . $record->getUuid() . '/payments', $owner);
|
|
self::assertSame(200, $this->responseCode());
|
|
self::assertCount(1, $res['data']);
|
|
self::assertSame(250000, $res['data'][0]['amount_rials']);
|
|
self::assertSame(1, $res['meta']['totalRecords']);
|
|
}
|
|
|
|
public function testWalletBalanceReflectsCreditMinusDebit(): void
|
|
{
|
|
[$owner, $record, $patient] = $this->recordFor();
|
|
|
|
$this->em->persist(new WalletTransaction($patient, 500000, 'credit', 500000));
|
|
$this->em->persist(new WalletTransaction($patient, 200000, 'debit', 300000));
|
|
$this->em->flush();
|
|
|
|
$res = $this->authJson('GET', '/api/v1/patient/' . $record->getUuid() . '/wallet', $owner);
|
|
self::assertSame(200, $this->responseCode());
|
|
self::assertSame(300000, $res['data']['balance_rials']);
|
|
self::assertCount(2, $res['data']['recent_transactions']);
|
|
}
|
|
|
|
public function testListsWalletTransactionsPaginated(): void
|
|
{
|
|
[$owner, $record, $patient] = $this->recordFor();
|
|
|
|
$this->em->persist(new WalletTransaction($patient, 100000, 'credit', 100000));
|
|
$this->em->flush();
|
|
|
|
$res = $this->authJson('GET', '/api/v1/patient/' . $record->getUuid() . '/wallet/transactions', $owner);
|
|
self::assertSame(200, $this->responseCode());
|
|
self::assertCount(1, $res['data']);
|
|
self::assertSame('credit', $res['data'][0]['type']);
|
|
self::assertSame(1, $res['meta']['totalRecords']);
|
|
}
|
|
|
|
public function testFinancialsAreOwnershipScoped(): void
|
|
{
|
|
[, $record] = $this->recordFor();
|
|
[$other] = $this->recordFor();
|
|
|
|
// A different owner cannot read this record's finances.
|
|
$this->authJson('GET', '/api/v1/patient/' . $record->getUuid() . '/payments', $other);
|
|
self::assertSame(404, $this->responseCode());
|
|
$this->authJson('GET', '/api/v1/patient/' . $record->getUuid() . '/wallet', $other);
|
|
self::assertSame(404, $this->responseCode());
|
|
$this->authJson('GET', '/api/v1/patient/' . $record->getUuid() . '/wallet/transactions', $other);
|
|
self::assertSame(404, $this->responseCode());
|
|
}
|
|
}
|