hamedandClaude Opus 4.8
66ab597efd
L1: PATCH /session now enforces the patient_records subscription gate like its sibling endpoints (ownership was already checked; the feature gate was missing). L11: POST /pre-registration and POST /representation/iban return 201 on create. Remaining low-tier findings triaged and accepted without change (documented in docs/audit-backlog.md): L8 is a false positive (FK auto-indexed), L6/L7/L9 are marginal indexes, L4/L5 are small bounded N+1, L2/L3/L10/L12 are minor — none with security/integrity impact. Regression: tests/Audit/LowTierFixesTest (both fail without the fix). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
47 lines
1.5 KiB
PHP
47 lines
1.5 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Audit;
|
|
|
|
use App\Auth\Entity\PreRegistration;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* Low-tier audit fixes:
|
|
* L1 — PATCH /session enforces the patient_records subscription gate.
|
|
* L11 — POST /pre-registration returns 201 (resource created).
|
|
*/
|
|
class LowTierFixesTest extends ApiTestCase
|
|
{
|
|
public function testUpdateSessionEnforcesPatientGate(): void
|
|
{
|
|
// a doctor with no subscription → no patient_records feature
|
|
$doctorUser = $this->createUser(['ROLE_DOCTOR']);
|
|
$doctor = new Doctor($doctorUser, 'دکتر');
|
|
$this->em->persist($doctor);
|
|
$this->em->flush();
|
|
|
|
// gate fires before the session lookup → 403 (not 404)
|
|
$this->authJson('PATCH', '/api/v1/session/nonexistent-uuid', $doctorUser, ['notes' => 'x']);
|
|
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testPreRegistrationReturns201(): void
|
|
{
|
|
$mobile = '0912' . str_pad((string) random_int(0, 9_999_999), 7, '0', STR_PAD_LEFT);
|
|
$this->client->request(
|
|
'POST',
|
|
'/api/v1/pre-registration',
|
|
server: ['CONTENT_TYPE' => 'application/json'],
|
|
content: json_encode([
|
|
'type' => PreRegistration::TYPE_INDEPENDENT_DOCTOR,
|
|
'name' => 'علی محمدی',
|
|
'mobile' => $mobile,
|
|
]),
|
|
);
|
|
|
|
$this->assertSame(201, $this->client->getResponse()->getStatusCode());
|
|
}
|
|
}
|