hamedandClaude Opus 4.8
9d46577181
Secretaries could reach neither the services module (EntityContextResolver does not recognise a secretary as clinic owner, so they resolved to `unknown` → 403) nor had any toggle to grant it. Add `services` as a first-class secretary permission resource, enforced end-to-end. Backend - DoctorSecretary::DEFAULT_PERMISSIONS: new `services` resource (default-deny). - SecretaryAccessChecker::resolveOwnerEntity(): reusable owner (clinic/doctor) resolution from the secretary's active context, for controllers whose data is fetched by [entityType, entityId] and whose generic resolver is not secretary-aware. - ClinicServiceController: resolveEntity() is now secretary-aware; every action (sections, items, tariffs — 13 total) guards with `services` view/create/ update/delete via denyUnlessGranted, ahead of the subscription gate. Frontend - SecretaryPermissions type + MySecretariesPage + SecretariesPage: `services` section so owners can grant it. - Sidebar (secretary branch): services / inventory / tags menu items gated by can(resource, 'view'). - RoleRoute: a secretary now needs the page's `permission` to open it (direct URL entry included); clinic-services, inventory, tags-settings routes accept secretary + permission gate. Tests - SecretaryResourceEnforcementTest: services denied-by-default, allowed-when- granted, create-denied-while-view-granted. - Sidebar.test: secretary menu gating for services/inventory/tags. Docs: secretary.md + clinic-services.md updated with the `services` resource and the resolveOwnerEntity note. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
118 lines
4.3 KiB
PHP
118 lines
4.3 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Secretary;
|
|
|
|
use App\Auth\Entity\UserActiveContext;
|
|
use App\Clinic\Entity\Clinic;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Secretary\Entity\DoctorSecretary;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* A secretary's per-resource permission JSON (DoctorSecretary.permission) must be
|
|
* enforced by the API, not only for appointments. Resources the secretary was not
|
|
* granted return 403; granted ones pass.
|
|
*/
|
|
class SecretaryResourceEnforcementTest extends ApiTestCase
|
|
{
|
|
private function makeClinicSecretary(): array
|
|
{
|
|
$owner = $this->createUser(['ROLE_CLINIC']);
|
|
$clinic = new Clinic($owner);
|
|
$this->em->persist($clinic);
|
|
|
|
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر تست');
|
|
$this->em->persist($doctor);
|
|
$clinic->getDoctors()->add($doctor);
|
|
|
|
$secretary = $this->createUser(['ROLE_SECRETARY']);
|
|
$rel = new DoctorSecretary($doctor, $secretary, DoctorSecretary::OWNER_CLINIC, $clinic);
|
|
$this->em->persist($rel);
|
|
$this->em->persist(new UserActiveContext($secretary, $clinic->getUuid()));
|
|
|
|
return [$secretary, $rel];
|
|
}
|
|
|
|
public function testInventoryDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: inventory.* = false
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testInventoryAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['inventory' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testPatientCreateDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: patients.create = false (view is true)
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('POST', '/api/v1/patient', $secretary, ['name' => 'x']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testInventoryCreateDeniedButViewGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['inventory' => ['view' => true, 'create' => false]]]);
|
|
$this->em->flush();
|
|
|
|
// مشاهده مجاز
|
|
$this->authJson('GET', '/api/v1/inventory-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
// ایجاد ممنوع
|
|
$this->authJson('POST', '/api/v1/inventory-item', $secretary, ['name' => 'گاز استریل']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
// service-items (listAllItems) فقط توگلِ permission را میسنجد — برخلاف
|
|
// service-sections که پیش از آن، گیتِ اشتراک (assertServicesGate) هم دارد.
|
|
public function testServicesDeniedByDefault(): void
|
|
{
|
|
// DEFAULT_PERMISSIONS: services.* = false
|
|
[$secretary] = $this->makeClinicSecretary();
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testServicesAllowedWhenGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true]]]);
|
|
$this->em->flush();
|
|
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testServicesCreateDeniedButViewGranted(): void
|
|
{
|
|
[$secretary, $rel] = $this->makeClinicSecretary();
|
|
$rel->mergePermissions(['resources' => ['services' => ['view' => true, 'create' => false]]]);
|
|
$this->em->flush();
|
|
|
|
// مشاهده مجاز
|
|
$this->authJson('GET', '/api/v1/service-items', $secretary);
|
|
$this->assertSame(200, $this->responseCode());
|
|
|
|
// ایجاد ممنوع — گیتِ permission پیش از گیتِ اشتراک اجرا میشود.
|
|
$this->authJson('POST', '/api/v1/service-section', $secretary, ['name' => 'بخش تست']);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
}
|