hamed
90736c8149
getSchedule returned any doctor's schedule to any authenticated user — the mutation endpoints (update/delete) already checked owner-or-admin but this GET did not. Add the same check + regression test (fails without the fix).
51 lines
1.7 KiB
PHP
51 lines
1.7 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Appointment;
|
|
|
|
use App\Appointment\Entity\WeeklySchedule;
|
|
use App\Auth\Entity\User;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* Regression: GET weekly-schedule must enforce ownership (IDOR fix).
|
|
* Before the fix any authenticated user could read any doctor's schedule.
|
|
*/
|
|
class ScheduleOwnershipTest extends ApiTestCase
|
|
{
|
|
private function makeDoctorWithSchedule(): array
|
|
{
|
|
$owner = $this->createUser(['ROLE_DOCTOR']);
|
|
$doctor = new Doctor($owner, 'دکتر تست');
|
|
$this->em->persist($doctor);
|
|
$schedule = new WeeklySchedule($doctor, ['sat' => []]);
|
|
$this->em->persist($schedule);
|
|
$this->em->flush();
|
|
|
|
return [$owner, $doctor];
|
|
}
|
|
|
|
public function testOwnerCanReadOwnSchedule(): void
|
|
{
|
|
[$owner, $doctor] = $this->makeDoctorWithSchedule();
|
|
$this->authJson('GET', '/api/v1/appointment-settings/weekly-schedule/' . $doctor->getUuid(), $owner);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
|
|
public function testOtherUserIsForbidden(): void
|
|
{
|
|
[, $doctor] = $this->makeDoctorWithSchedule();
|
|
$attacker = $this->createUser(['ROLE_DOCTOR']);
|
|
$this->authJson('GET', '/api/v1/appointment-settings/weekly-schedule/' . $doctor->getUuid(), $attacker);
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
|
|
public function testAdminCanRead(): void
|
|
{
|
|
[, $doctor] = $this->makeDoctorWithSchedule();
|
|
$admin = $this->createUser(['ROLE_ADMIN']);
|
|
$this->authJson('GET', '/api/v1/appointment-settings/weekly-schedule/' . $doctor->getUuid(), $admin);
|
|
$this->assertSame(200, $this->responseCode());
|
|
}
|
|
}
|