hamed
6ab7ed38b8
- Removed MyClinicPage and redirected its functionality to a new ClinicDoctorsPage. - Created ClinicDoctorsManager component for managing doctors and invitations within the settings layout. - Updated backend permissions to allow clinic owners to detach doctors, alongside admins. - Adjusted API documentation to reflect new permission structure. - Updated tests to cover new functionality and permissions. - Modified sidebar and settings menu to reflect the new structure and role-based visibility.
79 lines
2.5 KiB
PHP
79 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace App\Tests\Clinic;
|
|
|
|
use App\Clinic\Entity\Clinic;
|
|
use App\Doctor\Entity\Doctor;
|
|
use App\Tests\ApiTestCase;
|
|
|
|
/**
|
|
* Detaching a doctor from a clinic is allowed for an admin OR the clinic owner.
|
|
* Any other authenticated user (incl. a foreign clinic owner or a plain doctor)
|
|
* must be rejected with 403.
|
|
*/
|
|
class DetachDoctorPermissionTest extends ApiTestCase
|
|
{
|
|
/** @return array{0: Clinic, 1: Doctor} */
|
|
private function makeClinicWithDoctor(): array
|
|
{
|
|
$clinic = new Clinic($this->createUser(['ROLE_CLINIC']));
|
|
$this->em->persist($clinic);
|
|
|
|
$doctor = new Doctor($this->createUser(['ROLE_DOCTOR']), 'دکتر آزمایشی');
|
|
$this->em->persist($doctor);
|
|
$clinic->getDoctors()->add($doctor);
|
|
$this->em->flush();
|
|
|
|
return [$clinic, $doctor];
|
|
}
|
|
|
|
private function detachUri(Clinic $clinic, Doctor $doctor): string
|
|
{
|
|
return '/api/v1/admin/clinic/' . $clinic->getUuid() . '/doctor/' . $doctor->getUuid();
|
|
}
|
|
|
|
public function testClinicOwnerCanDetachOwnDoctor(): void
|
|
{
|
|
[$clinic, $doctor] = $this->makeClinicWithDoctor();
|
|
$owner = $clinic->getUser();
|
|
|
|
$body = $this->authJson('DELETE', $this->detachUri($clinic, $doctor), $owner);
|
|
|
|
$this->assertSame(200, $this->responseCode());
|
|
$this->assertTrue($body['success']);
|
|
}
|
|
|
|
public function testAdminCanDetachAnyDoctor(): void
|
|
{
|
|
[$clinic, $doctor] = $this->makeClinicWithDoctor();
|
|
$admin = $this->createUser(['ROLE_ADMIN']);
|
|
|
|
$body = $this->authJson('DELETE', $this->detachUri($clinic, $doctor), $admin);
|
|
|
|
$this->assertSame(200, $this->responseCode());
|
|
$this->assertTrue($body['success']);
|
|
}
|
|
|
|
public function testForeignClinicOwnerIsForbidden(): void
|
|
{
|
|
[$clinic, $doctor] = $this->makeClinicWithDoctor();
|
|
$intruder = $this->createUser(['ROLE_CLINIC']);
|
|
|
|
$body = $this->authJson('DELETE', $this->detachUri($clinic, $doctor), $intruder);
|
|
|
|
$this->assertSame(403, $this->responseCode());
|
|
$this->assertFalse($body['success']);
|
|
$this->assertSame('ERR_ACCESS_DENIED', $body['errors'][0]['code']);
|
|
}
|
|
|
|
public function testPlainDoctorIsForbidden(): void
|
|
{
|
|
[$clinic, $doctor] = $this->makeClinicWithDoctor();
|
|
$otherDoctor = $this->createUser(['ROLE_DOCTOR']);
|
|
|
|
$this->authJson('DELETE', $this->detachUri($clinic, $doctor), $otherDoctor);
|
|
|
|
$this->assertSame(403, $this->responseCode());
|
|
}
|
|
}
|