ealmeida/care-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: add spec-kit and standardize signatures

Browse Source 
- Added GitHub spec-kit for development workflow
- Standardized file signatures to Descomplicar® format
- Updated development configuration

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Emanuel Almeida
2025-09-12 01:27:29 +01:00
parent 30ad448ed3
commit 4a7b232f68
50 changed files with 513565 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

399
tests/integration/test-billing-automation.php Normal file
View File

@@ -0,0 +1,399 @@
/**
* Descomplicar® Crescimento Digital
* https://descomplicar.pt
*/
<?php
/**
* Integration tests for Automatic Billing Generation (User Story 4).
*
* These tests validate complete user stories and MUST FAIL initially (TDD RED phase).
*
* @package KiviCare_API\Tests\Integration
*/
/**
* Billing automation integration tests.
*
* User Story: Automatic billing generation based on encounters and services
*/
class Test_Billing_Automation extends KiviCare_API_Test_Case {
/**
* Test automatic billing generation workflow.
*
* @test
*/
public function test_automatic_billing_generation_workflow() {
// This test will fail initially as billing automation isn't implemented
$this->markTestIncomplete( 'Automatic billing generation not implemented yet - TDD RED phase' );
// ARRANGE: Setup complete billing scenario
$clinic_id = $this->create_test_clinic();
global $wpdb;
// Create services with prices
$service_ids = array();
$services = array(
array( 'name' => 'General Consultation', 'price' => '75.00', 'type' => 'consultation' ),
array( 'name' => 'Blood Pressure Check', 'price' => '15.00', 'type' => 'procedure' ),
array( 'name' => 'Prescription Review', 'price' => '25.00', 'type' => 'consultation' ),
);
foreach ( $services as $service ) {
$wpdb->insert( $wpdb->prefix . 'kc_services', array(
'name' => $service['name'],
'price' => $service['price'],
'type' => $service['type'],
'status' => 1,
'created_at' => current_time( 'mysql' ),
));
$service_ids[] = $wpdb->insert_id;
}
// Map doctor and patient to clinic
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $this->doctor_user, 'clinic_id' => $clinic_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $this->patient_user, 'clinic_id' => $clinic_id ) );
// STEP 1: Create appointment with services
$appointment_data = array(
'appointment_start_date' => gmdate( 'Y-m-d', strtotime( '+1 day' ) ),
'appointment_start_time' => '14:30:00',
'appointment_end_date' => gmdate( 'Y-m-d', strtotime( '+1 day' ) ),
'appointment_end_time' => '15:30:00',
'doctor_id' => $this->doctor_user,
'patient_id' => $this->patient_user,
'clinic_id' => $clinic_id,
'visit_type' => 'consultation',
'services' => array( $service_ids[0], $service_ids[1] ), // Consultation + BP Check
);
$appointment_response = $this->make_request( '/wp-json/kivicare/v1/appointments', 'POST', $appointment_data, $this->receptionist_user );
$this->assertRestResponse( $appointment_response, 201 );
$appointment_id = $appointment_response->get_data()['id'];
// Verify service mappings were created
$service_mappings = $wpdb->get_results(
$wpdb->prepare( "SELECT * FROM {$wpdb->prefix}kc_appointment_service_mapping WHERE appointment_id = %d", $appointment_id )
);
$this->assertCount( 2, $service_mappings );
// STEP 2: Doctor creates encounter (this should trigger billing)
$encounter_data = array(
'appointment_id' => $appointment_id,
'description' => 'Patient consultation completed. Blood pressure checked and found to be within normal range.',
'diagnosis' => 'Routine health check - Normal findings',
'treatment_plan' => 'Continue current lifestyle, return in 6 months',
'status' => 1,
);
$encounter_response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', $encounter_data, $this->doctor_user );
$this->assertRestResponse( $encounter_response, 201 );
$encounter_id = $encounter_response->get_data()['id'];
// STEP 3: Verify automatic bill generation
$bill = $wpdb->get_row(
$wpdb->prepare(
"SELECT * FROM {$wpdb->prefix}kc_bills WHERE encounter_id = %d AND appointment_id = %d",
$encounter_id,
$appointment_id
)
);
$this->assertNotNull( $bill, 'Bill should be automatically generated when encounter is created' );
$this->assertEquals( $encounter_id, $bill->encounter_id );
$this->assertEquals( $appointment_id, $bill->appointment_id );
$this->assertEquals( $clinic_id, $bill->clinic_id );
$this->assertEquals( 'unpaid', $bill->payment_status );
// STEP 4: Verify bill amount calculation
$expected_total = 75.00 + 15.00; // Consultation + BP Check
$this->assertEquals( number_format( $expected_total, 2 ), $bill->total_amount );
$this->assertEquals( '0.00', $bill->discount );
$this->assertEquals( number_format( $expected_total, 2 ), $bill->actual_amount );
// STEP 5: Doctor adds additional service during encounter
$additional_service_response = $this->make_request(
"/wp-json/kivicare/v1/encounters/{$encounter_id}/services",
'POST',
array( 'service_id' => $service_ids[2] ), // Prescription Review
$this->doctor_user
);
$this->assertRestResponse( $additional_service_response, 201 );
// STEP 6: Verify bill was automatically updated
$updated_bill = $wpdb->get_row(
$wpdb->prepare( "SELECT * FROM {$wpdb->prefix}kc_bills WHERE id = %d", $bill->id )
);
$new_expected_total = $expected_total + 25.00; // Added Prescription Review
$this->assertEquals( number_format( $new_expected_total, 2 ), $updated_bill->total_amount );
$this->assertEquals( number_format( $new_expected_total, 2 ), $updated_bill->actual_amount );
// STEP 7: Test bill retrieval via API
$bill_response = $this->make_request( "/wp-json/kivicare/v1/bills/{$bill->id}", 'GET', array(), $this->receptionist_user );
$this->assertRestResponse( $bill_response, 200 );
$bill_data = $bill_response->get_data();
$this->assertEquals( $bill->id, $bill_data['id'] );
$this->assertEquals( $encounter_id, $bill_data['encounter_id'] );
$this->assertEquals( number_format( $new_expected_total, 2 ), $bill_data['total_amount'] );
// Verify bill includes service breakdown
$this->assertArrayHasKey( 'services', $bill_data );
$this->assertCount( 3, $bill_data['services'] );
// STEP 8: Test payment processing
$payment_data = array(
'amount' => $bill_data['actual_amount'],
'payment_method' => 'cash',
'notes' => 'Payment received in full',
);
$payment_response = $this->make_request( "/wp-json/kivicare/v1/bills/{$bill->id}/payment", 'POST', $payment_data, $this->receptionist_user );
$this->assertRestResponse( $payment_response, 200 );
// Verify payment status updated
$paid_bill = $wpdb->get_row(
$wpdb->prepare( "SELECT * FROM {$wpdb->prefix}kc_bills WHERE id = %d", $bill->id )
);
$this->assertEquals( 'paid', $paid_bill->payment_status );
}
/**
* Test billing with discounts and insurance.
*
* @test
*/
public function test_billing_with_discounts_and_insurance() {
// This test will fail initially as discount/insurance features aren't implemented
$this->markTestIncomplete( 'Billing discounts and insurance not implemented yet - TDD RED phase' );
// ARRANGE: Setup scenario with discounts
$clinic_id = $this->create_test_clinic();
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
// Create encounter
$encounter_response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter for billing with discounts',
), $this->doctor_user );
$encounter_id = $encounter_response->get_data()['id'];
// STEP 1: Apply senior citizen discount (20%)
$discount_data = array(
'type' => 'percentage',
'value' => 20,
'reason' => 'Senior citizen discount',
'applied_by' => $this->doctor_user,
);
$discount_response = $this->make_request( "/wp-json/kivicare/v1/bills/encounter/{$encounter_id}/discount", 'POST', $discount_data, $this->doctor_user );
$this->assertRestResponse( $discount_response, 200 );
// STEP 2: Verify discount was applied to bill
global $wpdb;
$bill = $wpdb->get_row(
$wpdb->prepare( "SELECT * FROM {$wpdb->prefix}kc_bills WHERE encounter_id = %d", $encounter_id )
);
$total_amount = floatval( $bill->total_amount );
$discount_amount = floatval( $bill->discount );
$actual_amount = floatval( $bill->actual_amount );
$this->assertEquals( $total_amount * 0.20, $discount_amount );
$this->assertEquals( $total_amount - $discount_amount, $actual_amount );
// STEP 3: Test insurance claim processing
$insurance_data = array(
'insurance_provider' => 'Medicare',
'policy_number' => 'POL123456789',
'coverage_percentage' => 80,
'claim_amount' => $actual_amount,
);
$insurance_response = $this->make_request( "/wp-json/kivicare/v1/bills/{$bill->id}/insurance", 'POST', $insurance_data, $this->receptionist_user );
$this->assertRestResponse( $insurance_response, 201 );
// Verify insurance claim was created
$claim = $wpdb->get_row(
$wpdb->prepare( "SELECT * FROM {$wpdb->prefix}kc_insurance_claims WHERE bill_id = %d", $bill->id )
);
$this->assertNotNull( $claim );
$this->assertEquals( 'pending', $claim->status );
}
/**
* Test billing error handling and edge cases.
*
* @test
*/
public function test_billing_error_handling() {
// This test will fail initially as error handling isn't implemented
$this->markTestIncomplete( 'Billing error handling not implemented yet - TDD RED phase' );
$clinic_id = $this->create_test_clinic();
// Test error scenarios
$error_tests = array(
// Encounter without appointment
array(
'scenario' => 'Encounter without appointment',
'setup' => function() {
return array(
'description' => 'Test encounter without appointment',
'patient_id' => $this->patient_user,
'clinic_id' => $this->create_test_clinic(),
);
},
'expected_error' => 'missing_appointment',
),
// Appointment without services
array(
'scenario' => 'Appointment without services',
'setup' => function() use ( $clinic_id ) {
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
// Clear any default services
global $wpdb;
$wpdb->delete( $wpdb->prefix . 'kc_appointment_service_mapping', array( 'appointment_id' => $appointment_id ) );
return array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter without services',
);
},
'expected_error' => 'no_billable_services',
),
);
foreach ( $error_tests as $test ) {
$encounter_data = $test['setup']();
$response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', $encounter_data, $this->doctor_user );
// Should either prevent encounter creation or generate appropriate billing warning
if ( $response->get_status() === 201 ) {
// If encounter was created, check for billing warnings
$encounter = $response->get_data();
$this->assertArrayHasKey( 'billing_warnings', $encounter );
} else {
// If encounter was prevented, check error code
$error_data = $response->get_data();
$this->assertEquals( $test['expected_error'], $error_data['code'] );
}
}
}
/**
* Test billing permissions and access control.
*
* @test
*/
public function test_billing_permissions() {
// This test will fail initially as billing permissions aren't implemented
$this->markTestIncomplete( 'Billing permissions not implemented yet - TDD RED phase' );
// ARRANGE: Create bill
$clinic_id = $this->create_test_clinic();
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
$encounter_response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter for billing permissions',
), $this->doctor_user );
$encounter_id = $encounter_response->get_data()['id'];
global $wpdb;
$bill = $wpdb->get_row(
$wpdb->prepare( "SELECT * FROM {$wpdb->prefix}kc_bills WHERE encounter_id = %d", $encounter_id )
);
// Test role-based permissions
$permission_tests = array(
// View bill permissions
array( 'action' => 'GET', 'endpoint' => "/wp-json/kivicare/v1/bills/{$bill->id}", 'user' => $this->admin_user, 'expected' => 200 ),
array( 'action' => 'GET', 'endpoint' => "/wp-json/kivicare/v1/bills/{$bill->id}", 'user' => $this->doctor_user, 'expected' => 200 ),
array( 'action' => 'GET', 'endpoint' => "/wp-json/kivicare/v1/bills/{$bill->id}", 'user' => $this->receptionist_user, 'expected' => 200 ),
array( 'action' => 'GET', 'endpoint' => "/wp-json/kivicare/v1/bills/{$bill->id}", 'user' => $this->patient_user, 'expected' => 200 ), // Own bill
// Payment processing permissions
array( 'action' => 'POST', 'endpoint' => "/wp-json/kivicare/v1/bills/{$bill->id}/payment", 'user' => $this->receptionist_user, 'expected' => 200 ),
array( 'action' => 'POST', 'endpoint' => "/wp-json/kivicare/v1/bills/{$bill->id}/payment", 'user' => $this->admin_user, 'expected' => 200 ),
array( 'action' => 'POST', 'endpoint' => "/wp-json/kivicare/v1/bills/{$bill->id}/payment", 'user' => $this->doctor_user, 'expected' => 403 ), // Doctor cannot process payments
array( 'action' => 'POST', 'endpoint' => "/wp-json/kivicare/v1/bills/{$bill->id}/payment", 'user' => $this->patient_user, 'expected' => 403 ), // Patient cannot process payments
);
foreach ( $permission_tests as $test ) {
$data = ( $test['action'] === 'POST' ) ? array( 'amount' => $bill->actual_amount, 'payment_method' => 'cash' ) : array();
$response = $this->make_request( $test['endpoint'], $test['action'], $data, $test['user'] );
$this->assertRestResponse( $response, $test['expected'] );
}
}
/**
* Test billing reports and analytics.
*
* @test
*/
public function test_billing_reports_and_analytics() {
// This test will fail initially as billing reports aren't implemented
$this->markTestIncomplete( 'Billing reports not implemented yet - TDD RED phase' );
// ARRANGE: Create multiple bills with different statuses
$clinic_id = $this->create_test_clinic();
$bill_scenarios = array(
array( 'amount' => 100.00, 'status' => 'paid', 'date' => '2024-01-15' ),
array( 'amount' => 150.00, 'status' => 'unpaid', 'date' => '2024-01-16' ),
array( 'amount' => 75.00, 'status' => 'paid', 'date' => '2024-01-17' ),
array( 'amount' => 200.00, 'status' => 'partially_paid', 'date' => '2024-01-18' ),
);
foreach ( $bill_scenarios as $scenario ) {
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
$encounter_response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter for billing reports',
'encounter_date' => $scenario['date'],
), $this->doctor_user );
// Simulate different payment statuses
global $wpdb;
$encounter_id = $encounter_response->get_data()['id'];
$wpdb->update(
$wpdb->prefix . 'kc_bills',
array(
'total_amount' => number_format( $scenario['amount'], 2 ),
'actual_amount' => number_format( $scenario['amount'], 2 ),
'payment_status' => $scenario['status'],
),
array( 'encounter_id' => $encounter_id )
);
}
// ACT: Generate billing reports
$reports_response = $this->make_request( '/wp-json/kivicare/v1/reports/billing', 'GET', array(
'start_date' => '2024-01-01',
'end_date' => '2024-01-31',
'clinic_id' => $clinic_id,
), $this->admin_user );
// ASSERT: Report contains expected data
$this->assertRestResponse( $reports_response, 200 );
$report = $reports_response->get_data();
$this->assertArrayHasKey( 'total_revenue', $report );
$this->assertArrayHasKey( 'outstanding_amount', $report );
$this->assertArrayHasKey( 'payment_summary', $report );
// Verify calculations
$this->assertEquals( 525.00, $report['total_billed'] ); // Sum of all bills
$this->assertEquals( 175.00, $report['total_revenue'] ); // Only paid bills
$this->assertEquals( 350.00, $report['outstanding_amount'] ); // Unpaid + partially paid
}
}

331
tests/integration/test-clinic-data-access.php Normal file
View File

@@ -0,0 +1,331 @@
/**
* Descomplicar® Crescimento Digital
* https://descomplicar.pt
*/
<?php
/**
* Integration tests for Multi-Doctor Clinic Data Access (User Story 3).
*
* These tests validate complete user stories and MUST FAIL initially (TDD RED phase).
*
* @package KiviCare_API\Tests\Integration
*/
/**
* Clinic data access integration tests.
*
* User Story: Multi-doctor clinic data access with proper isolation
*/
class Test_Clinic_Data_Access extends KiviCare_API_Test_Case {
/**
* Test multi-doctor clinic data access workflow.
*
* @test
*/
public function test_multi_doctor_clinic_data_access_workflow() {
// This test will fail initially as clinic isolation isn't implemented
$this->markTestIncomplete( 'Multi-doctor clinic data access not implemented yet - TDD RED phase' );
// ARRANGE: Setup multi-doctor clinic scenario
$clinic1_id = $this->create_test_clinic();
$clinic2_id = $this->create_test_clinic();
// Create additional doctors
$doctor2_id = $this->factory->user->create( array(
'user_login' => 'doctor2',
'user_email' => 'doctor2@clinic.com',
'role' => 'doctor',
) );
$doctor3_id = $this->factory->user->create( array(
'user_login' => 'doctor3',
'user_email' => 'doctor3@clinic.com',
'role' => 'doctor',
) );
global $wpdb;
// Map doctors to clinics
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $this->doctor_user, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $doctor2_id, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $doctor3_id, 'clinic_id' => $clinic2_id ) );
// Create patients in different clinics
$patient1_id = $this->factory->user->create( array( 'role' => 'patient' ) );
$patient2_id = $this->factory->user->create( array( 'role' => 'patient' ) );
$patient3_id = $this->factory->user->create( array( 'role' => 'patient' ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $patient1_id, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $patient2_id, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $patient3_id, 'clinic_id' => $clinic2_id ) );
// STEP 1: Doctor 1 creates appointment with Patient 1
$appointment1_id = $this->create_test_appointment( $clinic1_id, $this->doctor_user, $patient1_id );
// Doctor 1 creates encounter
$encounter1_response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment1_id,
'description' => 'First encounter by Doctor 1',
'diagnosis' => 'Common cold',
), $this->doctor_user );
$this->assertRestResponse( $encounter1_response, 201 );
$encounter1_id = $encounter1_response->get_data()['id'];
// STEP 2: Doctor 2 should be able to access same patient data (same clinic)
$patient_access_response = $this->make_request( "/wp-json/kivicare/v1/patients/{$patient1_id}", 'GET', array(), $doctor2_id );
$this->assertRestResponse( $patient_access_response, 200 );
$patient_data = $patient_access_response->get_data();
$this->assertEquals( $patient1_id, $patient_data['id'] );
$this->assertEquals( $clinic1_id, $patient_data['clinic_id'] );
// STEP 3: Doctor 2 should see Doctor 1's encounter for same patient
$encounters_response = $this->make_request( "/wp-json/kivicare/v1/patients/{$patient1_id}/encounters", 'GET', array(), $doctor2_id );
$this->assertRestResponse( $encounters_response, 200 );
$encounters = $encounters_response->get_data();
$this->assertCount( 1, $encounters );
$this->assertEquals( $encounter1_id, $encounters[0]['id'] );
$this->assertEquals( $this->doctor_user, $encounters[0]['doctor_id'] );
// STEP 4: Doctor 2 can add notes to the encounter
$update_response = $this->make_request( "/wp-json/kivicare/v1/encounters/{$encounter1_id}", 'PUT', array(
'description' => 'First encounter by Doctor 1. Additional notes by Doctor 2: Patient responded well to treatment.',
), $doctor2_id );
$this->assertRestResponse( $update_response, 200 );
// STEP 5: Doctor 3 (different clinic) should NOT access Patient 1
$cross_clinic_response = $this->make_request( "/wp-json/kivicare/v1/patients/{$patient1_id}", 'GET', array(), $doctor3_id );
$this->assertRestResponse( $cross_clinic_response, 403 );
$error_data = $cross_clinic_response->get_data();
$this->assertEquals( 'clinic_access_denied', $error_data['code'] );
// STEP 6: Doctor 3 should NOT see encounters from different clinic
$cross_encounters_response = $this->make_request( "/wp-json/kivicare/v1/encounters", 'GET', array( 'patient_id' => $patient1_id ), $doctor3_id );
$this->assertRestResponse( $cross_encounters_response, 403 );
// STEP 7: Verify clinic-filtered patient lists
$clinic1_patients_response = $this->make_request( '/wp-json/kivicare/v1/patients', 'GET', array(), $this->doctor_user );
$this->assertRestResponse( $clinic1_patients_response, 200 );
$clinic1_patients = $clinic1_patients_response->get_data()['data'];
$clinic1_patient_ids = wp_list_pluck( $clinic1_patients, 'id' );
// Should include patients from clinic 1 only
$this->assertContains( $patient1_id, $clinic1_patient_ids );
$this->assertContains( $patient2_id, $clinic1_patient_ids );
$this->assertNotContains( $patient3_id, $clinic1_patient_ids );
// STEP 8: Verify appointment scheduling across doctors in same clinic
$appointment2_id = $this->create_test_appointment( $clinic1_id, $doctor2_id, $patient2_id );
// Doctor 1 should see Doctor 2's appointments in clinic view
$clinic_appointments_response = $this->make_request( '/wp-json/kivicare/v1/appointments', 'GET', array( 'clinic_id' => $clinic1_id ), $this->doctor_user );
$this->assertRestResponse( $clinic_appointments_response, 200 );
$appointments = $clinic_appointments_response->get_data()['data'];
$appointment_ids = wp_list_pluck( $appointments, 'id' );
$this->assertContains( $appointment1_id, $appointment_ids );
$this->assertContains( $appointment2_id, $appointment_ids );
}
/**
* Test clinic admin permissions and data access.
*
* @test
*/
public function test_clinic_admin_data_access() {
// This test will fail initially as clinic admin roles aren't implemented
$this->markTestIncomplete( 'Clinic admin permissions not implemented yet - TDD RED phase' );
// ARRANGE: Setup clinic with admin
$clinic_id = $this->create_test_clinic();
$clinic_admin_id = $this->factory->user->create( array(
'user_login' => 'clinic_admin',
'user_email' => 'admin@clinic.com',
'role' => 'administrator',
) );
global $wpdb;
// Update clinic to have admin
$wpdb->update(
$wpdb->prefix . 'kc_clinics',
array( 'clinic_admin_id' => $clinic_admin_id ),
array( 'id' => $clinic_id )
);
// Map doctor and patients to clinic
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $this->doctor_user, 'clinic_id' => $clinic_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $this->patient_user, 'clinic_id' => $clinic_id ) );
// Create appointment and encounter
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
$encounter_response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter for admin access',
), $this->doctor_user );
$encounter_id = $encounter_response->get_data()['id'];
// ACT & ASSERT: Clinic admin should have full access to clinic data
// Access patient data
$patient_response = $this->make_request( "/wp-json/kivicare/v1/patients/{$this->patient_user}", 'GET', array(), $clinic_admin_id );
$this->assertRestResponse( $patient_response, 200 );
// Access encounter data
$encounter_response = $this->make_request( "/wp-json/kivicare/v1/encounters/{$encounter_id}", 'GET', array(), $clinic_admin_id );
$this->assertRestResponse( $encounter_response, 200 );
// View clinic statistics
$stats_response = $this->make_request( "/wp-json/kivicare/v1/clinics/{$clinic_id}/statistics", 'GET', array(), $clinic_admin_id );
$this->assertRestResponse( $stats_response, 200 );
$stats = $stats_response->get_data();
$this->assertArrayHasKey( 'total_patients', $stats );
$this->assertArrayHasKey( 'total_appointments', $stats );
$this->assertArrayHasKey( 'total_encounters', $stats );
}
/**
* Test data access auditing and logging.
*
* @test
*/
public function test_clinic_data_access_auditing() {
// This test will fail initially as auditing isn't implemented
$this->markTestIncomplete( 'Data access auditing not implemented yet - TDD RED phase' );
// ARRANGE: Setup scenario with different doctors
$clinic_id = $this->create_test_clinic();
$doctor2_id = $this->factory->user->create( array( 'role' => 'doctor' ) );
global $wpdb;
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $this->doctor_user, 'clinic_id' => $clinic_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $doctor2_id, 'clinic_id' => $clinic_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $this->patient_user, 'clinic_id' => $clinic_id ) );
// Track audit log entries
$audit_entries = array();
add_action( 'kivicare_api_audit_log', function( $action, $resource_type, $resource_id, $user_id ) use ( &$audit_entries ) {
$audit_entries[] = compact( 'action', 'resource_type', 'resource_id', 'user_id' );
}, 10, 4 );
// ACT: Multiple data access operations
$this->make_request( "/wp-json/kivicare/v1/patients/{$this->patient_user}", 'GET', array(), $this->doctor_user );
$this->make_request( "/wp-json/kivicare/v1/patients/{$this->patient_user}", 'GET', array(), $doctor2_id );
$this->make_request( "/wp-json/kivicare/v1/patients/{$this->patient_user}", 'PUT', array( 'phone' => '+351999888777' ), $this->doctor_user );
// ASSERT: Audit entries were created
$this->assertCount( 3, $audit_entries );
$this->assertEquals( 'read', $audit_entries[0]['action'] );
$this->assertEquals( 'patient', $audit_entries[0]['resource_type'] );
$this->assertEquals( $this->patient_user, $audit_entries[0]['resource_id'] );
$this->assertEquals( $this->doctor_user, $audit_entries[0]['user_id'] );
$this->assertEquals( 'update', $audit_entries[2]['action'] );
}
/**
* Test clinic data isolation and security.
*
* @test
*/
public function test_clinic_data_isolation_security() {
// This test will fail initially as security isolation isn't implemented
$this->markTestIncomplete( 'Clinic data isolation security not implemented yet - TDD RED phase' );
// ARRANGE: Two separate clinics with sensitive data
$clinic1_id = $this->create_test_clinic();
$clinic2_id = $this->create_test_clinic();
$doctor_clinic1 = $this->factory->user->create( array( 'role' => 'doctor' ) );
$doctor_clinic2 = $this->factory->user->create( array( 'role' => 'doctor' ) );
$patient_clinic1 = $this->factory->user->create( array( 'role' => 'patient' ) );
$patient_clinic2 = $this->factory->user->create( array( 'role' => 'patient' ) );
global $wpdb;
// Map to respective clinics
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $doctor_clinic1, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $doctor_clinic2, 'clinic_id' => $clinic2_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $patient_clinic1, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $patient_clinic2, 'clinic_id' => $clinic2_id ) );
// Create sensitive encounters
$appointment1_id = $this->create_test_appointment( $clinic1_id, $doctor_clinic1, $patient_clinic1 );
$appointment2_id = $this->create_test_appointment( $clinic2_id, $doctor_clinic2, $patient_clinic2 );
$sensitive_encounter1 = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment1_id,
'description' => 'CONFIDENTIAL: Mental health consultation - Depression treatment',
'diagnosis' => 'Major Depressive Disorder (F32.9)',
), $doctor_clinic1 );
$sensitive_encounter2 = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment2_id,
'description' => 'CONFIDENTIAL: Substance abuse treatment consultation',
'diagnosis' => 'Alcohol Use Disorder (F10.20)',
), $doctor_clinic2 );
$encounter1_id = $sensitive_encounter1->get_data()['id'];
$encounter2_id = $sensitive_encounter2->get_data()['id'];
// Security test scenarios
$security_tests = array(
// Cross-clinic patient access
array(
'test' => 'Cross-clinic patient access',
'request' => "/wp-json/kivicare/v1/patients/{$patient_clinic2}",
'method' => 'GET',
'user_id' => $doctor_clinic1,
'expected' => 403,
),
// Cross-clinic encounter access
array(
'test' => 'Cross-clinic encounter access',
'request' => "/wp-json/kivicare/v1/encounters/{$encounter2_id}",
'method' => 'GET',
'user_id' => $doctor_clinic1,
'expected' => 403,
),
// Direct database manipulation attempts via API
array(
'test' => 'SQL injection attempt',
'request' => '/wp-json/kivicare/v1/patients',
'method' => 'GET',
'data' => array( 'clinic_id' => "1 OR 1=1; DROP TABLE {$wpdb->prefix}kc_clinics; --" ),
'user_id' => $doctor_clinic1,
'expected' => 400,
),
);
foreach ( $security_tests as $test ) {
$response = $this->make_request(
$test['request'],
$test['method'],
isset( $test['data'] ) ? $test['data'] : array(),
$test['user_id']
);
$this->assertRestResponse( $response, $test['expected'], "Failed security test: {$test['test']}" );
}
// Verify no data leakage in responses
$clinic1_patients_response = $this->make_request( '/wp-json/kivicare/v1/patients', 'GET', array(), $doctor_clinic1 );
$patients = $clinic1_patients_response->get_data()['data'];
foreach ( $patients as $patient ) {
$this->assertEquals( $clinic1_id, $patient['clinic_id'], 'Patient from wrong clinic returned in response' );
}
}
}

355
tests/integration/test-encounter-workflow.php Normal file
View File

@@ -0,0 +1,355 @@
/**
* Descomplicar® Crescimento Digital
* https://descomplicar.pt
*/
<?php
/**
* Integration tests for Encounter Creation Workflow (User Story 2).
*
* These tests validate complete user stories and MUST FAIL initially (TDD RED phase).
*
* @package KiviCare_API\Tests\Integration
*/
/**
* Encounter workflow integration tests.
*
* User Story: Doctor creates encounter with prescriptions
*/
class Test_Encounter_Workflow extends KiviCare_API_Test_Case {
/**
* Test complete encounter creation with prescriptions workflow.
*
* @test
*/
public function test_doctor_creates_encounter_with_prescriptions_workflow() {
// This test will fail initially as the workflow isn't implemented
$this->markTestIncomplete( 'Encounter workflow not implemented yet - TDD RED phase' );
// ARRANGE: Set up complete scenario
wp_set_current_user( $this->doctor_user );
$clinic_id = $this->create_test_clinic();
// Create patient
global $wpdb;
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array(
'patient_id' => $this->patient_user,
'clinic_id' => $clinic_id,
));
// Create appointment
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
// STEP 1: Doctor creates medical encounter
$encounter_data = array(
'encounter_date' => gmdate( 'Y-m-d' ),
'appointment_id' => $appointment_id,
'patient_id' => $this->patient_user,
'clinic_id' => $clinic_id,
'description' => 'Patient presents with mild fever (38.2°C), headache, and fatigue. Symptoms started 2 days ago. No cough or breathing difficulties. Physical examination reveals slightly elevated temperature, normal lung sounds, mild throat redness.',
'chief_complaint' => 'Fever and headache for 2 days',
'diagnosis' => 'Viral syndrome (R50.9)',
'treatment_plan' => 'Rest, hydration, symptomatic treatment with paracetamol',
'vital_signs' => json_encode(array(
'temperature' => '38.2°C',
'blood_pressure' => '120/80',
'heart_rate' => '85 bpm',
'weight' => '70 kg',
)),
'status' => 1,
);
$response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', $encounter_data, $this->doctor_user );
// ASSERT: Encounter created successfully
$this->assertRestResponse( $response, 201 );
$encounter = $response->get_data();
$this->assertEquals( $encounter_data['appointment_id'], $encounter['appointment_id'] );
$this->assertEquals( $encounter_data['patient_id'], $encounter['patient_id'] );
$encounter_id = $encounter['id'];
// STEP 2: Verify encounter exists in database
$db_encounter = $wpdb->get_row(
$wpdb->prepare(
"SELECT * FROM {$wpdb->prefix}kc_patient_encounters WHERE id = %d",
$encounter_id
)
);
$this->assertNotNull( $db_encounter );
$this->assertEquals( $encounter_data['description'], $db_encounter->description );
// STEP 3: Doctor adds prescriptions to encounter
$prescriptions = array(
array(
'name' => 'Paracetamol 500mg',
'frequency' => 'Every 8 hours as needed',
'duration' => '5 days',
'instruction' => 'Take with water after meals. Do not exceed 4g per day.',
'dosage' => '1-2 tablets',
'quantity' => '15 tablets',
),
array(
'name' => 'Vitamin C 1000mg',
'frequency' => 'Once daily',
'duration' => '7 days',
'instruction' => 'Take with breakfast to boost immune system.',
'dosage' => '1 tablet',
'quantity' => '7 tablets',
),
);
$prescription_ids = array();
foreach ( $prescriptions as $prescription_data ) {
$response = $this->make_request(
"/wp-json/kivicare/v1/encounters/{$encounter_id}/prescriptions",
'POST',
$prescription_data,
$this->doctor_user
);
$this->assertRestResponse( $response, 201 );
$prescription = $response->get_data();
$this->assertEquals( $encounter_id, $prescription['encounter_id'] );
$this->assertEquals( $this->patient_user, $prescription['patient_id'] );
$prescription_ids[] = $prescription['id'];
}
// STEP 4: Verify prescriptions are linked to encounter
$encounter_prescriptions_response = $this->make_request(
"/wp-json/kivicare/v1/encounters/{$encounter_id}/prescriptions",
'GET',
array(),
$this->doctor_user
);
$this->assertRestResponse( $encounter_prescriptions_response, 200 );
$encounter_prescriptions = $encounter_prescriptions_response->get_data();
$this->assertCount( 2, $encounter_prescriptions );
// Verify prescription details
foreach ( $encounter_prescriptions as $i => $prescription ) {
$this->assertEquals( $prescriptions[$i]['name'], $prescription['name'] );
$this->assertEquals( $prescriptions[$i]['frequency'], $prescription['frequency'] );
}
// STEP 5: Verify appointment status was updated to completed
$appointment_response = $this->make_request( "/wp-json/kivicare/v1/appointments/{$appointment_id}", 'GET', array(), $this->doctor_user );
$this->assertRestResponse( $appointment_response, 200 );
$appointment = $appointment_response->get_data();
$this->assertEquals( 'completed', $appointment['status'] );
// STEP 6: Verify automatic bill generation
$bill = $wpdb->get_row(
$wpdb->prepare(
"SELECT * FROM {$wpdb->prefix}kc_bills WHERE encounter_id = %d",
$encounter_id
)
);
$this->assertNotNull( $bill, 'Bill should be automatically generated for encounter' );
$this->assertEquals( $encounter_id, $bill->encounter_id );
$this->assertEquals( $appointment_id, $bill->appointment_id );
$this->assertEquals( 'unpaid', $bill->payment_status );
// STEP 7: Verify patient can view encounter and prescriptions
$patient_encounter_response = $this->make_request( "/wp-json/kivicare/v1/encounters/{$encounter_id}", 'GET', array(), $this->patient_user );
$this->assertRestResponse( $patient_encounter_response, 200 );
$patient_encounter = $patient_encounter_response->get_data();
$this->assertEquals( $encounter_id, $patient_encounter['id'] );
// Sensitive medical details should be filtered for patient view
$this->assertArrayNotHasKey( 'vital_signs', $patient_encounter );
}
/**
* Test encounter creation triggers proper workflow events.
*
* @test
*/
public function test_encounter_creation_workflow_events() {
// This test will fail initially as workflow events aren't implemented
$this->markTestIncomplete( 'Encounter workflow events not implemented yet - TDD RED phase' );
// ARRANGE: Setup scenario
$clinic_id = $this->create_test_clinic();
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
// Track WordPress actions/hooks that should fire
$actions_fired = array();
$test_instance = $this;
add_action( 'kivicare_encounter_created', function( $encounter_id, $encounter_data ) use ( &$actions_fired, $test_instance ) {
$actions_fired['encounter_created'] = array( $encounter_id, $encounter_data );
}, 10, 2 );
add_action( 'kivicare_appointment_completed', function( $appointment_id ) use ( &$actions_fired, $test_instance ) {
$actions_fired['appointment_completed'] = $appointment_id;
} );
add_action( 'kivicare_bill_generated', function( $bill_id, $encounter_id ) use ( &$actions_fired, $test_instance ) {
$actions_fired['bill_generated'] = array( $bill_id, $encounter_id );
}, 10, 2 );
// ACT: Create encounter
$encounter_data = array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter for workflow events',
'status' => 1,
);
$response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', $encounter_data, $this->doctor_user );
$this->assertRestResponse( $response, 201 );
// ASSERT: All workflow events were triggered
$this->assertArrayHasKey( 'encounter_created', $actions_fired );
$this->assertArrayHasKey( 'appointment_completed', $actions_fired );
$this->assertArrayHasKey( 'bill_generated', $actions_fired );
}
/**
* Test encounter data integrity and validation.
*
* @test
*/
public function test_encounter_data_integrity() {
// This test will fail initially as validation isn't implemented
$this->markTestIncomplete( 'Encounter data validation not implemented yet - TDD RED phase' );
$clinic_id = $this->create_test_clinic();
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
// Test various validation scenarios
$validation_tests = array(
// Missing required fields
array(
'data' => array( 'description' => 'Test encounter' ),
'status' => 400,
'code' => 'rest_missing_callback_param',
),
// Invalid appointment ID
array(
'data' => array( 'appointment_id' => 99999, 'description' => 'Test' ),
'status' => 400,
'code' => 'invalid_appointment',
),
// Encounter for completed appointment
array(
'setup' => function() use ( $appointment_id ) {
global $wpdb;
$wpdb->update(
$wpdb->prefix . 'kc_appointments',
array( 'status' => 0 ), // Mark as completed
array( 'id' => $appointment_id )
);
},
'data' => array( 'appointment_id' => $appointment_id, 'description' => 'Test' ),
'status' => 409,
'code' => 'appointment_already_completed',
),
);
foreach ( $validation_tests as $test ) {
if ( isset( $test['setup'] ) ) {
$test['setup']();
}
$response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', $test['data'], $this->doctor_user );
$this->assertRestResponse( $response, $test['status'] );
if ( isset( $test['code'] ) ) {
$error_data = $response->get_data();
$this->assertEquals( $test['code'], $error_data['code'] );
}
}
}
/**
* Test prescription validation and drug interaction checks.
*
* @test
*/
public function test_prescription_validation_workflow() {
// This test will fail initially as prescription validation isn't implemented
$this->markTestIncomplete( 'Prescription validation not implemented yet - TDD RED phase' );
// ARRANGE: Create encounter
$clinic_id = $this->create_test_clinic();
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
$encounter_response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter for prescription validation',
), $this->doctor_user );
$encounter_id = $encounter_response->get_data()['id'];
// Test prescription validation
$prescription_tests = array(
// Valid prescription
array(
'data' => array( 'name' => 'Paracetamol 500mg', 'frequency' => 'Every 8h', 'duration' => '7 days' ),
'status' => 201,
),
// Missing medication name
array(
'data' => array( 'frequency' => 'Every 8h', 'duration' => '7 days' ),
'status' => 400,
),
// Invalid duration format
array(
'data' => array( 'name' => 'Test Med', 'frequency' => 'Daily', 'duration' => 'forever' ),
'status' => 400,
),
);
foreach ( $prescription_tests as $test ) {
$response = $this->make_request(
"/wp-json/kivicare/v1/encounters/{$encounter_id}/prescriptions",
'POST',
$test['data'],
$this->doctor_user
);
$this->assertRestResponse( $response, $test['status'] );
}
}
/**
* Test encounter permissions and access control.
*
* @test
*/
public function test_encounter_permissions_workflow() {
// This test will fail initially as permissions aren't implemented
$this->markTestIncomplete( 'Encounter permissions not implemented yet - TDD RED phase' );
// ARRANGE: Create encounter
$clinic_id = $this->create_test_clinic();
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
$encounter_data = array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter for permissions',
);
// Test role-based permissions
$permission_tests = array(
array( 'user_id' => $this->doctor_user, 'expected_status' => 201 ), // Doctor can create
array( 'user_id' => $this->admin_user, 'expected_status' => 201 ), // Admin can create
array( 'user_id' => $this->patient_user, 'expected_status' => 403 ), // Patient cannot create
array( 'user_id' => $this->receptionist_user, 'expected_status' => 403 ), // Receptionist cannot create
);
foreach ( $permission_tests as $i => $test ) {
// Create unique appointment for each test
$test_appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
$test_data = $encounter_data;
$test_data['appointment_id'] = $test_appointment_id;
$response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', $test_data, $test['user_id'] );
$this->assertRestResponse( $response, $test['expected_status'] );
}
}
}

280
tests/integration/test-patient-creation-workflow.php Normal file
View File

@@ -0,0 +1,280 @@
/**
* Descomplicar® Crescimento Digital
* https://descomplicar.pt
*/
<?php
/**
* Integration tests for Patient Creation Workflow (User Story 1).
*
* These tests validate complete user stories and MUST FAIL initially (TDD RED phase).
*
* @package KiviCare_API\Tests\Integration
*/
/**
* Patient creation workflow integration tests.
*
* User Story: Doctor creates patient record
*/
class Test_Patient_Creation_Workflow extends KiviCare_API_Test_Case {
/**
* Test complete patient creation workflow.
*
* @test
*/
public function test_doctor_creates_patient_record_workflow() {
// This test will fail initially as the workflow isn't implemented
$this->markTestIncomplete( 'Patient creation workflow not implemented yet - TDD RED phase' );
// ARRANGE: Doctor authentication and clinic setup
wp_set_current_user( $this->doctor_user );
$clinic_id = $this->create_test_clinic();
// Map doctor to clinic
global $wpdb;
$wpdb->insert(
$wpdb->prefix . 'kc_doctor_clinic_mappings',
array(
'doctor_id' => $this->doctor_user,
'clinic_id' => $clinic_id,
'created_at' => current_time( 'mysql' ),
)
);
// STEP 1: Doctor creates new patient via API
$patient_data = array(
'display_name' => 'João Silva Santos',
'user_email' => 'joao.santos@example.com',
'first_name' => 'João',
'last_name' => 'Santos',
'clinic_id' => $clinic_id,
'phone' => '+351912345678',
'address' => 'Rua das Flores, 123',
'city' => 'Lisboa',
'postal_code' => '1000-001',
'birth_date' => '1985-05-15',
'gender' => 'M',
);
$response = $this->make_request( '/wp-json/kivicare/v1/patients', 'POST', $patient_data, $this->doctor_user );
// ASSERT: Patient created successfully
$this->assertRestResponse( $response, 201 );
$patient = $response->get_data();
$this->assertEquals( $patient_data['display_name'], $patient['display_name'] );
$this->assertEquals( $patient_data['user_email'], $patient['user_email'] );
$patient_id = $patient['id'];
// STEP 2: Verify patient exists in WordPress users table
$wp_user = get_user_by( 'id', $patient_id );
$this->assertInstanceOf( 'WP_User', $wp_user );
$this->assertEquals( $patient_data['user_email'], $wp_user->user_email );
$this->assertEquals( $patient_data['display_name'], $wp_user->display_name );
$this->assertTrue( in_array( 'patient', $wp_user->roles, true ) );
// STEP 3: Verify patient-clinic mapping was created
$mapping = $wpdb->get_row(
$wpdb->prepare(
"SELECT * FROM {$wpdb->prefix}kc_patient_clinic_mappings WHERE patient_id = %d AND clinic_id = %d",
$patient_id,
$clinic_id
)
);
$this->assertNotNull( $mapping );
$this->assertEquals( $patient_id, $mapping->patient_id );
$this->assertEquals( $clinic_id, $mapping->clinic_id );
// STEP 4: Verify patient metadata was stored correctly
$phone = get_user_meta( $patient_id, 'phone', true );
$address = get_user_meta( $patient_id, 'address', true );
$birth_date = get_user_meta( $patient_id, 'birth_date', true );
$this->assertEquals( $patient_data['phone'], $phone );
$this->assertEquals( $patient_data['address'], $address );
$this->assertEquals( $patient_data['birth_date'], $birth_date );
// STEP 5: Verify doctor can retrieve patient data
$get_response = $this->make_request( "/wp-json/kivicare/v1/patients/{$patient_id}", 'GET', array(), $this->doctor_user );
$this->assertRestResponse( $get_response, 200 );
$retrieved_patient = $get_response->get_data();
$this->assertEquals( $patient_id, $retrieved_patient['id'] );
$this->assertEquals( $clinic_id, $retrieved_patient['clinic_id'] );
// STEP 6: Verify patient appears in clinic's patient list
$list_response = $this->make_request( '/wp-json/kivicare/v1/patients', 'GET', array( 'clinic_id' => $clinic_id ), $this->doctor_user );
$this->assertRestResponse( $list_response, 200 );
$patients_list = $list_response->get_data();
$this->assertIsArray( $patients_list['data'] );
$found_patient = false;
foreach ( $patients_list['data'] as $list_patient ) {
if ( $list_patient['id'] === $patient_id ) {
$found_patient = true;
break;
}
}
$this->assertTrue( $found_patient, 'Created patient should appear in clinic patient list' );
}
/**
* Test patient creation with duplicate email handling.
*
* @test
*/
public function test_patient_creation_duplicate_email_handling() {
// This test will fail initially as duplicate handling isn't implemented
$this->markTestIncomplete( 'Duplicate email handling not implemented yet - TDD RED phase' );
// ARRANGE: First patient created successfully
$clinic_id = $this->create_test_clinic();
$patient_data = array(
'display_name' => 'João Silva',
'user_email' => 'joao@example.com',
'clinic_id' => $clinic_id,
);
$first_response = $this->make_request( '/wp-json/kivicare/v1/patients', 'POST', $patient_data, $this->doctor_user );
$this->assertRestResponse( $first_response, 201 );
// ACT: Try to create second patient with same email
$duplicate_data = array(
'display_name' => 'João Santos',
'user_email' => 'joao@example.com', // Same email
'clinic_id' => $clinic_id,
);
$duplicate_response = $this->make_request( '/wp-json/kivicare/v1/patients', 'POST', $duplicate_data, $this->doctor_user );
// ASSERT: Should return appropriate error
$this->assertRestResponse( $duplicate_response, 409 );
$error_data = $duplicate_response->get_data();
$this->assertEquals( 'duplicate_email', $error_data['code'] );
}
/**
* Test patient creation with data validation.
*
* @test
*/
public function test_patient_creation_data_validation() {
// This test will fail initially as validation isn't implemented
$this->markTestIncomplete( 'Patient data validation not implemented yet - TDD RED phase' );
$clinic_id = $this->create_test_clinic();
// Test required field validation
$invalid_data_sets = array(
// Missing name
array(
'data' => array( 'user_email' => 'test@example.com', 'clinic_id' => $clinic_id ),
'field' => 'display_name',
),
// Missing email
array(
'data' => array( 'display_name' => 'Test Patient', 'clinic_id' => $clinic_id ),
'field' => 'user_email',
),
// Invalid email format
array(
'data' => array( 'display_name' => 'Test Patient', 'user_email' => 'invalid-email', 'clinic_id' => $clinic_id ),
'field' => 'user_email',
),
// Missing clinic
array(
'data' => array( 'display_name' => 'Test Patient', 'user_email' => 'test@example.com' ),
'field' => 'clinic_id',
),
// Invalid clinic ID
array(
'data' => array( 'display_name' => 'Test Patient', 'user_email' => 'test@example.com', 'clinic_id' => 99999 ),
'field' => 'clinic_id',
),
);
foreach ( $invalid_data_sets as $test_case ) {
$response = $this->make_request( '/wp-json/kivicare/v1/patients', 'POST', $test_case['data'], $this->doctor_user );
$this->assertRestResponse( $response, 400 );
$error_data = $response->get_data();
$this->assertArrayHasKey( 'data', $error_data );
$this->assertArrayHasKey( 'params', $error_data['data'] );
$this->assertArrayHasKey( $test_case['field'], $error_data['data']['params'] );
}
}
/**
* Test patient creation permissions by role.
*
* @test
*/
public function test_patient_creation_permissions() {
// This test will fail initially as permissions aren't implemented
$this->markTestIncomplete( 'Patient creation permissions not implemented yet - TDD RED phase' );
$clinic_id = $this->create_test_clinic();
$patient_data = array(
'display_name' => 'Test Patient',
'user_email' => 'test@example.com',
'clinic_id' => $clinic_id,
);
// Test different role permissions
$role_tests = array(
array( 'user_id' => $this->admin_user, 'expected_status' => 201 ), // Admin can create
array( 'user_id' => $this->doctor_user, 'expected_status' => 201 ), // Doctor can create
array( 'user_id' => $this->receptionist_user, 'expected_status' => 201 ), // Receptionist can create
array( 'user_id' => $this->patient_user, 'expected_status' => 403 ), // Patient cannot create
);
foreach ( $role_tests as $i => $test ) {
// Make email unique for each test
$test_data = $patient_data;
$test_data['user_email'] = "test{$i}@example.com";
$response = $this->make_request( '/wp-json/kivicare/v1/patients', 'POST', $test_data, $test['user_id'] );
$this->assertRestResponse( $response, $test['expected_status'] );
}
}
/**
* Test patient creation with clinic isolation.
*
* @test
*/
public function test_patient_creation_clinic_isolation() {
// This test will fail initially as clinic isolation isn't implemented
$this->markTestIncomplete( 'Clinic isolation not implemented yet - TDD RED phase' );
// ARRANGE: Two different clinics and doctors
$clinic1_id = $this->create_test_clinic();
$clinic2_id = $this->create_test_clinic();
$doctor2_id = $this->factory->user->create( array( 'role' => 'doctor' ) );
global $wpdb;
// Map doctors to their respective clinics
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $this->doctor_user, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $doctor2_id, 'clinic_id' => $clinic2_id ) );
// ACT: Doctor 1 tries to create patient in Doctor 2's clinic
$patient_data = array(
'display_name' => 'Cross Clinic Patient',
'user_email' => 'cross@example.com',
'clinic_id' => $clinic2_id, // Different clinic
);
$response = $this->make_request( '/wp-json/kivicare/v1/patients', 'POST', $patient_data, $this->doctor_user );
// ASSERT: Should be forbidden
$this->assertRestResponse( $response, 403 );
$error_data = $response->get_data();
$this->assertEquals( 'clinic_access_denied', $error_data['code'] );
}
}

409
tests/integration/test-role-permissions.php Normal file
View File

@@ -0,0 +1,409 @@
/**
* Descomplicar® Crescimento Digital
* https://descomplicar.pt
*/
<?php
/**
* Integration tests for Role-Based Access Control (User Story 5).
*
* These tests validate complete user stories and MUST FAIL initially (TDD RED phase).
*
* @package KiviCare_API\Tests\Integration
*/
/**
* Role-based permissions integration tests.
*
* User Story: Role-based access control across all API endpoints
*/
class Test_Role_Permissions extends KiviCare_API_Test_Case {
/**
* Test complete role-based access control workflow.
*
* @test
*/
public function test_role_based_access_control_workflow() {
// This test will fail initially as role-based permissions aren't implemented
$this->markTestIncomplete( 'Role-based access control not implemented yet - TDD RED phase' );
// ARRANGE: Setup complete scenario with all roles
$clinic_id = $this->create_test_clinic();
global $wpdb;
// Map users to clinic
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $this->doctor_user, 'clinic_id' => $clinic_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $this->patient_user, 'clinic_id' => $clinic_id ) );
// Create test data
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
$encounter_response = $this->make_request( '/wp-json/kivicare/v1/encounters', 'POST', array(
'appointment_id' => $appointment_id,
'description' => 'Test encounter for permission testing',
), $this->doctor_user );
$encounter_id = $encounter_response->get_data()['id'];
// Define permission matrix for all roles and endpoints
$permission_matrix = array(
// ADMINISTRATOR - Full access to everything
'administrator' => array(
'user_id' => $this->admin_user,
'permissions' => array(
// Clinics
array( 'GET', '/wp-json/kivicare/v1/clinics', 200 ),
array( 'POST', '/wp-json/kivicare/v1/clinics', 201 ),
array( 'PUT', "/wp-json/kivicare/v1/clinics/{$clinic_id}", 200 ),
array( 'DELETE', "/wp-json/kivicare/v1/clinics/{$clinic_id}", 200 ),
// Patients
array( 'GET', '/wp-json/kivicare/v1/patients', 200 ),
array( 'POST', '/wp-json/kivicare/v1/patients', 201 ),
array( 'GET', "/wp-json/kivicare/v1/patients/{$this->patient_user}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/patients/{$this->patient_user}", 200 ),
// Appointments
array( 'GET', '/wp-json/kivicare/v1/appointments', 200 ),
array( 'POST', '/wp-json/kivicare/v1/appointments', 201 ),
array( 'GET', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
array( 'DELETE', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
// Encounters
array( 'GET', '/wp-json/kivicare/v1/encounters', 200 ),
array( 'POST', '/wp-json/kivicare/v1/encounters', 201 ),
array( 'GET', "/wp-json/kivicare/v1/encounters/{$encounter_id}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/encounters/{$encounter_id}", 200 ),
// Bills
array( 'GET', '/wp-json/kivicare/v1/bills', 200 ),
array( 'POST', "/wp-json/kivicare/v1/bills/1/payment", 200 ),
),
),
// DOCTOR - Medical access, read patients, create encounters
'doctor' => array(
'user_id' => $this->doctor_user,
'permissions' => array(
// Clinics - Read only
array( 'GET', '/wp-json/kivicare/v1/clinics', 200 ),
array( 'POST', '/wp-json/kivicare/v1/clinics', 403 ),
array( 'PUT', "/wp-json/kivicare/v1/clinics/{$clinic_id}", 403 ),
array( 'DELETE', "/wp-json/kivicare/v1/clinics/{$clinic_id}", 403 ),
// Patients - Full access to clinic patients
array( 'GET', '/wp-json/kivicare/v1/patients', 200 ),
array( 'POST', '/wp-json/kivicare/v1/patients', 201 ),
array( 'GET', "/wp-json/kivicare/v1/patients/{$this->patient_user}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/patients/{$this->patient_user}", 200 ),
// Appointments - Read and update own appointments
array( 'GET', '/wp-json/kivicare/v1/appointments', 200 ),
array( 'POST', '/wp-json/kivicare/v1/appointments', 403 ), // Cannot create
array( 'GET', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
array( 'DELETE', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 403 ),
// Encounters - Full access
array( 'GET', '/wp-json/kivicare/v1/encounters', 200 ),
array( 'POST', '/wp-json/kivicare/v1/encounters', 201 ),
array( 'GET', "/wp-json/kivicare/v1/encounters/{$encounter_id}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/encounters/{$encounter_id}", 200 ),
// Prescriptions - Full access
array( 'POST', "/wp-json/kivicare/v1/encounters/{$encounter_id}/prescriptions", 201 ),
// Bills - Read only
array( 'GET', '/wp-json/kivicare/v1/bills', 200 ),
array( 'POST', "/wp-json/kivicare/v1/bills/1/payment", 403 ),
),
),
// PATIENT - Own data only, read-only access
'patient' => array(
'user_id' => $this->patient_user,
'permissions' => array(
// Clinics - No access
array( 'GET', '/wp-json/kivicare/v1/clinics', 403 ),
array( 'POST', '/wp-json/kivicare/v1/clinics', 403 ),
// Patients - Own data only
array( 'GET', '/wp-json/kivicare/v1/patients', 403 ), // Cannot list all patients
array( 'POST', '/wp-json/kivicare/v1/patients', 403 ),
array( 'GET', "/wp-json/kivicare/v1/patients/{$this->patient_user}", 200 ), // Own data
array( 'PUT', "/wp-json/kivicare/v1/patients/{$this->patient_user}", 200 ), // Update own data
// Appointments - Own appointments only
array( 'GET', '/wp-json/kivicare/v1/appointments', 200 ), // Filtered to own
array( 'POST', '/wp-json/kivicare/v1/appointments', 201 ), // Can book appointments
array( 'GET', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 403 ), // Cannot modify
array( 'DELETE', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ), // Can cancel own
// Encounters - Own encounters, read-only
array( 'GET', '/wp-json/kivicare/v1/encounters', 200 ), // Filtered to own
array( 'POST', '/wp-json/kivicare/v1/encounters', 403 ),
array( 'GET', "/wp-json/kivicare/v1/encounters/{$encounter_id}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/encounters/{$encounter_id}", 403 ),
// Prescriptions - Read own prescriptions
array( 'GET', "/wp-json/kivicare/v1/patients/{$this->patient_user}/prescriptions", 200 ),
array( 'POST', "/wp-json/kivicare/v1/encounters/{$encounter_id}/prescriptions", 403 ),
// Bills - Own bills only
array( 'GET', '/wp-json/kivicare/v1/bills', 200 ), // Filtered to own
array( 'POST', "/wp-json/kivicare/v1/bills/1/payment", 403 ),
),
),
// RECEPTIONIST - Appointments and basic patient data
'receptionist' => array(
'user_id' => $this->receptionist_user,
'permissions' => array(
// Clinics - Read only
array( 'GET', '/wp-json/kivicare/v1/clinics', 200 ),
array( 'POST', '/wp-json/kivicare/v1/clinics', 403 ),
// Patients - Basic access
array( 'GET', '/wp-json/kivicare/v1/patients', 200 ),
array( 'POST', '/wp-json/kivicare/v1/patients', 201 ),
array( 'GET', "/wp-json/kivicare/v1/patients/{$this->patient_user}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/patients/{$this->patient_user}", 200 ), // Basic info only
// Appointments - Full access
array( 'GET', '/wp-json/kivicare/v1/appointments', 200 ),
array( 'POST', '/wp-json/kivicare/v1/appointments', 201 ),
array( 'GET', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
array( 'PUT', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
array( 'DELETE', "/wp-json/kivicare/v1/appointments/{$appointment_id}", 200 ),
// Encounters - No access to medical data
array( 'GET', '/wp-json/kivicare/v1/encounters', 403 ),
array( 'POST', '/wp-json/kivicare/v1/encounters', 403 ),
array( 'GET', "/wp-json/kivicare/v1/encounters/{$encounter_id}", 403 ),
// Bills - Full access
array( 'GET', '/wp-json/kivicare/v1/bills', 200 ),
array( 'POST', "/wp-json/kivicare/v1/bills/1/payment", 200 ),
),
),
);
// Execute permission tests for each role
foreach ( $permission_matrix as $role => $role_data ) {
foreach ( $role_data['permissions'] as $permission ) {
list( $method, $endpoint, $expected_status ) = $permission;
// Prepare test data based on method
$test_data = array();
if ( $method === 'POST' ) {
if ( strpos( $endpoint, 'clinics' ) !== false ) {
$test_data = array( 'name' => 'Test Clinic', 'email' => 'test@clinic.com' );
} elseif ( strpos( $endpoint, 'patients' ) !== false ) {
$test_data = array( 'display_name' => 'Test Patient', 'user_email' => 'test@patient.com', 'clinic_id' => $clinic_id );
} elseif ( strpos( $endpoint, 'appointments' ) !== false ) {
$test_data = array(
'appointment_start_date' => gmdate( 'Y-m-d', strtotime( '+2 days' ) ),
'appointment_start_time' => '10:00:00',
'appointment_end_time' => '10:30:00',
'doctor_id' => $this->doctor_user,
'patient_id' => $this->patient_user,
'clinic_id' => $clinic_id,
);
} elseif ( strpos( $endpoint, 'encounters' ) !== false ) {
$test_data = array( 'appointment_id' => $appointment_id, 'description' => 'Test encounter' );
} elseif ( strpos( $endpoint, 'prescriptions' ) !== false ) {
$test_data = array( 'name' => 'Test Medicine', 'frequency' => 'Daily', 'duration' => '7 days' );
} elseif ( strpos( $endpoint, 'payment' ) !== false ) {
$test_data = array( 'amount' => '50.00', 'payment_method' => 'cash' );
}
} elseif ( $method === 'PUT' ) {
if ( strpos( $endpoint, 'clinics' ) !== false ) {
$test_data = array( 'name' => 'Updated Clinic Name' );
} elseif ( strpos( $endpoint, 'patients' ) !== false ) {
$test_data = array( 'phone' => '+351999888777' );
} elseif ( strpos( $endpoint, 'appointments' ) !== false ) {
$test_data = array( 'description' => 'Updated appointment notes' );
} elseif ( strpos( $endpoint, 'encounters' ) !== false ) {
$test_data = array( 'description' => 'Updated encounter notes' );
}
}
// Make request and assert
$response = $this->make_request( $endpoint, $method, $test_data, $role_data['user_id'] );
$this->assertRestResponse(
$response,
$expected_status,
"Failed permission test for role {$role}: {$method} {$endpoint} (expected {$expected_status}, got {$response->get_status()})"
);
}
}
}
/**
* Test data filtering based on user role and clinic access.
*
* @test
*/
public function test_role_based_data_filtering() {
// This test will fail initially as data filtering isn't implemented
$this->markTestIncomplete( 'Role-based data filtering not implemented yet - TDD RED phase' );
// ARRANGE: Setup multi-clinic scenario
$clinic1_id = $this->create_test_clinic();
$clinic2_id = $this->create_test_clinic();
$doctor2_id = $this->factory->user->create( array( 'role' => 'doctor' ) );
$patient2_id = $this->factory->user->create( array( 'role' => 'patient' ) );
global $wpdb;
// Map users to different clinics
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $this->doctor_user, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_doctor_clinic_mappings', array( 'doctor_id' => $doctor2_id, 'clinic_id' => $clinic2_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $this->patient_user, 'clinic_id' => $clinic1_id ) );
$wpdb->insert( $wpdb->prefix . 'kc_patient_clinic_mappings', array( 'patient_id' => $patient2_id, 'clinic_id' => $clinic2_id ) );
// Create appointments in both clinics
$appointment1_id = $this->create_test_appointment( $clinic1_id, $this->doctor_user, $this->patient_user );
$appointment2_id = $this->create_test_appointment( $clinic2_id, $doctor2_id, $patient2_id );
// TEST: Doctor 1 should only see clinic 1 data
$doctor1_patients = $this->make_request( '/wp-json/kivicare/v1/patients', 'GET', array(), $this->doctor_user );
$patients_data = $doctor1_patients->get_data()['data'];
foreach ( $patients_data as $patient ) {
$this->assertEquals( $clinic1_id, $patient['clinic_id'], 'Doctor should only see patients from their clinic' );
}
$doctor1_appointments = $this->make_request( '/wp-json/kivicare/v1/appointments', 'GET', array(), $this->doctor_user );
$appointments_data = $doctor1_appointments->get_data()['data'];
foreach ( $appointments_data as $appointment ) {
$this->assertEquals( $clinic1_id, $appointment['clinic_id'], 'Doctor should only see appointments from their clinic' );
}
// TEST: Patient should only see own data
$patient_appointments = $this->make_request( '/wp-json/kivicare/v1/appointments', 'GET', array(), $this->patient_user );
$patient_appointments_data = $patient_appointments->get_data()['data'];
foreach ( $patient_appointments_data as $appointment ) {
$this->assertEquals( $this->patient_user, $appointment['patient_id'], 'Patient should only see their own appointments' );
}
// TEST: Administrator should see all data
$admin_patients = $this->make_request( '/wp-json/kivicare/v1/patients', 'GET', array(), $this->admin_user );
$all_patients_data = $admin_patients->get_data()['data'];
$clinic_ids = wp_list_pluck( $all_patients_data, 'clinic_id' );
$this->assertContains( $clinic1_id, $clinic_ids );
$this->assertContains( $clinic2_id, $clinic_ids );
}
/**
* Test API key authentication and permissions.
*
* @test
*/
public function test_api_key_authentication_permissions() {
// This test will fail initially as API key authentication isn't implemented
$this->markTestIncomplete( 'API key authentication not implemented yet - TDD RED phase' );
// ARRANGE: Generate API keys for different purposes
$api_keys = array(
'read_only' => $this->generate_api_key( 'read_only', array( 'read_patients', 'read_appointments' ) ),
'full_admin' => $this->generate_api_key( 'full_admin', array( 'all' ) ),
'billing' => $this->generate_api_key( 'billing', array( 'read_bills', 'process_payments' ) ),
);
$clinic_id = $this->create_test_clinic();
$appointment_id = $this->create_test_appointment( $clinic_id, $this->doctor_user, $this->patient_user );
// Test API key permissions
$api_key_tests = array(
array( 'key' => 'read_only', 'method' => 'GET', 'endpoint' => '/wp-json/kivicare/v1/patients', 'expected' => 200 ),
array( 'key' => 'read_only', 'method' => 'POST', 'endpoint' => '/wp-json/kivicare/v1/patients', 'expected' => 403 ),
array( 'key' => 'full_admin', 'method' => 'POST', 'endpoint' => '/wp-json/kivicare/v1/patients', 'expected' => 201 ),
array( 'key' => 'billing', 'method' => 'GET', 'endpoint' => '/wp-json/kivicare/v1/bills', 'expected' => 200 ),
array( 'key' => 'billing', 'method' => 'GET', 'endpoint' => '/wp-json/kivicare/v1/patients', 'expected' => 403 ),
);
foreach ( $api_key_tests as $test ) {
// Set API key in header
$_SERVER['HTTP_X_API_KEY'] = $api_keys[ $test['key'] ];
$test_data = array();
if ( $test['method'] === 'POST' && strpos( $test['endpoint'], 'patients' ) !== false ) {
$test_data = array( 'display_name' => 'API Test Patient', 'user_email' => 'api@test.com', 'clinic_id' => $clinic_id );
}
$response = $this->make_request( $test['endpoint'], $test['method'], $test_data );
$this->assertRestResponse( $response, $test['expected'] );
}
// Cleanup
unset( $_SERVER['HTTP_X_API_KEY'] );
}
/**
* Test permission inheritance and role hierarchy.
*
* @test
*/
public function test_permission_inheritance_hierarchy() {
// This test will fail initially as role hierarchy isn't implemented
$this->markTestIncomplete( 'Permission inheritance not implemented yet - TDD RED phase' );
// Create custom role with specific capabilities
add_role( 'clinic_manager', 'Clinic Manager', array(
'read' => true,
'manage_kivicare_api' => true,
'kivicare_api_clinic_admin' => true,
'kivicare_api_manage_doctors' => true,
'kivicare_api_manage_patients' => true,
'kivicare_api_view_reports' => true,
));
$clinic_manager_id = $this->factory->user->create( array( 'role' => 'clinic_manager' ) );
$clinic_id = $this->create_test_clinic();
// Test role hierarchy permissions
$hierarchy_tests = array(
// Clinic manager should have patient and doctor management access
array( 'user' => $clinic_manager_id, 'endpoint' => '/wp-json/kivicare/v1/patients', 'method' => 'GET', 'expected' => 200 ),
array( 'user' => $clinic_manager_id, 'endpoint' => '/wp-json/kivicare/v1/patients', 'method' => 'POST', 'expected' => 201 ),
array( 'user' => $clinic_manager_id, 'endpoint' => '/wp-json/kivicare/v1/reports/clinic', 'method' => 'GET', 'expected' => 200 ),
// But should NOT have medical data access
array( 'user' => $clinic_manager_id, 'endpoint' => '/wp-json/kivicare/v1/encounters', 'method' => 'GET', 'expected' => 403 ),
array( 'user' => $clinic_manager_id, 'endpoint' => '/wp-json/kivicare/v1/encounters/1/prescriptions', 'method' => 'POST', 'expected' => 403 ),
);
foreach ( $hierarchy_tests as $test ) {
$test_data = array();
if ( $test['method'] === 'POST' && strpos( $test['endpoint'], 'patients' ) !== false ) {
$test_data = array( 'display_name' => 'Manager Test', 'user_email' => 'manager@test.com', 'clinic_id' => $clinic_id );
}
$response = $this->make_request( $test['endpoint'], $test['method'], $test_data, $test['user'] );
$this->assertRestResponse( $response, $test['expected'] );
}
// Cleanup custom role
remove_role( 'clinic_manager' );
}
/**
* Helper method to generate API key (will be implemented).
*
* @param string $name Key name.
* @param array $permissions Key permissions.
* @return string API key.
*/
private function generate_api_key( $name, $permissions ) {
// This would be implemented with actual API key generation
return 'api_key_' . $name . '_' . wp_generate_password( 32, false );
}
}