Matthieu
808a290845
LST-69 (3.2) phase 1. New ClientPortal module + security foundations for the client portal (spec docs/superpowers/specs/2026-03-15-client-portal-design.md). - Security: User::getRoles() no longer adds ROLE_USER to ROLE_CLIENT users; role_hierarchy ROLE_ADMIN: [ROLE_USER, ROLE_CLIENT]. Existing Task/Project/ Client/TimeEntry/metadata endpoints already required ROLE_USER -> a pure ROLE_CLIENT is walled off (verified: 403). - User (Core): client (ManyToOne ClientInterface, SET NULL) + allowedProjects (ManyToMany ProjectInterface). UserInterface extended (getClient/ getAllowedProjects). - New ClientTicket entity (module ClientPortal) + enums + repository + API with per-client isolation (ClientTicketProvider: own tickets ∩ allowedProjects), per-project numbering under advisory lock (rejects if user.client null), status transition rules. ClientTicketInterface contract for Task/TaskDocument. - TaskDocument generalized: task nullable + clientTicket (CASCADE) + CHECK; per-role access. Task.clientTicket exposed in task:read. - Additive migration; demo client fixtures. - Tenancy tests assert the isolation invariant (a client never sees another client's tickets) rather than brittle absolute counts (shared test DB). 178 tests green, mapping valid, cs-fixer clean.
108 lines
4.6 KiB
YAML
108 lines
4.6 KiB
YAML
doctrine:
|
|
dbal:
|
|
default_connection: default
|
|
connections:
|
|
# ORM uses `default`; AuditLogWriter uses `audit` (same DSN, separate
|
|
# service) to write outside the ORM transaction so audit rows survive
|
|
# an application-side rollback and avoid transactional entanglement.
|
|
default:
|
|
url: '%env(resolve:DATABASE_URL)%'
|
|
profiling_collect_backtrace: '%kernel.debug%'
|
|
# audit_log has no ORM entity (written via raw DBAL). Exclude it
|
|
# from schema comparison so migrations:diff / schema:validate stay
|
|
# clean. Creation/teardown stay driven by migrations.
|
|
schema_filter: '~^(?!audit_log$).+~'
|
|
audit:
|
|
url: '%env(resolve:DATABASE_URL)%'
|
|
orm:
|
|
validate_xml_mapping: true
|
|
naming_strategy: doctrine.orm.naming_strategy.underscore_number_aware
|
|
identity_generation_preferences:
|
|
Doctrine\DBAL\Platforms\PostgreSQLPlatform: identity
|
|
auto_mapping: true
|
|
resolve_target_entities:
|
|
App\Shared\Domain\Contract\UserInterface: App\Module\Core\Domain\Entity\User
|
|
App\Shared\Domain\Contract\ProjectInterface: App\Module\ProjectManagement\Domain\Entity\Project
|
|
App\Shared\Domain\Contract\TaskInterface: App\Module\ProjectManagement\Domain\Entity\Task
|
|
App\Shared\Domain\Contract\TaskTagInterface: App\Module\ProjectManagement\Domain\Entity\TaskTag
|
|
App\Shared\Domain\Contract\ClientInterface: App\Module\Directory\Domain\Entity\Client
|
|
App\Shared\Domain\Contract\ClientTicketInterface: App\Module\ClientPortal\Domain\Entity\ClientTicket
|
|
mappings:
|
|
App:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Entity'
|
|
prefix: 'App\Entity'
|
|
alias: App
|
|
Core:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Module/Core/Domain/Entity'
|
|
prefix: 'App\Module\Core\Domain\Entity'
|
|
TimeTracking:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Module/TimeTracking/Domain/Entity'
|
|
prefix: 'App\Module\TimeTracking\Domain\Entity'
|
|
ProjectManagement:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Module/ProjectManagement/Domain/Entity'
|
|
prefix: 'App\Module\ProjectManagement\Domain\Entity'
|
|
Absence:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Module/Absence/Domain/Entity'
|
|
prefix: 'App\Module\Absence\Domain\Entity'
|
|
Directory:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Module/Directory/Domain/Entity'
|
|
prefix: 'App\Module\Directory\Domain\Entity'
|
|
Mail:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Module/Mail/Domain/Entity'
|
|
prefix: 'App\Module\Mail\Domain\Entity'
|
|
Integration:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Module/Integration/Domain/Entity'
|
|
prefix: 'App\Module\Integration\Domain\Entity'
|
|
ClientPortal:
|
|
type: attribute
|
|
is_bundle: false
|
|
dir: '%kernel.project_dir%/src/Module/ClientPortal/Domain/Entity'
|
|
prefix: 'App\Module\ClientPortal\Domain\Entity'
|
|
controller_resolver:
|
|
auto_mapping: false
|
|
|
|
when@test:
|
|
doctrine:
|
|
dbal:
|
|
# Propagate the _test suffix to BOTH connections: the audit
|
|
# connection must write to the test DB, not the dev DB.
|
|
connections:
|
|
default:
|
|
dbname_suffix: '_test%env(default::TEST_TOKEN)%'
|
|
audit:
|
|
dbname_suffix: '_test%env(default::TEST_TOKEN)%'
|
|
|
|
when@prod:
|
|
doctrine:
|
|
orm:
|
|
query_cache_driver:
|
|
type: pool
|
|
pool: doctrine.system_cache_pool
|
|
result_cache_driver:
|
|
type: pool
|
|
pool: doctrine.result_cache_pool
|
|
|
|
framework:
|
|
cache:
|
|
pools:
|
|
doctrine.result_cache_pool:
|
|
adapter: cache.app
|
|
doctrine.system_cache_pool:
|
|
adapter: cache.system
|