Add practitioners admin and staff-scoped Care UX.

Hospital admins can manage assignable doctors and invite team members
from Ladill mailboxes; invited staff only see Care tools they need.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Auth/SsoLoginController.php

@@ -284,7 +284,10 @@ class SsoLoginController extends Controller
     private function resolveLanding(IdentityTeamClient $identity, User $user, string $intended): string
     {
         try {
-            return $identity->postAuthRedirect($user->ownerRef(), $intended);
+            $access = $identity->appAccess($user->ownerRef(), $intended);
+            \App\Support\StaffUx::remember($access);
+
+            return $access['url'] !== '' ? $access['url'] : $intended;
         } catch (\Throwable) {
             return $intended;
         }

app/Http/Controllers/Care/MemberController.php

@@ -6,10 +6,12 @@ use App\Http\Controllers\Controller;
 use App\Http\Controllers\Care\Concerns\ScopesToAccount;
 use App\Models\Branch;
 use App\Models\Member;
+use App\Models\Practitioner;
 use App\Services\Care\AuditLogger;
 use App\Services\Identity\IdentityTeamClient;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Str;
 use Illuminate\View\View;
 
 class MemberController extends Controller
@@ -43,21 +45,30 @@ class MemberController extends Controller
         ]);
     }
 
-    public function create(Request $request): View
+    public function create(Request $request, IdentityTeamClient $identity): View
     {
         $this->authorizeAbility($request, 'admin.members.manage');
         $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
 
-        $branches = Branch::owned($this->ownerRef($request))
+        $branches = Branch::owned($owner)
             ->where('organization_id', $organization->id)
             ->where('is_active', true)
             ->orderBy('name')
             ->get();
 
+        $mailboxOptions = [];
+        try {
+            $mailboxOptions = $identity->mailboxOptions($owner);
+        } catch (\Throwable) {
+            // Identity optional for form rendering.
+        }
+
         return view('care.admin.members.create', [
             'organization' => $organization,
             'branches' => $branches,
             'roles' => config('care.roles'),
+            'mailboxOptions' => $mailboxOptions,
         ]);
     }
 
@@ -71,6 +82,9 @@ class MemberController extends Controller
             'email' => ['required', 'email', 'max:255'],
             'role' => ['required', 'string', 'in:'.implode(',', array_keys(config('care.roles')))],
             'branch_id' => ['nullable', 'integer', 'exists:care_branches,id'],
+            'create_practitioner' => ['sometimes', 'boolean'],
+            'practitioner_name' => ['nullable', 'string', 'max:255'],
+            'specialty' => ['nullable', 'string', 'max:255'],
         ]);
 
         $email = strtolower(trim($validated['email']));
@@ -106,6 +120,25 @@ class MemberController extends Controller
 
         AuditLogger::record($owner, 'member.invited', $organization->id, $owner, Member::class, $member->id);
 
+        $createPractitioner = $request->boolean('create_practitioner', $validated['role'] === 'doctor');
+        if ($createPractitioner) {
+            $name = trim((string) ($validated['practitioner_name'] ?? '')) ?: Str::headline(Str::before($email, '@'));
+            Practitioner::query()->firstOrCreate(
+                [
+                    'organization_id' => $organization->id,
+                    'member_id' => $member->id,
+                ],
+                [
+                    'owner_ref' => $owner,
+                    'branch_id' => $validated['branch_id'] ?? null,
+                    'user_ref' => $email,
+                    'name' => $name,
+                    'specialty' => $validated['specialty'] ?? null,
+                    'is_active' => true,
+                ],
+            );
+        }
+
         return redirect()->route('care.members.index')->with('success', 'Invitation sent to '.$email.'.');
     }
 

app/Http/Controllers/Care/PractitionerController.php

@@ -0,0 +1,195 @@
+<?php
+
+namespace App\Http\Controllers\Care;
+
+use App\Http\Controllers\Controller;
+use App\Http\Controllers\Care\Concerns\ScopesToAccount;
+use App\Models\Branch;
+use App\Models\Department;
+use App\Models\Member;
+use App\Models\Practitioner;
+use App\Services\Care\AuditLogger;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+class PractitionerController extends Controller
+{
+    use ScopesToAccount;
+
+    public function index(Request $request): View
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.view');
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        $practitioners = Practitioner::owned($owner)
+            ->where('organization_id', $organization->id)
+            ->with(['branch', 'department', 'member'])
+            ->orderBy('name')
+            ->get();
+
+        return view('care.admin.practitioners.index', [
+            'practitioners' => $practitioners,
+            'organization' => $organization,
+            'heroStats' => [
+                'total' => $practitioners->count(),
+                'active' => $practitioners->where('is_active', true)->count(),
+                'linked' => $practitioners->whereNotNull('member_id')->count(),
+            ],
+        ]);
+    }
+
+    public function create(Request $request): View
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        return view('care.admin.practitioners.create', [
+            'organization' => $organization,
+            'branches' => $this->activeBranches($owner, $organization->id),
+            'departments' => $this->activeDepartments($owner, $organization->id),
+            'members' => $this->linkableMembers($owner, $organization->id),
+        ]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        $validated = $this->validated($request, $owner, $organization->id);
+
+        $member = ! empty($validated['member_id'])
+            ? Member::owned($owner)->where('organization_id', $organization->id)->findOrFail($validated['member_id'])
+            : null;
+
+        $practitioner = Practitioner::create([
+            'owner_ref' => $owner,
+            'organization_id' => $organization->id,
+            'branch_id' => $validated['branch_id'] ?? null,
+            'department_id' => $validated['department_id'] ?? null,
+            'member_id' => $member?->id,
+            'user_ref' => $member?->user_ref,
+            'name' => $validated['name'],
+            'specialty' => $validated['specialty'] ?? null,
+            'is_active' => true,
+        ]);
+
+        AuditLogger::record($owner, 'practitioner.created', $organization->id, $owner, Practitioner::class, $practitioner->id);
+
+        return redirect()->route('care.practitioners.index')->with('success', 'Practitioner added.');
+    }
+
+    public function edit(Request $request, Practitioner $practitioner): View
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $this->authorizeOwner($request, $practitioner);
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        return view('care.admin.practitioners.edit', [
+            'practitioner' => $practitioner,
+            'branches' => $this->activeBranches($owner, $organization->id),
+            'departments' => $this->activeDepartments($owner, $organization->id),
+            'members' => $this->linkableMembers($owner, $organization->id),
+        ]);
+    }
+
+    public function update(Request $request, Practitioner $practitioner): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $this->authorizeOwner($request, $practitioner);
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        $validated = $this->validated($request, $owner, $organization->id);
+
+        $member = ! empty($validated['member_id'])
+            ? Member::owned($owner)->where('organization_id', $organization->id)->findOrFail($validated['member_id'])
+            : null;
+
+        $practitioner->update([
+            'branch_id' => $validated['branch_id'] ?? null,
+            'department_id' => $validated['department_id'] ?? null,
+            'member_id' => $member?->id,
+            'user_ref' => $member?->user_ref,
+            'name' => $validated['name'],
+            'specialty' => $validated['specialty'] ?? null,
+            'is_active' => $request->boolean('is_active', true),
+        ]);
+
+        AuditLogger::record($owner, 'practitioner.updated', $organization->id, $owner, Practitioner::class, $practitioner->id);
+
+        return redirect()->route('care.practitioners.index')->with('success', 'Practitioner updated.');
+    }
+
+    public function destroy(Request $request, Practitioner $practitioner): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $this->authorizeOwner($request, $practitioner);
+
+        $id = $practitioner->id;
+        $organizationId = $practitioner->organization_id;
+        $practitioner->delete();
+
+        AuditLogger::record($this->ownerRef($request), 'practitioner.deleted', $organizationId, $this->ownerRef($request), Practitioner::class, $id);
+
+        return redirect()->route('care.practitioners.index')->with('success', 'Practitioner removed.');
+    }
+
+    /**
+     * @return array{name: string, specialty?: string|null, branch_id?: int|null, department_id?: int|null, member_id?: int|null}
+     */
+    protected function validated(Request $request, string $owner, int $organizationId): array
+    {
+        $validated = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'specialty' => ['nullable', 'string', 'max:255'],
+            'branch_id' => ['nullable', 'integer', 'exists:care_branches,id'],
+            'department_id' => ['nullable', 'integer', 'exists:care_departments,id'],
+            'member_id' => ['nullable', 'integer', 'exists:care_members,id'],
+        ]);
+
+        if (! empty($validated['branch_id'])) {
+            $branch = Branch::owned($owner)->findOrFail($validated['branch_id']);
+            abort_unless($branch->organization_id === $organizationId, 404);
+        }
+
+        if (! empty($validated['department_id'])) {
+            $department = Department::owned($owner)->with('branch')->findOrFail($validated['department_id']);
+            abort_unless($department->branch?->organization_id === $organizationId, 404);
+        }
+
+        return $validated;
+    }
+
+    protected function activeBranches(string $owner, int $organizationId)
+    {
+        return Branch::owned($owner)
+            ->where('organization_id', $organizationId)
+            ->where('is_active', true)
+            ->orderBy('name')
+            ->get();
+    }
+
+    protected function activeDepartments(string $owner, int $organizationId)
+    {
+        return Department::owned($owner)
+            ->whereHas('branch', fn ($q) => $q->where('organization_id', $organizationId))
+            ->where('is_active', true)
+            ->orderBy('name')
+            ->get();
+    }
+
+    protected function linkableMembers(string $owner, int $organizationId)
+    {
+        return Member::owned($owner)
+            ->where('organization_id', $organizationId)
+            ->whereIn('role', ['doctor', 'nurse', 'lab_technician', 'pharmacist', 'hospital_admin', 'super_admin'])
+            ->orderBy('user_ref')
+            ->get();
+    }
+}