Add practitioners admin and staff-scoped Care UX.

Hospital admins can manage assignable doctors and invite team members from Ladill mailboxes; invited staff only see Care tools they need. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-14 21:59:39 +00:00
parent 898275ec05
commit 3a7bd14b2b
19 changed files with 684 additions and 18 deletions
@@ -284,7 +284,10 @@ class SsoLoginController extends Controller
    private function resolveLanding(IdentityTeamClient $identity, User $user, string $intended): string
    {
        try {
-            return $identity->postAuthRedirect($user->ownerRef(), $intended);
+            $access = $identity->appAccess($user->ownerRef(), $intended);
+            \App\Support\StaffUx::remember($access);
+
+            return $access['url'] !== '' ? $access['url'] : $intended;
        } catch (\Throwable) {
            return $intended;
        }
@@ -6,10 +6,12 @@ use App\Http\Controllers\Controller;
 use App\Http\Controllers\Care\Concerns\ScopesToAccount;
 use App\Models\Branch;
 use App\Models\Member;
+use App\Models\Practitioner;
 use App\Services\Care\AuditLogger;
 use App\Services\Identity\IdentityTeamClient;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Str;
 use Illuminate\View\View;

 class MemberController extends Controller
@@ -43,21 +45,30 @@ class MemberController extends Controller
        ]);
    }

-    public function create(Request $request): View
+    public function create(Request $request, IdentityTeamClient $identity): View
    {
        $this->authorizeAbility($request, 'admin.members.manage');
        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);

-        $branches = Branch::owned($this->ownerRef($request))
+        $branches = Branch::owned($owner)
            ->where('organization_id', $organization->id)
            ->where('is_active', true)
            ->orderBy('name')
            ->get();

+        $mailboxOptions = [];
+        try {
+            $mailboxOptions = $identity->mailboxOptions($owner);
+        } catch (\Throwable) {
+            // Identity optional for form rendering.
+        }
+
        return view('care.admin.members.create', [
            'organization' => $organization,
            'branches' => $branches,
            'roles' => config('care.roles'),
+            'mailboxOptions' => $mailboxOptions,
        ]);
    }

@@ -71,6 +82,9 @@ class MemberController extends Controller
            'email' => ['required', 'email', 'max:255'],
            'role' => ['required', 'string', 'in:'.implode(',', array_keys(config('care.roles')))],
            'branch_id' => ['nullable', 'integer', 'exists:care_branches,id'],
+            'create_practitioner' => ['sometimes', 'boolean'],
+            'practitioner_name' => ['nullable', 'string', 'max:255'],
+            'specialty' => ['nullable', 'string', 'max:255'],
        ]);

        $email = strtolower(trim($validated['email']));
@@ -106,6 +120,25 @@ class MemberController extends Controller

        AuditLogger::record($owner, 'member.invited', $organization->id, $owner, Member::class, $member->id);

+        $createPractitioner = $request->boolean('create_practitioner', $validated['role'] === 'doctor');
+        if ($createPractitioner) {
+            $name = trim((string) ($validated['practitioner_name'] ?? '')) ?: Str::headline(Str::before($email, '@'));
+            Practitioner::query()->firstOrCreate(
+                [
+                    'organization_id' => $organization->id,
+                    'member_id' => $member->id,
+                ],
+                [
+                    'owner_ref' => $owner,
+                    'branch_id' => $validated['branch_id'] ?? null,
+                    'user_ref' => $email,
+                    'name' => $name,
+                    'specialty' => $validated['specialty'] ?? null,
+                    'is_active' => true,
+                ],
+            );
+        }
+
        return redirect()->route('care.members.index')->with('success', 'Invitation sent to '.$email.'.');
    }

@@ -0,0 +1,195 @@
+<?php
+
+namespace App\Http\Controllers\Care;
+
+use App\Http\Controllers\Controller;
+use App\Http\Controllers\Care\Concerns\ScopesToAccount;
+use App\Models\Branch;
+use App\Models\Department;
+use App\Models\Member;
+use App\Models\Practitioner;
+use App\Services\Care\AuditLogger;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+class PractitionerController extends Controller
+{
+    use ScopesToAccount;
+
+    public function index(Request $request): View
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.view');
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        $practitioners = Practitioner::owned($owner)
+            ->where('organization_id', $organization->id)
+            ->with(['branch', 'department', 'member'])
+            ->orderBy('name')
+            ->get();
+
+        return view('care.admin.practitioners.index', [
+            'practitioners' => $practitioners,
+            'organization' => $organization,
+            'heroStats' => [
+                'total' => $practitioners->count(),
+                'active' => $practitioners->where('is_active', true)->count(),
+                'linked' => $practitioners->whereNotNull('member_id')->count(),
+            ],
+        ]);
+    }
+
+    public function create(Request $request): View
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        return view('care.admin.practitioners.create', [
+            'organization' => $organization,
+            'branches' => $this->activeBranches($owner, $organization->id),
+            'departments' => $this->activeDepartments($owner, $organization->id),
+            'members' => $this->linkableMembers($owner, $organization->id),
+        ]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        $validated = $this->validated($request, $owner, $organization->id);
+
+        $member = ! empty($validated['member_id'])
+            ? Member::owned($owner)->where('organization_id', $organization->id)->findOrFail($validated['member_id'])
+            : null;
+
+        $practitioner = Practitioner::create([
+            'owner_ref' => $owner,
+            'organization_id' => $organization->id,
+            'branch_id' => $validated['branch_id'] ?? null,
+            'department_id' => $validated['department_id'] ?? null,
+            'member_id' => $member?->id,
+            'user_ref' => $member?->user_ref,
+            'name' => $validated['name'],
+            'specialty' => $validated['specialty'] ?? null,
+            'is_active' => true,
+        ]);
+
+        AuditLogger::record($owner, 'practitioner.created', $organization->id, $owner, Practitioner::class, $practitioner->id);
+
+        return redirect()->route('care.practitioners.index')->with('success', 'Practitioner added.');
+    }
+
+    public function edit(Request $request, Practitioner $practitioner): View
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $this->authorizeOwner($request, $practitioner);
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        return view('care.admin.practitioners.edit', [
+            'practitioner' => $practitioner,
+            'branches' => $this->activeBranches($owner, $organization->id),
+            'departments' => $this->activeDepartments($owner, $organization->id),
+            'members' => $this->linkableMembers($owner, $organization->id),
+        ]);
+    }
+
+    public function update(Request $request, Practitioner $practitioner): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $this->authorizeOwner($request, $practitioner);
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        $validated = $this->validated($request, $owner, $organization->id);
+
+        $member = ! empty($validated['member_id'])
+            ? Member::owned($owner)->where('organization_id', $organization->id)->findOrFail($validated['member_id'])
+            : null;
+
+        $practitioner->update([
+            'branch_id' => $validated['branch_id'] ?? null,
+            'department_id' => $validated['department_id'] ?? null,
+            'member_id' => $member?->id,
+            'user_ref' => $member?->user_ref,
+            'name' => $validated['name'],
+            'specialty' => $validated['specialty'] ?? null,
+            'is_active' => $request->boolean('is_active', true),
+        ]);
+
+        AuditLogger::record($owner, 'practitioner.updated', $organization->id, $owner, Practitioner::class, $practitioner->id);
+
+        return redirect()->route('care.practitioners.index')->with('success', 'Practitioner updated.');
+    }
+
+    public function destroy(Request $request, Practitioner $practitioner): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'admin.practitioners.manage');
+        $this->authorizeOwner($request, $practitioner);
+
+        $id = $practitioner->id;
+        $organizationId = $practitioner->organization_id;
+        $practitioner->delete();
+
+        AuditLogger::record($this->ownerRef($request), 'practitioner.deleted', $organizationId, $this->ownerRef($request), Practitioner::class, $id);
+
+        return redirect()->route('care.practitioners.index')->with('success', 'Practitioner removed.');
+    }
+
+    /**
+     * @return array{name: string, specialty?: string|null, branch_id?: int|null, department_id?: int|null, member_id?: int|null}
+     */
+    protected function validated(Request $request, string $owner, int $organizationId): array
+    {
+        $validated = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'specialty' => ['nullable', 'string', 'max:255'],
+            'branch_id' => ['nullable', 'integer', 'exists:care_branches,id'],
+            'department_id' => ['nullable', 'integer', 'exists:care_departments,id'],
+            'member_id' => ['nullable', 'integer', 'exists:care_members,id'],
+        ]);
+
+        if (! empty($validated['branch_id'])) {
+            $branch = Branch::owned($owner)->findOrFail($validated['branch_id']);
+            abort_unless($branch->organization_id === $organizationId, 404);
+        }
+
+        if (! empty($validated['department_id'])) {
+            $department = Department::owned($owner)->with('branch')->findOrFail($validated['department_id']);
+            abort_unless($department->branch?->organization_id === $organizationId, 404);
+        }
+
+        return $validated;
+    }
+
+    protected function activeBranches(string $owner, int $organizationId)
+    {
+        return Branch::owned($owner)
+            ->where('organization_id', $organizationId)
+            ->where('is_active', true)
+            ->orderBy('name')
+            ->get();
+    }
+
+    protected function activeDepartments(string $owner, int $organizationId)
+    {
+        return Department::owned($owner)
+            ->whereHas('branch', fn ($q) => $q->where('organization_id', $organizationId))
+            ->where('is_active', true)
+            ->orderBy('name')
+            ->get();
+    }
+
+    protected function linkableMembers(string $owner, int $organizationId)
+    {
+        return Member::owned($owner)
+            ->where('organization_id', $organizationId)
+            ->whereIn('role', ['doctor', 'nurse', 'lab_technician', 'pharmacist', 'hospital_admin', 'super_admin'])
+            ->orderBy('user_ref')
+            ->get();
+    }
+}
@@ -52,5 +52,20 @@ class AppServiceProvider extends ServiceProvider
        View::composer(['partials.topbar'], function ($view) {
            $view->with(\App\Support\MobileTopbar::resolve());
        });
+
+        View::composer(['partials.launcher', 'partials.topbar-desktop-widgets', 'components.app-layout'], function () {
+            $user = auth()->user();
+            if (! $user || session()->has(\App\Support\StaffUx::SESSION_KEY)) {
+                return;
+            }
+
+            try {
+                $access = app(\App\Services\Identity\IdentityTeamClient::class)
+                    ->appAccess($user->ownerRef());
+                \App\Support\StaffUx::remember($access);
+            } catch (\Throwable) {
+                // Leave fail-open defaults until Identity is available.
+            }
+        });
    }
 }
@@ -45,6 +45,7 @@ class CarePermissions
    protected array $adminAbilities = [
        'admin.branches.view', 'admin.branches.manage',
        'admin.departments.view', 'admin.departments.manage',
+        'admin.practitioners.view', 'admin.practitioners.manage',
        'admin.members.view', 'admin.members.manage',
        'settings.view', 'settings.manage',
        'audit.view', 'audit.export',
@@ -32,14 +32,40 @@ class IdentityTeamClient
        return (array) $response->json('data', []);
    }

+    /**
+     * @return array{url: string, apps: list<string>, full_access: bool, show_hub: bool, show_billing: bool}
+     */
+    public function appAccess(string $userPublicId, string $intendedUrl = ''): array
+    {
+        $response = $this->request('get', '/identity/team/post-auth-redirect', array_filter([
+            'user' => $userPublicId,
+            'redirect' => $intendedUrl !== '' ? $intendedUrl : null,
+        ]));
+
+        $data = (array) $response->json('data', []);
+
+        return [
+            'url' => (string) ($data['url'] ?? $intendedUrl),
+            'apps' => array_values(array_map('strval', (array) ($data['apps'] ?? []))),
+            'full_access' => (bool) ($data['full_access'] ?? false),
+            'show_hub' => (bool) ($data['show_hub'] ?? ($data['full_access'] ?? false)),
+            'show_billing' => (bool) ($data['show_billing'] ?? ($data['full_access'] ?? false)),
+        ];
+    }
+
    public function postAuthRedirect(string $userPublicId, string $intendedUrl): string
    {
-        $response = $this->request('get', '/identity/team/post-auth-redirect', [
-            'user' => $userPublicId,
-            'redirect' => $intendedUrl,
+        return $this->appAccess($userPublicId, $intendedUrl)['url'];
+    }
+
+    /** @return list<string> */
+    public function mailboxOptions(string $ownerPublicId): array
+    {
+        $response = $this->request('get', '/identity/team/mailbox-options', [
+            'owner' => $ownerPublicId,
        ]);

-        return (string) $response->json('data.url', $intendedUrl);
+        return array_values(array_map('strval', (array) $response->json('data', [])));
    }

    /** @return list<array<string, mixed>> */
@@ -0,0 +1,119 @@
+<?php
+
+namespace App\Support;
+
+use Illuminate\Contracts\Auth\Authenticatable;
+
+/**
+ * Staff vs account-owner UX: team members are limited to the apps they were
+ * invited to. Single-app staff skip Home/launcher; all scoped staff hide
+ * Billing/Wallet (the account owner pays).
+ *
+ * In Care/Meet/etc., values are cached at SSO via Identity (StaffUx::remember).
+ * In the monolith, TeamAccessService resolves them live when available.
+ */
+class StaffUx
+{
+    public const SESSION_KEY = 'ladill.staff_ux';
+
+    public static function showProductHub(?Authenticatable $user = null): bool
+    {
+        $user ??= auth()->user();
+        if (! $user) {
+            return false;
+        }
+
+        if ($resolved = self::fromTeamAccess($user)) {
+            return $resolved['show_hub'];
+        }
+
+        $cached = session(self::SESSION_KEY);
+        if (is_array($cached) && array_key_exists('show_hub', $cached)) {
+            return (bool) $cached['show_hub'];
+        }
+
+        // Unknown in a silo before SSO cache — assume owner (fail open for hub).
+        return true;
+    }
+
+    public static function showBilling(?Authenticatable $user = null): bool
+    {
+        $user ??= auth()->user();
+        if (! $user) {
+            return false;
+        }
+
+        if ($resolved = self::fromTeamAccess($user)) {
+            return $resolved['show_billing'];
+        }
+
+        $cached = session(self::SESSION_KEY);
+        if (is_array($cached) && array_key_exists('show_billing', $cached)) {
+            return (bool) $cached['show_billing'];
+        }
+
+        return true;
+    }
+
+    /** @return list<string>|null Null means unrestricted / unknown. */
+    public static function allowedAppSlugs(?Authenticatable $user = null): ?array
+    {
+        $user ??= auth()->user();
+        if (! $user) {
+            return [];
+        }
+
+        if ($resolved = self::fromTeamAccess($user)) {
+            return $resolved['full_access'] ? null : $resolved['apps'];
+        }
+
+        $cached = session(self::SESSION_KEY);
+        if (is_array($cached)) {
+            if (! empty($cached['full_access'])) {
+                return null;
+            }
+            if (array_key_exists('apps', $cached) && is_array($cached['apps'])) {
+                return array_values(array_map('strval', $cached['apps']));
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * @param  array{full_access?: bool, apps?: list<string>, show_hub?: bool, show_billing?: bool}  $payload
+     */
+    public static function remember(array $payload): void
+    {
+        session([self::SESSION_KEY => [
+            'full_access' => (bool) ($payload['full_access'] ?? false),
+            'apps' => array_values(array_map('strval', (array) ($payload['apps'] ?? []))),
+            'show_hub' => (bool) ($payload['show_hub'] ?? false),
+            'show_billing' => (bool) ($payload['show_billing'] ?? false),
+        ]]);
+    }
+
+    /** @return array{full_access: bool, apps: list<string>, show_hub: bool, show_billing: bool}|null */
+    private static function fromTeamAccess(Authenticatable $user): ?array
+    {
+        $service = 'App\\Services\\Team\\TeamAccessService';
+        $userClass = 'App\\Models\\User';
+
+        if (! class_exists($service) || ! is_a($user, $userClass)) {
+            return null;
+        }
+
+        try {
+            $access = app($service);
+
+            return [
+                'full_access' => $access->hasFullProductAccess($user),
+                'apps' => $access->accessibleAppSlugs($user),
+                'show_hub' => $access->showProductHub($user),
+                'show_billing' => $access->showBilling($user),
+            ];
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+}
@@ -21,15 +21,25 @@ class UserProfileMenu
            return [];
        }

+        $showHub = StaffUx::showProductHub($user);
+        $showBilling = StaffUx::showBilling($user);
        $items = [];

        foreach ([
-            ['label' => 'Home', 'path' => '', 'host' => 'home'],
+            ['label' => 'Home', 'path' => '', 'host' => 'home', 'requires_hub' => true],
            ['label' => 'Profile', 'path' => 'profile'],
            ['label' => 'Account Settings', 'path' => 'account-settings'],
            ['label' => 'Dashboard', 'path' => 'dashboard'],
-            ['label' => 'Billing', 'path' => 'billing'],
+            ['label' => 'Billing', 'path' => 'billing', 'requires_billing' => true],
        ] as $link) {
+            if (! empty($link['requires_hub']) && ! $showHub) {
+                continue;
+            }
+
+            if (! empty($link['requires_billing']) && ! $showBilling) {
+                continue;
+            }
+
            $href = self::platformUrl($link['host'] ?? 'account', $link['path']);

            if (self::isCurrentMenuLink($link, $href)) {
@@ -43,7 +53,7 @@ class UserProfileMenu
            ];
        }

-        if (Route::has((string) config('billing.wallet_balance_route', 'wallet.balance'))) {
+        if ($showBilling && Route::has((string) config('billing.wallet_balance_route', 'wallet.balance'))) {
            $items[] = ['type' => 'wallet'];
        }

@@ -34,9 +34,13 @@ return [
        'department.created' => 'Department created',
        'department.updated' => 'Department updated',
        'department.deleted' => 'Department deleted',
+        'practitioner.created' => 'Practitioner added',
+        'practitioner.updated' => 'Practitioner updated',
+        'practitioner.deleted' => 'Practitioner removed',
        'member.created' => 'Member added',
        'member.updated' => 'Member updated',
        'member.deleted' => 'Member removed',
+        'member.invited' => 'Member invited',
        'patient.created' => 'Patient registered',
        'patient.updated' => 'Patient record updated',
        'patient.deleted' => 'Patient record archived',
@@ -1,13 +1,28 @@
 <x-app-layout title="Add member">
    <div class="mx-auto max-w-lg">
        <h1 class="text-xl font-semibold text-slate-900">Invite team member</h1>
+        <p class="mt-1 text-sm text-slate-500">They get access only to Ladill Care (plus Mail if they already have a Ladill mailbox).</p>

-        <form method="POST" action="{{ route('care.members.store') }}" class="mt-6 space-y-4 rounded-2xl border border-slate-200 bg-white p-6">
+        <form method="POST" action="{{ route('care.members.store') }}" class="mt-6 space-y-4 rounded-2xl border border-slate-200 bg-white p-6" x-data="{ role: '{{ old('role', 'doctor') }}' }">
            @csrf

+            @if (! empty($mailboxOptions))
+                <div>
+                    <label class="block text-sm font-medium text-slate-700">From a Ladill mailbox</label>
+                    <select x-on:change="if ($event.target.value) { $refs.email.value = $event.target.value }"
+                            class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+                        <option value="">Choose a mailbox…</option>
+                        @foreach ($mailboxOptions as $address)
+                            <option value="{{ $address }}">{{ $address }}</option>
+                        @endforeach
+                    </select>
+                    <p class="mt-1 text-xs text-slate-500">Or type any email below.</p>
+                </div>
+            @endif
+
            <div>
                <label class="block text-sm font-medium text-slate-700">Email address</label>
-                <input type="email" name="email" value="{{ old('email') }}" required
+                <input type="email" name="email" value="{{ old('email') }}" required x-ref="email"
                       class="mt-1 w-full rounded-lg border-slate-300 text-sm"
                       placeholder="colleague@company.com">
                <p class="mt-1 text-xs text-slate-500">They will receive an email to accept and join your Care organization.</p>
@@ -18,9 +33,9 @@

            <div>
                <label class="block text-sm font-medium text-slate-700">Role</label>
-                <select name="role" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+                <select name="role" x-model="role" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
                    @foreach ($roles as $value => $label)
-                        <option value="{{ $value }}" @selected(old('role') === $value)>{{ $label }}</option>
+                        <option value="{{ $value }}" @selected(old('role', 'doctor') === $value)>{{ $label }}</option>
                    @endforeach
                </select>
            </div>
@@ -35,6 +50,28 @@
                </select>
            </div>

+            <div class="rounded-xl border border-slate-100 bg-slate-50 p-4" x-show="role === 'doctor'" x-cloak>
+                <label class="flex items-start gap-2 text-sm">
+                    <input type="checkbox" name="create_practitioner" value="1" class="mt-0.5" @checked(old('create_practitioner', true))>
+                    <span>
+                        <span class="font-medium text-slate-800">Also add as practitioner</span>
+                        <span class="mt-0.5 block text-xs text-slate-500">So they appear on appointments and the clinical queue.</span>
+                    </span>
+                </label>
+                <div class="mt-3 space-y-3">
+                    <div>
+                        <label class="block text-xs font-medium text-slate-600">Display name</label>
+                        <input type="text" name="practitioner_name" value="{{ old('practitioner_name') }}"
+                               class="mt-1 w-full rounded-lg border-slate-300 text-sm" placeholder="Dr. Ama Mensah">
+                    </div>
+                    <div>
+                        <label class="block text-xs font-medium text-slate-600">Specialty (optional)</label>
+                        <input type="text" name="specialty" value="{{ old('specialty') }}"
+                               class="mt-1 w-full rounded-lg border-slate-300 text-sm" placeholder="General practice">
+                    </div>
+                </div>
+            </div>
+
            <button type="submit" class="btn-primary">Send invitation</button>
        </form>
    </div>
@@ -0,0 +1,50 @@
+<x-app-layout title="Add practitioner">
+    <div class="mx-auto max-w-lg">
+        <h1 class="text-xl font-semibold text-slate-900">Add practitioner</h1>
+        <p class="mt-1 text-sm text-slate-500">Creates a clinical listing for bookings. Invite them under Team if they also need to sign in.</p>
+
+        <form method="POST" action="{{ route('care.practitioners.store') }}" class="mt-6 space-y-4 rounded-2xl border border-slate-200 bg-white p-6">
+            @csrf
+            <div>
+                <label class="block text-sm font-medium">Name</label>
+                <input type="text" name="name" value="{{ old('name') }}" required class="mt-1 w-full rounded-lg border-slate-300 text-sm" placeholder="Dr. Ama Mensah">
+                @error('name')<p class="mt-1 text-sm text-red-600">{{ $message }}</p>@enderror
+            </div>
+            <div>
+                <label class="block text-sm font-medium">Specialty (optional)</label>
+                <input type="text" name="specialty" value="{{ old('specialty') }}" class="mt-1 w-full rounded-lg border-slate-300 text-sm" placeholder="General practice">
+            </div>
+            <div>
+                <label class="block text-sm font-medium">Branch (optional)</label>
+                <select name="branch_id" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+                    <option value="">All branches</option>
+                    @foreach ($branches as $branch)
+                        <option value="{{ $branch->id }}" @selected(old('branch_id') == $branch->id)>{{ $branch->name }}</option>
+                    @endforeach
+                </select>
+            </div>
+            <div>
+                <label class="block text-sm font-medium">Department (optional)</label>
+                <select name="department_id" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+                    <option value="">None</option>
+                    @foreach ($departments as $department)
+                        <option value="{{ $department->id }}" @selected(old('department_id') == $department->id)>{{ $department->name }}</option>
+                    @endforeach
+                </select>
+            </div>
+            <div>
+                <label class="block text-sm font-medium">Link team member (optional)</label>
+                <select name="member_id" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+                    <option value="">No login linked</option>
+                    @foreach ($members as $member)
+                        <option value="{{ $member->id }}" @selected(old('member_id') == $member->id)>
+                            {{ $member->user_ref }} · {{ config('care.roles.'.$member->role, $member->role) }}
+                        </option>
+                    @endforeach
+                </select>
+                <p class="mt-1 text-xs text-slate-500">Link after inviting them under Administration → Team.</p>
+            </div>
+            <button type="submit" class="btn-primary w-full">Save</button>
+        </form>
+    </div>
+</x-app-layout>
@@ -0,0 +1,59 @@
+<x-app-layout title="Edit practitioner">
+    <div class="mx-auto max-w-lg">
+        <h1 class="text-xl font-semibold text-slate-900">Edit practitioner</h1>
+
+        <form method="POST" action="{{ route('care.practitioners.update', $practitioner) }}" class="mt-6 space-y-4 rounded-2xl border border-slate-200 bg-white p-6">
+            @csrf
+            @method('PUT')
+            <div>
+                <label class="block text-sm font-medium">Name</label>
+                <input type="text" name="name" value="{{ old('name', $practitioner->name) }}" required class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+            </div>
+            <div>
+                <label class="block text-sm font-medium">Specialty (optional)</label>
+                <input type="text" name="specialty" value="{{ old('specialty', $practitioner->specialty) }}" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+            </div>
+            <div>
+                <label class="block text-sm font-medium">Branch (optional)</label>
+                <select name="branch_id" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+                    <option value="">All branches</option>
+                    @foreach ($branches as $branch)
+                        <option value="{{ $branch->id }}" @selected(old('branch_id', $practitioner->branch_id) == $branch->id)>{{ $branch->name }}</option>
+                    @endforeach
+                </select>
+            </div>
+            <div>
+                <label class="block text-sm font-medium">Department (optional)</label>
+                <select name="department_id" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+                    <option value="">None</option>
+                    @foreach ($departments as $department)
+                        <option value="{{ $department->id }}" @selected(old('department_id', $practitioner->department_id) == $department->id)>{{ $department->name }}</option>
+                    @endforeach
+                </select>
+            </div>
+            <div>
+                <label class="block text-sm font-medium">Link team member (optional)</label>
+                <select name="member_id" class="mt-1 w-full rounded-lg border-slate-300 text-sm">
+                    <option value="">No login linked</option>
+                    @foreach ($members as $member)
+                        <option value="{{ $member->id }}" @selected(old('member_id', $practitioner->member_id) == $member->id)>
+                            {{ $member->user_ref }} · {{ config('care.roles.'.$member->role, $member->role) }}
+                        </option>
+                    @endforeach
+                </select>
+            </div>
+            <label class="flex items-center gap-2 text-sm">
+                <input type="checkbox" name="is_active" value="1" @checked(old('is_active', $practitioner->is_active))>
+                Active
+            </label>
+            <button type="submit" class="btn-primary w-full">Save changes</button>
+        </form>
+
+        <form method="POST" action="{{ route('care.practitioners.destroy', $practitioner) }}" class="mt-4"
+              onsubmit="return confirm('Remove this practitioner from Care? Existing appointments keep their history.')">
+            @csrf
+            @method('DELETE')
+            <button type="submit" class="btn-secondary w-full text-rose-700">Remove practitioner</button>
+        </form>
+    </div>
+</x-app-layout>
@@ -0,0 +1,60 @@
+<x-app-layout title="Practitioners">
+    <div class="space-y-6">
+        <x-care.page-hero
+            badge="Doctors · Clinicians"
+            title="Practitioners"
+            description="People who can be assigned on appointments, the clinical queue, consultations, and prescriptions. Link a team member so they can also sign in."
+            :stats="[
+                ['value' => number_format($heroStats['total']), 'label' => 'Practitioners'],
+                ['value' => number_format($heroStats['active']), 'label' => 'Active'],
+                ['value' => number_format($heroStats['linked']), 'label' => 'Linked to team'],
+            ]">
+            <x-slot name="actions">
+                <a href="{{ route('care.practitioners.create') }}" class="btn-primary">Add practitioner</a>
+            </x-slot>
+        </x-care.page-hero>
+
+        @if (session('success'))
+            <p class="rounded-lg bg-emerald-50 px-3 py-2 text-sm text-emerald-800">{{ session('success') }}</p>
+        @endif
+
+        <div class="overflow-hidden rounded-2xl border border-slate-200 bg-white">
+            <table class="min-w-full text-sm">
+                <thead class="bg-slate-50 text-left text-xs uppercase text-slate-500">
+                    <tr>
+                        <th class="px-4 py-3">Name</th>
+                        <th class="px-4 py-3">Specialty</th>
+                        <th class="px-4 py-3">Branch</th>
+                        <th class="px-4 py-3">Team login</th>
+                        <th class="px-4 py-3">Status</th>
+                        <th class="px-4 py-3"></th>
+                    </tr>
+                </thead>
+                <tbody class="divide-y divide-slate-50">
+                    @forelse ($practitioners as $practitioner)
+                        <tr>
+                            <td class="px-4 py-3 font-medium">{{ $practitioner->name }}</td>
+                            <td class="px-4 py-3">{{ $practitioner->specialty ?: '—' }}</td>
+                            <td class="px-4 py-3">{{ $practitioner->branch?->name ?? 'All branches' }}</td>
+                            <td class="px-4 py-3">{{ $practitioner->member?->user_ref ?? '—' }}</td>
+                            <td class="px-4 py-3">
+                                <span class="inline-flex rounded-full px-2 py-0.5 text-xs font-medium {{ $practitioner->is_active ? 'bg-emerald-50 text-emerald-700' : 'bg-slate-100 text-slate-600' }}">
+                                    {{ $practitioner->is_active ? 'Active' : 'Inactive' }}
+                                </span>
+                            </td>
+                            <td class="px-4 py-3 text-right">
+                                <a href="{{ route('care.practitioners.edit', $practitioner) }}" class="text-sky-600">Edit</a>
+                            </td>
+                        </tr>
+                    @empty
+                        <tr>
+                            <td colspan="6" class="px-4 py-6 text-center text-slate-500">
+                                No practitioners yet. Add doctors here so they appear on appointments and the queue.
+                            </td>
+                        </tr>
+                    @endforelse
+                </tbody>
+            </table>
+        </div>
+    </div>
+</x-app-layout>
@@ -2,17 +2,59 @@
    // Shared Ladill app launcher — IDENTICAL across every app/service.
    // Driven by config/ladill_launcher.php (fully-extracted apps only) + icons
    // from public/images/launcher-icons/. Omits the current app (matched by
-    // APP_URL host). To replicate elsewhere, copy this file + the config +
-    // the launcher-icons folder verbatim.
+    // APP_URL host). Scoped team members only see apps they can access; the
+    // launcher is hidden entirely when they only have one app (or none).
    $sidebar = (bool) ($sidebar ?? false);
    $selfHost = parse_url((string) config('app.url'), PHP_URL_HOST);
+    $allowedSlugs = \App\Support\StaffUx::allowedAppSlugs(auth()->user());
    $launcherApps = array_values(array_filter(
        config('ladill_launcher.apps', []),
-        fn (array $app) => parse_url($app['url'], PHP_URL_HOST) !== $selfHost
+        function (array $app) use ($selfHost, $allowedSlugs) {
+            if (parse_url($app['url'], PHP_URL_HOST) === $selfHost) {
+                return false;
+            }
+
+            if ($allowedSlugs === null) {
+                return true;
+            }
+
+            $host = (string) parse_url($app['url'], PHP_URL_HOST);
+            $root = (string) config('app.platform_domain', 'ladill.com');
+            $suffix = '.'.$root;
+            if (! str_ends_with($host, $suffix)) {
+                return false;
+            }
+            $sub = substr($host, 0, -strlen($suffix));
+
+            foreach ($allowedSlugs as $slug) {
+                if ($slug === $sub || str_starts_with($sub, $slug)) {
+                    return true;
+                }
+            }
+
+            // Launcher URLs may use marketing hostnames — match by known slug keys.
+            $slug = match (true) {
+                str_starts_with($host, 'care.') => 'care',
+                str_starts_with($host, 'meet.') => 'meet',
+                str_starts_with($host, 'queue.') => 'queue',
+                str_starts_with($host, 'frontdesk.') => 'frontdesk',
+                str_starts_with($host, 'mail.') => 'mail',
+                str_starts_with($host, 'email.') => 'email',
+                default => explode('.', $host)[0] ?? null,
+            };
+
+            return $slug && in_array($slug, $allowedSlugs, true);
+        }
    ));
+
+    // Single-app staff: no launcher (they already are in their only app).
+    if ($allowedSlugs !== null && count($allowedSlugs) <= 1) {
+        $launcherApps = [];
+    }
+
    $launcherOverflows = count($launcherApps) > 15;
@endphp
-@if (! empty($launcherApps))
+@if (! empty($launcherApps) && \App\Support\StaffUx::showProductHub(auth()->user()))
 <div class="relative" x-data="{
    appsOpen: false,
    showScrollMore: {{ $launcherOverflows ? 'true' : 'false' }},
@@ -69,6 +69,10 @@
            $adminNav[] = ['name' => 'Departments', 'route' => route('care.departments.index'), 'active' => request()->routeIs('care.departments.*'),
             'icon' => '<path stroke-linecap="round" stroke-linejoin="round" d="M3.75 6A2.25 2.25 0 0 1 6 3.75h2.25A2.25 2.25 0 0 1 10.5 6v2.25a2.25 2.25 0 0 1-2.25 2.25H6a2.25 2.25 0 0 1-2.25-2.25V6ZM3.75 15.75A2.25 2.25 0 0 1 6 13.5h2.25a2.25 2.25 0 0 1 2.25 2.25V18a2.25 2.25 0 0 1-2.25 2.25H6A2.25 2.25 0 0 1 3.75 18v-2.25ZM13.5 6a2.25 2.25 0 0 1 2.25-2.25H18A2.25 2.25 0 0 1 20.25 6v2.25A2.25 2.25 0 0 1 18 10.5h-2.25a2.25 2.25 0 0 1-2.25-2.25V6ZM13.5 15.75a2.25 2.25 0 0 1 2.25-2.25H18a2.25 2.25 0 0 1 2.25 2.25V18A2.25 2.25 0 0 1 18 20.25h-2.25A2.25 2.25 0 0 1 13.5 18v-2.25Z" />'];
        }
+        if ($permissions->can($member, 'admin.practitioners.view')) {
+            $adminNav[] = ['name' => 'Practitioners', 'route' => route('care.practitioners.index'), 'active' => request()->routeIs('care.practitioners.*'),
+             'icon' => '<path stroke-linecap="round" stroke-linejoin="round" d="M15.75 6a3.75 3.75 0 1 1-7.5 0 3.75 3.75 0 0 1 7.5 0ZM4.501 20.118a7.5 7.5 0 0 1 14.998 0A17.933 17.933 0 0 1 12 21.75c-2.676 0-5.216-.584-7.499-1.632Z" />'];
+        }
        if ($permissions->can($member, 'admin.members.view')) {
            $adminNav[] = ['name' => 'Team', 'route' => route('care.members.index'), 'active' => request()->routeIs('care.members.*'),
             'icon' => '<path stroke-linecap="round" stroke-linejoin="round" d="M18 18.72a9.094 9.094 0 0 0 3.741-.479 3 3 0 0 0-4.682-2.72m.94 3.198.001.031c0 .225-.012.447-.037.666A11.944 11.944 0 0 1 12 21c-2.17 0-4.207-.576-5.963-1.584A6.062 6.062 0 0 1 6 18.719m12 0a5.971 5.971 0 0 0-.941-3.197m0 0A5.995 5.995 0 0 0 12 12.75a5.995 5.995 0 0 0-5.058 2.772m0 0a3 3 0 0 0-4.681 2.72 8.986 8.986 0 0 0 3.74.477m.94-3.197a5.971 5.971 0 0 0-.94 3.197M15 6.75a3 3 0 1 1-6 0 3 3 0 0 1 6 0Zm6 3a2.25 2.25 0 1 1-4.5 0 2.25 2.25 0 0 1 4.5 0Zm-13.5 0a2.25 2.25 0 1 1-4.5 0 2.25 2.25 0 0 1 4.5 0Z" />'];
@@ -18,6 +18,7 @@ use App\Http\Controllers\Care\MemberController;
 use App\Http\Controllers\Care\OnboardingController;
 use App\Http\Controllers\Care\PatientController;
 use App\Http\Controllers\Care\PatientMessageController;
+use App\Http\Controllers\Care\PractitionerController;
 use App\Http\Controllers\Care\PrescriptionController;
 use App\Http\Controllers\Care\QueueController;
 use App\Http\Controllers\Care\ProController;
@@ -164,6 +165,13 @@ Route::middleware(['auth', 'platform.session'])->group(function () {
        Route::put('/departments/{department}', [DepartmentController::class, 'update'])->name('care.departments.update');
        Route::delete('/departments/{department}', [DepartmentController::class, 'destroy'])->name('care.departments.destroy');

+        Route::get('/practitioners', [PractitionerController::class, 'index'])->name('care.practitioners.index');
+        Route::get('/practitioners/create', [PractitionerController::class, 'create'])->name('care.practitioners.create');
+        Route::post('/practitioners', [PractitionerController::class, 'store'])->name('care.practitioners.store');
+        Route::get('/practitioners/{practitioner}/edit', [PractitionerController::class, 'edit'])->name('care.practitioners.edit');
+        Route::put('/practitioners/{practitioner}', [PractitionerController::class, 'update'])->name('care.practitioners.update');
+        Route::delete('/practitioners/{practitioner}', [PractitionerController::class, 'destroy'])->name('care.practitioners.destroy');
+
        Route::get('/members', [MemberController::class, 'index'])->name('care.members.index');
        Route::get('/members/create', [MemberController::class, 'create'])->name('care.members.create');
        Route::post('/members', [MemberController::class, 'store'])->name('care.members.store');