Add Lab and Blood Bank manager roles with admin UIs.

Give lab_manager catalog/ops admin access and blood_bank_manager a branch-level stock register plus specialty admin surface, while keeping technicians on clinical queues.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/BloodBankAdminController.php

@@ -0,0 +1,96 @@
+<?php
+
+namespace App\Http\Controllers\Care;
+
+use App\Http\Controllers\Care\Concerns\ScopesToAccount;
+use App\Http\Controllers\Controller;
+use App\Services\Care\BloodBank\BloodBankAnalyticsService;
+use App\Services\Care\BloodBank\BloodBankInventoryService;
+use App\Services\Care\BranchContext;
+use App\Services\Care\CarePermissions;
+use App\Services\Care\SpecialtyModuleService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+class BloodBankAdminController extends Controller
+{
+    use ScopesToAccount;
+
+    public function __construct(
+        protected BloodBankInventoryService $inventory,
+        protected BloodBankAnalyticsService $analytics,
+        protected BranchContext $branchContext,
+    ) {}
+
+    public function index(
+        Request $request,
+        SpecialtyModuleService $modules,
+    ): View {
+        $this->authorizeAbility($request, 'blood_bank.manage');
+        $organization = $this->organization($request);
+        abort_unless($modules->isEnabled($organization, 'blood_bank'), 404);
+
+        $member = $this->member($request);
+        $branches = $this->branchContext->branches($request, $organization, $member);
+        $branchId = $this->branchContext->resolve($request, $organization, $member);
+        $branchScope = $branchId > 0 ? $branchId : null;
+
+        $overview = $this->inventory->adminOverview(
+            $organization,
+            $this->ownerRef($request),
+            $branchScope,
+        );
+
+        $report = $this->analytics->report(
+            $organization,
+            $this->ownerRef($request),
+            $branchScope,
+        );
+
+        return view('care.blood-bank.admin.index', [
+            'organization' => $organization,
+            'branches' => $branches,
+            'branchId' => $branchId,
+            'canSwitchBranch' => $this->branchContext->canSwitch($member),
+            'overview' => $overview,
+            'report' => $report,
+            'isAdmin' => app(CarePermissions::class)->isAdmin($member),
+        ]);
+    }
+
+    public function updateStock(
+        Request $request,
+        SpecialtyModuleService $modules,
+    ): RedirectResponse {
+        $this->authorizeAbility($request, 'blood_bank.manage');
+        $organization = $this->organization($request);
+        abort_unless($modules->isEnabled($organization, 'blood_bank'), 404);
+
+        $member = $this->member($request);
+        $branchId = $this->branchContext->resolve($request, $organization, $member);
+        $branchScope = $branchId > 0 ? $branchId : null;
+
+        $validated = $request->validate([
+            'stock' => ['required', 'array'],
+            'stock.*.product_code' => ['required', 'string', 'max:64'],
+            'stock.*.units_on_hand' => ['required', 'integer', 'min:0', 'max:99999'],
+            'stock.*.reorder_level' => ['required', 'integer', 'min:0', 'max:9999'],
+            'stock.*.notes' => ['nullable', 'string', 'max:2000'],
+        ]);
+
+        $this->inventory->updateStock(
+            $organization,
+            $this->ownerRef($request),
+            $branchScope,
+            array_values($validated['stock']),
+            $this->actorRef($request),
+        );
+
+        return redirect()
+            ->route('care.blood-bank.admin.index', array_filter([
+                'branch_id' => $branchId > 0 ? $branchId : null,
+            ]))
+            ->with('success', 'Blood Bank operational inventory updated.');
+    }
+}

app/Http/Controllers/Care/BloodBankWorkspaceController.php

@@ -8,6 +8,7 @@ use App\Models\SpecialtyClinicalRecord;
 use App\Models\Visit;
 use App\Services\Care\BloodBank\BloodBankAnalyticsService;
 use App\Services\Care\BloodBank\BloodBankWorkflowService;
+use App\Services\Care\CarePermissions;
 use App\Services\Care\SpecialtyClinicalRecordService;
 use App\Services\Care\SpecialtyModuleService;
 use App\Services\Care\SpecialtyShellService;
@@ -38,13 +39,40 @@ class BloodBankWorkspaceController extends Controller
         $this->authorizeBranch($request, (int) $visit->branch_id);
     }
 
+    /**
+     * Doctors use consultations.manage; Blood Bank managers use blood_bank.manage.
+     */
+    protected function authorizeBloodBankClinical(Request $request): void
+    {
+        $permissions = app(CarePermissions::class);
+        $member = $this->member($request);
+        abort_unless(
+            $permissions->can($member, 'blood_bank.manage')
+                || $permissions->can($member, 'consultations.manage'),
+            403,
+        );
+    }
+
+    protected function authorizeBloodBankViewAbility(Request $request): void
+    {
+        $permissions = app(CarePermissions::class);
+        $member = $this->member($request);
+        abort_unless(
+            $permissions->can($member, 'blood_bank.view')
+                || $permissions->can($member, 'blood_bank.manage')
+                || $permissions->can($member, 'consultations.view')
+                || $permissions->can($member, 'consultations.manage'),
+            403,
+        );
+    }
+
     public function setStage(
         Request $request,
         Visit $visit,
         SpecialtyModuleService $modules,
         SpecialtyVisitStageService $stages,
     ): RedirectResponse {
-        $this->authorizeAbility($request, 'consultations.manage');
+        $this->authorizeBloodBankClinical($request);
         $this->assertBloodBankManage($request, $modules);
         $this->assertVisit($request, $visit);
 
@@ -79,7 +107,7 @@ class BloodBankWorkspaceController extends Controller
         SpecialtyShellService $shell,
         BloodBankWorkflowService $workflow,
     ): RedirectResponse {
-        $this->authorizeAbility($request, 'consultations.manage');
+        $this->authorizeBloodBankClinical($request);
         $this->assertBloodBankManage($request, $modules);
         $this->assertVisit($request, $visit);
 
@@ -187,7 +215,7 @@ class BloodBankWorkspaceController extends Controller
         SpecialtyVisitStageService $stages,
         BloodBankWorkflowService $workflow,
     ): RedirectResponse {
-        $this->authorizeAbility($request, 'consultations.manage');
+        $this->authorizeBloodBankClinical($request);
         $this->assertBloodBankManage($request, $modules);
         $this->assertVisit($request, $visit);
 
@@ -271,7 +299,7 @@ class BloodBankWorkspaceController extends Controller
         SpecialtyShellService $shell,
         BloodBankAnalyticsService $analytics,
     ): View {
-        $this->authorizeAbility($request, 'consultations.view');
+        $this->authorizeBloodBankViewAbility($request);
         $this->assertBloodBankAccess($request, $modules);
 
         $organization = $this->organization($request);
@@ -300,7 +328,7 @@ class BloodBankWorkspaceController extends Controller
         SpecialtyModuleService $modules,
         SpecialtyClinicalRecordService $clinical,
     ): View {
-        $this->authorizeAbility($request, 'consultations.view');
+        $this->authorizeBloodBankViewAbility($request);
         $this->assertBloodBankAccess($request, $modules);
         $this->assertVisit($request, $visit);
 

app/Http/Controllers/Care/LabAdminController.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Http\Controllers\Care;
+
+use App\Http\Controllers\Care\Concerns\ScopesToAccount;
+use App\Http\Controllers\Controller;
+use App\Models\InvestigationRequest;
+use App\Models\InvestigationType;
+use App\Services\Care\BranchContext;
+use App\Services\Care\CarePermissions;
+use App\Services\Care\InvestigationService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\View\View;
+
+class LabAdminController extends Controller
+{
+    use ScopesToAccount;
+
+    public function __construct(
+        protected InvestigationService $investigations,
+        protected BranchContext $branchContext,
+    ) {}
+
+    public function index(Request $request): View
+    {
+        $this->authorizeAbility($request, 'lab.catalog.manage');
+        $organization = $this->organization($request);
+        $member = $this->member($request);
+        $owner = $this->ownerRef($request);
+        $branches = $this->branchContext->branches($request, $organization, $member);
+        $branchId = $this->branchContext->resolve($request, $organization, $member);
+        $branchScope = $branchId > 0 ? $branchId : null;
+
+        $catalogCount = InvestigationType::query()
+            ->where('organization_id', $organization->id)
+            ->count();
+
+        $activeCatalogCount = InvestigationType::query()
+            ->where('organization_id', $organization->id)
+            ->where('is_active', true)
+            ->count();
+
+        $queueCounts = InvestigationRequest::owned($owner)
+            ->where('organization_id', $organization->id)
+            ->when($branchScope, fn ($q) => $q->where('branch_id', $branchScope))
+            ->whereIn('status', [
+                InvestigationRequest::STATUS_PENDING,
+                InvestigationRequest::STATUS_SAMPLE_COLLECTED,
+                InvestigationRequest::STATUS_IN_PROGRESS,
+                InvestigationRequest::STATUS_AWAITING_REVIEW,
+            ])
+            ->select('status', DB::raw('count(*) as total'))
+            ->groupBy('status')
+            ->pluck('total', 'status');
+
+        $openQueue = (int) $queueCounts->sum();
+        $queue = $branchScope
+            ? $this->investigations->workQueue($owner, $branchScope)
+            : collect();
+
+        return view('care.lab.admin.index', [
+            'organization' => $organization,
+            'branches' => $branches,
+            'branchId' => $branchId,
+            'canSwitchBranch' => $this->branchContext->canSwitch($member),
+            'catalogCount' => $catalogCount,
+            'activeCatalogCount' => $activeCatalogCount,
+            'openQueue' => $openQueue,
+            'queueCounts' => $queueCounts,
+            'recentQueue' => $queue->take(8),
+            'statuses' => config('care.investigation_statuses'),
+            'isAdmin' => app(CarePermissions::class)->isAdmin($member),
+        ]);
+    }
+}

app/Http/Controllers/Care/MemberController.php

@@ -31,7 +31,7 @@ class MemberController extends Controller
             ->get();
 
         $adminRoles = ['super_admin', 'hospital_admin'];
-        $clinicalRoles = ['doctor', 'nurse', 'lab_technician', 'pharmacist'];
+        $clinicalRoles = ['doctor', 'nurse', 'lab_technician', 'lab_manager', 'pharmacist', 'blood_bank_manager'];
 
         $heroStats = [
             'total' => $members->count(),

app/Http/Controllers/Care/PractitionerController.php

@@ -210,7 +210,7 @@ class PractitionerController extends Controller
     {
         return Member::owned($owner)
             ->where('organization_id', $organizationId)
-            ->whereIn('role', ['doctor', 'nurse', 'lab_technician', 'pharmacist', 'hospital_admin', 'super_admin'])
+            ->whereIn('role', ['doctor', 'nurse', 'lab_technician', 'lab_manager', 'pharmacist', 'blood_bank_manager', 'hospital_admin', 'super_admin'])
             ->orderBy('user_ref')
             ->get();
     }

app/Http/Controllers/Care/ServiceQueueController.php

@@ -60,7 +60,8 @@ class ServiceQueueController extends Controller
         return match ($member?->role) {
             'cashier' => 'care.bills.index',
             'pharmacist' => 'care.prescriptions.queue',
-            'lab_technician' => 'care.lab.queue.index',
+            'lab_technician', 'lab_manager' => 'care.lab.queue.index',
+            'blood_bank_manager' => 'care.blood-bank.admin.index',
             'receptionist', 'nurse' => 'care.appointments.index',
             default => 'care.dashboard',
         };

app/Http/Controllers/Care/SpecialtyModuleController.php

@@ -670,7 +670,10 @@ class SpecialtyModuleController extends Controller
         // Ability-based for every role (doctor, nurse, receptionist, lab, pharmacist, …).
         // Module canManage alone is not enough — flags must match what mutate routes authorize.
         $canConsult = $permissions->can($member, 'consultations.manage') && $canManageSpecialty;
-        $canAdvanceStage = $canConsult;
+        $canAdvanceStage = $canConsult
+            || ($module === 'blood_bank'
+                && $canManageSpecialty
+                && $permissions->can($member, 'blood_bank.manage'));
         $canStartConsultation = $canConsult;
         $canCallNext = $canManageSpecialty;
         $canManageClinical = $canManageSpecialty;

app/Models/BloodBankStock.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Models;
+
+use App\Models\Concerns\BelongsToOwner;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class BloodBankStock extends Model
+{
+    use BelongsToOwner;
+
+    protected $table = 'care_blood_bank_stock';
+
+    protected $fillable = [
+        'owner_ref',
+        'organization_id',
+        'branch_id',
+        'product_code',
+        'product_label',
+        'units_on_hand',
+        'reorder_level',
+        'notes',
+        'updated_by',
+    ];
+
+    public function organization(): BelongsTo
+    {
+        return $this->belongsTo(Organization::class, 'organization_id');
+    }
+
+    public function branch(): BelongsTo
+    {
+        return $this->belongsTo(Branch::class, 'branch_id');
+    }
+
+    public function isLowStock(): bool
+    {
+        return (int) $this->units_on_hand <= (int) $this->reorder_level;
+    }
+}

app/Services/Care/BloodBank/BloodBankInventoryService.php

@@ -0,0 +1,149 @@
+<?php
+
+namespace App\Services\Care\BloodBank;
+
+use App\Models\BloodBankStock;
+use App\Models\Organization;
+use App\Models\SpecialtyClinicalRecord;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+class BloodBankInventoryService
+{
+    /**
+     * Canonical operational products for branch-level stock (thin register, not bag ledger).
+     *
+     * @return array<string, array{label: string, reorder_level: int}>
+     */
+    public function catalogProducts(): array
+    {
+        return [
+            'whole_blood' => ['label' => 'Whole blood', 'reorder_level' => 2],
+            'packed_rbc' => ['label' => 'Packed RBC', 'reorder_level' => 2],
+            'platelets' => ['label' => 'Platelets', 'reorder_level' => 2],
+            'ffp' => ['label' => 'FFP', 'reorder_level' => 2],
+            'cryo' => ['label' => 'Cryoprecipitate', 'reorder_level' => 1],
+        ];
+    }
+
+    /**
+     * Ensure catalog rows exist for the branch, then return them ordered.
+     *
+     * @return Collection<int, BloodBankStock>
+     */
+    public function ensureStockRows(
+        Organization $organization,
+        string $ownerRef,
+        ?int $branchId,
+    ): Collection {
+        foreach ($this->catalogProducts() as $code => $meta) {
+            BloodBankStock::query()->firstOrCreate(
+                [
+                    'organization_id' => $organization->id,
+                    'branch_id' => $branchId,
+                    'product_code' => $code,
+                ],
+                [
+                    'owner_ref' => $ownerRef,
+                    'product_label' => $meta['label'],
+                    'units_on_hand' => 0,
+                    'reorder_level' => $meta['reorder_level'],
+                ],
+            );
+        }
+
+        return BloodBankStock::owned($ownerRef)
+            ->where('organization_id', $organization->id)
+            ->when(
+                $branchId === null,
+                fn ($q) => $q->whereNull('branch_id'),
+                fn ($q) => $q->where('branch_id', $branchId),
+            )
+            ->orderBy('product_label')
+            ->get();
+    }
+
+    /**
+     * @param  list<array{product_code: string, units_on_hand: int, reorder_level: int, notes?: ?string}>  $rows
+     * @return Collection<int, BloodBankStock>
+     */
+    public function updateStock(
+        Organization $organization,
+        string $ownerRef,
+        ?int $branchId,
+        array $rows,
+        ?string $actorRef = null,
+    ): Collection {
+        $allowed = array_keys($this->catalogProducts());
+
+        return DB::transaction(function () use ($organization, $ownerRef, $branchId, $rows, $actorRef, $allowed) {
+            $this->ensureStockRows($organization, $ownerRef, $branchId);
+
+            foreach ($rows as $row) {
+                $code = (string) ($row['product_code'] ?? '');
+                if (! in_array($code, $allowed, true)) {
+                    continue;
+                }
+
+                $stock = BloodBankStock::owned($ownerRef)
+                    ->where('organization_id', $organization->id)
+                    ->where('product_code', $code)
+                    ->when(
+                        $branchId === null,
+                        fn ($q) => $q->whereNull('branch_id'),
+                        fn ($q) => $q->where('branch_id', $branchId),
+                    )
+                    ->first();
+
+                if (! $stock) {
+                    continue;
+                }
+
+                $stock->update([
+                    'units_on_hand' => max(0, (int) ($row['units_on_hand'] ?? 0)),
+                    'reorder_level' => max(0, (int) ($row['reorder_level'] ?? $stock->reorder_level)),
+                    'notes' => isset($row['notes']) ? (string) $row['notes'] : $stock->notes,
+                    'updated_by' => $actorRef,
+                ]);
+            }
+
+            return $this->ensureStockRows($organization, $ownerRef, $branchId);
+        });
+    }
+
+    /**
+     * @return array{
+     *     stock: Collection<int, BloodBankStock>,
+     *     low_stock: Collection<int, BloodBankStock>,
+     *     low_stock_count: int,
+     *     total_units: int,
+     *     recent_notes: Collection<int, SpecialtyClinicalRecord>
+     * }
+     */
+    public function adminOverview(
+        Organization $organization,
+        string $ownerRef,
+        ?int $branchId,
+    ): array {
+        $stock = $this->ensureStockRows($organization, $ownerRef, $branchId);
+        $lowStock = $stock->filter(fn (BloodBankStock $row) => $row->isLowStock())->values();
+
+        $recentNotes = SpecialtyClinicalRecord::owned($ownerRef)
+            ->where('organization_id', $organization->id)
+            ->where('module_key', 'blood_bank')
+            ->where('record_type', 'inventory_note')
+            ->when($branchId, fn ($q) => $q->where('branch_id', $branchId))
+            ->with(['visit.patient'])
+            ->orderByDesc('recorded_at')
+            ->limit(8)
+            ->get();
+
+        return [
+            'stock' => $stock,
+            'low_stock' => $lowStock,
+            'low_stock_count' => $lowStock->count(),
+            'total_units' => (int) $stock->sum('units_on_hand'),
+            'recent_notes' => $recentNotes,
+        ];
+    }
+}

app/Services/Care/BranchContext.php

@@ -38,6 +38,8 @@ class BranchContext
             'nurse',
             'pharmacist',
             'lab_technician',
+            'lab_manager',
+            'blood_bank_manager',
             'cashier',
             'receptionist',
         ], true)) {

app/Services/Care/CarePermissions.php

@@ -9,10 +9,13 @@ class CarePermissions
     /**
      * Role abilities.
      *
-     * Lab catalog pricing uses `lab.catalog.manage` (admins only via `*`).
+     * Lab catalog pricing uses `lab.catalog.manage` (admins via `*`, plus `lab_manager`).
      * Lab technicians keep `lab.manage` for queue / sample / process / results —
      * not catalog CRUD or price edits.
      *
+     * Blood Bank operational inventory uses `blood_bank.manage` (managers + admins).
+     * Clinical visit stage/issue for managers also requires specialty module manage.
+     *
      * @var array<string, list<string>>
      */
     protected array $roleAbilities = [
@@ -42,11 +45,21 @@ class CarePermissions
             'dashboard.view', 'patients.view', 'lab.view', 'lab.manage',
             'service_queues.console',
         ],
+        'lab_manager' => [
+            'dashboard.view', 'patients.view', 'lab.view', 'lab.manage',
+            'lab.catalog.manage',
+            'service_queues.console',
+        ],
         'pharmacist' => [
             'dashboard.view', 'patients.view', 'prescriptions.view', 'prescriptions.dispense',
             'pharmacy.view', 'pharmacy.manage',
             'service_queues.console',
         ],
+        'blood_bank_manager' => [
+            'dashboard.view', 'patients.view',
+            'blood_bank.view', 'blood_bank.manage',
+            'service_queues.console',
+        ],
         // Cashiers run the Billing desk (bills / payments). They do not get
         // Ladill POS app access — see filterAllowedAppSlugs() / DemoWorld.
         'cashier' => [
@@ -67,6 +80,7 @@ class CarePermissions
         'admin.members.view', 'admin.members.manage',
         'settings.view', 'settings.manage',
         'lab.catalog.manage',
+        'blood_bank.view', 'blood_bank.manage',
         'devices.view', 'devices.manage',
         'displays.view', 'displays.manage',
         'audit.view', 'audit.export',
@@ -106,7 +120,9 @@ class CarePermissions
             'doctor',
             'nurse',
             'lab_technician',
+            'lab_manager',
             'pharmacist',
+            'blood_bank_manager',
             'receptionist',
             'cashier',
         ], true);

app/Support/DemoWorld.php

@@ -282,6 +282,20 @@ final class DemoWorld
                 'apps' => ['care'],
                 'roles' => ['care' => 'lab_technician'],
             ],
+            [
+                'key' => 'lab_manager',
+                'email' => 'demo-pro-lab-manager@ladill.com',
+                'name' => 'Ama Lab Manager (Pro)',
+                'apps' => ['care'],
+                'roles' => ['care' => 'lab_manager'],
+            ],
+            [
+                'key' => 'blood_bank_manager',
+                'email' => 'demo-pro-blood-bank-manager@ladill.com',
+                'name' => 'Kofi Blood Bank Manager (Pro)',
+                'apps' => ['care'],
+                'roles' => ['care' => 'blood_bank_manager'],
+            ],
             [
                 'key' => 'cashier',
                 'email' => 'demo-pro-cashier@ladill.com',
@@ -370,6 +384,20 @@ final class DemoWorld
                 'apps' => ['care'],
                 'roles' => ['care' => 'lab_technician'],
             ],
+            [
+                'key' => 'lab_manager',
+                'email' => 'demo-enterprise-lab-manager@ladill.com',
+                'name' => 'Ama Lab Manager',
+                'apps' => ['care'],
+                'roles' => ['care' => 'lab_manager'],
+            ],
+            [
+                'key' => 'blood_bank_manager',
+                'email' => 'demo-enterprise-blood-bank-manager@ladill.com',
+                'name' => 'Kofi Blood Bank Manager',
+                'apps' => ['care'],
+                'roles' => ['care' => 'blood_bank_manager'],
+            ],
             [
                 'key' => 'cashier',
                 'email' => 'demo-enterprise-cashier@ladill.com',