Add Lab and Blood Bank manager roles with admin UIs.

Give lab_manager catalog/ops admin access and blood_bank_manager a branch-level stock register plus specialty admin surface, while keeping technicians on clinical queues.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/BloodBankWorkspaceController.php

@@ -8,6 +8,7 @@ use App\Models\SpecialtyClinicalRecord;
 use App\Models\Visit;
 use App\Services\Care\BloodBank\BloodBankAnalyticsService;
 use App\Services\Care\BloodBank\BloodBankWorkflowService;
+use App\Services\Care\CarePermissions;
 use App\Services\Care\SpecialtyClinicalRecordService;
 use App\Services\Care\SpecialtyModuleService;
 use App\Services\Care\SpecialtyShellService;
@@ -38,13 +39,40 @@ class BloodBankWorkspaceController extends Controller
         $this->authorizeBranch($request, (int) $visit->branch_id);
     }
 
+    /**
+     * Doctors use consultations.manage; Blood Bank managers use blood_bank.manage.
+     */
+    protected function authorizeBloodBankClinical(Request $request): void
+    {
+        $permissions = app(CarePermissions::class);
+        $member = $this->member($request);
+        abort_unless(
+            $permissions->can($member, 'blood_bank.manage')
+                || $permissions->can($member, 'consultations.manage'),
+            403,
+        );
+    }
+
+    protected function authorizeBloodBankViewAbility(Request $request): void
+    {
+        $permissions = app(CarePermissions::class);
+        $member = $this->member($request);
+        abort_unless(
+            $permissions->can($member, 'blood_bank.view')
+                || $permissions->can($member, 'blood_bank.manage')
+                || $permissions->can($member, 'consultations.view')
+                || $permissions->can($member, 'consultations.manage'),
+            403,
+        );
+    }
+
     public function setStage(
         Request $request,
         Visit $visit,
         SpecialtyModuleService $modules,
         SpecialtyVisitStageService $stages,
     ): RedirectResponse {
-        $this->authorizeAbility($request, 'consultations.manage');
+        $this->authorizeBloodBankClinical($request);
         $this->assertBloodBankManage($request, $modules);
         $this->assertVisit($request, $visit);
 
@@ -79,7 +107,7 @@ class BloodBankWorkspaceController extends Controller
         SpecialtyShellService $shell,
         BloodBankWorkflowService $workflow,
     ): RedirectResponse {
-        $this->authorizeAbility($request, 'consultations.manage');
+        $this->authorizeBloodBankClinical($request);
         $this->assertBloodBankManage($request, $modules);
         $this->assertVisit($request, $visit);
 
@@ -187,7 +215,7 @@ class BloodBankWorkspaceController extends Controller
         SpecialtyVisitStageService $stages,
         BloodBankWorkflowService $workflow,
     ): RedirectResponse {
-        $this->authorizeAbility($request, 'consultations.manage');
+        $this->authorizeBloodBankClinical($request);
         $this->assertBloodBankManage($request, $modules);
         $this->assertVisit($request, $visit);
 
@@ -271,7 +299,7 @@ class BloodBankWorkspaceController extends Controller
         SpecialtyShellService $shell,
         BloodBankAnalyticsService $analytics,
     ): View {
-        $this->authorizeAbility($request, 'consultations.view');
+        $this->authorizeBloodBankViewAbility($request);
         $this->assertBloodBankAccess($request, $modules);
 
         $organization = $this->organization($request);
@@ -300,7 +328,7 @@ class BloodBankWorkspaceController extends Controller
         SpecialtyModuleService $modules,
         SpecialtyClinicalRecordService $clinical,
     ): View {
-        $this->authorizeAbility($request, 'consultations.view');
+        $this->authorizeBloodBankViewAbility($request);
         $this->assertBloodBankAccess($request, $modules);
         $this->assertVisit($request, $visit);