Restrict lab catalog pricing to admins only.

Split catalog CRUD onto lab.catalog.manage so technicians keep lab.manage for queue and results workflow without setting investigation prices.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/InvestigationTypeController.php

@@ -20,7 +20,7 @@ class InvestigationTypeController extends Controller
 
     public function index(Request $request): View
     {
-        $this->authorizeAbility($request, 'lab.manage');
+        $this->authorizeAbility($request, 'lab.catalog.manage');
         $organization = $this->organization($request);
 
         $types = InvestigationType::query()
@@ -38,7 +38,7 @@ class InvestigationTypeController extends Controller
 
     public function create(Request $request): View
     {
-        $this->authorizeAbility($request, 'lab.manage');
+        $this->authorizeAbility($request, 'lab.catalog.manage');
 
         return view('care.lab.catalog.create', [
             'categories' => config('care.investigation_categories'),
@@ -47,7 +47,7 @@ class InvestigationTypeController extends Controller
 
     public function store(Request $request): RedirectResponse
     {
-        $this->authorizeAbility($request, 'lab.manage');
+        $this->authorizeAbility($request, 'lab.catalog.manage');
 
         $type = $this->investigations->createType(
             $this->organization($request),
@@ -61,7 +61,7 @@ class InvestigationTypeController extends Controller
 
     public function edit(Request $request, InvestigationType $investigationType): View
     {
-        $this->authorizeAbility($request, 'lab.manage');
+        $this->authorizeAbility($request, 'lab.catalog.manage');
         $this->authorizeType($request, $investigationType);
 
         return view('care.lab.catalog.edit', [
@@ -72,7 +72,7 @@ class InvestigationTypeController extends Controller
 
     public function update(Request $request, InvestigationType $investigationType): RedirectResponse
     {
-        $this->authorizeAbility($request, 'lab.manage');
+        $this->authorizeAbility($request, 'lab.catalog.manage');
         $this->authorizeType($request, $investigationType);
 
         $this->investigations->updateType($investigationType, $this->ownerRef($request), $this->validatedTypeData($request));

app/Http/Controllers/Care/SettingsController.php

@@ -61,6 +61,7 @@ class SettingsController extends Controller
             'canViewTeam' => $permissions->can($member, 'admin.members.view'),
             'canViewDevices' => $permissions->can($member, 'devices.view'),
             'canViewDisplays' => $permissions->can($member, 'displays.view'),
+            'canManageLabCatalog' => $permissions->can($member, 'lab.catalog.manage'),
             'hasBranchesFeature' => $plans->hasFeature($organization, 'branches'),
             'hasClinicalDevicesFeature' => $plans->hasFeature($organization, 'clinical_devices'),
             'canUseQueueIntegration' => $plans->canUseQueueIntegration($organization),

app/Services/Afia/AfiaService.php

@@ -158,10 +158,10 @@ class AfiaService
         - Appointments: schedule visits and manage walk-ins.
         - Queue: waiting patients and active consultations — doctors start consultations from here.
         - Consultations: record vitals, symptoms, clinical notes, diagnoses, lab requests, and prescriptions; complete the encounter when done.
-        - Laboratory: investigation catalog, request tests from consultations, sample collection, results entry, and approval.
+        - Laboratory: sample collection, results entry, and approval from the lab queue. Admins manage the investigation catalog and test prices in Settings / Lab catalog.
         - Prescriptions & pharmacy queue: prescribe during consultations; pharmacists dispense from the queue.
         - Billing: generate bills from completed visits, record payments, and print receipts.
-        - Settings & admin: branches, departments, members, practitioners, and audit logs.
+        - Settings & admin: branches, departments, members, practitioners, lab catalog pricing, and audit logs.
 
         Rules:
         - Only answer questions about Ladill Care — patients, appointments, queue, consultations, lab, pharmacy, and billing.

app/Services/Care/CarePermissions.php

@@ -6,7 +6,15 @@ use App\Models\Member;
 
 class CarePermissions
 {
-    /** @var array<string, list<string>> */
+    /**
+     * Role abilities.
+     *
+     * Lab catalog pricing uses `lab.catalog.manage` (admins only via `*`).
+     * Lab technicians keep `lab.manage` for queue / sample / process / results —
+     * not catalog CRUD or price edits.
+     *
+     * @var array<string, list<string>>
+     */
     protected array $roleAbilities = [
         'super_admin' => ['*'],
         'hospital_admin' => ['*'],
@@ -56,6 +64,7 @@ class CarePermissions
         'admin.practitioners.view', 'admin.practitioners.manage',
         'admin.members.view', 'admin.members.manage',
         'settings.view', 'settings.manage',
+        'lab.catalog.manage',
         'devices.view', 'devices.manage',
         'displays.view', 'displays.manage',
         'audit.view', 'audit.export',