Allow explicit multi-branch practitioner assignment for telemedicine.

Replace optional “All branches” with required branch checkboxes; doctors may switch only among assigned sites, never org-wide by default.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/MemberController.php

@@ -12,6 +12,7 @@ use App\Services\Identity\IdentityTeamClient;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
+use Illuminate\Validation\Rule;
 use Illuminate\View\View;
 
 class MemberController extends Controller
@@ -83,12 +84,22 @@ class MemberController extends Controller
         $validated = $request->validate([
             'email' => ['required', 'email', 'max:255'],
             'role' => ['required', 'string', 'in:'.implode(',', array_keys(config('care.roles')))],
-            'branch_id' => ['nullable', 'integer', 'exists:care_branches,id'],
+            'branch_id' => [
+                Rule::requiredIf(fn () => $request->input('role') === 'doctor'),
+                'nullable',
+                'integer',
+                'exists:care_branches,id',
+            ],
             'create_practitioner' => ['sometimes', 'boolean'],
             'practitioner_name' => ['nullable', 'string', 'max:255'],
             'specialty' => ['nullable', 'string', 'max:255'],
         ]);
 
+        if (! empty($validated['branch_id'])) {
+            $branch = Branch::owned($owner)->findOrFail($validated['branch_id']);
+            abort_unless($branch->organization_id === $organization->id, 404);
+        }
+
         $email = strtolower(trim($validated['email']));
 
         if ($email === strtolower((string) $request->user()->email)) {
@@ -125,7 +136,7 @@ class MemberController extends Controller
         $createPractitioner = $request->boolean('create_practitioner', $validated['role'] === 'doctor');
         if ($createPractitioner) {
             $name = trim((string) ($validated['practitioner_name'] ?? '')) ?: Str::headline(Str::before($email, '@'));
-            Practitioner::query()->firstOrCreate(
+            $practitioner = Practitioner::query()->firstOrCreate(
                 [
                     'organization_id' => $organization->id,
                     'member_id' => $member->id,
@@ -139,6 +150,10 @@ class MemberController extends Controller
                     'is_active' => true,
                 ],
             );
+
+            if (! empty($validated['branch_id'])) {
+                $practitioner->syncAssignedBranches([(int) $validated['branch_id']]);
+            }
         }
 
         return redirect()->route('care.members.index')->with('success', 'Invitation sent to '.$email.'.');