Keep Nursing Services hub off the regular nurse role.

Floor nurses keep clinical charting and My shifts but no longer
derive nursing.services.view, roster manage, or the Nursing /
Nursing Services admin nav. Ward lead roles (ed_nurse, midwife, …)
and admins are unchanged. Gate the nursing_services specialty
redirect the same way as the hub route.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/SpecialtyModuleController.php

@@ -35,6 +35,8 @@ class SpecialtyModuleController extends Controller
     ): View|RedirectResponse {
         // Nursing Services is an ops hub (roster / registry), not a patient specialty shell.
         if ($module === 'nursing_services') {
+            $this->authorizeAbility($request, 'nursing.services.view');
+
             return redirect()->route('care.nursing.services');
         }
 

app/Services/Care/CarePermissions.php

@@ -83,7 +83,7 @@ class CarePermissions
         'cashier' => [],
         'accountant' => [],
         'department_manager' => null, // department analytics — all enabled modules view
-        'nurse' => ['vaccination', 'child_welfare', 'infusion', 'womens_health', 'nursing_services'],
+        'nurse' => ['vaccination', 'child_welfare', 'infusion', 'womens_health'],
     ];
 
     /**
@@ -498,9 +498,8 @@ class CarePermissions
         ],
     ];
 
-    /** Ward / nursing-ops roles — not every clinical role with vitals (e.g. ambulance, GP). */
+    /** Ward / nursing-ops roles (charge / unit leads) — not the legacy floor `nurse`. */
     protected array $nursingOpsRoles = [
-        'nurse',
         'ed_nurse',
         'theatre_nurse',
         'labour_ward_nurse',

config/care_specialty_modules.php

@@ -507,11 +507,11 @@ return [
         'queue_keywords' => ['nursing', 'nurse', 'matron', 'ward'],
         'access' => 'general',
         'roles' => [
-            'nurse', 'ed_nurse', 'theatre_nurse', 'labour_ward_nurse',
+            'ed_nurse', 'theatre_nurse', 'labour_ward_nurse',
             'fertility_nurse', 'dialysis_nurse', 'midwife',
         ],
         'view_roles' => [
-            'nurse', 'ed_nurse', 'theatre_nurse', 'labour_ward_nurse',
+            'ed_nurse', 'theatre_nurse', 'labour_ward_nurse',
             'fertility_nurse', 'dialysis_nurse', 'midwife',
             'department_manager', 'general_physician', 'doctor',
         ],

tests/Feature/CareMyShiftsAndNavPermissionsTest.php

@@ -154,7 +154,7 @@ class CareMyShiftsAndNavPermissionsTest extends TestCase
             ->assertSee('Day shift');
     }
 
-    public function test_nurse_still_gets_nursing_services_access(): void
+    public function test_regular_nurse_cannot_access_nursing_services_hub(): void
     {
         $user = User::create([
             'public_id' => 'nurse-hub',
@@ -170,8 +170,10 @@ class CareMyShiftsAndNavPermissionsTest extends TestCase
         ]);
 
         $permissions = app(CarePermissions::class);
-        $this->assertTrue($permissions->can($member, 'nursing.services.view'));
-        $this->assertTrue($permissions->can($member, 'inpatient.placement.view'));
+        $this->assertFalse($permissions->can($member, 'nursing.services.view'));
+        $this->assertFalse($permissions->can($member, 'inpatient.placement.view'));
+        $this->assertFalse($permissions->can($member, 'nursing.roster.manage'));
+        $this->assertTrue($permissions->can($member, 'nursing.my_shifts.view'));
         $this->assertFalse($permissions->can($member, 'admin.departments.view'));
         $this->assertFalse($permissions->can($member, 'admin.departments.manage'));
 
@@ -193,13 +195,19 @@ class CareMyShiftsAndNavPermissionsTest extends TestCase
 
         $this->actingAs($user)
             ->get(route('care.nursing.services'))
-            ->assertOk();
+            ->assertForbidden();
+
+        $this->actingAs($user)
+            ->get(route('care.specialty.show', 'nursing_services'))
+            ->assertForbidden();
 
         $this->actingAs($user)
             ->get(route('care.dashboard'))
             ->assertOk()
             ->assertDontSee('>Care units<', false)
             ->assertDontSee('>Departments<', false)
-            ->assertSee('>Nursing Services<', false);
+            ->assertDontSee('>Nursing Services<', false)
+            ->assertDontSee('>Nursing<', false)
+            ->assertSee('My shifts', false);
     }
 }