Allow MAR visit charts for nurses on duty outside their home branch.

Station could list clinic patients on a covered unit while authorizeBranch 404'd the MAR link; duty-unit census now grants access too.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/MarController.php

@@ -8,7 +8,10 @@ use App\Models\CareUnit;
 use App\Models\MarOrder;
 use App\Models\Visit;
 use App\Services\Care\CarePermissions;
+use App\Services\Care\CareUnitCensusService;
 use App\Services\Care\MarService;
+use App\Services\Care\NurseStationService;
+use App\Services\Care\OrganizationResolver;
 use Carbon\Carbon;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
@@ -47,7 +50,7 @@ class MarController extends Controller
     {
         $this->authorizeAbility($request, 'mar.view');
         $this->authorizeOwner($request, $visit);
-        $this->authorizeBranch($request, (int) $visit->branch_id);
+        $this->authorizeMarVisitAccess($request, $visit);
 
         $day = $request->filled('date')
             ? Carbon::parse($request->input('date'))->startOfDay()
@@ -109,4 +112,38 @@ class MarController extends Controller
 
         return back()->with('success', 'MAR entry recorded.');
     }
+
+    /**
+     * Branch-scoped staff may open MAR for home-branch visits, or for patients
+     * on a unit they are rostered/placed on today (coverage across branches).
+     */
+    protected function authorizeMarVisitAccess(Request $request, Visit $visit): void
+    {
+        $member = $this->member($request);
+        $resolver = app(OrganizationResolver::class);
+
+        if ($resolver->mayAccessBranch($member, (int) $visit->branch_id)) {
+            return;
+        }
+
+        $permissions = app(CarePermissions::class);
+        if (! $permissions->can($member, 'nursing.station.view')) {
+            abort(404);
+        }
+
+        $dutyUnits = app(NurseStationService::class)->dutyUnits(
+            $this->organization($request),
+            $member,
+            $this->ownerRef($request),
+        );
+
+        $census = app(CareUnitCensusService::class);
+        foreach ($dutyUnits as $unit) {
+            if ($census->visitBelongsToUnit($visit, $unit)) {
+                return;
+            }
+        }
+
+        abort(404);
+    }
 }