Fix nurse onboarding redirects and specialty Documents 404s.

Resolve staff memberships by invite/demo email as well as public_id so nurses stay on their employer org; block staff from owner onboarding; keep Documents viewable with module access while upload stays manage-gated. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-18 19:09:06 +00:00
parent 656f402e8f
commit c3219a1bf1
7 changed files with 524 additions and 14 deletions
@@ -347,6 +347,7 @@ class SpecialtyModuleController extends Controller

        $organization = $this->organization($request);
        $member = $this->member($request);
+        // Viewing docs is workspace GET (memberCanAccess / memberCanView). Upload needs manage.
        abort_unless($modules->memberCanAccess($organization, $member, $module), 403);
        abort_unless($modules->memberCanManage($organization, $member, $module), 403);
        abort_unless($visit->organization_id === $organization->id, 404);