Allow specialty doctors to open patient charts and order labs.

Branch-scoped staff could 404 on charts when the patient's home branch differed from the visit site; Orders also linked doctors to a lab index they could not access.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Api/PatientController.php

@@ -4,7 +4,9 @@ namespace App\Http\Controllers\Api;
 
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Models\Appointment;
 use App\Models\Patient;
+use App\Models\Visit;
 use App\Services\Care\CarePermissions;
 use App\Services\Care\OrganizationResolver;
 use App\Services\Care\PatientService;
@@ -89,9 +91,22 @@ class PatientController extends Controller
         abort_unless($patient->organization_id === $this->organization($request)->id, 404);
 
         $branchScope = app(OrganizationResolver::class)->branchScope($this->member($request));
-        if ($branchScope !== null && $patient->branch_id !== $branchScope) {
-            abort(404);
+        if ($branchScope === null || $patient->branch_id === $branchScope) {
+            return;
         }
+
+        $hasLocalActivity = Visit::query()
+            ->where('patient_id', $patient->id)
+            ->where('organization_id', $patient->organization_id)
+            ->where('branch_id', $branchScope)
+            ->exists()
+            || Appointment::query()
+                ->where('patient_id', $patient->id)
+                ->where('organization_id', $patient->organization_id)
+                ->where('branch_id', $branchScope)
+                ->exists();
+
+        abort_unless($hasLocalActivity, 404);
     }
 
     /**

app/Http/Controllers/Care/PatientController.php

@@ -4,8 +4,10 @@ namespace App\Http\Controllers\Care;
 
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Care\Concerns\ScopesToAccount;
+use App\Models\Appointment;
 use App\Models\Branch;
 use App\Models\Patient;
+use App\Models\Visit;
 use App\Services\Care\AdminOverviewService;
 use App\Services\Care\CareFeatures;
 use App\Services\Care\CarePermissions;
@@ -293,9 +295,24 @@ class PatientController extends Controller
         abort_unless($patient->organization_id === $this->organization($request)->id, 404);
 
         $branchId = app(OrganizationResolver::class)->branchScope($this->member($request));
-        if ($branchId !== null && $patient->branch_id !== $branchId) {
-            abort(404);
+        if ($branchId === null || $patient->branch_id === $branchId) {
+            return;
         }
+
+        // Home branch may differ from the site where care is delivered — allow chart
+        // access when the patient has a visit or appointment at the member's branch.
+        $hasLocalActivity = Visit::query()
+            ->where('patient_id', $patient->id)
+            ->where('organization_id', $patient->organization_id)
+            ->where('branch_id', $branchId)
+            ->exists()
+            || Appointment::query()
+                ->where('patient_id', $patient->id)
+                ->where('organization_id', $patient->organization_id)
+                ->where('branch_id', $branchId)
+                ->exists();
+
+        abort_unless($hasLocalActivity, 404);
     }
 
     /**

app/Http/Controllers/Care/PatientMessageController.php

@@ -4,7 +4,9 @@ namespace App\Http\Controllers\Care;
 
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Care\Concerns\ScopesToAccount;
+use App\Models\Appointment;
 use App\Models\Patient;
+use App\Models\Visit;
 use App\Services\Billing\PlatformEmailClient;
 use App\Services\Billing\PlatformSmsClient;
 use App\Services\Care\AuditLogger;
@@ -176,8 +178,21 @@ class PatientMessageController extends Controller
         abort_unless($patient->organization_id === $this->organization($request)->id, 404);
 
         $branchId = app(OrganizationResolver::class)->branchScope($this->member($request));
-        if ($branchId !== null && $patient->branch_id !== $branchId) {
-            abort(404);
+        if ($branchId === null || $patient->branch_id === $branchId) {
+            return;
         }
+
+        $hasLocalActivity = Visit::query()
+            ->where('patient_id', $patient->id)
+            ->where('organization_id', $patient->organization_id)
+            ->where('branch_id', $branchId)
+            ->exists()
+            || Appointment::query()
+                ->where('patient_id', $patient->id)
+                ->where('organization_id', $patient->organization_id)
+                ->where('branch_id', $branchId)
+                ->exists();
+
+        abort_unless($hasLocalActivity, 404);
     }
 }

app/Http/Controllers/Care/SpecialtyModuleController.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Care\Concerns\ScopesToAccount;
 use App\Http\Controllers\Controller;
 use App\Models\Appointment;
 use App\Models\Department;
+use App\Models\InvestigationType;
 use App\Models\PatientAttachment;
 use App\Models\Visit;
 use App\Services\Care\AppointmentService;
@@ -507,6 +508,7 @@ class SpecialtyModuleController extends Controller
         $clinicalFields = [];
         $clinicalAlerts = [];
         $visitDocuments = collect();
+        $investigationTypes = collect();
         $dentalChart = null;
         $dentalTeethMap = [];
         $dentalPlan = null;
@@ -529,9 +531,9 @@ class SpecialtyModuleController extends Controller
                 'patient.emergencyContacts',
                 'patient.attachments',
                 'appointment.practitioner',
-                'appointment.consultation',
+                'appointment.consultation.investigationRequests.investigationType',
                 'bill.lineItems',
-                'consultations',
+                'consultations.investigationRequests.investigationType',
             ]);
             $workspaceVisit = $visit;
             if ($visit->patient) {
@@ -549,9 +551,9 @@ class SpecialtyModuleController extends Controller
                     'patient.emergencyContacts',
                     'patient.attachments',
                     'appointment.practitioner',
-                    'appointment.consultation',
+                    'appointment.consultation.investigationRequests.investigationType',
                     'bill.lineItems',
-                    'consultations',
+                    'consultations.investigationRequests.investigationType',
                 ]);
                 $workspaceVisit = $first;
                 $patientHeader = array_merge(
@@ -624,6 +626,14 @@ class SpecialtyModuleController extends Controller
                     ->limit(20)
                     ->get()
                 : collect();
+
+            if ($activeTab === 'orders' && $canConsult) {
+                $investigationTypes = InvestigationType::query()
+                    ->where('organization_id', $organization->id)
+                    ->where('is_active', true)
+                    ->orderBy('name')
+                    ->get();
+            }
         }
 
         return view('care.specialty.shell', [
@@ -650,6 +660,7 @@ class SpecialtyModuleController extends Controller
             'clinicalFields' => $clinicalFields,
             'clinicalAlerts' => $clinicalAlerts,
             'visitDocuments' => $visitDocuments,
+            'investigationTypes' => $investigationTypes,
             'dentalChart' => $dentalChart,
             'dentalTeethMap' => $dentalTeethMap,
             'dentalPlan' => $dentalPlan,

app/Services/Care/CarePermissions.php

@@ -18,7 +18,8 @@ class CarePermissions
         'doctor' => [
             'dashboard.view', 'patients.view', 'appointments.view',
             'consultations.view', 'consultations.manage',
-            'investigations.request', 'prescriptions.manage', 'lab.results.view',
+            'investigations.request', 'prescriptions.manage',
+            'lab.view', 'lab.results.view',
             'assessments.view', 'assessments.capture', 'assessments.manage',
             'pathways.manage',
             'service_queues.console',

resources/views/care/specialty/partials/orders.blade.php

@@ -0,0 +1,88 @@
+@php
+    $openConsultation = $workspaceVisit->appointment?->consultation
+        ?? $workspaceVisit->consultations->firstWhere('status', '!=', \App\Models\Consultation::STATUS_COMPLETED);
+    $canRequestLabs = ($canConsult ?? false) && $openConsultation;
+    $visitLabRequests = $workspaceVisit->consultations
+        ->flatMap(fn ($c) => $c->investigationRequests)
+        ->sortByDesc('id')
+        ->values();
+@endphp
+
+<section class="rounded-2xl border border-slate-200 bg-white p-5">
+    <div class="flex flex-wrap items-start justify-between gap-3">
+        <div>
+            <h3 class="text-sm font-semibold text-slate-900">Orders</h3>
+            <p class="mt-0.5 text-xs text-slate-500">Lab and imaging requests for this visit.</p>
+        </div>
+        @if ($canRequestLabs)
+            <button
+                type="button"
+                class="rounded-lg bg-indigo-600 px-3 py-1.5 text-sm font-semibold text-white hover:bg-indigo-700"
+                @click="$dispatch('open-modal', {{ \Illuminate\Support\Js::from('specialty-request-investigations-'.$openConsultation->id) }})"
+            >
+                Request investigations
+            </button>
+        @endif
+    </div>
+
+    @if (! $openConsultation)
+        <p class="mt-3 text-sm text-amber-800">Start the encounter to order lab / imaging from this visit.</p>
+    @endif
+
+    <ul class="mt-4 space-y-2 text-sm">
+        @forelse ($visitLabRequests as $req)
+            <li class="flex flex-wrap items-center justify-between gap-2 rounded-xl border border-slate-100 bg-slate-50 px-3 py-2">
+                <div>
+                    <p class="font-medium text-slate-800">{{ $req->investigationType?->name ?? 'Investigation' }}</p>
+                    <p class="text-xs text-slate-500">{{ config('care.investigation_statuses')[$req->status] ?? $req->status }}</p>
+                </div>
+                <a href="{{ route('care.lab.requests.show', $req) }}" class="text-xs font-medium text-indigo-600">Open</a>
+            </li>
+        @empty
+            <li class="text-slate-500">No lab requests on this visit yet.</li>
+        @endforelse
+    </ul>
+
+    <div class="mt-4 flex flex-wrap gap-3 border-t border-slate-100 pt-4">
+        @if ($workspaceVisit->appointment)
+            <a href="{{ route('care.appointments.show', $workspaceVisit->appointment) }}" class="text-sm font-medium text-indigo-600">Appointment</a>
+        @endif
+    </div>
+</section>
+
+@if ($canRequestLabs && ($investigationTypes ?? collect())->isNotEmpty())
+    <x-modal :name="'specialty-request-investigations-'.$openConsultation->id" maxWidth="2xl">
+        <div class="px-5 pb-6 pt-2 sm:px-6 sm:pb-6 sm:pt-4">
+            <h2 class="pr-8 text-lg font-semibold text-slate-900">Request investigations</h2>
+            <p class="mt-1 text-sm text-slate-500">Select tests to send to the lab for this visit.</p>
+            <form method="POST" action="{{ route('care.lab.requests.store', $openConsultation) }}" class="mt-4 space-y-4">
+                @csrf
+                <div class="grid max-h-[40vh] gap-2 overflow-y-auto sm:grid-cols-2">
+                    @foreach ($investigationTypes as $type)
+                        <label class="flex items-center gap-2 rounded-lg border border-slate-100 bg-slate-50 px-3 py-2 text-sm">
+                            <input type="checkbox" name="investigation_type_ids[]" value="{{ $type->id }}" class="rounded border-slate-300">
+                            <span>{{ $type->name }} <span class="text-slate-400">({{ config('care.investigation_categories')[$type->category] ?? $type->category }})</span></span>
+                        </label>
+                    @endforeach
+                </div>
+                <div>
+                    <label class="block text-xs font-medium text-slate-600">Clinical notes</label>
+                    <textarea name="clinical_notes" rows="2" class="mt-1 w-full rounded-xl border border-slate-200 px-3 py-2 text-sm"></textarea>
+                </div>
+                <div>
+                    <label class="block text-xs font-medium text-slate-600">Priority</label>
+                    <select name="priority" class="mt-1 w-full rounded-xl border border-slate-200 px-3 py-2 text-sm">
+                        <option value="routine">Routine</option>
+                        <option value="urgent">Urgent</option>
+                    </select>
+                </div>
+                <div class="flex justify-end gap-2">
+                    <button type="button" class="rounded-xl border border-slate-200 px-4 py-2.5 text-sm font-semibold text-slate-700 hover:bg-slate-50" @click="$dispatch('close-modal', {{ \Illuminate\Support\Js::from('specialty-request-investigations-'.$openConsultation->id) }})">
+                        Cancel
+                    </button>
+                    <button type="submit" class="rounded-xl bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white hover:bg-indigo-700">Submit requests</button>
+                </div>
+            </form>
+        </div>
+    </x-modal>
+@endif

resources/views/care/specialty/sections/workspace.blade.php

@@ -74,16 +74,7 @@
         @elseif (! empty($clinicalFields))
             @include('care.specialty.partials.clinical-form')
         @elseif ($activeTab === 'orders')
-            <section class="rounded-2xl border border-slate-200 bg-white p-5">
-                <h3 class="text-sm font-semibold text-slate-900">Orders</h3>
-                <p class="mt-2 text-sm text-slate-500">Order lab / imaging from the consultation flow. Specialty order sets can extend this later.</p>
-                <div class="mt-3 flex flex-wrap gap-3">
-                    <a href="{{ route('care.lab.requests.index') }}" class="text-sm font-medium text-indigo-600">Lab requests</a>
-                    @if ($workspaceVisit->appointment)
-                        <a href="{{ route('care.appointments.show', $workspaceVisit->appointment) }}" class="text-sm font-medium text-indigo-600">Appointment</a>
-                    @endif
-                </div>
-            </section>
+            @include('care.specialty.partials.orders')
         @elseif ($activeTab === 'documents')
             <section class="rounded-2xl border border-slate-200 bg-white p-5">
                 <h3 class="text-sm font-semibold text-slate-900">Documents</h3>