Allow specialty doctors to open patient charts and order labs.

Branch-scoped staff could 404 on charts when the patient's home branch differed from the visit site; Orders also linked doctors to a lab index they could not access.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/PatientMessageController.php

@@ -4,7 +4,9 @@ namespace App\Http\Controllers\Care;
 
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Care\Concerns\ScopesToAccount;
+use App\Models\Appointment;
 use App\Models\Patient;
+use App\Models\Visit;
 use App\Services\Billing\PlatformEmailClient;
 use App\Services\Billing\PlatformSmsClient;
 use App\Services\Care\AuditLogger;
@@ -176,8 +178,21 @@ class PatientMessageController extends Controller
         abort_unless($patient->organization_id === $this->organization($request)->id, 404);
 
         $branchId = app(OrganizationResolver::class)->branchScope($this->member($request));
-        if ($branchId !== null && $patient->branch_id !== $branchId) {
-            abort(404);
+        if ($branchId === null || $patient->branch_id === $branchId) {
+            return;
         }
+
+        $hasLocalActivity = Visit::query()
+            ->where('patient_id', $patient->id)
+            ->where('organization_id', $patient->organization_id)
+            ->where('branch_id', $branchId)
+            ->exists()
+            || Appointment::query()
+                ->where('patient_id', $patient->id)
+                ->where('organization_id', $patient->organization_id)
+                ->where('branch_id', $branchId)
+                ->exists();
+
+        abort_unless($hasLocalActivity, 404);
     }
 }