Add per-customer SMS and Bird Integrations for patient messaging.

Patient SMS/email now use encrypted tenant keys via the platform relay instead of shared platform Care API keys.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Care/IntegrationsController.php

@@ -0,0 +1,152 @@
+<?php
+
+namespace App\Http\Controllers\Care;
+
+use App\Http\Controllers\Controller;
+use App\Http\Controllers\Care\Concerns\ScopesToAccount;
+use App\Services\Care\AuditLogger;
+use App\Services\Care\CarePermissions;
+use App\Services\Messaging\CustomerSmsClient;
+use App\Services\Messaging\MessagingCredentialsService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+class IntegrationsController extends Controller
+{
+    use ScopesToAccount;
+
+    public function edit(Request $request, MessagingCredentialsService $credentials): View
+    {
+        $this->authorizeAbility($request, 'settings.view');
+        $organization = $this->organization($request);
+        $canManage = app(CarePermissions::class)->can($this->member($request), 'settings.manage');
+
+        return view('care.integrations.edit', [
+            'organization' => $organization,
+            'canManage' => $canManage,
+            'credential' => $credentials->forOrganization($organization),
+        ]);
+    }
+
+    public function saveSms(Request $request, MessagingCredentialsService $credentials): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'settings.manage');
+        $organization = $this->organization($request);
+
+        $data = $request->validate([
+            'sms_api_key' => ['required', 'string', 'max:200'],
+            'sms_sender_id' => ['required', 'string', 'max:11'],
+        ]);
+
+        $result = $credentials->validateAndSaveSms(
+            $organization,
+            $data['sms_api_key'],
+            $data['sms_sender_id'],
+        );
+
+        AuditLogger::record(
+            $this->ownerRef($request),
+            ($result['ok'] ?? false) ? 'integrations.sms_connected' : 'integrations.sms_failed',
+            $organization->id,
+            $this->ownerRef($request),
+            \App\Models\Organization::class,
+            $organization->id,
+            ['prefix' => substr(trim($data['sms_api_key']), 0, 16)],
+        );
+
+        if (! ($result['ok'] ?? false)) {
+            return back()->withInput()->with('error', $result['error'] ?? 'Could not save SMS credentials.');
+        }
+
+        return back()->with('success', 'Ladill SMS connected. Outbound patient SMS will use your key and sender ID.');
+    }
+
+    public function disconnectSms(Request $request, MessagingCredentialsService $credentials): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'settings.manage');
+        $organization = $this->organization($request);
+        $credentials->disconnectSms($organization);
+
+        AuditLogger::record(
+            $this->ownerRef($request),
+            'integrations.sms_disconnected',
+            $organization->id,
+            $this->ownerRef($request),
+            \App\Models\Organization::class,
+            $organization->id,
+        );
+
+        return back()->with('success', 'Ladill SMS disconnected.');
+    }
+
+    public function saveBird(Request $request, MessagingCredentialsService $credentials): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'settings.manage');
+        $organization = $this->organization($request);
+
+        $data = $request->validate([
+            'bird_api_key' => ['required', 'string', 'max:200'],
+            'bird_from_email' => ['required', 'email', 'max:255'],
+            'bird_from_name' => ['nullable', 'string', 'max:100'],
+        ]);
+
+        $result = $credentials->validateAndSaveBird(
+            $organization,
+            $data['bird_api_key'],
+            $data['bird_from_email'],
+            $data['bird_from_name'] ?? null,
+        );
+
+        AuditLogger::record(
+            $this->ownerRef($request),
+            ($result['ok'] ?? false) ? 'integrations.bird_connected' : 'integrations.bird_failed',
+            $organization->id,
+            $this->ownerRef($request),
+            \App\Models\Organization::class,
+            $organization->id,
+            ['prefix' => substr(trim($data['bird_api_key']), 0, 16)],
+        );
+
+        if (! ($result['ok'] ?? false)) {
+            return back()->withInput()->with('error', $result['error'] ?? 'Could not save Bird credentials.');
+        }
+
+        return back()->with('success', 'Ladill Bird connected. Outbound patient email will use your key and from address.');
+    }
+
+    public function disconnectBird(Request $request, MessagingCredentialsService $credentials): RedirectResponse
+    {
+        $this->authorizeAbility($request, 'settings.manage');
+        $organization = $this->organization($request);
+        $credentials->disconnectBird($organization);
+
+        AuditLogger::record(
+            $this->ownerRef($request),
+            'integrations.bird_disconnected',
+            $organization->id,
+            $this->ownerRef($request),
+            \App\Models\Organization::class,
+            $organization->id,
+        );
+
+        return back()->with('success', 'Ladill Bird disconnected.');
+    }
+
+    public function previewSenders(Request $request, CustomerSmsClient $sms): JsonResponse
+    {
+        $this->authorizeAbility($request, 'settings.manage');
+
+        $data = $request->validate([
+            'sms_api_key' => ['required', 'string', 'max:200'],
+        ]);
+
+        $result = $sms->senders(trim($data['sms_api_key']));
+        if (! ($result['ok'] ?? false)) {
+            return response()->json(['error' => $result['error'] ?? 'Could not load senders.'], 422);
+        }
+
+        return response()->json($result['data'] ?? []);
+    }
+}

app/Http/Controllers/Care/PatientController.php

@@ -93,9 +93,13 @@ class PatientController extends Controller
         $dashboard = $this->patients->dashboard($patient);
         $canManage = app(\App\Services\Care\CarePermissions::class)
             ->can($this->member($request), 'patients.manage');
+        $credential = app(\App\Services\Messaging\MessagingCredentialsService::class)
+            ->forOrganization($this->organization($request));
 
         return view('care.patients.show', array_merge($dashboard, [
             'canManage' => $canManage,
+            'messagingSmsReady' => $credential->hasValidSms(),
+            'messagingEmailReady' => $credential->hasValidBird(),
             'genders' => config('care.genders'),
             'allergySeverities' => config('care.allergy_severities'),
             'documentTypes' => config('care.document_types'),

app/Http/Controllers/Care/PatientMessageController.php

@@ -5,10 +5,11 @@ namespace App\Http\Controllers\Care;
 use App\Http\Controllers\Controller;
 use App\Http\Controllers\Care\Concerns\ScopesToAccount;
 use App\Models\Patient;
-use App\Services\Billing\PlatformEmailClient;
-use App\Services\Billing\PlatformSmsClient;
 use App\Services\Care\AuditLogger;
 use App\Services\Care\OrganizationResolver;
+use App\Services\Messaging\CustomerEmailClient;
+use App\Services\Messaging\CustomerSmsClient;
+use App\Services\Messaging\MessagingCredentialsService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 
@@ -16,8 +17,12 @@ class PatientMessageController extends Controller
 {
     use ScopesToAccount;
 
-    public function sendEmail(Request $request, Patient $patient, PlatformEmailClient $email): RedirectResponse
-    {
+    public function sendEmail(
+        Request $request,
+        Patient $patient,
+        MessagingCredentialsService $credentials,
+        CustomerEmailClient $email,
+    ): RedirectResponse {
         $this->authorizeAbility($request, 'patients.manage');
         $this->authorizePatient($request, $patient);
 
@@ -25,6 +30,16 @@ class PatientMessageController extends Controller
             return back()->with('error', 'This patient has no valid email on file.');
         }
 
+        $credential = $credentials->forOrganization($this->organization($request));
+        if (! $credential->hasValidBird()) {
+            return back()->with('error', 'Connect Ladill Bird in Integrations before sending patient email.');
+        }
+
+        $apiKey = $credential->birdApiKey();
+        if (! $apiKey) {
+            return back()->with('error', 'Bird credentials could not be decrypted. Reconnect Bird in Integrations.');
+        }
+
         $data = $request->validate([
             'subject' => ['required', 'string', 'max:200'],
             'body' => ['required', 'string', 'max:5000'],
@@ -32,7 +47,15 @@ class PatientMessageController extends Controller
 
         $owner = $this->ownerRef($request);
         $html = nl2br(e($data['body']));
-        $sent = $email->send($owner, (string) $patient->email, $data['subject'], $html, $data['body']);
+        $sent = $email->send(
+            $apiKey,
+            (string) $credential->bird_from_email,
+            $credential->bird_from_name,
+            (string) $patient->email,
+            $data['subject'],
+            $html,
+            $data['body'],
+        );
 
         AuditLogger::record(
             $owner,
@@ -55,8 +78,12 @@ class PatientMessageController extends Controller
         return back()->with('success', 'Email sent to '.$patient->email);
     }
 
-    public function sendSms(Request $request, Patient $patient, PlatformSmsClient $sms): RedirectResponse
-    {
+    public function sendSms(
+        Request $request,
+        Patient $patient,
+        MessagingCredentialsService $credentials,
+        CustomerSmsClient $sms,
+    ): RedirectResponse {
         $this->authorizeAbility($request, 'patients.manage');
         $this->authorizePatient($request, $patient);
 
@@ -64,12 +91,22 @@ class PatientMessageController extends Controller
             return back()->with('error', 'This patient has no phone number on file.');
         }
 
+        $credential = $credentials->forOrganization($this->organization($request));
+        if (! $credential->hasValidSms()) {
+            return back()->with('error', 'Connect Ladill SMS in Integrations before sending patient SMS.');
+        }
+
+        $apiKey = $credential->smsApiKey();
+        if (! $apiKey) {
+            return back()->with('error', 'SMS credentials could not be decrypted. Reconnect SMS in Integrations.');
+        }
+
         $data = $request->validate([
             'message' => ['required', 'string', 'max:480'],
         ]);
 
         $owner = $this->ownerRef($request);
-        $sent = $sms->send($owner, (string) $patient->phone, $data['message']);
+        $sent = $sms->send($apiKey, (string) $patient->phone, $data['message'], (string) $credential->sms_sender_id);
 
         AuditLogger::record(
             $owner,