Remove Care cashier access to Ladill POS.

Cashiers collect via Billing only; strip POS from demo staff grants and StaffUx/launcher so the suite hub no longer offers POS for that role. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-18 23:47:07 +00:00
parent 4ad3a8a901
commit f82964b2a0
5 changed files with 164 additions and 9 deletions
@@ -193,6 +193,68 @@ class CareWebTest extends TestCase
            ->assertDontSee('Patients in queue');
    }

+    public function test_cashier_pos_app_access_is_stripped_from_staff_ux(): void
+    {
+        Member::where('user_ref', $this->user->public_id)->update(['role' => 'cashier']);
+
+        $member = Member::where('user_ref', $this->user->public_id)->firstOrFail();
+        $permissions = app(\App\Services\Care\CarePermissions::class);
+
+        $this->assertSame(
+            ['care'],
+            $permissions->filterAllowedAppSlugs($member, ['care', 'pos']),
+        );
+
+        $filtered = $permissions->filterStaffAppAccess($member, [
+            'full_access' => false,
+            'apps' => ['care', 'pos'],
+            'show_hub' => true,
+            'show_billing' => false,
+        ]);
+
+        $this->assertSame(['care'], $filtered['apps']);
+        $this->assertFalse($filtered['show_hub']);
+
+        foreach (['pro', 'enterprise'] as $tier) {
+            $cashier = collect(\App\Support\DemoWorld::staff($tier))->firstWhere('key', 'cashier');
+            $this->assertNotNull($cashier);
+            $this->assertSame(['care'], $cashier['apps']);
+            $this->assertArrayNotHasKey('pos', $cashier['roles']);
+            $this->assertSame('cashier', $cashier['roles']['care'] ?? null);
+        }
+    }
+
+    public function test_cashier_dashboard_hides_pos_launcher_and_keeps_billing(): void
+    {
+        $this->organization->update([
+            'settings' => array_merge($this->organization->settings ?? [], [
+                'plan' => 'pro',
+                'plan_expires_at' => now()->addMonth()->toIso8601String(),
+            ]),
+        ]);
+
+        Member::where('user_ref', $this->user->public_id)->update([
+            'role' => 'cashier',
+            'branch_id' => Branch::firstOrFail()->id,
+        ]);
+
+        // Simulate a stale Identity grant that still includes POS.
+        \App\Support\StaffUx::remember([
+            'full_access' => false,
+            'apps' => ['care', 'pos'],
+            'show_hub' => true,
+            'show_billing' => false,
+        ]);
+
+        $this->actingAs($this->user)
+            ->get(route('care.dashboard'))
+            ->assertOk()
+            ->assertSee('Billing')
+            ->assertSee(route('care.bills.index'), false)
+            ->assertDontSee('https://pos.', false)
+            ->assertDontSee('>POS<', false);
+    }
+
    public function test_onboarding_creates_organization(): void
    {
        Organization::query()->delete();