ladill-care/app/Services/Care/CarePermissions.php

<?php

namespace App\Services\Care;

use App\Models\Member;

class CarePermissions
{
    /**
     * Role abilities.
     *
     * Lab catalog pricing uses `lab.catalog.manage` (admins only via `*`).
     * Lab technicians keep `lab.manage` for queue / sample / process / results —
     * not catalog CRUD or price edits.
     *
     * @var array<string, list<string>>
     */
    protected array $roleAbilities = [
        'super_admin' => ['*'],
        'hospital_admin' => ['*'],
        'receptionist' => [
            'dashboard.view', 'patients.view', 'patients.manage',
            'appointments.view', 'appointments.manage', 'queue.manage',
            'service_queues.console',
        ],
        'doctor' => [
            'dashboard.view', 'patients.view', 'appointments.view',
            'consultations.view', 'consultations.manage',
            'investigations.request', 'prescriptions.manage',
            'lab.view', 'lab.results.view',
            'assessments.view', 'assessments.capture', 'assessments.manage',
            'pathways.manage',
            'service_queues.console',
        ],
        'nurse' => [
            'dashboard.view', 'patients.view', 'appointments.view',
            'consultations.view', 'vitals.manage',
            'service_queues.console',
            'assessments.view', 'assessments.capture',
        ],
        'lab_technician' => [
            'dashboard.view', 'patients.view', 'lab.view', 'lab.manage',
            'service_queues.console',
        ],
        'pharmacist' => [
            'dashboard.view', 'patients.view', 'prescriptions.view', 'prescriptions.dispense',
            'pharmacy.view', 'pharmacy.manage',
            'service_queues.console',
        ],
        'cashier' => [
            'dashboard.view', 'patients.view', 'bills.view', 'bills.manage', 'payments.manage',
            'service_queues.console',
        ],
        'accountant' => [
            'dashboard.view', 'bills.view', 'reports.finance.view', 'reports.finance.export',
            'audit.view', 'audit.export',
        ],
    ];

    /** @var list<string> */
    protected array $adminAbilities = [
        'admin.branches.view', 'admin.branches.manage',
        'admin.departments.view', 'admin.departments.manage',
        'admin.practitioners.view', 'admin.practitioners.manage',
        'admin.members.view', 'admin.members.manage',
        'settings.view', 'settings.manage',
        'lab.catalog.manage',
        'devices.view', 'devices.manage',
        'displays.view', 'displays.manage',
        'audit.view', 'audit.export',
    ];

    public function can(?Member $member, string $ability): bool
    {
        if ($member === null) {
            return false;
        }

        $abilities = $this->roleAbilities[$member->role] ?? [];

        if (in_array('*', $abilities, true)) {
            return true;
        }

        return in_array($ability, $abilities, true);
    }

    public function isAdmin(?Member $member): bool
    {
        return $member !== null && in_array($member->role, ['super_admin', 'hospital_admin'], true);
    }

    /**
     * Floor care: queues, specialty clinics, lab/pharmacy counters.
     * Facility admins manage settings/staff — they do not staff waiting lines.
     */
    public function handlesFloorCare(?Member $member): bool
    {
        if ($member === null || $this->isAdmin($member)) {
            return false;
        }

        return in_array($member->role, [
            'doctor',
            'nurse',
            'lab_technician',
            'pharmacist',
            'receptionist',
            'cashier',
        ], true);
    }

    /**
     * Dedicated patient-flow board (GP / specialty Queue homes).
     * Nurses keep specialty workspaces and vitals — not the call-next board.
     */
    public function canAccessPatientQueue(?Member $member): bool
    {
        if (! $this->handlesFloorCare($member)) {
            return false;
        }

        return $member->role !== 'nurse';
    }
}