backend: replace viewer role with pharmacy and lab department roles

Drop the unused read-only "viewer" role and remap any members (and pending
invitations) holding it to "member" via a custom migration. Add a "lab"
statement (read/write) granted to all full clinicians, plus two new
provisionable department roles: "pharmacy" (patient/appointment read,
prescription read+write — no delete, which doubles as the full-clinician
marker the frontend probes) and "lab" (patient/appointment read, task queue,
lab results via the new statement). Both join TASK_DEPARTMENTS so tasks can
be assigned to them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/CLAUDE.md

@@ -29,10 +29,13 @@ No test runner is configured. Verify by running the stack (`docker compose up`)
 
 - **`src/auth.ts`** — the Better Auth config (the CLI auto-discovers it). Email/password +
   **username** plugin (staff sign in by username) and the organization plugin (clinics) with custom
-  RBAC from **`src/lib/access.ts`** (`owner`/`admin`/`doctor`/`reception`/`member`/`viewer` over
-  `patient`/`appointment`/`prescription`/`task` resources). `reception` has no `prescription`
-  statement — it's scoped to scheduling + registration, and `src/services/patients.ts` redacts
-  clinical fields for it. Mounted in `src/index.ts` via `toNodeHandler(auth)` at `/api/auth/*`.
+  RBAC from **`src/lib/access.ts`** (`owner`/`admin`/`doctor`/`reception`/`pharmacy`/`lab`/`member`
+  over `patient`/`appointment`/`prescription`/`task`/`lab` resources). `reception` has no
+  `prescription` statement — it's scoped to scheduling + registration, and
+  `src/services/patients.ts` redacts clinical fields for it. `pharmacy` has `prescription`
+  read/write (no delete — `prescription:delete` is the full-clinician marker the frontend route
+  gating probes); `lab` submits results via the `lab` statement (`POST
+  /api/patients/:fileNumber/labs`) without `patient:write`. Mounted in `src/index.ts` via `toNodeHandler(auth)` at `/api/auth/*`.
 - **`src/routes/staff.ts`** — admin-provisioned staff: `POST /api/staff` creates a user
   (`auth.api.signUpEmail`) + attaches them to the clinic (`auth.api.addMember`); `GET /api/staff`
   lists members with usernames. Replaces the old email-invitation flow. Gated by

backend/README.md

@@ -78,12 +78,14 @@ served by Better Auth under `/api/auth/*`.
 
 ### Roles
 
-| Role | Patient access | Clinic management |
-| --- | --- | --- |
-| `owner` | read / write / delete | full |
-| `admin` | read / write / delete | members, invitations, settings |
-| `member` (clinician) | read / write | — |
-| `viewer` | read | — |
+| Role | Patient access | Prescriptions | Lab results | Clinic management |
+| --- | --- | --- | --- | --- |
+| `owner` | read / write / delete | read / write / delete | read / write | full |
+| `admin` | read / write / delete | read / write / delete | read / write | members, invitations, settings |
+| `doctor` / `member` (clinician) | read / write | read / write / delete | read / write | — |
+| `reception` | read / write (demographics) | — | — | — |
+| `pharmacy` | read | read / write | — | — |
+| `lab` | read | — | read / write | — |
 
 ## Environment
 

backend/drizzle/0011_remap_viewer_to_member.sql

@@ -0,0 +1,8 @@
+-- Custom SQL migration file, put your code below! --
+
+-- The read-only `viewer` role was removed from src/lib/access.ts. Members left
+-- with it would fail every permission check (requirePermission looks roles up
+-- by name), so remap them to `member` (clinician). Pending invitations carry a
+-- role too — cover them as well.
+UPDATE "member" SET "role" = 'member' WHERE "role" = 'viewer';--> statement-breakpoint
+UPDATE "invitation" SET "role" = 'member' WHERE "role" = 'viewer';

backend/drizzle/meta/_journal.json

@@ -78,6 +78,13 @@
       "when": 1781111039837,
       "tag": "0010_eager_hellfire_club",
       "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "7",
+      "when": 1781196252617,
+      "tag": "0011_remap_viewer_to_member",
+      "breakpoints": true
     }
   ]
 }

backend/src/lib/access.ts

@@ -8,22 +8,30 @@ import {
 
 // RBAC for clinics (organizations). We extend Better Auth's default
 // organization statements (organization / member / invitation / team) with
-// clinical resources (`patient`, `appointment`, `prescription`, `task`) so roles
-// can be granted fine-grained access to records.
+// clinical resources (`patient`, `appointment`, `prescription`, `task`, `lab`)
+// so roles can be granted fine-grained access to records. `lab` guards the
+// lab-results append endpoint so lab staff can submit analyses without
+// patient:write.
 export const statements = {
   ...defaultStatements,
   patient: ["read", "write", "delete"],
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 } as const;
 
 export const ac = createAccessControl(statements);
 
 // We keep Better Auth's default organization role names (owner / admin /
 // member) so the creator role and default membership flows work unchanged,
-// and add a read-only `viewer`. In the UI these read as Owner / Admin /
-// Clinician (member) / Viewer.
+// and add department roles (`doctor`, `reception`, `pharmacy`, `lab`). In the
+// UI these read as Owner / Admin / Doctor / Reception / Pharmacy / Lab /
+// Clinician (member).
+//
+// NOTE: `prescription: ["delete"]` doubles as the "full clinician" marker the
+// frontend route gating probes (owner/admin/doctor/member only) — don't grant
+// it to department roles like pharmacy.
 //
 // owner / admin: run the clinic AND have full access to clinical records.
 export const owner = ac.newRole({
@@ -32,6 +40,7 @@ export const owner = ac.newRole({
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 });
 
 export const admin = ac.newRole({
@@ -40,6 +49,7 @@ export const admin = ac.newRole({
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 });
 
 // member (clinician): a regular member who can read and edit clinical records.
@@ -49,6 +59,7 @@ export const member = ac.newRole({
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 });
 
 // doctor (clinician): same clinical access as `member` — the role we provision
@@ -60,6 +71,7 @@ export const doctor = ac.newRole({
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 });
 
 // reception (front desk): scheduling + patient registration only. Can manage
@@ -74,12 +86,28 @@ export const reception = ac.newRole({
   task: ["read", "write"],
 });
 
-// viewer: read-only access to clinical records.
-export const viewer = ac.newRole({
+// pharmacy (dispensing): reviews and dispenses prescriptions — read patients
+// (allergies, current meds) and appointments, read/write prescriptions (status
+// updates, NOT delete — see the full-clinician marker note above), and work
+// the task queue. Per pharmacy RBAC guidance: dispense/review, never
+// prescribe-from-scratch.
+export const pharmacy = ac.newRole({
+  ...memberAc.statements,
   patient: ["read"],
   appointment: ["read"],
-  prescription: ["read"],
-  task: ["read"],
+  prescription: ["read", "write"],
+  task: ["read", "write"],
 });
 
-export const roles = { owner, admin, doctor, reception, member, viewer };
+// lab (analyses): submits lab results via the dedicated `lab` statement (no
+// patient:write, so they can't edit the rest of the record) and works the lab
+// task queue. No prescription statement — lab staff don't see medications.
+export const lab = ac.newRole({
+  ...memberAc.statements,
+  patient: ["read"],
+  appointment: ["read"],
+  task: ["read", "write"],
+  lab: ["read", "write"],
+});
+
+export const roles = { owner, admin, doctor, reception, pharmacy, lab, member };

backend/src/lib/task-validation.ts

@@ -2,7 +2,13 @@ import { z } from "zod";
 
 // Departments a task can be assigned to (member roles). Null = a personal task
 // that belongs to its creator.
-export const TASK_DEPARTMENTS = ["admin", "doctor", "reception"] as const;
+export const TASK_DEPARTMENTS = [
+  "admin",
+  "doctor",
+  "reception",
+  "pharmacy",
+  "lab",
+] as const;
 
 // Payload accepted by POST /api/tasks (full create).
 export const taskInputSchema = z.object({

backend/src/routes/staff.ts

@@ -20,7 +20,13 @@ export const staffRouter = Router();
 
 // Roles an admin may assign — `owner` is intentionally excluded (the clinic
 // creator is the sole owner; transfer ownership via member-role updates).
-const PROVISIONABLE_ROLES = ["admin", "doctor", "reception", "viewer"] as const;
+const PROVISIONABLE_ROLES = [
+  "admin",
+  "doctor",
+  "reception",
+  "pharmacy",
+  "lab",
+] as const;
 
 const staffInputSchema = z.object({
   name: z.string().trim().min(1).max(120),
@@ -45,8 +51,8 @@ const staffInputSchema = z.object({
 
 staffRouter.use(requireAuth, requireOrg);
 
-// Clinical-capable roles that can be a patient's primary provider. Reception
-// (front desk) and viewer (read-only) are excluded.
+// Clinical-capable roles that can be a patient's primary provider. Department
+// roles (reception, pharmacy, lab) are excluded.
 const PROVIDER_ROLES = ["owner", "admin", "doctor", "member"] as const;
 
 // List clinicians who can be assigned as a patient's primary provider. Readable