backend: replace viewer role with pharmacy and lab department roles

Drop the unused read-only "viewer" role and remap any members (and pending
invitations) holding it to "member" via a custom migration. Add a "lab"
statement (read/write) granted to all full clinicians, plus two new
provisionable department roles: "pharmacy" (patient/appointment read,
prescription read+write — no delete, which doubles as the full-clinician
marker the frontend probes) and "lab" (patient/appointment read, task queue,
lab results via the new statement). Both join TASK_DEPARTMENTS so tasks can
be assigned to them.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/src/lib/access.ts

@@ -8,22 +8,30 @@ import {
 
 // RBAC for clinics (organizations). We extend Better Auth's default
 // organization statements (organization / member / invitation / team) with
-// clinical resources (`patient`, `appointment`, `prescription`, `task`) so roles
-// can be granted fine-grained access to records.
+// clinical resources (`patient`, `appointment`, `prescription`, `task`, `lab`)
+// so roles can be granted fine-grained access to records. `lab` guards the
+// lab-results append endpoint so lab staff can submit analyses without
+// patient:write.
 export const statements = {
   ...defaultStatements,
   patient: ["read", "write", "delete"],
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 } as const;
 
 export const ac = createAccessControl(statements);
 
 // We keep Better Auth's default organization role names (owner / admin /
 // member) so the creator role and default membership flows work unchanged,
-// and add a read-only `viewer`. In the UI these read as Owner / Admin /
-// Clinician (member) / Viewer.
+// and add department roles (`doctor`, `reception`, `pharmacy`, `lab`). In the
+// UI these read as Owner / Admin / Doctor / Reception / Pharmacy / Lab /
+// Clinician (member).
+//
+// NOTE: `prescription: ["delete"]` doubles as the "full clinician" marker the
+// frontend route gating probes (owner/admin/doctor/member only) — don't grant
+// it to department roles like pharmacy.
 //
 // owner / admin: run the clinic AND have full access to clinical records.
 export const owner = ac.newRole({
@@ -32,6 +40,7 @@ export const owner = ac.newRole({
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 });
 
 export const admin = ac.newRole({
@@ -40,6 +49,7 @@ export const admin = ac.newRole({
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 });
 
 // member (clinician): a regular member who can read and edit clinical records.
@@ -49,6 +59,7 @@ export const member = ac.newRole({
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 });
 
 // doctor (clinician): same clinical access as `member` — the role we provision
@@ -60,6 +71,7 @@ export const doctor = ac.newRole({
   appointment: ["read", "write", "delete"],
   prescription: ["read", "write", "delete"],
   task: ["read", "write", "delete"],
+  lab: ["read", "write"],
 });
 
 // reception (front desk): scheduling + patient registration only. Can manage
@@ -74,12 +86,28 @@ export const reception = ac.newRole({
   task: ["read", "write"],
 });
 
-// viewer: read-only access to clinical records.
-export const viewer = ac.newRole({
+// pharmacy (dispensing): reviews and dispenses prescriptions — read patients
+// (allergies, current meds) and appointments, read/write prescriptions (status
+// updates, NOT delete — see the full-clinician marker note above), and work
+// the task queue. Per pharmacy RBAC guidance: dispense/review, never
+// prescribe-from-scratch.
+export const pharmacy = ac.newRole({
+  ...memberAc.statements,
   patient: ["read"],
   appointment: ["read"],
-  prescription: ["read"],
-  task: ["read"],
+  prescription: ["read", "write"],
+  task: ["read", "write"],
 });
 
-export const roles = { owner, admin, doctor, reception, member, viewer };
+// lab (analyses): submits lab results via the dedicated `lab` statement (no
+// patient:write, so they can't edit the rest of the record) and works the lab
+// task queue. No prescription statement — lab staff don't see medications.
+export const lab = ac.newRole({
+  ...memberAc.statements,
+  patient: ["read"],
+  appointment: ["read"],
+  task: ["read", "write"],
+  lab: ["read", "write"],
+});
+
+export const roles = { owner, admin, doctor, reception, pharmacy, lab, member };

backend/src/lib/task-validation.ts

@@ -2,7 +2,13 @@ import { z } from "zod";
 
 // Departments a task can be assigned to (member roles). Null = a personal task
 // that belongs to its creator.
-export const TASK_DEPARTMENTS = ["admin", "doctor", "reception"] as const;
+export const TASK_DEPARTMENTS = [
+  "admin",
+  "doctor",
+  "reception",
+  "pharmacy",
+  "lab",
+] as const;
 
 // Payload accepted by POST /api/tasks (full create).
 export const taskInputSchema = z.object({

backend/src/routes/staff.ts

@@ -20,7 +20,13 @@ export const staffRouter = Router();
 
 // Roles an admin may assign — `owner` is intentionally excluded (the clinic
 // creator is the sole owner; transfer ownership via member-role updates).
-const PROVISIONABLE_ROLES = ["admin", "doctor", "reception", "viewer"] as const;
+const PROVISIONABLE_ROLES = [
+  "admin",
+  "doctor",
+  "reception",
+  "pharmacy",
+  "lab",
+] as const;
 
 const staffInputSchema = z.object({
   name: z.string().trim().min(1).max(120),
@@ -45,8 +51,8 @@ const staffInputSchema = z.object({
 
 staffRouter.use(requireAuth, requireOrg);
 
-// Clinical-capable roles that can be a patient's primary provider. Reception
-// (front desk) and viewer (read-only) are excluded.
+// Clinical-capable roles that can be a patient's primary provider. Department
+// roles (reception, pharmacy, lab) are excluded.
 const PROVIDER_ROLES = ["owner", "admin", "doctor", "member"] as const;
 
 // List clinicians who can be assigned as a patient's primary provider. Readable