import { describe, it, expect, vi, beforeEach } from 'vitest';

// Mock getReadDb to return controllable rows
const mockSelect = vi.fn();
vi.mock('../../lib/db', () => ({
  getReadDb: () => ({ select: () => ({ from: () => ({ where: () => ({ limit: (_n: number) => Promise.resolve(mockSelect()) }) }) }) }),
}));

import app from '../clinic-modules';

describe('GET /clinic-modules/active', () => {
  beforeEach(() => mockSelect.mockReset());

  it('removes finance for receptionist when role template disables it', async () => {
    // 1st call: clinicModules rows
    mockSelect
      .mockResolvedValueOnce([{ moduleKey: 'finance', isEnabled: true }])
      // 2nd call: userClinicAssignments (no user override)
      .mockResolvedValueOnce([])
      // 3rd call: clinic_permission_templates row with finance=false for receptionist
      .mockResolvedValueOnce([{ permissions: { finance: false } }]);

    const res = await app.request('/active', {
      headers: { /* mocked auth headers — fill from test helpers */ },
    });

    const body: { modules: string[] } = await res.json();
    expect(body.modules).not.toContain('finance');
  });

  it('keeps finance for admin even when receptionist template disables it', async () => {
    mockSelect
      .mockResolvedValueOnce([{ moduleKey: 'finance', isEnabled: true }])
      .mockResolvedValueOnce([])
      .mockResolvedValueOnce([]); // no template row for admin

    const res = await app.request('/active', { headers: { /* admin auth */ } });
    const body: { modules: string[] } = await res.json();
    expect(body.modules).toContain('finance');
  });
});

git add server/src/routes/__tests__/clinic-modules.test.ts
git commit -m "test(clinic-modules): role-template merge fails (red)"

grep -n "clinicPermissionTemplates\|clinic_permission_templates" server/src/schema/*.ts

const clinicModuleKeys = activeModules.map(m => m.moduleKey);
const merged = new Set([...ALWAYS_ON, ...clinicModuleKeys]);
let finalModules = [...merged];

// Receptionist hardcoded blocklist (kept for backward compat)
const RECEPTIONIST_BLOCKED = new Set(['expenses', 'analytics', 'dental_chart']);
if (user.role === 'receptionist') {
    finalModules = finalModules.filter(key => !RECEPTIONIST_BLOCKED.has(key));
}

// Per-clinic per-role template (e.g., "Dental Square reception: no finance")
const [roleTemplate] = await db.select({ permissions: clinicPermissionTemplates.permissions })
    .from(clinicPermissionTemplates)
    .where(and(
        eq(clinicPermissionTemplates.clinicId, currentClinicId),
        eq(clinicPermissionTemplates.role, user.role as any),
    ))
    .limit(1);

if (roleTemplate?.permissions) {
    const rolePerms = roleTemplate.permissions as Record<string, boolean>;
    finalModules = finalModules.filter(key => rolePerms[key] !== false);
    Object.keys(rolePerms).forEach(key => {
        if (rolePerms[key] === true && !finalModules.includes(key)) {
            finalModules.push(key);
        }
    });
}

// Per-user override (highest precedence — superadmin grants/revokes per user)
if (assignment?.permissions) {
    const userPerms = assignment.permissions as Record<string, boolean>;
    finalModules = finalModules.filter(key => userPerms[key] !== false);
    Object.keys(userPerms).forEach(key => {
        if (userPerms[key] === true && !finalModules.includes(key)) {
            finalModules.push(key);
        }
    });
}

import { clinicModules, userClinicAssignments, clinicPermissionTemplates } from '../schema';

git add server/src/routes/clinic-modules.ts
git commit -m "feat(clinic-modules): merge clinic_permission_templates into /active"

grep -rn "finance\|Finance" /Users/ssh/Documents/Beta-App/odontoX/ui/src --include="*.tsx" | \
  grep -iE "navigate|onclick|to=|href|module|card|nav" | head -30

const { hasModule } = useModules();
if (!hasModule('finance')) return null;

git add ui/src/...
git commit -m "fix(finance): gate stray Finance entry points on hasModule('finance')"

-- Dental Square: hide finance module for receptionist role.
-- Per the no-live-tenant-execution rule, this script is committed but NOT executed automatically.
-- Run only after explicit per-action user confirmation against the production connection string.

-- 1. Resolve the clinic id for "Dental Square" — verify before running
-- SELECT id, name FROM app.clinics WHERE name ILIKE '%dental square%';

-- 2. Upsert the role template
INSERT INTO app.clinic_permission_templates (id, clinic_id, role, permissions, updated_at)
VALUES (
  gen_random_uuid()::text,
  :'clinic_id',
  'receptionist',
  jsonb_build_object('finance', false),
  NOW()
)
ON CONFLICT (clinic_id, role) DO UPDATE
SET permissions = COALESCE(app.clinic_permission_templates.permissions, '{}'::jsonb) || jsonb_build_object('finance', false),
    updated_at = NOW();

-- 3. Verify
SELECT clinic_id, role, permissions FROM app.clinic_permission_templates
WHERE clinic_id = :'clinic_id' AND role = 'receptionist';

git add server/scripts/dental-square-hide-finance.sql
git commit -m "feat(scripts): SQL to disable finance for Dental Square reception"

### Merge order for `modules` response

The endpoint computes the user's visible module list in this order, each later layer overriding the previous:

1. `ALWAYS_ON` core modules.
2. `clinic_modules.is_enabled = true` rows for the current clinic.
3. Receptionist hardcoded blocklist (`expenses`, `analytics`, `dental_chart`).
4. `clinic_permission_templates.permissions` for `(clinic_id, user.role)` — `false` removes, `true` grants.
5. `user_clinic_assignments.permissions` for `(clinic_id, user.id)` — same semantics, highest precedence.

git add docs/api-reference.md
git commit -m "docs(api): document clinic-modules merge order"

sed -n '450,475p' ui/src/components/receptionist/ReceptionistOverview.tsx

git add ui/src/components/receptionist/ReceptionistOverview.tsx
git commit -m "fix(reception): remove stale Messages card (chat globally deprecated)"

grep -n "import.*Message\|MessageSquare\|MessageCircle" ui/src/components/patients/PatientDetails.tsx

git add ui/src/components/patients/PatientDetails.tsx
git commit -m "fix(patients): remove stale Message button (chat globally deprecated)"

toast("You have unread updates", {
    description: `There are ${unread} notifications waiting for you.`,
    duration: 8000,
    className: "border-primary bg-primary/10 text-primary-foreground",
    // action removed — chat globally deprecated
});

git add ui/src/components/providers/NotificationProvider.tsx
git commit -m "fix(notifications): drop stale 'View Inbox' chat action"

grep -rn "chat=1\|navigate.*chat" ui/src --include="*.tsx" | grep -v "components/chat" | grep -v "components/chat-v2"

git add ui/src/components/layout/AppLayout.tsx
git commit -m "chore(layout): drop dead chat URL-strip handler"

grep -rn "chat" server/src/schema/mobile_role_permissions.ts server/src/lib/seeds/ 2>/dev/null | head

git add server/src/schema/mobile_role_permissions.ts
git commit -m "chore(mobile-perms): drop chat from receptionist defaults"

import { describe, it, expect } from 'vitest';
import { detectConflicts } from '../detectConflicts';

describe('detectConflicts — unassigned appointments', () => {
  it('allows two NULL-doctor appointments at the same time', () => {
    const existing = [{
      id: 'a1', doctorId: null, operatory: null,
      appointmentTime: '09:00', durationMinutes: 30,
    }];
    const result = detectConflicts(existing, {
      clinicId: 'c1', appointmentDate: '2026-05-23',
      appointmentTime: '09:00', durationMinutes: 30,
      doctorId: null, operatory: null,
    } as any);
    expect(result.allowed).toBe(true);
  });

  it('blocks same-doctor overlap', () => {
    const existing = [{
      id: 'a1', doctorId: 'd1', operatory: null,
      appointmentTime: '09:00', durationMinutes: 30,
    }];
    const result = detectConflicts(existing, {
      clinicId: 'c1', appointmentDate: '2026-05-23',
      appointmentTime: '09:15', durationMinutes: 30,
      doctorId: 'd1', operatory: null,
    } as any);
    expect(result.allowed).toBe(false);
    expect(result.code).toBe('CONFLICT');
  });
});

git add server/src/lib/rules/scheduling/__tests__/unassigned-booking.test.ts
git commit -m "test(scheduling): codify unassigned-booking-stacking behavior"

grep -n "in_progress\|status.*update\|PATCH" server/src/routes/appointments.ts | head -20

it('rejects status=in_progress when doctor_id is null', async () => {
  // Seed an appointment with doctorId=null
  const apptId = await seedAppointment({ doctorId: null, status: 'scheduled' });
  const res = await app.request(`/appointments/${apptId}`, {
    method: 'PATCH',
    headers: { 'content-type': 'application/json', /* auth */ },
    body: JSON.stringify({ status: 'in_progress' }),
  });
  expect(res.status).toBe(400);
  const body = await res.json() as { code: string };
  expect(body.code).toBe('UNASSIGNED_APPOINTMENT');
});

if (body.status === 'in_progress') {
  const [current] = await db.select({ doctorId: appointments.doctorId })
    .from(appointments).where(eq(appointments.id, appointmentId)).limit(1);
  if (!current || !current.doctorId) {
    return c.json({
      code: 'UNASSIGNED_APPOINTMENT',
      message: 'Assign a doctor before starting this appointment.',
    }, 400);
  }
}

git add server/src/routes/appointments.ts server/src/routes/__tests__/appointments.test.ts
git commit -m "feat(appointments): block in_progress transition without doctor"

it('PATCH /:id/assign-doctor assigns the doctor and audits', async () => {
  const apptId = await seedAppointment({ doctorId: null, status: 'scheduled' });
  const doctorId = await seedDoctor({ accountType: 'login' });
  const res = await app.request(`/appointments/${apptId}/assign-doctor`, {
    method: 'PATCH',
    headers: { 'content-type': 'application/json', /* receptionist auth */ },
    body: JSON.stringify({ doctorId }),
  });
  expect(res.status).toBe(200);
  const [row] = await db.select().from(appointments).where(eq(appointments.id, apptId)).limit(1);
  expect(row.doctorId).toBe(doctorId);
});

it('returns 409 when target doctor has a hard conflict', async () => {
  const doctorId = await seedDoctor({ accountType: 'login' });
  await seedAppointment({ doctorId, status: 'scheduled', appointmentTime: '09:00', durationMinutes: 30 });
  const unassignedId = await seedAppointment({ doctorId: null, status: 'scheduled', appointmentTime: '09:00', durationMinutes: 30 });
  const res = await app.request(`/appointments/${unassignedId}/assign-doctor`, {
    method: 'PATCH', headers: { /* auth */ },
    body: JSON.stringify({ doctorId }),
  });
  expect(res.status).toBe(409);
});

import { canCreateAppointment } from '../lib/rules/scheduling/canCreateAppointment';

const assignDoctorSchema = z.object({ doctorId: z.string().uuid() });

appointmentsRoute.patch('/:id/assign-doctor', async (c) => {
  const user = c.get('user');
  const clinicId = c.get('clinicContext')?.currentClinicId;
  if (!clinicId) return c.json({ error: 'No clinic context' }, 400);

  // Permission: receptionist, admin, doctor (any) can reassign
  if (!['admin', 'receptionist', 'doctor', 'superadmin'].includes(user.role)) {
    return c.json({ error: 'Forbidden' }, 403);
  }

  const apptId = c.req.param('id');
  const body = assignDoctorSchema.parse(await c.req.json());

  const db = getDb();
  const [appt] = await db.select().from(appointments)
    .where(and(eq(appointments.id, apptId), eq(appointments.clinicId, clinicId)))
    .limit(1);
  if (!appt) return c.json({ error: 'Appointment not found' }, 404);

  // Verify the target doctor exists at this clinic
  const [doctor] = await db.select({ id: users.id, accountType: users.accountType })
    .from(users)
    .innerJoin(userClinicAssignments, eq(userClinicAssignments.userId, users.id))
    .where(and(
      eq(users.id, body.doctorId),
      eq(userClinicAssignments.clinicId, clinicId),
      eq(userClinicAssignments.role, 'doctor'),
    ))
    .limit(1);
  if (!doctor) return c.json({ error: 'Doctor not found at this clinic' }, 404);

  // Run the conflict check against the new doctor
  const ruleResult = await canCreateAppointment(getReadDb(), {
    clinicId,
    doctorId: body.doctorId,
    patientId: appt.patientId,
    appointmentDate: appt.appointmentDate,
    appointmentTime: appt.appointmentTime,
    durationMinutes: appt.durationMinutes ?? 30,
    operatory: appt.operatory,
    existingAppointmentId: appt.id,
  });
  if (!ruleResult.allowed) {
    return c.json({ code: ruleResult.code, message: ruleResult.message }, 409);
  }

  const previousDoctorId = appt.doctorId;
  await db.update(appointments)
    .set({ doctorId: body.doctorId, updatedAt: new Date() })
    .where(eq(appointments.id, apptId));

  // Audit log
  await db.insert(auditLog).values({
    clinicId, actorUserId: user.id, event: 'appointment.assign_doctor',
    payload: { appointmentId: apptId, from: previousDoctorId, to: body.doctorId },
    createdAt: new Date(),
  });

  // SSE broadcast (use the existing helper)
  await broadcastAppointmentChange(clinicId, apptId, 'reassigned');

  return c.json({ ok: true, doctorId: body.doctorId });
});

git add server/src/routes/appointments.ts server/src/routes/__tests__/appointments.test.ts
git commit -m "feat(appointments): PATCH /:id/assign-doctor with conflict check + audit"

grep -rn "getClinicUsers\|clinic.*users\|listClinicDoctors" server/src/routes/ | head

accountType: users.accountType,

git add server/src/routes/staff.ts
git commit -m "feat(staff): expose accountType in doctor list response"

import { useState } from 'react';
import { useQuery } from '@tanstack/react-query';
import { getClinicDoctors } from '../../lib/serverComm';
import { Button } from '../ui/button';
import { Input } from '../ui/input';
import { Badge } from '../ui/badge';
import { Popover, PopoverTrigger, PopoverContent } from '../ui/popover';
import { UserPlus, Search } from 'lucide-react';

interface Doctor {
  id: string;
  firstName: string;
  lastName: string;
  accountType: 'login' | 'visiting';
}

interface DoctorPickerProps {
  value: string | null;
  onChange: (doctorId: string) => void;
  trigger?: React.ReactNode;
  showAddVisiting?: boolean;
  onAddVisiting?: () => void;
}

export function DoctorPicker({ value, onChange, trigger, showAddVisiting, onAddVisiting }: DoctorPickerProps) {
  const [open, setOpen] = useState(false);
  const [search, setSearch] = useState('');
  const { data: doctors = [] } = useQuery({
    queryKey: ['clinic-doctors'],
    queryFn: getClinicDoctors,
  });

  const filtered = doctors.filter((d: Doctor) =>
    `${d.firstName} ${d.lastName}`.toLowerCase().includes(search.toLowerCase())
  );

  return (
    <Popover open={open} onOpenChange={setOpen}>
      <PopoverTrigger asChild>
        {trigger ?? <Button variant="outline" size="sm">Pick doctor</Button>}
      </PopoverTrigger>
      <PopoverContent className="w-72 p-2" align="start">
        <div className="flex items-center gap-2 px-2 pb-2">
          <Search className="h-4 w-4 text-muted-foreground" />
          <Input
            value={search}
            onChange={(e) => setSearch(e.target.value)}
            placeholder="Search doctors..."
            className="h-8"
          />
        </div>
        <div className="max-h-64 overflow-y-auto">
          {filtered.map((d: Doctor) => (
            <button
              key={d.id}
              className="w-full text-left px-2 py-2 hover:bg-accent rounded flex items-center justify-between"
              onClick={() => { onChange(d.id); setOpen(false); }}
            >
              <span>Dr. {d.firstName} {d.lastName}</span>
              {d.accountType === 'visiting' && (
                <Badge variant="secondary" className="text-xs">Visiting</Badge>
              )}
            </button>
          ))}
          {filtered.length === 0 && (
            <div className="px-2 py-4 text-center text-sm text-muted-foreground">
              No doctors found
            </div>
          )}
        </div>
        {showAddVisiting && (
          <div className="border-t mt-2 pt-2">
            <Button
              variant="ghost" size="sm" className="w-full justify-start gap-2"
              onClick={() => { setOpen(false); onAddVisiting?.(); }}
            >
              <UserPlus className="h-4 w-4" /> Add visiting doctor
            </Button>
          </div>
        )}
      </PopoverContent>
    </Popover>
  );
}

export async function getClinicDoctors() {
  const res = await fetch('/api/staff?role=doctor', { credentials: 'include' });
  if (!res.ok) throw new Error('Failed to fetch doctors');
  return res.json();
}

git add ui/src/components/appointments/DoctorPicker.tsx ui/src/lib/serverComm.ts
git commit -m "feat(appointments): shared DoctorPicker with visiting-doctor support"

grep -rn "doctorName\|doctor.*Name\|doctorId" ui/src/components/appointments/ --include="*.tsx" | grep -iE "render|return|td|td>" | head

{doctorId ? (
  <span>Dr. {doctorName}</span>
) : (
  <Badge variant="warning" className="bg-amber-100 text-amber-900 border-amber-300">
    Assign doctor
  </Badge>
)}

<DoctorPicker
  value={doctorId}
  onChange={async (id) => {
    await assignDoctor(appointmentId, id); // new serverComm helper
    queryClient.invalidateQueries({ queryKey: ['appointments'] });
  }}
  trigger={<Badge variant="warning" className="cursor-pointer">Assign doctor</Badge>}
  showAddVisiting={hasPermission('staff.create.visiting')}
  onAddVisiting={() => setAddVisitingOpen(true)}
/>

export async function assignDoctor(appointmentId: string, doctorId: string) {
  const res = await fetch(`/api/appointments/${appointmentId}/assign-doctor`, {
    method: 'PATCH',
    headers: { 'content-type': 'application/json' },
    credentials: 'include',
    body: JSON.stringify({ doctorId }),
  });
  if (!res.ok) {
    const body = await res.json();
    throw new Error(body.message || 'Failed to assign doctor');
  }
  return res.json();
}

git add ui/src/components/appointments/ ui/src/lib/serverComm.ts
git commit -m "feat(appointments): Assign-doctor badge + picker on list rows"

grep -n "doctorName\|Doctor:" ui/src/components/appointments/AppointmentRightRail.tsx

<div className="flex items-center justify-between">
  <span className="text-sm text-muted-foreground">Doctor</span>
  {appointment.doctorId ? (
    <div className="flex items-center gap-2">
      <span className="font-medium">Dr. {appointment.doctorName}</span>
      <DoctorPicker
        value={appointment.doctorId}
        onChange={(id) => assignDoctor(appointment.id, id).then(refetch)}
        trigger={<Button variant="ghost" size="sm" className="text-xs">Reassign</Button>}
      />
    </div>
  ) : (
    <DoctorPicker
      value={null}
      onChange={(id) => assignDoctor(appointment.id, id).then(refetch)}
      trigger={
        <Button variant="outline" size="sm" className="text-amber-700 border-amber-400">
          Assign doctor
        </Button>
      }
    />
  )}
</div>

<Button
  disabled={!appointment.doctorId}
  title={!appointment.doctorId ? 'Assign a doctor first' : undefined}
  onClick={handleStart}
>
  Start appointment
</Button>

git add ui/src/components/appointments/AppointmentRightRail.tsx ui/src/components/appointments/AppointmentDetailPage.tsx
git commit -m "feat(appointments): right-rail reassign + disabled start when unassigned"

grep -rn "lane\|doctorColumn\|doctorLanes\|groupBy.*doctor" ui/src/components/appointments/ --include="*.tsx" | head

git add ui/src/components/appointments/
git commit -m "feat(calendar): Unassigned lane for null-doctor appointments"

### PATCH /appointments/:id/assign-doctor

Reassign or first-time-assign a doctor to an appointment.

**Auth:** any clinic user (admin, doctor, receptionist, superadmin).

**Body:** `{ "doctorId": "<uuid>" }`

**Responses:**
- `200 { ok: true, doctorId }` — success.
- `404` — appointment or doctor not found at this clinic.
- `409 { code: 'CONFLICT' | '...', message }` — target doctor has a scheduling conflict.

**Behavior:** Writes an `appointment.assign_doctor` audit log entry (with `from`/`to` doctor ids) and broadcasts an SSE update on the clinic's appointments channel.

**Status transitions:**
- `in_progress` is rejected with `{ code: 'UNASSIGNED_APPOINTMENT' }` when `doctor_id` is null.

git add docs/api-reference.md
git commit -m "docs(api): document assign-doctor + unassigned status guard"

ALTER TABLE app.users
  ADD COLUMN account_type TEXT NOT NULL DEFAULT 'login'
    CHECK (account_type IN ('login', 'visiting'));

CREATE INDEX users_account_type_idx ON app.users(account_type);

accountType: text('account_type').default('login').notNull(), // 'login' | 'visiting'

git add server/drizzle/0052_user_account_type.sql server/src/schema/users.ts
git commit -m "feat(db): add users.account_type column (migration 0052)"

it('rejects sign-in for account_type=visiting with generic error', async () => {
  const email = `visit-${Date.now()}@example.com`;
  await seedUser({ email, accountType: 'visiting', passwordHash: null });
  const res = await app.request('/auth/signin', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ email, password: 'whatever' }),
  });
  expect(res.status).toBe(401);
});

if (user.accountType === 'visiting') {
  // Generic invalid-credentials response — avoid email enumeration
  return c.json({ error: 'Invalid credentials' }, 401);
}

cd server && pnpm test src/routes/__tests__/auth.test.ts -t "visiting"

git add server/src/routes/auth.ts server/src/routes/__tests__/auth.test.ts
git commit -m "feat(auth): reject visiting-account sign-in"

it('POST /staff/visiting-doctor creates a no-login doctor as receptionist', async () => {
  const res = await app.request('/staff/visiting-doctor', {
    method: 'POST',
    headers: { 'content-type': 'application/json', /* receptionist auth */ },
    body: JSON.stringify({
      firstName: 'Alex', lastName: 'Visit',
      email: `alex-${Date.now()}@example.com`,
      phone: '+1-555-0100', specialty: 'Orthodontics',
    }),
  });
  expect(res.status).toBe(201);
  const body = await res.json() as { id: string; accountType: string };
  expect(body.accountType).toBe('visiting');

  const [row] = await db.select().from(users).where(eq(users.id, body.id));
  expect(row.passwordHash).toBeNull();
  expect(row.onboardingToken).toBeNull();
});

import { requirePermission } from '../middleware/permissions';

const visitingDoctorSchema = z.object({
  firstName: z.string().min(1),
  lastName: z.string().min(1),
  email: z.string().email(),
  phone: z.string().optional(),
  specialty: z.string().optional(),
});

staffRoute.post('/visiting-doctor',
  requirePermission('staff.create.visiting'),
  async (c) => {
    const user = c.get('user');
    const clinicId = c.get('clinicContext')?.currentClinicId;
    if (!clinicId) return c.json({ error: 'No clinic context' }, 400);

    const body = visitingDoctorSchema.parse(await c.req.json());
    const db = getDb();

    // Reject duplicate emails (across visiting + login)
    const [existing] = await db.select({ id: users.id }).from(users)
      .where(eq(users.email, body.email)).limit(1);
    if (existing) return c.json({ error: 'Email already in use' }, 409);

    const userId = crypto.randomUUID();
    await db.insert(users).values({
      id: userId,
      email: body.email,
      passwordHash: null,
      firstName: body.firstName,
      lastName: body.lastName,
      role: 'doctor',
      accountType: 'visiting',
      status: 'active',
      isActive: true,
      isOnboarded: true,
      authProvider: 'visiting',
      clinicId,
      primaryClinicId: clinicId,
      createdAt: new Date(),
      updatedAt: new Date(),
    });

    await db.insert(userClinicAssignments).values({
      id: crypto.randomUUID(),
      userId, clinicId,
      role: 'doctor',
      status: 'active',
      createdAt: new Date(),
      updatedAt: new Date(),
    });

    // Audit
    await db.insert(auditLog).values({
      clinicId, actorUserId: user.id, event: 'staff.create_visiting_doctor',
      payload: { userId, email: body.email },
      createdAt: new Date(),
    });

    return c.json({ id: userId, accountType: 'visiting' }, 201);
  }
);

ls server/src/middleware/permissions* 2>/dev/null

import type { MiddlewareHandler } from 'hono';
import { getReadDb } from '../lib/db';
import { clinicPermissionTemplates, userClinicAssignments } from '../schema';
import { and, eq } from 'drizzle-orm';

export function requirePermission(key: string): MiddlewareHandler {
  return async (c, next) => {
    const user = c.get('user');
    const clinicId = c.get('clinicContext')?.currentClinicId;
    if (!user || !clinicId) return c.json({ error: 'Unauthorized' }, 401);

    // Admin + superadmin implicitly allowed
    if (user.role === 'admin' || user.role === 'superadmin') return next();

    const db = getReadDb();
    // Per-user override wins
    const [assn] = await db.select({ permissions: userClinicAssignments.permissions })
      .from(userClinicAssignments)
      .where(and(eq(userClinicAssignments.userId, user.id), eq(userClinicAssignments.clinicId, clinicId)))
      .limit(1);
    const userPerm = (assn?.permissions as Record<string, boolean> | undefined)?.[key];
    if (userPerm === true) return next();
    if (userPerm === false) return c.json({ error: 'Forbidden' }, 403);

    // Role template
    const [tpl] = await db.select({ permissions: clinicPermissionTemplates.permissions })
      .from(clinicPermissionTemplates)
      .where(and(eq(clinicPermissionTemplates.clinicId, clinicId), eq(clinicPermissionTemplates.role, user.role as any)))
      .limit(1);
    if ((tpl?.permissions as Record<string, boolean> | undefined)?.[key] === true) return next();

    // Defaults: receptionist has staff.create.visiting by default
    const DEFAULTS: Record<string, string[]> = {
      'staff.create.visiting': ['admin', 'receptionist', 'superadmin'],
    };
    if (DEFAULTS[key]?.includes(user.role)) return next();

    return c.json({ error: 'Forbidden' }, 403);
  };
}

cd server && pnpm test src/routes/__tests__/staff.test.ts -t "visiting-doctor"

git add server/src/routes/staff.ts server/src/middleware/permissions.ts server/src/routes/__tests__/staff.test.ts
git commit -m "feat(staff): POST /staff/visiting-doctor (receptionist-allowed)"

accountType: users.accountType,

git add server/src/routes/staff.ts
git commit -m "feat(staff): expose accountType in staff list"

import { useState } from 'react';
import { useMutation, useQueryClient } from '@tanstack/react-query';
import { Sheet, SheetContent, SheetHeader, SheetTitle, SheetTrigger } from '../ui/sheet';
import { Button } from '../ui/button';
import { Input } from '../ui/input';
import { Label } from '../ui/label';
import { addVisitingDoctor } from '../../lib/serverComm';
import { toast } from 'sonner';

interface AddVisitingDoctorSheetProps {
  trigger: React.ReactNode;
  onCreated?: (id: string) => void;
}

export function AddVisitingDoctorSheet({ trigger, onCreated }: AddVisitingDoctorSheetProps) {
  const [open, setOpen] = useState(false);
  const [form, setForm] = useState({ firstName: '', lastName: '', email: '', phone: '', specialty: '' });
  const queryClient = useQueryClient();

  const mutation = useMutation({
    mutationFn: addVisitingDoctor,
    onSuccess: ({ id }) => {
      toast.success('Visiting doctor added');
      queryClient.invalidateQueries({ queryKey: ['staff'] });
      queryClient.invalidateQueries({ queryKey: ['clinic-doctors'] });
      setOpen(false);
      setForm({ firstName: '', lastName: '', email: '', phone: '', specialty: '' });
      onCreated?.(id);
    },
    onError: (e: Error) => toast.error(e.message),
  });

  return (
    <Sheet open={open} onOpenChange={setOpen}>
      <SheetTrigger asChild>{trigger}</SheetTrigger>
      <SheetContent side="right" className="sm:max-w-md">
        <SheetHeader>
          <SheetTitle>Add visiting doctor</SheetTitle>
          <p className="text-sm text-muted-foreground">
            Visiting doctors don't get login access. Add their contact info so reception can assign appointments to them.
          </p>
        </SheetHeader>
        <form className="space-y-4 mt-6" onSubmit={(e) => { e.preventDefault(); mutation.mutate(form); }}>
          <div className="grid grid-cols-2 gap-3">
            <div>
              <Label htmlFor="firstName">First name</Label>
              <Input id="firstName" required value={form.firstName}
                onChange={(e) => setForm(f => ({ ...f, firstName: e.target.value }))} />
            </div>
            <div>
              <Label htmlFor="lastName">Last name</Label>
              <Input id="lastName" required value={form.lastName}
                onChange={(e) => setForm(f => ({ ...f, lastName: e.target.value }))} />
            </div>
          </div>
          <div>
            <Label htmlFor="email">Email</Label>
            <Input id="email" type="email" required value={form.email}
              onChange={(e) => setForm(f => ({ ...f, email: e.target.value }))} />
          </div>
          <div>
            <Label htmlFor="phone">Phone</Label>
            <Input id="phone" value={form.phone}
              onChange={(e) => setForm(f => ({ ...f, phone: e.target.value }))} />
          </div>
          <div>
            <Label htmlFor="specialty">Specialty (optional)</Label>
            <Input id="specialty" value={form.specialty}
              onChange={(e) => setForm(f => ({ ...f, specialty: e.target.value }))} />
          </div>
          <Button type="submit" className="w-full" disabled={mutation.isPending}>
            {mutation.isPending ? 'Adding…' : 'Add visiting doctor'}
          </Button>
        </form>
      </SheetContent>
    </Sheet>
  );
}

export async function addVisitingDoctor(payload: {
  firstName: string; lastName: string; email: string; phone?: string; specialty?: string;
}) {
  const res = await fetch('/api/staff/visiting-doctor', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    credentials: 'include',
    body: JSON.stringify(payload),
  });
  if (!res.ok) {
    const body = await res.json();
    throw new Error(body.error || 'Failed to add visiting doctor');
  }
  return res.json() as Promise<{ id: string; accountType: 'visiting' }>;
}

git add ui/src/components/settings/AddVisitingDoctorSheet.tsx ui/src/lib/serverComm.ts
git commit -m "feat(staff): AddVisitingDoctorSheet UI"

<AddVisitingDoctorSheet
  trigger={
    <Button variant="outline" className="gap-2">
      <UserPlus className="h-4 w-4" />
      Add visiting doctor
    </Button>
  }
/>

{member.accountType === 'visiting' && (
  <Badge variant="secondary" className="text-xs ml-2">Visiting</Badge>
)}

{member.accountType !== 'visiting' && (
  <>
    <Button onClick={resendInvite}>Resend invite</Button>
    <Button onClick={resetPassword}>Reset password</Button>
  </>
)}

git add ui/src/components/settings/StaffManagement.tsx
git commit -m "feat(staff): wire visiting-doctor sheet + badge into StaffManagement"

grep -rn "staff\|Staff" ui/src/components/superadmin/tenants/ --include="*.tsx" | head

<span className="text-sm text-muted-foreground">
  {totalStaff} staff ({loginCount} login, {visitingCount} visiting)
</span>

git add ui/src/components/superadmin/tenants/
git commit -m "feat(superadmin): visiting-doctor count + badge in tenant staff tab"

grep -rn "staff.create\|staff.invite\|permission.*tree\|PERMISSION_KEYS" server/src/ ui/src/ | head -10

{ key: 'staff.create.visiting', label: 'Add visiting (no-login) doctors',
  defaults: { admin: true, receptionist: true, doctor: false, superadmin: true } },

git add server/src/lib/permissions.ts
git commit -m "feat(permissions): add staff.create.visiting key"

### POST /staff/visiting-doctor

Create a visiting (no-login) doctor.

**Auth:** requires `staff.create.visiting` permission (default: admin + receptionist).

**Body:**
```json
{
  "firstName": "Alex",
  "lastName": "Visit",
  "email": "[email protected]",
  "phone": "+1-555-0100",
  "specialty": "Orthodontics"
}

Also note in the existing `GET /staff` section: response now includes `accountType: 'login' | 'visiting'` per row.

- [ ] **Step 2: Commit**

```bash
git add docs/api-reference.md
git commit -m "docs(api): document POST /staff/visiting-doctor"