# PERM — grant every new clinical-platform permission (fresh installs + existing installs + role presets)

Read `_COMMON.md` first. Migration range `2026_11_03_220000`–`220099`. For THIS WP you own `Modules/Core/database/seeders/RolePermissionSeeder.php`, `Modules/Core/database/seeders/StandardRolesSeeder.php`, `Modules/Clinic/app/Support/ClinicPermissionDependencies.php` and the seeders list in `config/moonstack.php` (no other agent edits them now). Do NOT edit any routes file.

## Why
New platform permissions were added to RolePermissionSeeder's catalogue but are not granted to any role, and existing installs never receive them, so non-admin users get 403 on the new features.

## Permissions (all must exist in RolePermissionSeeder — some already do; add the missing ones next to their siblings)
| permission | used by | grant to roles |
|---|---|---|
| clinic.layout.manage | PUT /clinic/visit-layout/client | admin, clinic manager-type roles (read StandardRolesSeeder + RolePermissionSeeder to find the clinic admin/manager role names) |
| clinic.fields.private | private history fields/answers/attachments | doctor (and admin for now; SEC2 later strips admin medical) |
| clinic.prescriptions.update | PUT /clinic/prescriptions/{id} | doctor |
| clinic.prescriptions.inpatient | POST …/items/{i}/stop | doctor, nurse |
| clinic.rad-orders.cancel | POST /clinic/rad-orders/{o}/cancel | rad_technologist, reception, admin |
| clinic.rad-reports.print | GET /clinic/rad-reports/{r}/pdf | radiologist, doctor, reception, admin |
| clinic.rad-studies.update | PATCH /clinic/rad-studies/{s} (acquire) | rad_technologist, radiologist, admin |
| clinic.clinical-templates.view | GET /clinic/clinical-templates | doctor, radiologist, admin |
| clinic.clinical-templates.manage | POST/PUT /clinic/clinical-templates | radiologist, admin |

New role presets (create in StandardRolesSeeder following how the doctor/nurse/reception presets are built, company-scoped as the others are): **radiologist** = clinic.rad-worklist.view, clinic.rad-reports.enter, clinic.rad-reports.verify, clinic.rad-reports.release, clinic.rad-reports.print, clinic.clinical-templates.view, clinic.clinical-templates.manage, clinic.rad-studies.update (+ the basic clinic/patient view permissions the doctor preset has for reading a patient file). **rad_technologist** = clinic.rad-worklist.view, clinic.rad-studies.update, clinic.rad-orders.cancel (+ basic patient view).

## Do
1. Catalogue: ensure each permission above is in RolePermissionSeeder (verify spelling against the routes: grep `Modules/Clinic/routes/api.php` for each name).
2. Fresh installs: StandardRolesSeeder grants as in the table; add the two presets.
3. Dependencies: ClinicPermissionDependencies — read it; add entries so the role editor auto-adds what each new permission needs (e.g. prescriptions.update needs prescriptions.view; rad-orders.cancel needs rad-orders.view; clinical-templates.manage needs .view; layout.manage needs encounters.view).
4. Existing installs: ONE grant seeder `Modules/Clinic/database/seeders/GrantClinicalPlatformPermissionsSeeder.php` + ONE bridge migration `2026_11_03_220000_clinical_platform_permission_bridge.php`, following exactly the pattern of `Modules/Clinic/database/migrations/2026_10_12_190000_clinic_cashier_view_expected_permission_bridge.php` and its seeder (read both, plus any other `*_permission_bridge.php` for the idempotent grant-to-existing-roles logic: grant to roles that already hold the matching base permission — e.g. whoever has clinic.prescriptions.create gets .update; whoever has clinic.rad-reports.enter gets rad-studies.update; whoever has clinic.history.manage gets layout.manage; whoever has clinic.encounters.sign gets fields.private; whoever has clinic.rad-orders.create gets rad-orders.cancel; whoever has clinic.rad-worklist.view gets rad-reports.print + clinical-templates.view). Register the seeder in `config/moonstack.php` updater seeders list after RolePermissionSeeder (see how GrantClinicCashierViewExpectedPermissionSeeder is listed).
5. Routed tests (now that routes exist): create `Modules/Clinic/tests/Feature/PermPlatformRoutesTest.php` (helpers `perm_`) — a doctor-preset user can PUT a prescription update and GET a rad report PDF; a rad_technologist can cancel a rad order (and the line is flagged for refund through the event — RadOrderCancelled → FlagLinesForRefund is wired); reception cannot PUT visit-layout/client, a clinic admin can; the grant seeder is idempotent and gives the mapped permissions to an existing role that held the base permission. Reuse factories/fixtures from `P3ExecutorRadiologyTest.php` / `P1PrescriptionV2Test.php` (read them; copy helpers under your prefix).

Run also: `P1PrescriptionV2Test`, `P3ExecutorRadiologyTest`, `S1VisitLayoutApiTest`, `E1eAnswersTest`, `Af3AttachmentPrivacyTest`, any `*Role*Test.php`/`*Permission*Test.php` in Modules/Core and Modules/Clinic tests — keep green.

## Report
Files, the final role→permission matrix you implemented, test output.