improvement: QRcode and shared link added to cases inorder to make it possible for staff users to share a case info with other staffs or other clinics.

.cursor/skills/lab-case-share-link/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: dyolink-lab-case-share-link
+description: Lab case QR share link — access token, focus page, auth redirect, Cases QR UI. Use when changing share links, /lab-case/[token], lab-case-access API, or post-login redirect from share URLs.
+---
+
+# Lab case share link
+
+Shipped cases get a stable **access token** and share URL. QR + link open a focused tasks page with comments — not a public page; JWT + org context required.
+
+## Data & token lifecycle
+
+- **Schema:** `LabCase.accessToken` (`String?`, `@unique`).
+- **On first ship:** `treatments.service` sets `accessToken` + `sentAt` in the same update.
+- **Backfill:** `LabCaseAccessService.ensureAccessToken()` for older sent cases when building case detail `shareUrl`.
+- **URL:** `buildLabCaseShareUrl(token, locale)` → `{FRONTEND_URL}/{locale}/lab-case/{token}` (`backend/src/common/lab-case-access-token.ts`).
+
+## Backend API (`LabCaseAccessController`)
+
+Base path: `/lab-cases/access/:token` (JWT + selected org required).
+
+| Route | Purpose |
+|-------|---------|
+| `GET :token` | Session metadata (access mode, permissions, patient, prosthesis groups) |
+| `GET :token/tasks` | All case tasks (includes assignee for status rules) |
+| `GET/POST :token/comments` | List / add comments |
+| `PATCH :token/comments/:id/visibility` | Lab only — clinic visibility toggle |
+
+**Access resolution** (`lab-case-access.service.ts`):
+
+| Actor | View | Edit task status | Comments |
+|-------|------|------------------|----------|
+| Lab + `TAB_TASKS_READ`/`EDIT` | ✅ | ✅ if `TAB_TASKS_EDIT` + assignee rules | Post/toggle if `TAB_TASKS_EDIT` |
+| Clinic + `TAB_TREATMENT_EDIT` + **treatment provider** | ✅ | ❌ read-only | Post only (no visibility toggle) |
+| Everyone else | ❌ `LAB_CASE_ACCESS_DENIED` | | |
+
+Task status updates use **`PATCH /tasks/:id`** (not token routes) — same assignee rule as Tasks tab: unassigned or assigned-to-you only.
+
+## Frontend
+
+| Piece | Path |
+|-------|------|
+| Focus page | `app/[locale]/(dashboard)/lab-case/[token]/page.tsx` → `CaseTasksFocusView` |
+| API client | `lib/api/lab-case-access.ts` |
+| QR UI | `LabCaseShareQrCode`, `LabCaseShareQrDialog`, thumb in `CaseDetailPanel` |
+| QR package | `react-qr-code` (frontend only — no backend QR generation) |
+
+**Cases detail header:** attachment preview **left**, QR thumb **right**, same row (`w-24 sm:w-32`). QR opens dialog (large QR + URL + copy); no inline copy on panel. Only when `shareUrl` present (sent case).
+
+**Share focus page:** grouped tasks (reuse `TaskRow`, `TaskCaseGroupHeader`); comments section via `LabCaseCommentsPanel` + token API adapters. Access denied → inline message (`asApiError` for `LAB_CASE_ACCESS_DENIED`).
+
+## Auth redirect (logged out → login → back)
+
+Helpers: `lib/auth/postAuthRedirect.ts` (`sessionStorage` key `authRedirect`).
+
+1. Logged-out user hits `/lab-case/{token}` → dashboard layout stores path + `router.replace('/login?from=…')`.
+2. Login page `useSearchParams` (inside **Suspense**) calls `storeAuthRedirectFromPath(from)`.
+3. After login + org ready: **one** `consumeAuthRedirect()` on login page (wait for `!isLoading` and org selected).
+4. **Do not** `consumeAuthRedirect()` inside `useAuth.login()` — double consume sends user to `/today`.
+5. Multi-org: redirect stays in storage until `selectOrganization()` consumes it.
+
+## Tasks tab interaction
+
+Grouped sort (`sortBy=date`): **one comments control on case header** (`expandedCommentsCaseId`), not per task row. Flat sort unchanged (`showCommentsButton={flatMode}`).
+
+## i18n
+
+- `cases.*` — QR dialog strings (`shareQrDialogTitle`, `copyShareLink`, …)
+- `labCaseAccess.*` — focus page strings
+- `errors.LAB_CASE_ACCESS_DENIED` — all three locales
+
+## Verify
+
+- Backend: `npm run build`; apply migration for `accessToken`.
+- Frontend: `npx tsc --noEmit`; `next build` (login page Suspense for `useSearchParams`).