improvement: QRcode and shared link added to cases inorder to make it possible for staff users to share a case info with other staffs or other clinics.

backend/src/modules/lab-case-comments/lab-case-comments.service.ts

@@ -34,6 +34,12 @@ export class LabCaseCommentsService {
     return { success: true, data: comments.map((c) => this.mapComment(c, LabCaseCommentSide.LAB)) };
   }
 
+  async listForLabViewer(caseId: string, labOrganizationId: string, actorUserId: string) {
+    await this.assertLabCanViewCase(caseId, labOrganizationId, actorUserId);
+    const comments = await this.fetchComments(caseId);
+    return { success: true, data: comments.map((c) => this.mapComment(c, LabCaseCommentSide.LAB)) };
+  }
+
   async addForLab(
     caseId: string,
     labOrganizationId: string,
@@ -219,6 +225,18 @@ export class LabCaseCommentsService {
     caseId: string,
     labOrganizationId: string,
     actorUserId: string,
+  ) {
+    await this.assertLabCanViewCase(caseId, labOrganizationId, actorUserId);
+    const membership = await this.getLabMembership(actorUserId, labOrganizationId);
+    if (!hasEffectivePermission(membership, 'TAB_TASKS_EDIT')) {
+      throw new ForbiddenException('You do not have access to task comments');
+    }
+  }
+
+  private async assertLabCanViewCase(
+    caseId: string,
+    labOrganizationId: string,
+    actorUserId: string,
   ) {
     const labCase = await this.prisma.labCase.findFirst({
       where: {
@@ -232,10 +250,20 @@ export class LabCaseCommentsService {
       throw new NotFoundException('Case not found');
     }
 
+    const membership = await this.getLabMembership(actorUserId, labOrganizationId);
+    if (
+      !hasEffectivePermission(membership, 'TAB_TASKS_READ') &&
+      !hasEffectivePermission(membership, 'TAB_TASKS_EDIT')
+    ) {
+      throw new ForbiddenException('You do not have access to tasks');
+    }
+  }
+
+  private async getLabMembership(userId: string, organizationId: string) {
     const membership = await this.prisma.membership.findFirst({
       where: {
-        userId: actorUserId,
-        organizationId: labOrganizationId,
+        userId,
+        organizationId,
         OR: [{ isOwner: true }, { isActive: true }],
       },
       include: {
@@ -246,9 +274,7 @@ export class LabCaseCommentsService {
     if (!membership) {
       throw new ForbiddenException('You are not a member of this organization');
     }
-    if (!hasEffectivePermission(membership, 'TAB_TASKS_EDIT')) {
-      throw new ForbiddenException('You do not have access to task comments');
-    }
+    return membership;
   }
 
   private async assertClinicOwnsCase(