bugfix: clinic owner user access to other (dentist)staff's treatment plans terminated.

backend/src/common/treatment-provider-scope.ts

@@ -0,0 +1,26 @@
+import type { Prisma } from '@prisma/client';
+
+/** Treatments the clinician owns — by plan provider or linked appointment provider. */
+export function treatmentProviderScopeWhere(
+  actorUserId: string,
+): Pick<Prisma.TreatmentWhereInput, 'OR'> {
+  return {
+    OR: [
+      { providerUserId: actorUserId },
+      { appointment: { is: { providerUserId: actorUserId } } },
+    ],
+  };
+}
+
+type TreatmentProviderRow = {
+  providerUserId: string | null;
+  appointment?: { providerUserId: string } | null;
+};
+
+export function isActorTreatmentProvider(
+  treatment: TreatmentProviderRow,
+  actorUserId: string,
+): boolean {
+  if (treatment.providerUserId === actorUserId) return true;
+  return treatment.appointment?.providerUserId === actorUserId;
+}