bugfix: clinic owner user access to other (dentist)staff's treatment plans terminated.

backend/src/modules/lab-case-comments/lab-case-comments.service.ts

@@ -7,6 +7,7 @@ import { LabCaseCommentSide, LabCaseActivityType, Prisma } from '@prisma/client'
 import { PrismaService } from '../../../prisma/prisma.service';
 import { CreateLabCaseCommentDto } from './dto/lab-case-comment.dto';
 import { hasEffectivePermission } from '../../common/membership-permissions';
+import { treatmentProviderScopeWhere } from '../../common/treatment-provider-scope';
 import { LabCaseActivityService } from '../notifications/lab-case-activity.service';
 
 const commentInclude = {
@@ -273,7 +274,20 @@ export class LabCaseCommentsService {
     clinicOrganizationId: string,
     actorUserId: string,
   ) {
-    await this.assertClinicOwnsCase(caseId, clinicOrganizationId);
+    const labCase = await this.prisma.labCase.findFirst({
+      where: {
+        id: caseId,
+        treatment: {
+          organizationId: clinicOrganizationId,
+          ...treatmentProviderScopeWhere(actorUserId),
+        },
+      },
+      select: { id: true },
+    });
+    if (!labCase) {
+      throw new NotFoundException('Case not found');
+    }
+
     const membership = await this.prisma.membership.findFirst({
       where: {
         userId: actorUserId,