feature: a minimal implementation of staff management is done.

frontend/src/shared/permissions.ts

@@ -0,0 +1,51 @@
+import type { Organization } from '@/types';
+
+const ROUTE_TAB_READ: { prefix: string; permission: string }[] = [
+  { prefix: '/today', permission: 'TAB_TODAY_READ' },
+  { prefix: '/patients', permission: 'TAB_PATIENTS_READ' },
+  { prefix: '/appointments', permission: 'TAB_APPOINTMENTS_READ' },
+  { prefix: '/staff', permission: 'TAB_STAFF_READ' },
+  { prefix: '/lab', permission: 'TAB_LAB_READ' },
+  { prefix: '/billing', permission: 'TAB_BILLING_READ' },
+  { prefix: '/reports', permission: 'TAB_REPORTS_READ' },
+];
+
+export function hasPermission(org: Organization | null, permission: string): boolean {
+  if (!org) return false;
+  if (org.isOwner) return true;
+  return Boolean(org.permissions?.includes(permission));
+}
+
+/** Sidebar / route guard: READ access to a tab */
+export function canViewTab(org: Organization | null, readPermission: string): boolean {
+  return hasPermission(org, readPermission);
+}
+
+export function getRequiredReadPermissionForPath(pathname: string): string | null {
+  for (const { prefix, permission } of ROUTE_TAB_READ) {
+    if (pathname === prefix || pathname.startsWith(`${prefix}/`)) {
+      return permission;
+    }
+  }
+  return null;
+}
+
+/** First dashboard route the user may open (ordered). Fallback: account settings. */
+export function firstAccessibleDashboardPath(org: Organization | null): string {
+  if (!org) return '/today';
+  if (org.isOwner) return '/today';
+  for (const { prefix, permission } of ROUTE_TAB_READ) {
+    if (hasPermission(org, permission)) return prefix;
+  }
+  return '/settings/account';
+}
+
+export function canEditStaff(org: Organization | null): boolean {
+  return hasPermission(org, 'TAB_STAFF_EDIT');
+}
+
+export function canViewStaff(org: Organization | null): boolean {
+  return (
+    hasPermission(org, 'TAB_STAFF_READ') || hasPermission(org, 'TAB_STAFF_EDIT')
+  );
+}