2026-04-30 18:53:10 +03:30
10 changed files with 232 additions and 45 deletions
--- a/backend/prisma/migrations/20260430184000_add_treatment_permissions/migration.sql
+++ b/backend/prisma/migrations/20260430184000_add_treatment_permissions/migration.sql
@@ -0,0 +1,24 @@
+-- Ensure Treatment feature and permissions exist for existing databases.
+WITH treatment_feature AS (
+  INSERT INTO "features" ("id", "name")
+  VALUES (md5(random()::text || clock_timestamp()::text), 'Treatment')
+  ON CONFLICT ("name") DO UPDATE SET "name" = EXCLUDED."name"
+  RETURNING "id"
+),
+selected_feature AS (
+  SELECT "id" FROM treatment_feature
+  UNION ALL
+  SELECT f."id" FROM "features" f WHERE f."name" = 'Treatment' LIMIT 1
+)
+INSERT INTO "permissions" ("id", "name", "featureId")
+SELECT md5(random()::text || clock_timestamp()::text), 'TAB_TREATMENT_READ', sf."id"
+FROM selected_feature sf
+ON CONFLICT ("name") DO NOTHING;
+
+WITH treatment_feature AS (
+  SELECT "id" FROM "features" WHERE "name" = 'Treatment' LIMIT 1
+)
+INSERT INTO "permissions" ("id", "name", "featureId")
+SELECT md5(random()::text || clock_timestamp()::text), 'TAB_TREATMENT_EDIT', tf."id"
+FROM treatment_feature tf
+ON CONFLICT ("name") DO NOTHING;
--- a/backend/prisma/seed.ts
+++ b/backend/prisma/seed.ts
@@ -69,21 +69,25 @@ async function main() {
      name: 'Today',
      permissions: ['TAB_TODAY_READ', 'TAB_TODAY_EDIT'],
    },
+    {
+      name: 'Staff',
+      permissions: ['TAB_STAFF_READ', 'TAB_STAFF_EDIT'],
+    },
+    {
+      name: 'Labs / Clinics',
+      permissions: ['TAB_LAB_READ', 'TAB_LAB_EDIT'],
+    },
    {
      name: 'Patients',
      permissions: ['TAB_PATIENTS_READ', 'TAB_PATIENTS_EDIT'],
    },
    {
-      name: 'Appointments',
+      name: 'Appointment',
      permissions: ['TAB_APPOINTMENTS_READ', 'TAB_APPOINTMENTS_EDIT'],
    },
    {
-      name: 'Staff Management',
-      permissions: ['TAB_STAFF_READ', 'TAB_STAFF_EDIT'],
-    },
-    {
-      name: 'Lab Management',
-      permissions: ['TAB_LAB_READ', 'TAB_LAB_EDIT'],
+      name: 'Treatment',
+      permissions: ['TAB_TREATMENT_READ', 'TAB_TREATMENT_EDIT'],
    },
    {
      name: 'Billing',
--- a/backend/src/common/permissions.ts
+++ b/backend/src/common/permissions.ts
@@ -2,14 +2,16 @@
 export const ALL_TAB_PERMISSIONS = [
  'TAB_TODAY_READ',
  'TAB_TODAY_EDIT',
-  'TAB_PATIENTS_READ',
-  'TAB_PATIENTS_EDIT',
-  'TAB_APPOINTMENTS_READ',
-  'TAB_APPOINTMENTS_EDIT',
  'TAB_STAFF_READ',
  'TAB_STAFF_EDIT',
  'TAB_LAB_READ',
  'TAB_LAB_EDIT',
+  'TAB_PATIENTS_READ',
+  'TAB_PATIENTS_EDIT',
+  'TAB_APPOINTMENTS_READ',
+  'TAB_APPOINTMENTS_EDIT',
+  'TAB_TREATMENT_READ',
+  'TAB_TREATMENT_EDIT',
  'TAB_BILLING_READ',
  'TAB_BILLING_EDIT',
  'TAB_REPORTS_READ',
@@ -37,6 +39,7 @@ const EDIT_TO_READ: Record<string, string> = {
  TAB_APPOINTMENTS_EDIT: 'TAB_APPOINTMENTS_READ',
  TAB_STAFF_EDIT: 'TAB_STAFF_READ',
  TAB_LAB_EDIT: 'TAB_LAB_READ',
+  TAB_TREATMENT_EDIT: 'TAB_TREATMENT_READ',
  TAB_BILLING_EDIT: 'TAB_BILLING_READ',
  TAB_REPORTS_EDIT: 'TAB_REPORTS_READ',
 };
--- a/backend/src/modules/auth/auth.service.ts
+++ b/backend/src/modules/auth/auth.service.ts
@@ -18,14 +18,16 @@ import { JwtPayload } from './interfaces/jwt-payload.interface';
 const ALL_PERMISSIONS = [
  'TAB_TODAY_READ',
  'TAB_TODAY_EDIT',
-  'TAB_PATIENTS_READ',
-  'TAB_PATIENTS_EDIT',
-  'TAB_APPOINTMENTS_READ',
-  'TAB_APPOINTMENTS_EDIT',
  'TAB_STAFF_READ',
  'TAB_STAFF_EDIT',
  'TAB_LAB_READ',
  'TAB_LAB_EDIT',
+  'TAB_PATIENTS_READ',
+  'TAB_PATIENTS_EDIT',
+  'TAB_APPOINTMENTS_READ',
+  'TAB_APPOINTMENTS_EDIT',
+  'TAB_TREATMENT_READ',
+  'TAB_TREATMENT_EDIT',
  'TAB_BILLING_READ',
  'TAB_BILLING_EDIT',
  'TAB_REPORTS_READ',
@@ -34,10 +36,11 @@ const ALL_PERMISSIONS = [

 const READ_ONLY_PERMISSIONS = [
  'TAB_TODAY_READ',
-  'TAB_PATIENTS_READ',
-  'TAB_APPOINTMENTS_READ',
  'TAB_STAFF_READ',
  'TAB_LAB_READ',
+  'TAB_PATIENTS_READ',
+  'TAB_APPOINTMENTS_READ',
+  'TAB_TREATMENT_READ',
  'TAB_BILLING_READ',
  'TAB_REPORTS_READ',
 ];
--- a/frontend/src/app/(dashboard)/staff/components/staffPermissions.ts
+++ b/frontend/src/app/(dashboard)/staff/components/staffPermissions.ts
@@ -1,10 +1,11 @@
 /** Feature groups for staff invite/edit UI — matches backend seed */
 export const STAFF_FEATURE_GROUPS = [
  { label: 'Today', read: 'TAB_TODAY_READ', edit: 'TAB_TODAY_EDIT' },
+  { label: 'Staff', read: 'TAB_STAFF_READ', edit: 'TAB_STAFF_EDIT' },
+  { label: 'Labs / Clinics', read: 'TAB_LAB_READ', edit: 'TAB_LAB_EDIT' },
  { label: 'Patients', read: 'TAB_PATIENTS_READ', edit: 'TAB_PATIENTS_EDIT' },
-  { label: 'Appointments', read: 'TAB_APPOINTMENTS_READ', edit: 'TAB_APPOINTMENTS_EDIT' },
-  { label: 'Staff Management', read: 'TAB_STAFF_READ', edit: 'TAB_STAFF_EDIT' },
-  { label: 'Lab Management', read: 'TAB_LAB_READ', edit: 'TAB_LAB_EDIT' },
+  { label: 'Appointment', read: 'TAB_APPOINTMENTS_READ', edit: 'TAB_APPOINTMENTS_EDIT' },
+  { label: 'Treatment', read: 'TAB_TREATMENT_READ', edit: 'TAB_TREATMENT_EDIT' },
  { label: 'Billing', read: 'TAB_BILLING_READ', edit: 'TAB_BILLING_EDIT' },
  { label: 'Reports', read: 'TAB_REPORTS_READ', edit: 'TAB_REPORTS_EDIT' },
 ] as const;
--- a/frontend/src/app/(dashboard)/staff/page.tsx
+++ b/frontend/src/app/(dashboard)/staff/page.tsx
@@ -12,6 +12,7 @@ import {
  permissionNamesFromFeatureState,
  emptyFeaturePermissionState,
  featureStateFromPermissionNames,
+  resolveStaffFeatureLabel,
  formatAccessSummary,
  type FeaturePermState,
 } from './staff-permission-form';
@@ -23,6 +24,33 @@ import { Input } from '@/components/ui/common/Input';
 import { Checkbox } from '@/components/ui/common/Checkbox';
 import type { ApiError } from '@/types/api';

+type StoredInviteLink = {
+  membershipId: string;
+  email: string;
+  invitationUrl: string;
+};
+
+function inviteLinksStorageKey(orgId: string): string {
+  return `staffInviteLinks:${orgId}`;
+}
+
+function readStoredInviteLinks(orgId: string): Record<string, StoredInviteLink> {
+  if (typeof window === 'undefined') return {};
+  try {
+    const raw = window.localStorage.getItem(inviteLinksStorageKey(orgId));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw) as Record<string, StoredInviteLink>;
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeStoredInviteLinks(orgId: string, links: Record<string, StoredInviteLink>) {
+  if (typeof window === 'undefined') return;
+  window.localStorage.setItem(inviteLinksStorageKey(orgId), JSON.stringify(links));
+}
+
 function formatApiMessage(err: unknown): string {
  if (!err || typeof err !== 'object') return 'Something went wrong';
  const m = (err as ApiError).message;
@@ -35,10 +63,12 @@ function PermissionGrid({
  state,
  onChange,
  disabled,
+  organizationType,
 }: {
  state: FeaturePermState;
  onChange: (next: FeaturePermState) => void;
  disabled?: boolean;
+  organizationType?: 'CLINIC' | 'LAB';
 }) {
  const setRead = (editKey: string, read: boolean) => {
    const cur = state[editKey] ?? { read: false, edit: false };
@@ -65,7 +95,9 @@ function PermissionGrid({
            key={g.edit}
            className="flex flex-col gap-3 rounded-[var(--radius-md)] border border-border/60 bg-background-card/50 px-3 py-3"
          >
-            <span className="text-sm font-medium text-text-primary">{g.label}</span>
+            <span className="text-sm font-medium text-text-primary">
+              {resolveStaffFeatureLabel(g, organizationType)}
+            </span>
            <div className="flex flex-col gap-2.5 pl-0.5">
              <Checkbox
                checked={cell.read}
@@ -105,13 +137,15 @@ export default function StaffPage() {
  const [inviteName, setInviteName] = useState('');
  const [invitePerms, setInvitePerms] = useState(() => emptyFeaturePermissionState());
  const [inviteLoading, setInviteLoading] = useState(false);
-  const [copiedInviteLink, setCopiedInviteLink] = useState(false);
+  const [copiedInviteMembershipId, setCopiedInviteMembershipId] = useState<string | null>(null);
  const [lastInviteInfo, setLastInviteInfo] = useState<{
+    membershipId: string;
    name: string;
    email: string;
    invitationUrl: string | null;
    invitationStatus: 'PENDING' | 'ACCEPTED';
  } | null>(null);
+  const [pendingInviteLinks, setPendingInviteLinks] = useState<Record<string, StoredInviteLink>>({});

  const [editing, setEditing] = useState<StaffMemberDto | null>(null);
  const [editName, setEditName] = useState('');
@@ -140,6 +174,34 @@ export default function StaffPage() {
    }
  }, []);

+  useEffect(() => {
+    if (!currentOrganization?.id) return;
+    setPendingInviteLinks(readStoredInviteLinks(currentOrganization.id));
+  }, [currentOrganization?.id]);
+
+  useEffect(() => {
+    if (!currentOrganization?.id || loading) return;
+
+    const activeMemberIds = new Set(
+      members
+        .filter((m) => m.isOwner || m.invitationStatus === 'ACTIVE')
+        .map((m) => m.id),
+    );
+
+    let changed = false;
+    const nextLinks: Record<string, StoredInviteLink> = { ...pendingInviteLinks };
+    for (const memberId of Object.keys(nextLinks)) {
+      if (activeMemberIds.has(memberId)) {
+        delete nextLinks[memberId];
+        changed = true;
+      }
+    }
+    if (!changed) return;
+
+    setPendingInviteLinks(nextLinks);
+    writeStoredInviteLinks(currentOrganization.id, nextLinks);
+  }, [currentOrganization?.id, loading, members, pendingInviteLinks]);
+
  useEffect(() => {
    void load();
  }, [load]);
@@ -171,11 +233,24 @@ export default function StaffPage() {
        permissionNames,
      });
      setLastInviteInfo({
+        membershipId: res.data.membershipId,
        name: displayName,
        email: res.data.email,
        invitationUrl: res.data.invitationUrl,
        invitationStatus: res.data.invitationStatus,
      });
+      if (currentOrganization?.id && res.data.invitationUrl) {
+        const nextLinks = {
+          ...pendingInviteLinks,
+          [res.data.membershipId]: {
+            membershipId: res.data.membershipId,
+            email: res.data.email,
+            invitationUrl: res.data.invitationUrl,
+          },
+        };
+        setPendingInviteLinks(nextLinks);
+        writeStoredInviteLinks(currentOrganization.id, nextLinks);
+      }
      setSuccess('');
      setInviteOpen(false);
      setInviteEmail('');
@@ -328,15 +403,21 @@ export default function StaffPage() {
                  onClick={async () => {
                    try {
                      await navigator.clipboard.writeText(lastInviteInfo.invitationUrl as string);
-                      setCopiedInviteLink(true);
-                      setTimeout(() => setCopiedInviteLink(false), 1500);
+                      setCopiedInviteMembershipId(lastInviteInfo.membershipId);
+                      setTimeout(() => setCopiedInviteMembershipId(null), 1500);
                    } catch {
                      setError('Could not copy invitation link');
                    }
                  }}
                >
-                  {copiedInviteLink ? <Check className="w-4 h-4" /> : <Copy className="w-4 h-4" />}
-                  <span className="ml-1">{copiedInviteLink ? 'Copied' : 'Copy link'}</span>
+                  {copiedInviteMembershipId === lastInviteInfo.membershipId ? (
+                    <Check className="w-4 h-4" />
+                  ) : (
+                    <Copy className="w-4 h-4" />
+                  )}
+                  <span className="ml-1">
+                    {copiedInviteMembershipId === lastInviteInfo.membershipId ? 'Copied' : 'Copy link'}
+                  </span>
                </Button>
              </div>
              <p className="text-xs text-text-muted">
@@ -364,7 +445,7 @@ export default function StaffPage() {
            </thead>
            <tbody>
              {members.map((m) => (
-                <tr key={m.id} className="border-b border-border/40 last:border-0">
+                <tr key={m.id} className="h-14 border-b border-border/40 last:border-0">
                  <td className="p-3 text-text-primary">{m.name}</td>
                  <td className="p-3 text-text-secondary">{m.email}</td>
                  <td className="p-3">
@@ -374,7 +455,7 @@ export default function StaffPage() {
                      <span className="text-text-secondary">Staff</span>
                    )}
                  </td>
-                  <td className="p-3">
+                  <td className="p-3 align-middle">
                    {m.isOwner || m.invitationStatus === 'ACTIVE' ? (
                      <span className="inline-flex items-center rounded-full border border-emerald-600/40 bg-emerald-600/15 px-2 py-0.5 text-xs text-emerald-400">
                        Active
@@ -395,13 +476,36 @@ export default function StaffPage() {
                      <span className="text-text-muted">All features</span>
                    ) : (
                      <span className="line-clamp-3 text-sm leading-relaxed">
-                        {formatAccessSummary(m.permissions)}
+                        {formatAccessSummary(m.permissions, currentOrganization?.type)}
                      </span>
                    )}
                  </td>
-                  <td className="p-3">
+                  <td className="p-3 align-middle">
                    {!m.isOwner && (
-                      <div className="flex items-center gap-1">
+                      <div className="flex min-h-[36px] items-center justify-end gap-1">
+                        {m.invitationStatus === 'PENDING' && pendingInviteLinks[m.id]?.invitationUrl && (
+                          <button
+                            type="button"
+                            className="p-2 rounded-md text-text-secondary hover:bg-background-card/80 hover:text-text-primary"
+                            onClick={async () => {
+                              try {
+                                await navigator.clipboard.writeText(pendingInviteLinks[m.id].invitationUrl);
+                                setCopiedInviteMembershipId(m.id);
+                                setTimeout(() => setCopiedInviteMembershipId(null), 1500);
+                              } catch {
+                                setError('Could not copy invitation link');
+                              }
+                            }}
+                            aria-label="Copy invite link"
+                            title="Copy invite link"
+                          >
+                            {copiedInviteMembershipId === m.id ? (
+                              <Check className="w-4 h-4" />
+                            ) : (
+                              <Copy className="w-4 h-4" />
+                            )}
+                          </button>
+                        )}
                        <button
                          type="button"
                          className={`p-2 rounded-md ${
@@ -469,7 +573,11 @@ export default function StaffPage() {
            />
            <div>
              <p className="text-sm font-medium text-text-secondary mb-2">Tab access</p>
-              <PermissionGrid state={invitePerms} onChange={setInvitePerms} />
+              <PermissionGrid
+                state={invitePerms}
+                onChange={setInvitePerms}
+                organizationType={currentOrganization?.type}
+              />
            </div>
            <div className="flex justify-end gap-2 pt-2">
              <Button variant="outline" type="button" onClick={() => setInviteOpen(false)}>
@@ -500,7 +608,11 @@ export default function StaffPage() {
            <Input label="Display name" value={editName} onChange={(e) => setEditName(e.target.value)} />
            <div>
              <p className="text-sm font-medium text-text-secondary mb-2">Tab access</p>
-              <PermissionGrid state={editPerms} onChange={setEditPerms} />
+              <PermissionGrid
+                state={editPerms}
+                onChange={setEditPerms}
+                organizationType={currentOrganization?.type}
+              />
            </div>
            <div className="flex justify-end gap-2 pt-2">
              <Button variant="outline" type="button" onClick={() => setEditing(null)}>
--- a/frontend/src/app/(dashboard)/staff/staff-permission-form.ts
+++ b/frontend/src/app/(dashboard)/staff/staff-permission-form.ts
@@ -5,15 +5,27 @@

 export const STAFF_FEATURE_GROUPS = [
  { label: 'Today', read: 'TAB_TODAY_READ', edit: 'TAB_TODAY_EDIT' },
+  { label: 'Staff', read: 'TAB_STAFF_READ', edit: 'TAB_STAFF_EDIT' },
+  { label: 'Labs', read: 'TAB_LAB_READ', edit: 'TAB_LAB_EDIT' },
  { label: 'Patients', read: 'TAB_PATIENTS_READ', edit: 'TAB_PATIENTS_EDIT' },
-  { label: 'Appointments', read: 'TAB_APPOINTMENTS_READ', edit: 'TAB_APPOINTMENTS_EDIT' },
-  { label: 'Staff Management', read: 'TAB_STAFF_READ', edit: 'TAB_STAFF_EDIT' },
-  { label: 'Lab Management', read: 'TAB_LAB_READ', edit: 'TAB_LAB_EDIT' },
+  { label: 'Appointment', read: 'TAB_APPOINTMENTS_READ', edit: 'TAB_APPOINTMENTS_EDIT' },
+  { label: 'Treatment', read: 'TAB_TREATMENT_READ', edit: 'TAB_TREATMENT_EDIT' },
  { label: 'Billing', read: 'TAB_BILLING_READ', edit: 'TAB_BILLING_EDIT' },
  { label: 'Reports', read: 'TAB_REPORTS_READ', edit: 'TAB_REPORTS_EDIT' },
 ] as const;

 export type FeaturePermState = Record<string, { read: boolean; edit: boolean }>;
+export type OrgType = 'CLINIC' | 'LAB' | null | undefined;
+
+export function resolveStaffFeatureLabel(
+  group: (typeof STAFF_FEATURE_GROUPS)[number],
+  organizationType: OrgType,
+): string {
+  if (group.read === 'TAB_LAB_READ') {
+    return organizationType === 'LAB' ? 'Clinics' : 'Labs';
+  }
+  return group.label;
+}

 export function emptyFeaturePermissionState(): FeaturePermState {
  const s: FeaturePermState = {};
@@ -46,7 +58,10 @@ export function permissionNamesFromFeatureState(state: FeaturePermState): string
 }

 /** Human-readable access for the team table — feature name, or "Feature (Read only)" */
-export function formatAccessSummary(permissionNames: string[] | null | undefined): string {
+export function formatAccessSummary(
+  permissionNames: string[] | null | undefined,
+  organizationType?: OrgType,
+): string {
  if (!permissionNames?.length) return 'No tab access';
  const set = new Set(permissionNames);
  const parts: string[] = [];
@@ -54,7 +69,8 @@ export function formatAccessSummary(permissionNames: string[] | null | undefined
    const hasEdit = set.has(g.edit);
    const hasRead = set.has(g.read) || hasEdit;
    if (!hasRead) continue;
-    parts.push(hasEdit ? g.label : `${g.label} (Read only)`);
+    const label = resolveStaffFeatureLabel(g, organizationType);
+    parts.push(hasEdit ? label : `${label} (Read only)`);
  }
  return parts.length ? parts.join(' · ') : 'No tab access';
 }
--- a/frontend/src/app/(dashboard)/treatment/page.tsx
+++ b/frontend/src/app/(dashboard)/treatment/page.tsx
@@ -0,0 +1,10 @@
+export default function TreatmentPage() {
+  return (
+    <div className="space-y-3">
+      <h1 className="text-2xl font-semibold text-text-primary">Treatment</h1>
+      <p className="text-sm text-text-secondary">
+        Treatment module is coming soon.
+      </p>
+    </div>
+  );
+}
--- a/frontend/src/components/ui/common/Sidebar.tsx
+++ b/frontend/src/components/ui/common/Sidebar.tsx
@@ -17,10 +17,10 @@ import { canViewTab } from '@/shared/permissions';

 const menu = [
  { name: 'Today', path: '/today', icon: LayoutDashboard, read: 'TAB_TODAY_READ' as const },
+  { name: 'Staff', path: '/staff', icon: UserCog, read: 'TAB_STAFF_READ' as const },
  { name: 'Patients', path: '/patients', icon: Users, read: 'TAB_PATIENTS_READ' as const },
-  { name: 'Appointments', path: '/appointments', icon: Calendar, read: 'TAB_APPOINTMENTS_READ' as const },
-  { name: 'Staff Management', path: '/staff', icon: UserCog, read: 'TAB_STAFF_READ' as const },
-  { name: 'Lab Management', path: '/lab', icon: FlaskConical, read: 'TAB_LAB_READ' as const },
+  { name: 'Appointment', path: '/appointments', icon: Calendar, read: 'TAB_APPOINTMENTS_READ' as const },
+  { name: 'Treatment', path: '/treatment', icon: FlaskConical, read: 'TAB_TREATMENT_READ' as const },
  { name: 'Billing', path: '/billing', icon: CreditCard, read: 'TAB_BILLING_READ' as const },
  { name: 'Reports', path: '/reports', icon: FileText, read: 'TAB_REPORTS_READ' as const },
 ];
@@ -28,10 +28,23 @@ const menu = [
 function Sidebar() {
  const pathname = usePathname();
  const { currentOrganization } = useAuth();
+  const counterpartLabel = currentOrganization?.type === 'LAB' ? 'Clinics' : 'Labs';

  const visibleMenu = useMemo(
-    () => menu.filter((item) => canViewTab(currentOrganization, item.read)),
-    [currentOrganization],
+    () => {
+      const withCounterpartTab = [
+        menu[0],
+        menu[1],
+        { name: counterpartLabel, path: '/lab', icon: FlaskConical, read: 'TAB_LAB_READ' as const },
+        menu[2],
+        menu[3],
+        menu[4],
+        menu[5],
+        menu[6],
+      ];
+      return withCounterpartTab.filter((item) => canViewTab(currentOrganization, item.read));
+    },
+    [counterpartLabel, currentOrganization],
  );

  return (
--- a/frontend/src/shared/permissions.ts
+++ b/frontend/src/shared/permissions.ts
@@ -2,10 +2,11 @@ import type { Organization } from '@/types/organization';

 const ROUTE_TAB_READ: { prefix: string; permission: string }[] = [
  { prefix: '/today', permission: 'TAB_TODAY_READ' },
-  { prefix: '/patients', permission: 'TAB_PATIENTS_READ' },
-  { prefix: '/appointments', permission: 'TAB_APPOINTMENTS_READ' },
  { prefix: '/staff', permission: 'TAB_STAFF_READ' },
  { prefix: '/lab', permission: 'TAB_LAB_READ' },
+  { prefix: '/patients', permission: 'TAB_PATIENTS_READ' },
+  { prefix: '/appointments', permission: 'TAB_APPOINTMENTS_READ' },
+  { prefix: '/treatment', permission: 'TAB_TREATMENT_READ' },
  { prefix: '/billing', permission: 'TAB_BILLING_READ' },
  { prefix: '/reports', permission: 'TAB_REPORTS_READ' },
 ];