Roles & Permissions

EaseLab uses role-based access control (RBAC) at the tenant level. Roles bundle permissions; users inherit the union of all assigned roles. Permissions follow a {module}.{action} pattern where action is view, create, edit, or delete.

Screen: /admin/roles
Required permission: roles.view

Permission model

flowchart LR
    G[Permission Group] --> M[Module]
    M --> V[view]
    M --> C[create]
    M --> E[edit]
    M --> D[delete]
    G --> Q[Quick Access shortcuts]

Legacy manage codes

Older roles may use shorthand codes such as users.manage. The system expands these to full create/edit/delete rights for that module. New roles should use granular CRUD toggles in the UI matrix.

Invoice deletion

invoices.delete is also satisfied by the legacy code invoices.delete (standalone) in addition to invoices.delete from the CRUD matrix. Treat delete access as highly restricted.

Built-in roles

Role	Color	Description
Admin	Blue	All permissions
Lab Technician	Cyan	Bench workflow: samples, results, catalog read
Receptionist	Green	Front desk: patients, invoices, collection
Viewer	Gray	Read-only across core modules

Customize or duplicate these roles for your organization.

---

Admin group

Staff, catalog, and lab configuration

Module	Label	View	Create	Edit	Delete
users	Users	✓	✓	✓	✓
roles	Roles & Permissions	✓	✓	✓	✓
sms_log	SMS Log	✓	✓	✓	✓
sample_handling	Sample Handling	✓	✓	✓	✓
reports_viewer	Reports Viewer	✓	—	✓	—
profiles	Testing Profile	✓	✓	✓	✓
departments	Department View	✓	✓	✓	✓
catalog	Catalog	✓	✓	✓	✓
catalog_parameters	Catalog Parameters	✓	✓	✓	✓
contacts	Contacts	✓	✓	✓	✓
backups	Backups	✓	✓	—	—
settings	Lab Settings	✓	✓	✓	✓
crm	CRM	✓	✓	✓	✓

---

Billing group

Invoices, referrals, and pricing

Module	Label	View	Create	Edit	Delete
referrals	Referral Doctor	✓	✓	✓	✓
rate_lists	Coupons / Special Discount	✓	✓	✓	✓
home_collection	Home Collection Charges	✓	✓	✓	✓
invoices	Invoices	✓	✓	✓	✓
balance_adjustment	Balance Adjustment	✓	✓	✓	—
deleted_invoices	Deleted Invoices	✓	—	—	—

---

Patients group

Patient workflow and results

Module	Label	View	Create	Edit	Delete
patients	Patients	✓	✓	✓	✓
register_patients	Register Patients	✓	✓	✓	✓
medicine_prescription	Medicine Prescription	✓	✓	✓	✓
sample_collection	Sample Collection	✓	✓	✓	✓
samples	Samples	✓	✓	✓	✓
results_entry	Results Entry	✓	✓	✓	✓
result_verification	Result Verification	✓	—	✓	—
report_delivery	Report Delivery	✓	✓	—	—
qr_attendance	QR Attendance	✓	✓	✓	✓

---

Sales group

Stock and operating expenses

Module	Label	View	Create	Edit	Delete
stock	Stock	✓	✓	✓	✓
consumption	Consumption	✓	✓	✓	✓
expenses	Lab Expenses	✓	✓	✓	✓

---

Finance group

Ledgers and cash operations

Module	Label	View	Create	Edit	Delete
ledgers	Ledgers	✓	✓	✓	✓
ledger_entries	Ledger Entries	✓	✓	✓	✓
daybook_summary	Daybook Summary	✓	—	—	—
patient_vouchers	Patient Vouchers	✓	✓	✓	✓
cash_management	Cash Management	✓	✓	✓	✓
advance_payment	Advance Payment	✓	✓	✓	✓
banks_cheque	Banks & Cheque Book	✓	✓	✓	✓
transfer_cash	Transfer Cash	✓	✓	—	—
employee_ledger	Employee Ledger	✓	✓	✓	✓
employee_advances	Employee Advances	✓	✓	✓	✓
vendor_payment	Vendor Payment	✓	✓	✓	✓
salary_management	Salary Management	✓	✓	✓	✓

---

Report group

Operational and financial reports

Module	Label	View	Create	Edit	Delete
patient_activity	Patient Activity	✓	—	—	—
referral_summary	Referral Dr. Summary	✓	—	—	—
unsettled_referral	Unsettled Referral Balance	✓	—	—	—
patient_due	Patient Due / Unclaimed	✓	—	—	—
delayed_samples	Delayed Samples	✓	—	—	—
pending_samples	Pending Samples	✓	—	—	—
top_tests	Top Tests	✓	—	—	—
analytics	Analytics	✓	—	—	—

---

Subscription group

Module	Label	View	Create	Edit	Delete
subscription	Subscription	✓	—	—	—

---

Quick Access group

Shortcuts for high-frequency actions in the invoice and messaging workflow. These are standalone permission codes, not CRUD modules.

Code	Label	Description
quick.create_invoice	Create Invoice	Open invoice creation from main workflow
quick.verify_results	Verify Results	Sign off verified results
quick.mark_all_paid	Mark All Paid	Mark invoice payments complete
quick.download_invoice	Download Invoice	Export invoice PDF
quick.cancel_invoice	Cancel Invoice	Cancel active invoices
quick.send_sms	Send SMS	Patient SMS notifications
quick.send_whatsapp	Send WhatsApp	WhatsApp notifications
quick.send_email	Send Email	Email notifications
quick.print_invoice	Print Invoice	Print invoices and receipts
quick.barcode_printer	Barcode Printer	Print sample barcodes
quick.smart_card	Smart Card Manager	Patient smart card operations

Reception desk bundle

A typical receptionist role combines Patients group view/create/edit, Billing invoices CRUD, and Quick Access items for print, SMS, and barcode printing.

Creating a custom role

1. Go to Admin → Roles & Permissions.
2. Click Add Role.
3. Set name, description, and color (used in UI badges).
4. Toggle CRUD cells in the matrix — groups collapse for clarity.
5. Enable Quick Access shortcuts as needed.
6. Save and assign to users on the Users screen.

flowchart TD
    A[Define role] --> B[Set CRUD matrix]
    B --> C[Add Quick Access]
    C --> D[Assign to users]
    D --> E[Test with non-admin account]

Permission evaluation

When a user attempts an action:

1. Collect all permissions from assigned roles.
2. Expand legacy .manage codes.
3. Check PermissionCatalog.Satisfies(held, required).
4. Deny with HTTP 403 if insufficient.

Tenant Admin flag bypasses permission checks for break-glass accounts — use sparingly.

Related documentation

• Users
• Security: RBAC
• Admin Overview
• How-To: Manage Staff & Roles