# WP3 — BE hardening: unique code per company + role grant

## Goal
Two small backend safety additions on top of the already-complete antibiotics CRUD: (1) reject a duplicate antibiotic `code` within the same company, (2) grant the `lis.antibiotics.view`/`lis.antibiotics.manage` permissions to the lab-manager role(s) so the new screen is reachable without manual permission-granting.

## Repo & branch
BE repo `/home/moonui/moon-erp-be`, branch `hazemdev`. Conventional commit `feat(lis):`.

## Already exists (do NOT recreate)
- `Modules/LIS/app/Http/Controllers/LabNewTypesController.php` — `storeAntibiotic` (`:78`), `updateAntibiotic` (`:96`) with validation. Table `lab_antibiotics` (columns incl. `company_id`, `code`, soft-delete `deleted_at`). Perms `lis.antibiotics.view` / `lis.antibiotics.manage` already defined + enforced via controller middleware (`:36-37`).

## Changes
1. **Unique code per company** in `storeAntibiotic` + `updateAntibiotic` validation:
   - store: `'code' => ['required','string','max:20', Rule::unique('lab_antibiotics','code')->where('company_id', auth()->user()->company_id)->whereNull('deleted_at')]`.
   - update: same but `->ignore($id)` so editing the same row doesn't self-collide; keep `sometimes`.
   - Return a clear 422 message. (Consider trimming/uppercasing code for consistency ONLY if the existing seeder does — check `LabAntibioticSeeder`; don't diverge from seeded format.)
2. **Role grant**: grant `lis.antibiotics.view` + `lis.antibiotics.manage` to the appropriate lab-manager/admin role(s) via the permission seeder used for role grants (find how other `lis.*` perms are granted — likely `Modules/Core/Database/Seeders/GrantRolePermissionsSeeder` or a LIS role seeder). Make it idempotent (the seeder runs repeatedly via the updater). Owner/super-admin already bypasses via Gate::before, so this is for tenant lab-manager roles.

## Files to MODIFY
- `Modules/LIS/app/Http/Controllers/LabNewTypesController.php` (add `use Illuminate\Validation\Rule;` if missing).
- The role-grant seeder (whichever grants `lis.*` perms to roles) — add the two antibiotics perms idempotently.

## Tests
- Pest (sqlite): extend/add a test asserting (a) creating two antibiotics with the same code in one company → 422; (b) same code in a DIFFERENT company → allowed; (c) editing an antibiotic keeping its own code → OK. Run the LIS antibiotics tests + confirm no regression in the module suite.

## Acceptance criteria
- [ ] Duplicate code in same company rejected (422); allowed across companies; self-edit OK.
- [ ] Role grant is idempotent and grants both perms to the lab-manager role(s).
- [ ] Pest green (record counts), no new failures.
- [ ] No migration needed (validation + seeder only). If you DO add a DB unique index, that's a migration → run it on dev same-step and note it; but validation-level unique is sufficient for MVP — prefer that unless the mirror pattern uses a DB index.

## Out of scope
- The FE screen (WP1/WP2). Any schema change beyond the (optional) index.

## Flags
No [FIN]. No migration (validation + seeder). If you choose a DB unique index → migration:yes, run on dev.