zyt/.trellis/tasks/archive/2026-05/05-07-diagnosis-business-order-no-data-scope/research/prescription-order-permission-scope.md

Findings

• Diagnosis edit dialog business-order tab uses prescriptionOrderLists from admin/src/api/tcm.ts.
• The request is rendered by admin/src/views/tcm/diagnosis/components/PatientOrderList.vue.
• Backend controller server/app/adminapi/controller/tcm/PrescriptionOrderController.php forwards to PrescriptionOrderLists.
• Visibility restrictions are applied in server/app/adminapi/lists/tcm/PrescriptionOrderLists.php by:
  • applyCreatorOrOwnPrescriptionVisibility()
  • applyDataScopeForPrescriptionOrder()
• Patient scoping is already constrained through:
  • applyPatientIdFilter()
  • built-in diagnosis_id equality search

Recommended change

Introduce an explicit scene flag for diagnosis-edit patient-order queries and bypass only the list visibility filters in that scene, while keeping patient/diagnosis filters intact.