fix: allow app admins to access MedSchedule UI and API

client/src/components/Sidebar.tsx

@@ -1208,7 +1208,7 @@ function MedScheduleNavItem({ collapsed }: { collapsed: boolean }) {
   const [location] = useLocation();
   const isActive = location === '/med' || location.startsWith('/med/');
 
-  if (user?.organization?.slug !== 'medschedule') return null;
+  if (user?.organization?.slug !== 'medschedule' && !isAdmin(user)) return null;
 
   if (collapsed) {
     return (

server/medschedule/routes.ts

@@ -2,7 +2,7 @@ import { Router } from "express";
 import type { Express, Request, Response, NextFunction } from "express";
 import type { Response as ExpressResponse } from "express";
 import { authenticateToken, type AuthenticatedRequest } from "../middleware/auth.middleware";
-import { tenantIsolation } from "../middleware/tenant.middleware";
+
 import { medScheduleStorage } from "./storage";
 
 interface MedRequest extends AuthenticatedRequest {
@@ -17,24 +17,16 @@ async function resolveMedOrganizationId(): Promise<number> {
   return cachedMedOrgId;
 }
 
-function medOrgResolver() {
-  return async (_req: Request, _res: Response, next: NextFunction) => {
-    try {
-      await resolveMedOrganizationId();
-      next();
-    } catch (err) {
-      next(err as Error);
-    }
-  };
-}
-
 function requireMedOrganization() {
   return async (req: MedRequest, res: Response, next: NextFunction) => {
     const medOrgId = await resolveMedOrganizationId();
     req.medOrganizationId = medOrgId;
 
-    // Если запрос от аутентифицированного пользователя, убедимся, что он принадлежит к org MedSchedule
-    if (req.user && req.user.organizationId !== medOrgId) {
+    // MedSchedule API работает в контексте org medschedule, а не текущей org пользователя
+    req.organizationId = medOrgId;
+
+    // Доступ разрешён либо членам org medschedule, либо администраторам приложения
+    if (req.user && req.user.organizationId !== medOrgId && req.user.appRole !== "admin") {
       return res.status(403).json({
         success: false,
         error: "Этот раздел доступен только пользователям MedSchedule",
@@ -55,8 +47,6 @@ function parseDate(value: unknown): Date | null {
 export function registerMedScheduleRoutes(app: Express) {
   const router = Router();
   router.use(authenticateToken);
-  router.use(tenantIsolation);
-  router.use(medOrgResolver());
   router.use(requireMedOrganization());
 
   // =====================