diff --git a/lab_domicilios.php b/lab_domicilios.php
index d0ea469..6883137 100644
--- a/lab_domicilios.php
+++ b/lab_domicilios.php
@@ -39,17 +39,35 @@ $domIdParam = (int)($_GET['id'] ?? 0);
diff --git a/lab_ordenes.php b/lab_ordenes.php
index 101da21..f578f82 100644
--- a/lab_ordenes.php
+++ b/lab_ordenes.php
@@ -39,17 +39,35 @@ $estadoParam = $_GET['estado'] ?? '';
diff --git a/login.php b/login.php
index 31acec8..cdfca29 100644
--- a/login.php
+++ b/login.php
@@ -61,6 +61,10 @@ if ($_POST && !$loginBlocked) {
header('Location: enfermero_portal.php');
} elseif (count($modules) === 1 && $modules[0] === 'lab_formularios') {
header('Location: lab_formularios.php');
+ } elseif (count($modules) === 2
+ && in_array('lab_domicilios', $modules, true)
+ && in_array('lab_ordenes', $modules, true)) {
+ header('Location: lab_domicilios.php');
} else {
header('Location: index.php');
}
diff --git a/migrations/20260402_lab_readonly_only_ordenes_domicilios.sql b/migrations/20260402_lab_readonly_only_ordenes_domicilios.sql
new file mode 100644
index 0000000..e3b8100
--- /dev/null
+++ b/migrations/20260402_lab_readonly_only_ordenes_domicilios.sql
@@ -0,0 +1,5 @@
+-- Rol lab_readonly: dejar solo lab_domicilios y lab_ordenes (ambos con permiso read)
+-- Eliminar módulos que no corresponden a este rol
+DELETE FROM role_modules
+WHERE role_id = (SELECT id FROM roles WHERE slug = 'lab_readonly')
+ AND module_slug IN ('lab_dashboard', 'lab_pacientes');