更新

2026-11-09 11:56:28 +08:00
parent 839166524f
commit 01a46ee06f
17 changed files with 1552 additions and 31 deletions
@@ -145,7 +145,18 @@ class AuthMiddleware
            return JsonService::fail('权限不足，无法访问或操作');
        }

-        // Metadata-only mobile links always share the patient page grant, even before menu registration.
+        // Private media endpoints must never use the unregistered-route compatibility bypass.
+        if (str_starts_with($accessUri, 'tcm.mobilerecordingmedia/')) {
+            $action = substr($accessUri, strlen('tcm.mobilerecordingmedia/'));
+            $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
+            if (in_array($action, ['prepare', 'chunk', 'complete', 'status', 'audio', 'transcript'], true)
+                && in_array('firstvisit.mypatient/lists', $uris, true)) {
+                return $next($request); // Service rechecks live actor, binding and patient scope on every request.
+            }
+            return JsonService::fail('权限不足，无法访问我的患者录音内容');
+        }
+
+        // Mobile links always share the patient page grant, even before menu registration.
        if (str_starts_with($accessUri, 'tcm.mobilerecording/')) {
            $action = substr($accessUri, strlen('tcm.mobilerecording/'));
            $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);