1

server/app/adminapi/http/middleware/AuthMiddleware.php

@@ -82,7 +82,7 @@ class AuthMiddleware
         $AdminUris = $adminAuthCache->getAdminUri() ?? [];
         $AdminUris = $this->formatUrl($AdminUris);
 
-        if (in_array($accessUri, $AdminUris)) {
+        if (in_array($accessUri, $AdminUris) || $this->matchPermissionAlias($accessUri, $AdminUris)) {
             return $next($request);
         }
         return JsonService::fail('权限不足，无法访问或操作');
@@ -103,6 +103,25 @@ class AuthMiddleware
         }, $data);
     }
 
+    /**
+     * 日常记录权限域：前端统一收口到 tcm.diagnosis/dailyRecord，
+     * 但待办/跟踪备注接口仍保留历史路由名，故在鉴权层做精确别名映射。
+     */
+    private function matchPermissionAlias(string $accessUri, array $adminUris): bool
+    {
+        if (!in_array('tcm.diagnosis/dailyrecord', $adminUris, true)) {
+            return false;
+        }
+
+        return in_array($accessUri, [
+            'tcm.diagnosistodo/lists',
+            'tcm.diagnosistodo/add',
+            'tcm.diagnosistodo/cancel',
+            'tcm.diagnosis/trackingnotes',
+            'tcm.diagnosis/addtrackingnote',
+        ], true);
+    }
+
     /**
      * 面诊进度专用：auth.admin/lists、doctor.appointment/lists + progress_board=1，不校验菜单权限
      */
@@ -118,4 +137,4 @@ class AuthMiddleware
 
         return in_array($c, ['auth.admin', 'doctor.appointment'], true);
     }
-}
+}