更新

server/app/adminapi/http/middleware/AuthMiddleware.php

@@ -80,6 +80,17 @@ class AuthMiddleware
         // 当前访问路径
         $accessUri = strtolower($request->controller() . '/' . $request->action());
 
+        // 患者列表的部门筛选复用列表权限；只允许 GET 查询显式启用数据范围的部门树。
+        // 必须与 DeptController::all 读取同一个 GET 参数，避免请求体参数意外放行全量部门。
+        if ($accessUri === 'dept.dept/all'
+            && $request->isGet()
+            && in_array($request->get('apply_data_scope'), [1, '1'], true)) {
+            $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
+            if (in_array('tcm.diagnosis/lists', $uris, true)) {
+                return $next($request);
+            }
+        }
+
         // Screenshot analysis shares the assistant grant and must never use the
         // unregistered-route bypass, even before menus have been synchronized.
         if ($accessUri === 'tcm.diagnosis/aitonguescreenshot') {