更新

server/app/adminapi/http/middleware/AuthMiddleware.php

@@ -16,8 +16,9 @@ declare (strict_types=1);
 
 namespace app\adminapi\http\middleware;
 
-use app\adminapi\logic\LoginLogic;
-use app\common\service\pharmacy\PharmacyUploadPermissionAlias;
+use app\adminapi\logic\LoginLogic;
+use app\common\service\pharmacy\PharmacyUploadPermissionAlias;
+use app\common\service\qywx\QywxPromotionOperatorAccess;
 use app\common\{
     cache\AdminAuthCache,
     service\JsonService
@@ -69,10 +70,23 @@ class AuthMiddleware
 
         $adminAuthCache = new AdminAuthCache($request->adminInfo['admin_id']);
 
-        // 当前访问路径
-        $accessUri = strtolower($request->controller() . '/' . $request->action());
-        // 全部路由
-        $allUri = $this->formatUrl($adminAuthCache->getAllUri());
+        // 当前访问路径
+        $accessUri = strtolower($request->controller() . '/' . $request->action());
+
+        // 获客助手的子接口多数不是独立菜单权限。整组动作统一绑定页面权限，
+        // 共享操作人的动态页面权限也必须先经过这一层，再由业务层校验具体方案。
+        if (str_starts_with($accessUri, 'firstvisit.wecompromotion/')) {
+            $adminUris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
+            if ($this->isKnownWecomPromotionAction($accessUri)
+                && in_array(strtolower(QywxPromotionOperatorAccess::PAGE_PERMISSION), $adminUris, true)) {
+                return $next($request);
+            }
+
+            return JsonService::fail('权限不足，无法访问或操作');
+        }
+
+        // 全部路由
+        $allUri = $this->formatUrl($adminAuthCache->getAllUri());
 
         // 判断该当前访问的uri是否存在，不存在无需验证
         if (!in_array($accessUri, $allUri, true)
@@ -204,6 +218,31 @@ class AuthMiddleware
             'tcm.prescription/audit',
         ], true);
     }
+
+    private function isKnownWecomPromotionAction(string $accessUri): bool
+    {
+        return in_array($accessUri, [
+            'firstvisit.wecompromotion/tagoptions',
+            'firstvisit.wecompromotion/createtag',
+            'firstvisit.wecompromotion/uploadwelcomemedia',
+            'firstvisit.wecompromotion/overview',
+            'firstvisit.wecompromotion/savepool',
+            'firstvisit.wecompromotion/savewidget',
+            'firstvisit.wecompromotion/batchsetoperators',
+            'firstvisit.wecompromotion/deletepool',
+            'firstvisit.wecompromotion/savelink',
+            'firstvisit.wecompromotion/savemember',
+            'firstvisit.wecompromotion/togglemember',
+            'firstvisit.wecompromotion/checkapipermission',
+            'firstvisit.wecompromotion/syncremotelinks',
+            'firstvisit.wecompromotion/remotelinkdetail',
+            'firstvisit.wecompromotion/deleteremotelink',
+            'firstvisit.wecompromotion/synccustomers',
+            'firstvisit.wecompromotion/customerstatistics',
+            'firstvisit.wecompromotion/togglelink',
+            'firstvisit.wecompromotion/deletelink',
+        ], true);
+    }
 
     /**
      * 处方库 lists：与开方、处方库维护菜单权限互通（避免开方页「从处方库导入」403）