更新

server/app/adminapi/http/middleware/AuthMiddleware.php

@@ -109,6 +109,16 @@ class AuthMiddleware
             return JsonService::fail('权限不足，无法查看面诊记录');
         }
 
+        // Full-audio recovery exercises all three realtime write capabilities.
+        // Protect it explicitly before the unregistered-route compatibility branch.
+        if ($accessUri === 'tcm.diagnosis/savelocalaudiotranscript') {
+            $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
+            $required = ['tcm.diagnosis/startcalltranscription',
+                'tcm.diagnosis/upsertcalltranscriptsegments', 'tcm.diagnosis/finishcalltranscription'];
+            return array_diff($required, $uris) === []
+                ? $next($request) : JsonService::fail('权限不足，无法保存录音补转写');
+        }
+
         // This group must never use the legacy unregistered-route bypass.
         if (str_starts_with($accessUri, 'tcm.followupaudio/')) {
             $allowed = ['capabilities', 'uploadsession', 'uploadchunk', 'uploadcomplete',
@@ -135,6 +145,16 @@ class AuthMiddleware
             return JsonService::fail('权限不足，无法访问或操作');
         }
 
+        // Metadata-only mobile links always share the patient page grant, even before menu registration.
+        if (str_starts_with($accessUri, 'tcm.mobilerecording/')) {
+            $action = substr($accessUri, strlen('tcm.mobilerecording/'));
+            $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
+            if (in_array($action, ['bind', 'unbind', 'devicelists', 'patientlists'], true)
+                && in_array('firstvisit.mypatient/lists', $uris, true)) {
+                return $next($request); // Controller re-reads grants; logic enforces the current patient scope.
+            }
+            return JsonService::fail('权限不足，无法访问我的患者录音关联');
+        }
         // 全部路由
         $allUri = $this->formatUrl($adminAuthCache->getAllUri());