更新

app/tests/test_prescription_security_ui.py

@@ -129,6 +129,31 @@ def test_canonical_permission_helper_rejects_dot_aliases_and_accepts_wildcards()
     assert not widgets.has_permission({}, "cf.prescription/edit")
 
 
+def test_diagnosis_prescription_edit_uses_admin_edit_permission(
+    application: QApplication,
+) -> None:
+    repository = SimpleNamespace(
+        create_prescription=lambda **_kwargs: {},
+        update_prescription=lambda **_kwargs: {},
+    )
+    create_only = DiagnosisDialog(
+        repository,
+        permissions=PermissionSet(["tcm.diagnosis/chufang"]),
+    )
+    assert create_only._can_prescribe
+    assert not create_only._can_edit_prescription
+    create_only.close()
+
+    edit_only = DiagnosisDialog(
+        repository,
+        permissions=PermissionSet(["cf.prescription/edit"]),
+    )
+    assert not edit_only._can_prescribe
+    assert edit_only._can_edit_prescription
+    edit_only.close()
+    application.processEvents()
+
+
 def test_diagnosis_masks_sensitive_fields_and_loads_exact_context_orders(
     application: QApplication,
     monkeypatch: pytest.MonkeyPatch,
@@ -190,7 +215,7 @@ def test_diagnosis_edit_checks_unique_identity_and_saves_expanded_dto(
     application.processEvents()
 
 
-def test_duplicate_herbs_are_rejected_for_templates_and_issued_prescriptions(
+def test_duplicate_herbs_match_admin_warning_for_issued_prescriptions(
     application: QApplication,
 ) -> None:
     herbs = [
@@ -216,9 +241,9 @@ def test_duplicate_herbs_are_rejected_for_templates_and_issued_prescriptions(
     editor.clinical_diagnosis.setPlainText("气虚")
     editor.signature._has_strokes = True
     editor.herbs.set_rows(herbs, locked=False)
+    assert "存在重复药名" in editor.herb_summary.text()
     editor.accept()
-    assert editor.result() == QDialog.DialogCode.Rejected
-    assert "药材不可重复：黄芪" in editor.validation.label.text()
+    assert editor.result() == QDialog.DialogCode.Accepted
     template.close()
     editor.close()
     application.processEvents()
@@ -358,7 +383,7 @@ def test_diagnosis_detail_requires_permission_and_ignores_stale_target(
     shown: list[int] = []
 
     class FakeDiagnosisDetailDialog:
-        def __init__(self, detail: dict[str, Any], _parent: Any) -> None:
+        def __init__(self, detail: dict[str, Any], _parent: Any, **_kwargs: Any) -> None:
             shown.append(detail["id"])
 
         def exec(self) -> int:
@@ -384,3 +409,51 @@ def test_diagnosis_detail_requires_permission_and_ignores_stale_target(
     denied.close()
     allowed.close()
     application.processEvents()
+
+
+def test_diagnosis_prescription_view_fetches_full_detail_and_ignores_stale_row(
+    application: QApplication,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    requested: list[int] = []
+    callbacks: list[tuple[Any, dict[str, Any]]] = []
+    shown: list[int] = []
+
+    class Repository:
+        def get_prescription(self, prescription_id: int) -> dict[str, Any]:
+            requested.append(prescription_id)
+            return {
+                "id": prescription_id,
+                "patient_name": f"患者{prescription_id}",
+                "doctor_signature": "data:image/png;base64,detail",
+                "herbs": [{"medicine_id": 31, "name": "黄芪", "dosage": 15}],
+            }
+
+    def queue_async(function: Any, **options: Any) -> object:
+        callbacks.append((function, options))
+        return object()
+
+    class FakePrescriptionDetailDialog:
+        def __init__(self, detail: dict[str, Any], **_kwargs: Any) -> None:
+            assert detail["doctor_signature"].endswith("detail")
+            assert detail["herbs"][0]["name"] == "黄芪"
+            shown.append(detail["id"])
+
+        def exec(self) -> int:
+            return 0
+
+    monkeypatch.setattr(diagnosis_module, "run_async", queue_async)
+    monkeypatch.setattr(dialog_module, "PrescriptionDetailDialog", FakePrescriptionDetailDialog)
+    dialog = DiagnosisDialog(Repository(), permissions=PermissionSet(["*"]))
+    dialog._view_prescription({"id": 11, "herbs": []})
+    dialog._view_prescription({"id": 12, "herbs": []})
+
+    old_function, old_options = callbacks[0]
+    old_options["on_success"](old_function())
+    assert shown == []
+    new_function, new_options = callbacks[1]
+    new_options["on_success"](new_function())
+    assert requested == [11, 12]
+    assert shown == [12]
+    dialog.close()
+    application.processEvents()