更新

server/app/adminapi/controller/order/OrderController.php

@@ -6,6 +6,7 @@ namespace app\adminapi\controller\order;
 
 use app\adminapi\controller\BaseAdminController;
 use app\adminapi\lists\order\OrderLists;
+use app\adminapi\logic\auth\AuthLogic;
 use app\adminapi\logic\order\OrderActionLogLogic;
 use app\adminapi\logic\order\OrderLogic;
 use app\adminapi\validate\order\OrderValidate;
@@ -17,6 +18,8 @@ use app\adminapi\validate\order\OrderValidate;
  */
 class OrderController extends BaseAdminController
 {
+    private const EDIT_TIME_PERMISSION = 'order.order/editTime';
+
     /**
      * @notes 订单列表
      * @return \think\response\Json
@@ -348,6 +351,14 @@ class OrderController extends BaseAdminController
     public function edit()
     {
         $params = (new OrderValidate())->post()->goCheck('edit');
+        $hasTimeParams = array_key_exists('payment_time', $params)
+            || array_key_exists('create_time', $params);
+        if ($hasTimeParams) {
+            if (!$this->canEditOrderTime()) {
+                return $this->fail('无权限修改订单支付时间或创建时间');
+            }
+            $params = (new OrderValidate())->post()->goCheck('edit_time');
+        }
         $orderId = (int)$params['id'];
         $order = \app\common\model\Order::find($orderId);
         if (!$order) {
@@ -357,11 +368,15 @@ class OrderController extends BaseAdminController
             return $this->fail('无权限修改此订单');
         }
         
-        $result = OrderLogic::edit($orderId, $params);
+        $result = OrderLogic::edit($orderId, $params, $hasTimeParams);
         if (!$result) {
             return $this->fail(OrderLogic::getError());
         }
-        $this->logOrderAction($orderId, 'edit', '编辑患者/订单类型/支付时间/创建时间等');
+        $this->logOrderAction(
+            $orderId,
+            'edit',
+            $hasTimeParams ? '编辑患者/订单类型/支付时间/创建时间等' : '编辑患者/订单类型等'
+        );
         
         return $this->success('编辑成功');
     }
@@ -382,6 +397,18 @@ class OrderController extends BaseAdminController
         return (int)$order->creator_id === $this->adminId;
     }
 
+    /**
+     * @notes 是否拥有支付单时间修正权限
+     */
+    private function canEditOrderTime(): bool
+    {
+        if (!empty($this->adminInfo['root']) && (int)$this->adminInfo['root'] === 1) {
+            return true;
+        }
+
+        return in_array(self::EDIT_TIME_PERMISSION, AuthLogic::getAuthByAdminId($this->adminId), true);
+    }
+
     /**
      * @notes 支付订单
      * @return \think\response\Json

server/app/adminapi/logic/order/OrderLogic.php

@@ -357,9 +357,10 @@ class OrderLogic
      * @notes 编辑订单
      * @param int $id
      * @param array $params
+     * @param bool $canEditTime 是否已通过订单时间修改权限校验
      * @return bool
      */
-    public static function edit(int $id, array $params): bool
+    public static function edit(int $id, array $params, bool $canEditTime = false): bool
     {
         try {
             $order = Order::find($id);
@@ -368,6 +369,13 @@ class OrderLogic
                 return false;
             }
 
+            $hasTimeParams = array_key_exists('payment_time', $params)
+                || array_key_exists('create_time', $params);
+            if ($hasTimeParams && !$canEditTime) {
+                self::setError('无权限修改订单支付时间或创建时间');
+                return false;
+            }
+
             if (isset($params['remark'])) {
                 $order->remark = $params['remark'];
             }

server/app/adminapi/validate/order/OrderValidate.php

@@ -47,7 +47,8 @@ class OrderValidate extends BaseValidate
 
     protected $scene = [
         'create' => ['patient_id',  'order_type', 'amount'],
-        'edit' => ['id', 'patient_id', 'order_type', 'remark', 'payment_time', 'create_time'],
+        'edit' => ['id', 'patient_id', 'order_type', 'remark'],
+        'edit_time' => ['id', 'payment_time', 'create_time'],
         'detail' => ['id'],
         'pay' => ['payment_method'],
         'cancel' => ['id'],