更新

server/app/adminapi/controller/order/OrderController.php

@@ -6,6 +6,7 @@ namespace app\adminapi\controller\order;
 
 use app\adminapi\controller\BaseAdminController;
 use app\adminapi\lists\order\OrderLists;
+use app\adminapi\logic\auth\AuthLogic;
 use app\adminapi\logic\order\OrderActionLogLogic;
 use app\adminapi\logic\order\OrderLogic;
 use app\adminapi\validate\order\OrderValidate;
@@ -17,6 +18,8 @@ use app\adminapi\validate\order\OrderValidate;
  */
 class OrderController extends BaseAdminController
 {
+    private const EDIT_TIME_PERMISSION = 'order.order/editTime';
+
     /**
      * @notes 订单列表
      * @return \think\response\Json
@@ -348,6 +351,14 @@ class OrderController extends BaseAdminController
     public function edit()
     {
         $params = (new OrderValidate())->post()->goCheck('edit');
+        $hasTimeParams = array_key_exists('payment_time', $params)
+            || array_key_exists('create_time', $params);
+        if ($hasTimeParams) {
+            if (!$this->canEditOrderTime()) {
+                return $this->fail('无权限修改订单支付时间或创建时间');
+            }
+            $params = (new OrderValidate())->post()->goCheck('edit_time');
+        }
         $orderId = (int)$params['id'];
         $order = \app\common\model\Order::find($orderId);
         if (!$order) {
@@ -357,11 +368,15 @@ class OrderController extends BaseAdminController
             return $this->fail('无权限修改此订单');
         }
         
-        $result = OrderLogic::edit($orderId, $params);
+        $result = OrderLogic::edit($orderId, $params, $hasTimeParams);
         if (!$result) {
             return $this->fail(OrderLogic::getError());
         }
-        $this->logOrderAction($orderId, 'edit', '编辑患者/订单类型/支付时间/创建时间等');
+        $this->logOrderAction(
+            $orderId,
+            'edit',
+            $hasTimeParams ? '编辑患者/订单类型/支付时间/创建时间等' : '编辑患者/订单类型等'
+        );
         
         return $this->success('编辑成功');
     }
@@ -382,6 +397,18 @@ class OrderController extends BaseAdminController
         return (int)$order->creator_id === $this->adminId;
     }
 
+    /**
+     * @notes 是否拥有支付单时间修正权限
+     */
+    private function canEditOrderTime(): bool
+    {
+        if (!empty($this->adminInfo['root']) && (int)$this->adminInfo['root'] === 1) {
+            return true;
+        }
+
+        return in_array(self::EDIT_TIME_PERMISSION, AuthLogic::getAuthByAdminId($this->adminId), true);
+    }
+
     /**
      * @notes 支付订单
      * @return \think\response\Json