chore: record session journal - 握力环训练趣味化

2026-05-27 16:53:33 +08:00
parent 261f8315de
commit b9d2541b32
946 changed files with 107438 additions and 0 deletions
@@ -0,0 +1 @@
+{"file":".trellis/tasks/05-07-diagnosis-business-order-no-data-scope/research/prescription-order-permission-scope.md","reason":"Check agent should verify the scoped bypass only affects diagnosis-edit patient-order queries."}
@@ -0,0 +1 @@
+{"file":".trellis/tasks/05-07-diagnosis-business-order-no-data-scope/research/prescription-order-permission-scope.md","reason":"Implementation needs the verified permission-filter locations and the agreed scoped bypass approach."}
@@ -0,0 +1,41 @@
+# 诊单编辑业务订单 tab 去除数据权限
+
+## Goal
+
+修正「编辑诊单」对话框中的“业务订单”tab：获取订单数据时不再受业务订单列表页的数据权限限制，只要订单与当前诊单患者相关，就应展示出来。
+
+## What I verified
+
+- 前端组件是 [admin/src/views/tcm/diagnosis/components/PatientOrderList.vue](/Users/long/Work/zyt/admin/src/views/tcm/diagnosis/components/PatientOrderList.vue)，直接调用 `prescriptionOrderLists`。
+- 路由仍是 `GET /tcm.prescriptionOrder/lists`，控制器 [server/app/adminapi/controller/tcm/PrescriptionOrderController.php](/Users/long/Work/zyt/server/app/adminapi/controller/tcm/PrescriptionOrderController.php) 只是透传给 `PrescriptionOrderLists`。
+- 真正的权限过滤在 [server/app/adminapi/lists/tcm/PrescriptionOrderLists.php](/Users/long/Work/zyt/server/app/adminapi/lists/tcm/PrescriptionOrderLists.php)：
+  - `applyCreatorOrOwnPrescriptionVisibility()`
+  - `applyDataScopeForPrescriptionOrder()`
+- 当前诊单 tab 已经按 `patient_id` 过滤，且支持 `diagnosis_id` 精确过滤，因此即使跳过列表权限，也仍然只会落在“当前患者/当前诊单关联订单”的安全范围内。
+
+## Decision
+
+- 不新增独立接口，继续复用 `/tcm.prescriptionOrder/lists`。
+- 仅为“诊单编辑业务订单 tab”增加一个显式场景参数，例如 `scene=diagnosis_edit`。
+- 只有在该场景下，`PrescriptionOrderLists` 才跳过业务订单列表页的两层权限过滤。
+- 其它页面继续保持原有权限逻辑，不改行为。
+
+## Requirements
+
+- 前端业务订单 tab 请求列表时附带场景参数，标记这是诊单编辑页内的患者订单查询。
+- 后端列表类识别该场景后，不执行：
+  - 创建人/开方人可见性过滤
+  - 数据范围过滤
+- 后端仍保留患者/诊单过滤逻辑，不允许无条件返回全量订单。
+- 原订单管理页、统计页、其它依赖 `/tcm.prescriptionOrder/lists` 的页面行为不变。
+
+## Acceptance Criteria
+
+- 打开任意诊单编辑页，“业务订单”tab 可以看到该患者实际关联的业务订单，不因当前登录人不是订单创建人或不在数据范围内而丢失数据。
+- 切换“仅本诊单”时，只显示当前诊单关联的业务订单。
+- 业务订单主列表页权限行为不变。
+- 不新增新的权限点，不修改现有 tab 显隐权限。
+
+## Risks
+
+- 如果跳过权限的判断条件不够收敛，可能误影响订单管理页；因此必须使用显式场景参数，不要靠 `patient_id`/`diagnosis_id` 猜测场景。
@@ -0,0 +1,15 @@
+# Findings
+
+- Diagnosis edit dialog business-order tab uses `prescriptionOrderLists` from `admin/src/api/tcm.ts`.
+- The request is rendered by `admin/src/views/tcm/diagnosis/components/PatientOrderList.vue`.
+- Backend controller `server/app/adminapi/controller/tcm/PrescriptionOrderController.php` forwards to `PrescriptionOrderLists`.
+- Visibility restrictions are applied in `server/app/adminapi/lists/tcm/PrescriptionOrderLists.php` by:
+  - `applyCreatorOrOwnPrescriptionVisibility()`
+  - `applyDataScopeForPrescriptionOrder()`
+- Patient scoping is already constrained through:
+  - `applyPatientIdFilter()`
+  - built-in `diagnosis_id` equality search
+
+# Recommended change
+
+Introduce an explicit scene flag for diagnosis-edit patient-order queries and bypass only the list visibility filters in that scene, while keeping patient/diagnosis filters intact.
@@ -0,0 +1,26 @@
+{
+  "id": "diagnosis-business-order-no-data-scope",
+  "name": "diagnosis-business-order-no-data-scope",
+  "title": "诊单编辑业务订单去除数据权限",
+  "description": "",
+  "status": "completed",
+  "dev_type": null,
+  "scope": null,
+  "package": null,
+  "priority": "P2",
+  "creator": "codex-agent",
+  "assignee": "codex-agent",
+  "createdAt": "2026-05-07",
+  "completedAt": "2026-05-11",
+  "branch": null,
+  "base_branch": "long-0507",
+  "worktree_path": null,
+  "commit": null,
+  "pr_url": null,
+  "subtasks": [],
+  "children": [],
+  "parent": null,
+  "relatedFiles": [],
+  "notes": "",
+  "meta": {}
+}
				`@@ -0,0 +1 @@`
				`{"file":".trellis/tasks/05-07-diagnosis-business-order-no-data-scope/research/prescription-order-permission-scope.md","reason":"Check agent should verify the scoped bypass only affects diagnosis-edit patient-order queries."}`