geng

server/app/adminapi/controller/doctor/AppointmentController.php

@@ -4,9 +4,10 @@ namespace app\adminapi\controller\doctor;
 
 use app\adminapi\controller\BaseAdminController;
 use app\adminapi\lists\doctor\AppointmentLists;
-use app\adminapi\logic\doctor\AppointmentLogic;
-use app\adminapi\logic\doctor\DoctorNoteLogic;
-use app\adminapi\validate\doctor\AppointmentValidate;
+use app\adminapi\logic\doctor\AppointmentLogic;
+use app\adminapi\logic\doctor\DoctorNoteLogic;
+use app\adminapi\logic\tcm\DiagnosisLogic;
+use app\adminapi\validate\doctor\AppointmentValidate;
 
 /**
  * 医生预约控制器
@@ -147,8 +148,11 @@ class AppointmentController extends BaseAdminController
     public function reception()
     {
         $params = (new AppointmentValidate())->goCheck('reception');
-        $result = AppointmentLogic::reception($params);
-        return $this->data($result);
+        $result = AppointmentLogic::reception($params, $this->adminId, $this->adminInfo);
+        if (empty($result)) {
+            return $this->fail('预约记录不存在或无权访问');
+        }
+        return $this->data($result);
     }
 
     /**
@@ -165,10 +169,17 @@ class AppointmentController extends BaseAdminController
         return $this->success('通知已发送');
     }
 
-    public function addDoctorNote()
-    {
-        $params = (new AppointmentValidate())->post()->goCheck('addDoctorNote');
-        $params['doctor_id'] = $this->adminId;
+    public function addDoctorNote()
+    {
+        $params = (new AppointmentValidate())->post()->goCheck('addDoctorNote');
+        if (!DiagnosisLogic::canViewReadonlyDiagnosis(
+            (int) $params['diagnosis_id'],
+            $this->adminId,
+            $this->adminInfo
+        )) {
+            return $this->fail(DiagnosisLogic::getError() ?: '诊单不存在或无权访问');
+        }
+        $params['doctor_id'] = $this->adminId;
         $result = DoctorNoteLogic::addOrAppend($params);
         if ($result === false) {
             return $this->fail(DoctorNoteLogic::getError());
@@ -176,10 +187,17 @@ class AppointmentController extends BaseAdminController
         return $this->success('保存成功');
     }
 
-    public function doctorNotes()
-    {
-        $params = (new AppointmentValidate())->goCheck('doctorNotes');
-        return $this->data(DoctorNoteLogic::getByDiagnosis((int) $params['diagnosis_id']));
+    public function doctorNotes()
+    {
+        $params = (new AppointmentValidate())->goCheck('doctorNotes');
+        if (!DiagnosisLogic::canViewReadonlyDiagnosis(
+            (int) $params['diagnosis_id'],
+            $this->adminId,
+            $this->adminInfo
+        )) {
+            return $this->fail('诊单不存在或无权访问');
+        }
+        return $this->data(DoctorNoteLogic::getByDiagnosis((int) $params['diagnosis_id']));
     }
 
     public function deleteDoctorNoteImage()