ZYT/zyt
2
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

feat(followup-audio): separate uploader-only recording delete permission

Browse Source
This commit is contained in:
long
2026-10-12 16:36:47 +08:00
parent 11306e6314
commit bcd42a5c39
10 changed files with 263 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/app/adminapi/http/middleware/AuthMiddleware.php
+2 -1
View File
@@ -87,7 +87,8 @@ class AuthMiddleware
$action = substr($accessUri, strlen('tcm.followupaudio/'));
$uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
if (in_array($action, $allowed, true) && in_array('tcm.diagnosis/edit', $uris, true)
&& in_array('tcm.diagnosis/followupaudio', $uris, true)) {
&& in_array('tcm.diagnosis/followupaudio', $uris, true)
&& ($action !== 'delete' || in_array('tcm.followupaudio/delete', $uris, true))) {
return $next($request); // The service also checks the current patient scope and daily permissions.
}
return JsonService::fail('权限不足，无法访问或操作');
server/app/adminapi/logic/tcm/FollowupAudioLogic.php
+2 -3
View File
@@ -108,9 +108,8 @@ final class FollowupAudioLogic
{
$task = Store::task((int) $summary['id']);
$info = Access::actor($actor);
$reason = !Store::enabled() ? '回访录音功能尚未启用'
: ((int) $info['root'] !== 1 && (int) $task['actor_id'] !== $actor
? '仅上传者或超级管理员可删除录音' : Store::deleteBlockReason($task));
$reason = !Store::enabled() ? '回访录音功能尚未启用' : Access::deleteReason($task, $actor);
if ($reason === '') { $reason = Store::deleteBlockReason($task); }
$reextractReason = (int) $info['root'] !== 1 && (int) $task['actor_id'] !== $actor
? '仅上传者或超级管理员可重新提炼' : Reextract::blockReason($task);
return $summary + ['can_delete' => $reason === '', 'delete_block_reason' => $reason,
server/app/common/service/followupaudio/FollowupAudioAccess.php
+13
View File
@@ -74,6 +74,19 @@ final class FollowupAudioAccess
return $task;
}
/** One fresh authorization rule for both delete capability and the locked delete transaction. */
public static function deleteReason(array $task, int $actor): string
{
$info = self::actor($actor);
if (!self::allowed($actor, $info, 'tcm.followupAudio/delete')) {
return '缺少删除回访录音权限';
}
if ((int) $info['root'] !== 1 && (int) ($task['actor_id'] ?? 0) !== $actor) {
return '仅上传者或超级管理员可删除录音';
}
return '';
}
public static function canDaily(int $actor, array $info): bool
{
$info = self::actor($actor);
server/app/common/service/followupaudio/FollowupAudioStore.php
+2 -3
View File
@@ -273,9 +273,8 @@ final class FollowupAudioStore
$task = self::lockTask($taskId);
$info = FollowupAudioAccess::actor($actor);
FollowupAudioAccess::task($taskId, $actor, $info);
if ((int) $info['root'] !== 1 && (int) $task['actor_id'] !== $actor) {
throw new DomainException('仅上传者或超级管理员可删除录音');
}
$permissionReason = FollowupAudioAccess::deleteReason($task, $actor);
if ($permissionReason !== '') { throw new DomainException($permissionReason); }
if ((int) $task['version'] !== $version) { throw new DomainException('FOLLOWUP_AUDIO_VERSION_CONFLICT'); }
$reason = self::deleteBlockReason($task);
if ($reason !== '') { throw new DomainException($reason); }