feat(followup-audio): separate uploader-only recording delete permission

2026-10-12 16:36:47 +08:00
parent 11306e6314
commit bcd42a5c39
10 changed files with 263 additions and 13 deletions
@@ -87,7 +87,8 @@ class AuthMiddleware
            $action = substr($accessUri, strlen('tcm.followupaudio/'));
            $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
            if (in_array($action, $allowed, true) && in_array('tcm.diagnosis/edit', $uris, true)
-                && in_array('tcm.diagnosis/followupaudio', $uris, true)) {
+                && in_array('tcm.diagnosis/followupaudio', $uris, true)
+                && ($action !== 'delete' || in_array('tcm.followupaudio/delete', $uris, true))) {
                return $next($request); // The service also checks the current patient scope and daily permissions.
            }
            return JsonService::fail('权限不足，无法访问或操作');