ZYT/zyt
2
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

feat(followup-audio): separate uploader-only recording delete permission

Browse Source
This commit is contained in:
long
2026-10-12 16:36:47 +08:00
parent 11306e6314
commit bcd42a5c39
10 changed files with 263 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/tests/FollowupAudioEndpointContractTest.php
+2
View File
@@ -23,6 +23,8 @@ expectEndpoint(str_contains($middleware, "in_array('tcm.diagnosis/edit', \$uris,
expectEndpoint(str_contains($access, "Db::name('admin')->where('id', \$actor)->whereNull('delete_time')->where('disable', 0)->lock(true)"), 'active actor refresh');
expectEndpoint(str_contains($access, 'MyPatientLogic::applyScope($query, $actor, $info)') && str_contains($access, '$query->lock(true)->find()'), 'row management guard');
expectEndpoint(str_contains($access, 'tcm.diagnosis/dailyRecord'), 'daily permission guard');
expectEndpoint(str_contains($middleware, "in_array('tcm.followupaudio/delete', \$uris, true)"), 'delete has an independent route permission');
expectEndpoint(str_contains($access, "self::allowed(\$actor, \$info, 'tcm.followupAudio/delete')"), 'delete permission also checked against current DB');
expectEndpoint(str_contains($middleware, "in_array('tcm.diagnosis/followupaudio', \$uris, true)"), 'independent audio route permission');
expectEndpoint(str_contains($access, "self::allowed(\$actor, \$info, 'tcm.diagnosis/followupAudio')"), 'fresh independent audio permission at every service entry');
expectEndpoint(str_contains($access, "\$task['patient_id'] !== (int) (\$diagnosis['patient_id']"), 'historical patient rebind guard');