ZYT/zyt
2
0
Fork 0
Code Issues Actions Packages Projects Releases Wiki Activity

feat(followup-audio): separate uploader-only recording delete permission

Browse Source
This commit is contained in:
long
2026-10-12 16:36:47 +08:00
parent 11306e6314
commit bcd42a5c39
10 changed files with 263 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/tests/FollowupAudioPermissionTest.php
+3 -2
View File
@@ -79,7 +79,8 @@ try {
'detail', 'saveDraft', 'apply', 'retry', 'audio', 'delete', 'reextract'];
foreach ($actions as $action) {
foreach ([[], ['tcm.diagnosis/edit'], ['tcm.diagnosis/followupAudio'],
['tcm.diagnosis/edit', 'tcm.diagnosis/followupAudio']] as $uris) {
['tcm.diagnosis/edit', 'tcm.diagnosis/followupAudio'],
['tcm.diagnosis/edit', 'tcm.diagnosis/followupAudio', 'tcm.followupAudio/delete']] as $uris) {
FollowupPermissionAuthCacheDouble::$uris = $uris;
$route = new class($action, $request->ip()) {
public array $adminInfo;
@@ -93,7 +94,7 @@ try {
public function param($name, $default = null) { return $default; }
};
$result = $middleware->handle($route, static fn () => 'ALLOWED');
$expected = count($uris) === 2;
$expected = count($uris) >= 2 && ($action !== 'delete' || in_array('tcm.followupAudio/delete', $uris, true));
$expect(($result === 'ALLOWED') === $expected, 'middleware ' . $action . ' permission set ' . json_encode($uris));
if (!$expected) { $expect($result->getData()['code'] === 0, 'middleware failure envelope'); }
}