更新

server/app/adminapi/http/middleware/AuthMiddleware.php

@@ -77,6 +77,7 @@ class AuthMiddleware
         // 判断该当前访问的uri是否存在，不存在无需验证
         if (!in_array($accessUri, $allUri, true)
             && !PharmacyUploadPermissionAlias::allows($accessUri, $allUri)
+            && !$this->isCriticalPrescriptionWrite($accessUri)
             && !($accessUri === 'tcm.diagnosis/aiassistantstream'
                 && in_array('tcm.diagnosis/aiassistant', $allUri, true))) {
             return $next($request);
@@ -122,7 +123,25 @@ class AuthMiddleware
 
         if (PharmacyUploadPermissionAlias::isControlled($accessUri)) {
             return PharmacyUploadPermissionAlias::allows($accessUri, $adminUris);
-        }
+        }
+
+        $prescriptionWriteAliases = [
+            'tcm.prescription/add' => [
+                'tcm.prescription/add', 'cf.prescription/add',
+                'tcm.diagnosis/chufang', 'tcm.diagnosis/kaifang',
+            ],
+            'tcm.prescription/edit' => [
+                'tcm.prescription/edit', 'cf.prescription/edit',
+                'tcm.diagnosis/chufang', 'tcm.diagnosis/kaifang',
+            ],
+            'tcm.prescription/delete' => ['tcm.prescription/delete', 'cf.prescription/del'],
+            'tcm.prescription/void' => ['tcm.prescription/void', 'cf.prescription/del', 'cf.prescription/audit'],
+            'tcm.prescription/audit' => ['tcm.prescription/audit', 'cf.prescription/audit'],
+        ];
+        if (isset($prescriptionWriteAliases[$accessUri])
+            && count(array_intersect($prescriptionWriteAliases[$accessUri], $adminUris)) > 0) {
+            return true;
+        }
 
         if (in_array('tcm.diagnosis/dailyrecord', $adminUris, true)
             && in_array($accessUri, [
@@ -172,8 +191,19 @@ class AuthMiddleware
             return true;
         }
 
-        return false;
-    }
+        return false;
+    }
+
+    private function isCriticalPrescriptionWrite(string $accessUri): bool
+    {
+        return in_array($accessUri, [
+            'tcm.prescription/add',
+            'tcm.prescription/edit',
+            'tcm.prescription/delete',
+            'tcm.prescription/void',
+            'tcm.prescription/audit',
+        ], true);
+    }
 
     /**
      * 处方库 lists：与开方、处方库维护菜单权限互通（避免开方页「从处方库导入」403）