更新

2026-08-22 08:51:35 +08:00
parent 6c444a4a04
commit c06d293424
69 changed files with 11431 additions and 1601 deletions
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+require_once dirname(__DIR__) . '/vendor/autoload.php';
+
+use app\adminapi\logic\tcm\PrescriptionLogic;
+
+function prescriptionAiWriteSafetyExpect(bool $condition, string $message): void
+{
+    if (!$condition) {
+        throw new RuntimeException($message);
+    }
+}
+
+function prescriptionAiWriteSafetySource(string $method): string
+{
+    $reflection = (new ReflectionClass(PrescriptionLogic::class))->getMethod($method);
+    $lines = file($reflection->getFileName());
+    if (!is_array($lines)) {
+        throw new RuntimeException('method source must be readable');
+    }
+
+    return implode('', array_slice(
+        $lines,
+        $reflection->getStartLine() - 1,
+        $reflection->getEndLine() - $reflection->getStartLine() + 1
+    ));
+}
+
+$add = prescriptionAiWriteSafetySource('add');
+$edit = prescriptionAiWriteSafetySource('editLocked');
+
+prescriptionAiWriteSafetyExpect(
+    str_contains($add, 'DiagnosisLogic::canManageDiagnosis'),
+    'prescription creation must enforce diagnosis write scope before loading patient data'
+);
+prescriptionAiWriteSafetyExpect(
+    str_contains($add, "->where('patient_id', \$diagnosisIdRule)"),
+    'client appointment id must be bound to the authorized diagnosis'
+);
+foreach (['patient_id', 'patient_name', 'gender', 'age', 'phone'] as $field) {
+    prescriptionAiWriteSafetyExpect(
+        str_contains($add, "'{$field}' => \$diagnosis !== null"),
+        "{$field} must be derived from the authorized diagnosis"
+    );
+}
+prescriptionAiWriteSafetyExpect(
+    str_contains($add, "'case_record' => \$diagnosis !== null")
+        && str_contains($add, "'doctor_name' => \$doctorName")
+        && !str_contains($add, "'doctor_name' => \$doctorName !== ''"),
+    'case record and doctor identity must come from authoritative server state'
+);
+prescriptionAiWriteSafetyExpect(
+    str_contains($add, "'audit_status' => 0"),
+    'new AI-assisted prescriptions must always enter pending audit'
+);
+prescriptionAiWriteSafetyExpect(
+    str_contains($edit, '共享只扩大只读范围')
+        && str_contains($edit, '处方不允许改绑其他诊单'),
+    'shared prescriptions must stay read-only and edits must not rebind diagnoses'
+);
+
+echo "Prescription AI write safety contract: OK\n";