更新

server/app/adminapi/controller/tcm/DiagnosisController.php

@@ -447,11 +447,18 @@ class DiagnosisController extends BaseAdminController
         set_time_limit(120);
 
         $diagnosisId = (int)$this->request->get('diagnosis_id', 0);
-        if ($diagnosisId <= 0) {
-            return $this->fail('诊单ID不能为空');
-        }
-        $onlyArchived = (int)$this->request->get('only_archived', 0) === 1;
-        $result = DiagnosisLogic::getImChatMessagesForDiagnosis($diagnosisId, $onlyArchived);
+        if ($diagnosisId <= 0) {
+            return $this->fail('诊单ID不能为空');
+        }
+        if (!DiagnosisLogic::canViewReadonlyDiagnosis(
+            $diagnosisId,
+            (int) $this->adminId,
+            $this->adminInfo
+        )) {
+            return $this->fail(DiagnosisLogic::getError() ?: '诊单不存在或无权访问');
+        }
+        $onlyArchived = (int)$this->request->get('only_archived', 0) === 1;
+        $result = DiagnosisLogic::getImChatMessagesForDiagnosis($diagnosisId, $onlyArchived);
         if ($result === false) {
             return $this->fail(DiagnosisLogic::getError());
         }
@@ -468,11 +475,18 @@ class DiagnosisController extends BaseAdminController
         if ($diagnosisId <= 0) {
             $diagnosisId = (int)$this->request->get('diagnosis_id', 0);
         }
-        if ($diagnosisId <= 0) {
-            return $this->fail('诊单ID不能为空');
-        }
-
-        register_shutdown_function(function () use ($diagnosisId) {
+        if ($diagnosisId <= 0) {
+            return $this->fail('诊单ID不能为空');
+        }
+        if (!DiagnosisLogic::canViewReadonlyDiagnosis(
+            $diagnosisId,
+            (int) $this->adminId,
+            $this->adminInfo
+        )) {
+            return $this->fail(DiagnosisLogic::getError() ?: '诊单不存在或无权访问');
+        }
+
+        register_shutdown_function(function () use ($diagnosisId) {
             try {
                 @set_time_limit(300);
                 ignore_user_abort(true);

server/app/adminapi/logic/doctor/AppointmentLogic.php

@@ -30,9 +30,8 @@ use think\facade\Log;
  */
 class AppointmentLogic extends BaseLogic
 {
-    /** 仅这些字典名称需填写 channel_source_detail（与 admin 预约弹窗白名单一致，按 name 全等） */
+    /** 自媒体4H/4Q 无需补充；仅这些字典名称需填写 channel_source_detail（与 admin 预约弹窗白名单一致，按 name 全等） */
     private const CHANNEL_NAMES_REQUIRING_SOURCE_DETAIL = [
-        '自媒体4H',
         '自媒体3Q',
         '自媒体3H',
         '自媒体2H',

server/app/adminapi/logic/tcm/DiagnosisLogic.php

@@ -1044,9 +1044,12 @@ class DiagnosisLogic extends BaseLogic
             $patientImId = 'patient_' . $patientId;
             $archived = self::loadArchivedImChatRows($diagnosisId);
 
-            if ($onlyArchived) {
-                $lists = self::enrichImMessagesWithStaffNames($archived);
-                return [
+            if ($onlyArchived) {
+                $lists = self::attachDiagnosisIdToImMessages(
+                    self::enrichImMessagesWithStaffNames($archived),
+                    $diagnosisId
+                );
+                return [
                     'lists' => $lists,
                     'patient_im_id' => $patientImId,
                     'patient_name' => $diag['patient_name'] ?? '',
@@ -1061,7 +1064,10 @@ class DiagnosisLogic extends BaseLogic
                     self::setError('请先配置腾讯云 TRTC / IM 参数');
                     return false;
                 }
-                $lists = self::enrichImMessagesWithStaffNames($archived);
+                $lists = self::attachDiagnosisIdToImMessages(
+                    self::enrichImMessagesWithStaffNames($archived),
+                    $diagnosisId
+                );
 
                 return [
                     'lists' => $lists,
@@ -1082,9 +1088,12 @@ class DiagnosisLogic extends BaseLogic
                 return false;
             }
 
-            $live = self::pullLiveImChatMessagesForDiagnosis($diag, $doctorAccounts);
-            $merged = self::mergeImMessagesByMsgId($archived, $live);
-            $merged = self::enrichImMessagesWithStaffNames($merged);
+            $live = self::pullLiveImChatMessagesForDiagnosis($diag, $doctorAccounts);
+            $merged = self::mergeImMessagesByMsgId($archived, $live);
+            $merged = self::attachDiagnosisIdToImMessages(
+                self::enrichImMessagesWithStaffNames($merged),
+                $diagnosisId
+            );
 
             // 首次云端拉取后异步落库，下一次即可直接读归档，无需再全量扫描医生账号
             if (!empty($live)) {
@@ -1175,7 +1184,7 @@ class DiagnosisLogic extends BaseLogic
     /**
      * @return array<int, array<string, mixed>>
      */
-    private static function loadArchivedImChatRows(int $diagnosisId): array
+    private static function loadArchivedImChatRows(int $diagnosisId): array
     {
         if ($diagnosisId <= 0) {
             return [];
@@ -1203,8 +1212,25 @@ class DiagnosisLogic extends BaseLogic
                 'doctor_peer_account' => (string)($row['doctor_peer_account'] ?? ''),
             ];
         }
-        return $out;
-    }
+        return $out;
+    }
+
+    /**
+     * Keep the parent diagnosis on every child row so clients can reject
+     * accidentally mixed or stale IM payloads before rendering them.
+     *
+     * @param array<int, array<string, mixed>> $rows
+     * @return array<int, array<string, mixed>>
+     */
+    private static function attachDiagnosisIdToImMessages(array $rows, int $diagnosisId): array
+    {
+        foreach ($rows as &$row) {
+            $row['diagnosis_id'] = $diagnosisId;
+        }
+        unset($row);
+
+        return $rows;
+    }
 
     /**
      * @param array<int, array<string, mixed>> $archived