更新

server/app/adminapi/logic/tcm/PrescriptionOrderLogic.php

@@ -111,6 +111,31 @@ class PrescriptionOrderLogic
         return self::roleIntersect($adminInfo, is_array($roles) ? $roles : []);
     }
 
+    /**
+     * 菜单权限：非全量角色可额外查看「关联处方开方人为本账号」的业务订单（医助代建单）
+     *
+     * perms: tcm.prescriptionOrder/viewOrdersForOwnPrescription
+     */
+    public static function canViewOrdersForOwnPrescription(array $adminInfo): bool
+    {
+        $perms = AuthLogic::getAuthByAdminId((int) ($adminInfo['admin_id'] ?? 0));
+
+        return in_array('tcm.prescriptionOrder/viewOrdersForOwnPrescription', $perms, true);
+    }
+
+    /**
+     * 业务订单关联处方的开方人是否为指定管理员（处方 creator_id）
+     */
+    public static function isPrescriptionOrderPrescriber(int $prescriptionId, int $adminId): bool
+    {
+        if ($prescriptionId <= 0 || $adminId <= 0) {
+            return false;
+        }
+        $cid = (int) Prescription::where('id', $prescriptionId)->whereNull('delete_time')->value('creator_id');
+
+        return $cid === $adminId;
+    }
+
     /**
      * @param PrescriptionOrder $row
      */
@@ -119,16 +144,28 @@ class PrescriptionOrderLogic
         if (self::canSeeAllPrescriptionOrders($adminInfo)) {
             return true;
         }
+        if ((int) $row->creator_id === $adminId) {
+            return true;
+        }
+        if (self::canViewOrdersForOwnPrescription($adminInfo)) {
+            return self::isPrescriptionOrderPrescriber((int) $row->prescription_id, $adminId);
+        }
 
-        return (int) $row->creator_id === $adminId;
+        return false;
     }
 
     /**
+     * 撤回：仅创建人或全量角色（避免开方医生仅「查看医助代建单」权限误撤他人单子）
+     *
      * @param PrescriptionOrder $row
      */
     public static function canWithdrawOrder($row, int $adminId, array $adminInfo): bool
     {
-        return self::canAccessOrder($row, $adminId, $adminInfo);
+        if (self::canSeeAllPrescriptionOrders($adminInfo)) {
+            return true;
+        }
+
+        return (int) $row->creator_id === $adminId;
     }
 
     public static function canViewInternalCost(array $adminInfo): bool
@@ -2040,6 +2077,12 @@ class PrescriptionOrderLogic
         if ((int) ($item['creator_id'] ?? 0) === $adminId) {
             return true;
         }
+        if (
+            self::canViewOrdersForOwnPrescription($adminInfo)
+            && self::isPrescriptionOrderPrescriber((int) ($item['prescription_id'] ?? 0), $adminId)
+        ) {
+            return true;
+        }
         $did = (int) ($item['diagnosis_id'] ?? 0);
         $aid = (int) ($assistantByDiag[$did] ?? 0);