更新

2026-11-03 17:20:35 +08:00
parent 3d912ddcd7
commit f277fec427
41 changed files with 4008 additions and 376 deletions
@@ -80,6 +80,14 @@ class AuthMiddleware
        // 当前访问路径
        $accessUri = strtolower($request->controller() . '/' . $request->action());

+        // Screenshot analysis shares the assistant grant and must never use the
+        // unregistered-route bypass, even before menus have been synchronized.
+        if ($accessUri === 'tcm.diagnosis/aitonguescreenshot') {
+            $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);
+            return in_array('tcm.diagnosis/aiassistant', $uris, true)
+                ? $next($request) : JsonService::fail('权限不足，无法使用诊单 AI 助手');
+        }
+
        // 面诊回放与文字共用读取权限；未登记该接口时也不能走历史放行分支。
        if ($accessUri === 'tcm.diagnosis/getcallrecords') {
            $uris = $this->formatUrl($adminAuthCache->getAdminUri() ?? []);