新增

server/app/adminapi/controller/LoginController.php

@@ -50,13 +50,23 @@ class LoginController extends BaseAdminController
         $agentId = env('work_wechat.agent_id', '');
 
         if (empty($corpId) || empty($agentId)) {
-            return $this->data(['enabled' => false]);
+            return $this->data([
+                'enabled'              => false,
+                'require_bind_nonroot' => false,
+                'force_bind_login'     => LoginLogic::isForceBindWorkWechatFromEnv(),
+            ]);
         }
 
+        $oauthOk  = LoginLogic::isWorkWechatOAuthConfigured();
+        $forceBind = LoginLogic::isForceBindWorkWechatFromEnv();
+
         return $this->data([
             'enabled'  => true,
             'corp_id'  => $corpId,
             'agent_id' => $agentId,
+            /** 与 .env FORCE_BIND_LOGIN 一致：为 true 且 OAuth 配全时非 root 须先绑定 */
+            'require_bind_nonroot' => $forceBind && $oauthOk,
+            'force_bind_login'     => $forceBind,
         ]);
     }
 

server/app/adminapi/controller/auth/AdminController.php

@@ -20,6 +20,7 @@ use app\adminapi\validate\auth\AdminValidate;
 use app\adminapi\logic\auth\AdminLogic;
 use app\adminapi\logic\LoginLogic;
 use app\adminapi\validate\auth\editSelfValidate;
+use app\common\cache\AdminTokenCache;
 use app\common\model\auth\Admin;
 
 /**
@@ -169,9 +170,14 @@ class AdminController extends BaseAdminController
             return $this->fail('企业微信授权失败: ' . ($response['errmsg'] ?? '未知错误'));
         }
 
-        $wxUserId = $response['userid'] ?? '';
-        if (empty($wxUserId)) {
-            return $this->fail('未获取到企业微信用户身份');
+        $wxUserId = LoginLogic::workWechatUserIdFromAuthResponse($response);
+        if ($wxUserId === '') {
+            $hasOpenId = trim((string) ($response['openid'] ?? $response['OpenId'] ?? '')) !== '';
+            return $this->fail(
+                $hasOpenId
+                    ? '当前扫码账号非企业通讯录成员（或尚未同步到通讯录），无法绑定。请使用已在企业微信通讯录中的成员扫码，或联系管理员将你加入企业后再试'
+                    : '未获取到企业微信成员 userid。请确认 .env 中 work_wechat.secret 为「该自建应用」的 Secret（与 agent_id 对应），且绑定页完整 URL 已加入应用可信域名'
+            );
         }
 
         // 检查是否已被其他管理员绑定
@@ -182,10 +188,15 @@ class AdminController extends BaseAdminController
             return $this->fail('该企业微信账号已被其他管理员绑定');
         }
 
-        Admin::update([
-            'id' => $this->adminId,
-            'work_wechat_userid' => $wxUserId,
-        ]);
+        $affected = Admin::where('id', $this->adminId)->update(['work_wechat_userid' => $wxUserId]);
+        if ($affected === 0) {
+            return $this->fail('保存绑定失败，请确认账号有效后重试');
+        }
+
+        $token = $this->request->header('token');
+        if ($token) {
+            (new AdminTokenCache())->deleteAdminInfo($token);
+        }
 
         return $this->success('绑定成功', ['work_wechat_userid' => $wxUserId]);
     }
@@ -195,10 +206,7 @@ class AdminController extends BaseAdminController
      */
     public function unbindWorkWechat()
     {
-        Admin::update([
-            'id' => $this->adminId,
-            'work_wechat_userid' => '',
-        ]);
+        Admin::where('id', $this->adminId)->update(['work_wechat_userid' => '']);
 
         return $this->success('解绑成功');
     }

server/app/adminapi/controller/order/OrderController.php

@@ -25,6 +25,27 @@ class OrderController extends BaseAdminController
         return $this->dataLists(new OrderLists());
     }
 
+    /**
+     * @notes 指定诊单下已支付支付单列表（创建/编辑处方业务订单时多选关联）
+     * @return \think\response\Json
+     */
+    public function paidOrdersForDiagnosis()
+    {
+        $diagnosisId = (int) $this->request->get('diagnosis_id', 0);
+        if ($diagnosisId <= 0) {
+            return $this->fail('诊单ID必填');
+        }
+        $exceptPo = (int) $this->request->get('prescription_order_id', 0);
+        $lists = OrderLogic::listPaidOrdersForDiagnosis(
+            $diagnosisId,
+            $this->adminId,
+            $this->adminInfo,
+            $exceptPo > 0 ? $exceptPo : null
+        );
+
+        return $this->success('', ['lists' => $lists]);
+    }
+
     /**
      * @notes 同步企业微信对外收款账单到订单
      * 员工直接在企业微信发起收款（未经过后台创建）时，通过此接口拉取并创建订单

server/app/adminapi/controller/tcm/PrescriptionOrderController.php

@@ -0,0 +1,140 @@
+<?php
+
+declare(strict_types=1);
+
+namespace app\adminapi\controller\tcm;
+
+use app\adminapi\controller\BaseAdminController;
+use app\adminapi\lists\tcm\PrescriptionOrderLists;
+use app\adminapi\logic\order\OrderLogic;
+use app\adminapi\logic\tcm\PrescriptionOrderLogic;
+use app\adminapi\validate\tcm\PrescriptionOrderValidate;
+
+/**
+ * 处方业务订单（非支付单）
+ */
+class PrescriptionOrderController extends BaseAdminController
+{
+    public function lists()
+    {
+        return $this->dataLists(new PrescriptionOrderLists());
+    }
+
+    /**
+     * 指定诊单下已支付支付单（创建/编辑业务订单时多选关联）
+     */
+    public function paidPayOrders()
+    {
+        $params = (new PrescriptionOrderValidate())->get()->goCheck('paidPayOrders');
+        $exceptPo = (int) $this->request->get('prescription_order_id', 0);
+        $lists = OrderLogic::listPaidOrdersForDiagnosis(
+            (int) $params['diagnosis_id'],
+            $this->adminId,
+            $this->adminInfo,
+            $exceptPo > 0 ? $exceptPo : null
+        );
+
+        return $this->success('', ['lists' => $lists]);
+    }
+
+    public function create()
+    {
+        $params = (new PrescriptionOrderValidate())->post()->goCheck('create');
+        $result = PrescriptionOrderLogic::create($params, $this->adminId, $this->adminInfo);
+        if ($result === false) {
+            return $this->fail(PrescriptionOrderLogic::getError());
+        }
+
+        return $this->success('创建成功', $result);
+    }
+
+    public function detail()
+    {
+        $params = (new PrescriptionOrderValidate())->get()->goCheck('detail');
+        $detail = PrescriptionOrderLogic::detail((int) $params['id'], $this->adminId, $this->adminInfo);
+        if ($detail === null) {
+            return $this->fail(PrescriptionOrderLogic::getError());
+        }
+
+        return $this->data($detail);
+    }
+
+    /**
+     * 快递轨迹查询（对接快递100；未配置时仍可跳转顺丰/京东官网）
+     */
+    public function logisticsTrace()
+    {
+        $params = (new PrescriptionOrderValidate())->get()->goCheck('logisticsTrace');
+        $expressOverride = trim((string) $this->request->get('express_company', ''));
+        $data = PrescriptionOrderLogic::logisticsTrace(
+            (int) $params['id'],
+            $expressOverride,
+            $this->adminId,
+            $this->adminInfo
+        );
+        if ($data === null) {
+            return $this->fail(PrescriptionOrderLogic::getError());
+        }
+
+        return $this->success('', $data);
+    }
+
+    public function edit()
+    {
+        $params = (new PrescriptionOrderValidate())->post()->goCheck('edit');
+        $result = PrescriptionOrderLogic::edit($params, $this->adminId, $this->adminInfo);
+        if ($result === false) {
+            return $this->fail(PrescriptionOrderLogic::getError());
+        }
+
+        return $this->success('保存成功', $result);
+    }
+
+    public function auditPrescription()
+    {
+        $params = (new PrescriptionOrderValidate())->post()->goCheck('auditPrescription');
+        $result = PrescriptionOrderLogic::auditPrescription(
+            (int) $params['id'],
+            (string) $params['action'],
+            (string) ($params['remark'] ?? ''),
+            $this->adminId,
+            $this->adminInfo
+        );
+        if ($result === false) {
+            return $this->fail(PrescriptionOrderLogic::getError());
+        }
+
+        return $this->success('操作成功', $result);
+    }
+
+    public function auditPayment()
+    {
+        $params = (new PrescriptionOrderValidate())->post()->goCheck('auditPayment');
+        $result = PrescriptionOrderLogic::auditPaymentSlip(
+            (int) $params['id'],
+            (string) $params['action'],
+            (string) ($params['remark'] ?? ''),
+            $this->adminId,
+            $this->adminInfo
+        );
+        if ($result === false) {
+            return $this->fail(PrescriptionOrderLogic::getError());
+        }
+
+        return $this->success('操作成功', $result);
+    }
+
+    /**
+     * 医助/创建人撤回：仅「待双审通过」可撤（未通过或双审均驳回等仍为该状态）
+     */
+    public function withdraw()
+    {
+        $params = (new PrescriptionOrderValidate())->post()->goCheck('withdraw');
+        $result = PrescriptionOrderLogic::withdraw((int) $params['id'], $this->adminId, $this->adminInfo);
+        if ($result === false) {
+            return $this->fail(PrescriptionOrderLogic::getError());
+        }
+
+        return $this->success('已撤回', $result);
+    }
+}