新增

server/app/adminapi/http/middleware/AuthMiddleware.php

@@ -16,6 +16,7 @@ declare (strict_types=1);
 
 namespace app\adminapi\http\middleware;
 
+use app\adminapi\logic\LoginLogic;
 use app\common\{
     cache\AdminAuthCache,
     service\JsonService
@@ -48,11 +49,23 @@ class AuthMiddleware
             return JsonService::fail('ip地址发生变化，请重新登录', [], -1);
         }
 
+        // 非 root 待绑企微：放行绑定 / 解绑 / 个人信息 / 退出（避免无菜单权限；action 与路由大小写一致）
+        if (LoginLogic::adminMustBindWorkWechat($request->adminInfo)) {
+            if (LoginLogic::isWorkWechatBindExemptActionName((string) $request->action())) {
+                return $next($request);
+            }
+        }
+
         //系统默认超级管理员，无需权限验证
         if (1 === $request->adminInfo['root']) {
             return $next($request);
         }
 
+        // 面诊进度看板：仅登录即可拉医生列表 + 预约列表（须带 progress_board=1，见 AdminLists / AppointmentLists 内限制）
+        if ($this->isFaceProgressBoardPublicLists($request)) {
+            return $next($request);
+        }
+
         $adminAuthCache = new AdminAuthCache($request->adminInfo['admin_id']);
 
         // 当前访问路径
@@ -90,4 +103,19 @@ class AuthMiddleware
         }, $data);
     }
 
+    /**
+     * 面诊进度专用：auth.admin/lists、doctor.appointment/lists + progress_board=1，不校验菜单权限
+     */
+    private function isFaceProgressBoardPublicLists($request): bool
+    {
+        if ((int) $request->param('progress_board', 0) !== 1) {
+            return false;
+        }
+        if (strtolower((string) $request->action()) !== 'lists') {
+            return false;
+        }
+        $c = strtolower((string) $request->controller());
+
+        return in_array($c, ['auth.admin', 'doctor.appointment'], true);
+    }
 }

server/app/adminapi/http/middleware/LoginMiddleware.php

@@ -16,6 +16,7 @@ declare (strict_types=1);
 
 namespace app\adminapi\http\middleware;
 
+use app\adminapi\logic\LoginLogic;
 use app\common\cache\AdminTokenCache;
 use app\adminapi\service\AdminTokenService;
 use app\common\service\JsonService;
@@ -72,7 +73,34 @@ class LoginMiddleware
         $request->adminInfo = $adminInfo;
         $request->adminId = $adminInfo['admin_id'] ?? 0;
 
+        // 非 root 须绑定企微：免登录接口不拦截（如 getConfig），避免 init 死循环
+        if (!empty($adminInfo) && LoginLogic::adminMustBindWorkWechat($adminInfo) && !$isNotNeedLogin) {
+            if (!self::isWorkWechatBindExemptAction($request)) {
+                return JsonService::fail(
+                    '请先绑定企业微信后再使用系统',
+                    [],
+                    LoginLogic::CODE_NEED_BIND_WORK_WECHAT,
+                    0
+                );
+            }
+        }
+
         return $next($request);
     }
 
+    private static function isWorkWechatBindExemptAction($request): bool
+    {
+        if (LoginLogic::isWorkWechatBindExemptActionName((string) $request->action())) {
+            return true;
+        }
+        // 与 AuthMiddleware 一致：未绑企微时仍允许打开面诊进度所需只读列表
+        if ((int) $request->param('progress_board', 0) === 1 && strtolower((string) $request->action()) === 'lists') {
+            $c = strtolower((string) $request->controller());
+
+            return in_array($c, ['auth.admin', 'doctor.appointment'], true);
+        }
+
+        return false;
+    }
+
 }