xJourney/api_health
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修改了bug

Browse Source
This commit is contained in:
lik
2026-10-07 15:51:13 +08:00
parent 1bff9819ab
commit 168abd3133
10 changed files with 286 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
handler/escort_record.js
+127 -15
View File
@@ -1,4 +1,5 @@
import { DBModel } from "../models/index.js";
import services from "../resource/services.js";
import ResponseUtil from "../utils/responseUtil.js";
class HandlerEscortRecord {
@@ -11,10 +12,40 @@ class HandlerEscortRecord {
"attendant", "hospital", "schedule", "payment", "notes", "status",
];
static pickFields(body) {
// 用户端可自助修改的字段：费用、状态、陪诊员分配等一律由平台控制
static OWNER_UPDATE_FIELDS = [
"patient", "healthProfileId", "hospital", "schedule", "notes",
];
// 用户端可自助触发的状态（取消/确认完成），其余状态由平台流转
static OWNER_ALLOWED_STATUS = ["cancelled", "completed"];
// 单页最大条数，避免 pageSize 传超大值一次拖库
static MAX_PAGE_SIZE = 200;
/**
* 是否为管理端账号（与 WS 管理端 agent 的校验口径一致）
* @param {Object} user token 解析出的用户
*/
static isAdmin(user) {
return !!(user && user.app && ("wxapp-escort-admin" in user.app));
}
/**
* 记录访问校验：仅记录所属用户本人或管理员可读写
* @param {Object} user 当前登录用户
* @param {Object} record 目标记录
*/
static canAccess(user, record) {
if (!record) return false;
if (HandlerEscortRecord.isAdmin(user)) return true;
return String(record.userId) === String(user?._id);
}
static pickFields(body, allowFields = HandlerEscortRecord.RECORD_FIELDS) {
const picked = {};
for (const key of Object.keys(body || {})) {
const allowed = HandlerEscortRecord.RECORD_FIELDS.some(
const allowed = allowFields.some(
(f) => key === f || key.startsWith(f + ".")
);
if (allowed) {
@@ -24,6 +55,14 @@ class HandlerEscortRecord {
return picked;
}
// 解析分页参数并夹紧上限，防止超大 pageSize 拖库
static parsePaging(query = {}) {
const page = Math.max(1, parseInt(query.page) || 1);
const rawSize = parseInt(query.pageSize) || 20;
const pageSize = Math.min(Math.max(1, rawSize), HandlerEscortRecord.MAX_PAGE_SIZE);
return { page, pageSize };
}
// 按条件查询记录（管理端，可查全部）
async getRecords(ctx) {
return this._listRecords(ctx, false);
@@ -36,7 +75,8 @@ class HandlerEscortRecord {
async _listRecords(ctx, forceSelf) {
try {
const { page = 1, pageSize = 20, status, userId, appointmentDate, healthProfileId } = ctx.request.query;
const { status, userId, appointmentDate, healthProfileId } = ctx.request.query;
const { page, pageSize } = HandlerEscortRecord.parsePaging(ctx.request.query);
const effectiveUserId = forceSelf ? ctx.state.user?._id : userId;
// status解析成数组
@@ -46,8 +86,8 @@ class HandlerEscortRecord {
}
const records = await DBModel.EscortRecord.findRecords({
page: parseInt(page),
pageSize: parseInt(pageSize),
page,
pageSize,
status: statusArray,
userId: effectiveUserId,
appointmentDate,
@@ -68,10 +108,11 @@ class HandlerEscortRecord {
return ResponseUtil.badRequest(ctx, "缺少陪诊员ID");
}
const { page = 1, pageSize = 20, status } = ctx.request.query;
const { status } = ctx.request.query;
const { page, pageSize } = HandlerEscortRecord.parsePaging(ctx.request.query);
const records = await DBModel.EscortRecord.findRecordsByAttendant(attendantId, {
page: parseInt(page),
pageSize: parseInt(pageSize),
page,
pageSize,
status,
});
@@ -92,6 +133,10 @@ class HandlerEscortRecord {
if (!record) {
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
}
// 归属校验：非本人订单按无权限处理，避免凭 id 遍历他人订单
if (!HandlerEscortRecord.canAccess(ctx.state.user, record)) {
return ResponseUtil.forbidden(ctx, "无权访问该订单");
}
return ResponseUtil.success(ctx, { record }, "查询成功");
} catch (err) {
@@ -101,16 +146,39 @@ class HandlerEscortRecord {
async createRecord(ctx) {
try {
const record = ctx.request.body;
if (!record.userId) {
return ResponseUtil.badRequest(ctx, "缺少患者信息");
const body = ctx.request.body || {};
const userId = ctx.state.user?._id;
if (!userId) {
return ResponseUtil.unauthorized(ctx, "登录已失效");
}
// 订单必须关联就诊人：patient 是下单当刻的快照，healthProfileId 才是关联
if (!record.healthProfileId) {
if (!body.healthProfileId) {
return ResponseUtil.badRequest(ctx, "缺少就诊人档案ID");
}
const newRecord = await DBModel.EscortRecord.createRecord(HandlerEscortRecord.pickFields(record));
// 就诊人档案必须属于当前登录用户，避免把订单挂到他人档案上
const profile = await DBModel.HealthProfile.findProfileById(body.healthProfileId);
if (!profile || String(profile.userId) !== String(userId)) {
return ResponseUtil.badRequest(ctx, "就诊人档案不存在");
}
// 服务项目与价格以服务端 services.js 为准，客户端提交的价格一律忽略
const service = services.find((s) => String(s.id) === String(body.escort?.serviceId));
if (!service) {
return ResponseUtil.badRequest(ctx, "服务项目不存在");
}
const payload = HandlerEscortRecord.pickFields(body);
// 归属、状态、费用全部由服务端决定
payload.userId = userId;
payload.status = "pending";
payload.payment = {
totalFee: Number(service.price) || 0,
paidFee: 0,
status: "unpaid",
};
const newRecord = await DBModel.EscortRecord.createRecord(payload);
return ResponseUtil.success(ctx, { record: newRecord }, "创建成功");
} catch (err) {
return ResponseUtil.internalError(ctx, err.message);
@@ -126,7 +194,20 @@ class HandlerEscortRecord {
return ResponseUtil.badRequest(ctx, "缺少记录ID");
}
const updatedRecord = await DBModel.EscortRecord.updateRecord(id, HandlerEscortRecord.pickFields(update));
const existing = await DBModel.EscortRecord.findById(id);
if (!existing) {
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
}
if (!HandlerEscortRecord.canAccess(ctx.state.user, existing)) {
return ResponseUtil.forbidden(ctx, "无权修改该订单");
}
// 非管理员只能改就诊信息类字段，费用/状态/归属/陪诊员分配不可自助修改
const allowFields = HandlerEscortRecord.isAdmin(ctx.state.user)
? HandlerEscortRecord.RECORD_FIELDS
: HandlerEscortRecord.OWNER_UPDATE_FIELDS;
const updatedRecord = await DBModel.EscortRecord.updateRecord(id, HandlerEscortRecord.pickFields(update, allowFields));
if (!updatedRecord) {
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
}
@@ -149,6 +230,20 @@ class HandlerEscortRecord {
return ResponseUtil.badRequest(ctx, "缺少状态值");
}
const existing = await DBModel.EscortRecord.findById(id);
if (!existing) {
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
}
if (!HandlerEscortRecord.canAccess(ctx.state.user, existing)) {
return ResponseUtil.forbidden(ctx, "无权修改该订单");
}
// 用户端只允许「取消」与「确认完成」，其余状态由平台流转
if (!HandlerEscortRecord.isAdmin(ctx.state.user)
&& !HandlerEscortRecord.OWNER_ALLOWED_STATUS.includes(status)) {
return ResponseUtil.forbidden(ctx, "不支持的状态变更");
}
const updatedRecord = await DBModel.EscortRecord.updateRecord(id, {
"status": status,
});
@@ -171,6 +266,23 @@ class HandlerEscortRecord {
return ResponseUtil.badRequest(ctx, "缺少记录ID");
}
const existing = await DBModel.EscortRecord.findById(id);
if (!existing) {
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
}
if (!HandlerEscortRecord.canAccess(ctx.state.user, existing)) {
return ResponseUtil.forbidden(ctx, "无权删除该订单");
}
// 与前端口径一致：仅「未支付且未进入服务阶段」的订单可删。
// 已支付/进行中/已完成的订单承载服务与费用记录，不能只靠前端隐藏按钮来保护
const paymentStatus = existing.payment?.status || "unpaid";
const deletable = paymentStatus === "unpaid"
&& ["pending", "confirmed", "cancelled"].includes(existing.status);
if (!HandlerEscortRecord.isAdmin(ctx.state.user) && !deletable) {
return ResponseUtil.forbidden(ctx, "该订单不可删除");
}
const deletedRecord = await DBModel.EscortRecord.deleteRecord(id);
if (!deletedRecord) {
@@ -184,4 +296,4 @@ class HandlerEscortRecord {
}
}
export { HandlerEscortRecord };
export { HandlerEscortRecord };
handler/health_profile.js
+19 -6
View File
@@ -8,6 +8,17 @@ class HandlerHealthProfile {
// 白名单：只允许写入 schema 定义的顶层字段（兼容 'profile.name' 等点号路径）
static PROFILE_FIELDS = ["userId", "profile", "location", "health"];
// 单页最大条数，避免 pageSize 传超大值一次拖库
static MAX_PAGE_SIZE = 200;
// 解析分页参数并夹紧上限
static parsePaging(query = {}) {
const page = Math.max(1, parseInt(query.page) || 1);
const rawSize = parseInt(query.pageSize) || 20;
const pageSize = Math.min(Math.max(1, rawSize), HandlerHealthProfile.MAX_PAGE_SIZE);
return { page, pageSize };
}
static pickFields(body) {
const picked = {};
for (const key of Object.keys(body || {})) {
@@ -23,11 +34,12 @@ class HandlerHealthProfile {
async getProfiles(ctx) {
try {
const { page = 1, pageSize = 20, userId, name, mobile, sortBy } = ctx.request.query;
const { userId, name, mobile, sortBy } = ctx.request.query;
const { page, pageSize } = HandlerHealthProfile.parsePaging(ctx.request.query);
const result = await DBModel.HealthProfile.findProfiles({
page: parseInt(page),
pageSize: parseInt(pageSize),
page,
pageSize,
userId,
name,
mobile,
@@ -43,12 +55,13 @@ class HandlerHealthProfile {
// 查询"我的"健康档案列表：强制以登录用户身份查询，忽略请求中的 userId
async getMyProfiles(ctx) {
try {
const { page = 1, pageSize = 20, name, mobile, sortBy } = ctx.request.query;
const { name, mobile, sortBy } = ctx.request.query;
const { page, pageSize } = HandlerHealthProfile.parsePaging(ctx.request.query);
const userId = ctx.state.user?._id;
const result = await DBModel.HealthProfile.findProfiles({
page: parseInt(page),
pageSize: parseInt(pageSize),
page,
pageSize,
userId,
name,
mobile,