ai review

handler/escort_record.js

@@ -5,21 +5,51 @@ class HandlerEscortRecord {
   constructor() {
   }
 
+  // 白名单：只允许写入 schema 定义的顶层字段（兼容 'patient.name' 等点号路径）
+  static RECORD_FIELDS = [
+    "userId", "healthProfileId", "patient", "escort",
+    "attendant", "hospital", "schedule", "payment", "notes", "status",
+  ];
+
+  static pickFields(body) {
+    const picked = {};
+    for (const key of Object.keys(body || {})) {
+      const allowed = HandlerEscortRecord.RECORD_FIELDS.some(
+        (f) => key === f || key.startsWith(f + ".")
+      );
+      if (allowed) {
+        picked[key] = body[key];
+      }
+    }
+    return picked;
+  }
+
+  // 按条件查询记录（管理端，可查全部）
   async getRecords(ctx) {
+    return this._listRecords(ctx, false);
+  }
+
+  // 查询"我的"记录：强制以登录用户身份查询，忽略 query 中的 userId
+  async getMyRecords(ctx) {
+    return this._listRecords(ctx, true);
+  }
+
+  async _listRecords(ctx, forceSelf) {
     try {
       const { page = 1, pageSize = 20, status, userId, appointmentDate } = ctx.request.query;
+      const effectiveUserId = forceSelf ? ctx.state.user?._id : userId;
 
       // status解析成数组
       let statusArray = null;
       if (status && status.length > 0) {
         statusArray = status.split(',')
-      } 
+      }
 
       const records = await DBModel.EscortRecord.findRecords({
         page: parseInt(page),
         pageSize: parseInt(pageSize),
         status: statusArray,
-        userId,
+        userId: effectiveUserId,
         appointmentDate,
       });
 
@@ -31,7 +61,8 @@ class HandlerEscortRecord {
 
   async getAttendantRecords(ctx) {
     try {
-      const attendantId = ctx.state.user?._id || ctx.request.query?.attendantId;
+      // 只允许查询当前登录陪诊员自己的记录
+      const attendantId = ctx.state.user?._id;
       if (!attendantId) {
         return ResponseUtil.badRequest(ctx, "缺少陪诊员ID");
       }
@@ -74,7 +105,7 @@ class HandlerEscortRecord {
         return ResponseUtil.badRequest(ctx, "缺少患者信息");
       }
 
-      const newRecord = await DBModel.EscortRecord.createRecord(record);
+      const newRecord = await DBModel.EscortRecord.createRecord(HandlerEscortRecord.pickFields(record));
       return ResponseUtil.success(ctx, { record: newRecord }, "创建成功");
     } catch (err) {
       return ResponseUtil.internalError(ctx, err.message);
@@ -90,7 +121,7 @@ class HandlerEscortRecord {
         return ResponseUtil.badRequest(ctx, "缺少记录ID");
       }
 
-      const updatedRecord = await DBModel.EscortRecord.updateRecord(id, update);
+      const updatedRecord = await DBModel.EscortRecord.updateRecord(id, HandlerEscortRecord.pickFields(update));
       if (!updatedRecord) {
         return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
       }