300 lines
10 KiB
JavaScript
300 lines
10 KiB
JavaScript
import { DBModel } from "../models/index.js";
|
|
import services from "../resource/services.js";
|
|
import ResponseUtil from "../utils/responseUtil.js";
|
|
|
|
class HandlerEscortRecord {
|
|
constructor() {
|
|
}
|
|
|
|
// 白名单：只允许写入 schema 定义的顶层字段（兼容 'patient.name' 等点号路径）
|
|
static RECORD_FIELDS = [
|
|
"userId", "healthProfileId", "patient", "escort",
|
|
"attendant", "hospital", "schedule", "payment", "notes", "status",
|
|
];
|
|
|
|
// 用户端可自助修改的字段：费用、状态、陪诊员分配等一律由平台控制
|
|
static OWNER_UPDATE_FIELDS = [
|
|
"patient", "healthProfileId", "hospital", "schedule", "notes",
|
|
];
|
|
|
|
// 用户端可自助触发的状态（取消/确认完成），其余状态由平台流转
|
|
static OWNER_ALLOWED_STATUS = ["cancelled", "completed"];
|
|
|
|
// 单页最大条数，避免 pageSize 传超大值一次拖库
|
|
static MAX_PAGE_SIZE = 200;
|
|
|
|
/**
|
|
* 是否为管理端账号（与 WS 管理端 agent 的校验口径一致）
|
|
* @param {Object} user token 解析出的用户
|
|
*/
|
|
static isAdmin(user) {
|
|
return !!(user && user.app && ("wxapp-escort-admin" in user.app));
|
|
}
|
|
|
|
/**
|
|
* 记录访问校验：仅记录所属用户本人或管理员可读写
|
|
* @param {Object} user 当前登录用户
|
|
* @param {Object} record 目标记录
|
|
*/
|
|
static canAccess(user, record) {
|
|
if (!record) return false;
|
|
if (HandlerEscortRecord.isAdmin(user)) return true;
|
|
return String(record.userId) === String(user?._id);
|
|
}
|
|
|
|
static pickFields(body, allowFields = HandlerEscortRecord.RECORD_FIELDS) {
|
|
const picked = {};
|
|
for (const key of Object.keys(body || {})) {
|
|
const allowed = allowFields.some(
|
|
(f) => key === f || key.startsWith(f + ".")
|
|
);
|
|
if (allowed) {
|
|
picked[key] = body[key];
|
|
}
|
|
}
|
|
return picked;
|
|
}
|
|
|
|
// 解析分页参数并夹紧上限，防止超大 pageSize 拖库
|
|
static parsePaging(query = {}) {
|
|
const page = Math.max(1, parseInt(query.page) || 1);
|
|
const rawSize = parseInt(query.pageSize) || 20;
|
|
const pageSize = Math.min(Math.max(1, rawSize), HandlerEscortRecord.MAX_PAGE_SIZE);
|
|
return { page, pageSize };
|
|
}
|
|
|
|
// 按条件查询记录（管理端，可查全部）
|
|
async getRecords(ctx) {
|
|
return this._listRecords(ctx, false);
|
|
}
|
|
|
|
// 查询"我的"记录：强制以登录用户身份查询，忽略 query 中的 userId
|
|
async getMyRecords(ctx) {
|
|
return this._listRecords(ctx, true);
|
|
}
|
|
|
|
async _listRecords(ctx, forceSelf) {
|
|
try {
|
|
const { status, userId, appointmentDate, healthProfileId } = ctx.request.query;
|
|
const { page, pageSize } = HandlerEscortRecord.parsePaging(ctx.request.query);
|
|
const effectiveUserId = forceSelf ? ctx.state.user?._id : userId;
|
|
|
|
// status解析成数组
|
|
let statusArray = null;
|
|
if (status && status.length > 0) {
|
|
statusArray = status.split(',')
|
|
}
|
|
|
|
const records = await DBModel.EscortRecord.findRecords({
|
|
page,
|
|
pageSize,
|
|
status: statusArray,
|
|
userId: effectiveUserId,
|
|
appointmentDate,
|
|
healthProfileId,
|
|
});
|
|
|
|
return ResponseUtil.success(ctx, { records }, "查询成功");
|
|
} catch (err) {
|
|
return ResponseUtil.internalError(ctx, err.message);
|
|
}
|
|
}
|
|
|
|
async getAttendantRecords(ctx) {
|
|
try {
|
|
// 只允许查询当前登录陪诊员自己的记录
|
|
const attendantId = ctx.state.user?._id;
|
|
if (!attendantId) {
|
|
return ResponseUtil.badRequest(ctx, "缺少陪诊员ID");
|
|
}
|
|
|
|
const { status } = ctx.request.query;
|
|
const { page, pageSize } = HandlerEscortRecord.parsePaging(ctx.request.query);
|
|
const records = await DBModel.EscortRecord.findRecordsByAttendant(attendantId, {
|
|
page,
|
|
pageSize,
|
|
status,
|
|
});
|
|
|
|
return ResponseUtil.success(ctx, { records }, "查询成功");
|
|
} catch (err) {
|
|
return ResponseUtil.internalError(ctx, err.message);
|
|
}
|
|
}
|
|
|
|
async getRecordById(ctx) {
|
|
try {
|
|
const { id } = ctx.params;
|
|
if (!id) {
|
|
return ResponseUtil.badRequest(ctx, "缺少记录ID");
|
|
}
|
|
|
|
const record = await DBModel.EscortRecord.findById(id);
|
|
if (!record) {
|
|
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
|
|
}
|
|
// 归属校验：非本人订单按无权限处理，避免凭 id 遍历他人订单
|
|
if (!HandlerEscortRecord.canAccess(ctx.state.user, record)) {
|
|
return ResponseUtil.forbidden(ctx, "无权访问该订单");
|
|
}
|
|
|
|
return ResponseUtil.success(ctx, { record }, "查询成功");
|
|
} catch (err) {
|
|
return ResponseUtil.internalError(ctx, err.message);
|
|
}
|
|
}
|
|
|
|
async createRecord(ctx) {
|
|
try {
|
|
const body = ctx.request.body || {};
|
|
const userId = ctx.state.user?._id;
|
|
if (!userId) {
|
|
return ResponseUtil.unauthorized(ctx, "登录已失效");
|
|
}
|
|
// 订单必须关联就诊人：patient 是下单当刻的快照，healthProfileId 才是关联
|
|
if (!body.healthProfileId) {
|
|
return ResponseUtil.badRequest(ctx, "缺少就诊人档案ID");
|
|
}
|
|
|
|
// 就诊人档案必须属于当前登录用户，避免把订单挂到他人档案上
|
|
const profile = await DBModel.HealthProfile.findProfileById(body.healthProfileId);
|
|
if (!profile || String(profile.userId) !== String(userId)) {
|
|
return ResponseUtil.badRequest(ctx, "就诊人档案不存在");
|
|
}
|
|
|
|
// 服务项目与价格以服务端 services.js 为准，客户端提交的价格一律忽略
|
|
const service = services.find((s) => String(s.id) === String(body.escort?.serviceId));
|
|
if (!service) {
|
|
return ResponseUtil.badRequest(ctx, "服务项目不存在");
|
|
}
|
|
|
|
const payload = HandlerEscortRecord.pickFields(body);
|
|
// 归属、状态、费用全部由服务端决定
|
|
payload.userId = userId;
|
|
payload.status = "pending";
|
|
payload.payment = {
|
|
totalFee: Number(service.price) || 0,
|
|
paidFee: 0,
|
|
status: "unpaid",
|
|
};
|
|
|
|
const newRecord = await DBModel.EscortRecord.createRecord(payload);
|
|
return ResponseUtil.success(ctx, { record: newRecord }, "创建成功");
|
|
} catch (err) {
|
|
return ResponseUtil.internalError(ctx, err.message);
|
|
}
|
|
}
|
|
|
|
async updateRecord(ctx) {
|
|
try {
|
|
const { id } = ctx.params;
|
|
const update = ctx.request.body;
|
|
|
|
if (!id) {
|
|
return ResponseUtil.badRequest(ctx, "缺少记录ID");
|
|
}
|
|
|
|
const existing = await DBModel.EscortRecord.findById(id);
|
|
if (!existing) {
|
|
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
|
|
}
|
|
if (!HandlerEscortRecord.canAccess(ctx.state.user, existing)) {
|
|
return ResponseUtil.forbidden(ctx, "无权修改该订单");
|
|
}
|
|
|
|
// 非管理员只能改就诊信息类字段，费用/状态/归属/陪诊员分配不可自助修改
|
|
const allowFields = HandlerEscortRecord.isAdmin(ctx.state.user)
|
|
? HandlerEscortRecord.RECORD_FIELDS
|
|
: HandlerEscortRecord.OWNER_UPDATE_FIELDS;
|
|
|
|
const updatedRecord = await DBModel.EscortRecord.updateRecord(id, HandlerEscortRecord.pickFields(update, allowFields));
|
|
if (!updatedRecord) {
|
|
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
|
|
}
|
|
|
|
return ResponseUtil.success(ctx, { record: updatedRecord }, "更新成功");
|
|
} catch (err) {
|
|
return ResponseUtil.internalError(ctx, err.message);
|
|
}
|
|
}
|
|
|
|
async updateStatus(ctx) {
|
|
try {
|
|
const { id } = ctx.params;
|
|
const { status } = ctx.request.body;
|
|
|
|
if (!id) {
|
|
return ResponseUtil.badRequest(ctx, "缺少记录ID");
|
|
}
|
|
if (!status) {
|
|
return ResponseUtil.badRequest(ctx, "缺少状态值");
|
|
}
|
|
|
|
const existing = await DBModel.EscortRecord.findById(id);
|
|
if (!existing) {
|
|
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
|
|
}
|
|
if (!HandlerEscortRecord.canAccess(ctx.state.user, existing)) {
|
|
return ResponseUtil.forbidden(ctx, "无权修改该订单");
|
|
}
|
|
|
|
// 用户端只允许「取消」与「确认完成」，其余状态由平台流转
|
|
if (!HandlerEscortRecord.isAdmin(ctx.state.user)
|
|
&& !HandlerEscortRecord.OWNER_ALLOWED_STATUS.includes(status)) {
|
|
return ResponseUtil.forbidden(ctx, "不支持的状态变更");
|
|
}
|
|
|
|
const updatedRecord = await DBModel.EscortRecord.updateRecord(id, {
|
|
"status": status,
|
|
});
|
|
|
|
if (!updatedRecord) {
|
|
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
|
|
}
|
|
|
|
return ResponseUtil.success(ctx, { record: updatedRecord }, "状态更新成功");
|
|
} catch (err) {
|
|
return ResponseUtil.internalError(ctx, err.message);
|
|
}
|
|
}
|
|
|
|
async deleteRecord(ctx) {
|
|
try {
|
|
const { id } = ctx.params;
|
|
|
|
if (!id) {
|
|
return ResponseUtil.badRequest(ctx, "缺少记录ID");
|
|
}
|
|
|
|
const existing = await DBModel.EscortRecord.findById(id);
|
|
if (!existing) {
|
|
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
|
|
}
|
|
if (!HandlerEscortRecord.canAccess(ctx.state.user, existing)) {
|
|
return ResponseUtil.forbidden(ctx, "无权删除该订单");
|
|
}
|
|
|
|
// 与前端口径一致：仅「未支付且未进入服务阶段」的订单可删。
|
|
// 已支付/进行中/已完成的订单承载服务与费用记录，不能只靠前端隐藏按钮来保护
|
|
const paymentStatus = existing.payment?.status || "unpaid";
|
|
const deletable = paymentStatus === "unpaid"
|
|
&& ["pending", "confirmed", "cancelled"].includes(existing.status);
|
|
if (!HandlerEscortRecord.isAdmin(ctx.state.user) && !deletable) {
|
|
return ResponseUtil.forbidden(ctx, "该订单不可删除");
|
|
}
|
|
|
|
const deletedRecord = await DBModel.EscortRecord.deleteRecord(id);
|
|
|
|
if (!deletedRecord) {
|
|
return ResponseUtil.error(ctx, "陪诊记录不存在", null, 404);
|
|
}
|
|
|
|
return ResponseUtil.success(ctx, { record: deletedRecord }, "删除成功");
|
|
} catch (err) {
|
|
return ResponseUtil.internalError(ctx, err.message);
|
|
}
|
|
}
|
|
}
|
|
|
|
export { HandlerEscortRecord };
|