plan-aggregate.service.ts
27.5 KB
-
fix(plan): orgScope→clinicIds 作硬边界,view_all 不再豁免越权(修 leader 仍能跨诊所) · 67668e9e上版按 !PLAN_VIEW_ALL 豁免,但 leader 角色本就带 PLAN_VIEW_ALL → 漏洞对 leader 仍在。 clinicIds 由 orgScope 派生,本应是硬边界:list 去掉 view!=='all' 豁免、detail/aggregate 去掉 view_all 豁免,始终按 clinicIds 圈诊所(null 集团池放行)。宽 scope(集团 leader/admin)clinicIds 覆盖全部 → no-op 不受影响;窄 scope 才被真正圈住。view_all 语义=本 scope 内看所有经办人,不跨诊所。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
luoqi committed