| Name |
Last commit
|
Last update |
|---|---|---|
| .. | ||
| data | ||
| prisma | ||
| sql | ||
| src | ||
| tests | ||
| .dockerignore | ||
| .env.example | ||
| .gitignore | ||
| .swcrc | ||
| Dockerfile | ||
| jest.config.cjs | ||
| nest-cli.json | ||
| package.json | ||
| tsconfig.build.json | ||
| tsconfig.json |
上版按 !PLAN_VIEW_ALL 豁免,但 leader 角色本就带 PLAN_VIEW_ALL → 漏洞对 leader 仍在。 clinicIds 由 orgScope 派生,本应是硬边界:list 去掉 view!=='all' 豁免、detail/aggregate 去掉 view_all 豁免,始终按 clinicIds 圈诊所(null 集团池放行)。宽 scope(集团 leader/admin)clinicIds 覆盖全部 → no-op 不受影响;窄 scope 才被真正圈住。view_all 语义=本 scope 内看所有经办人,不跨诊所。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
| Name |
Last commit
|
Last update |
|---|---|---|
| .. | ||
| data | Loading commit data... | |
| prisma | Loading commit data... | |
| sql | Loading commit data... | |
| src | Loading commit data... | |
| tests | Loading commit data... | |
| .dockerignore | Loading commit data... | |
| .env.example | Loading commit data... | |
| .gitignore | Loading commit data... | |
| .swcrc | Loading commit data... | |
| Dockerfile | Loading commit data... | |
| jest.config.cjs | Loading commit data... | |
| nest-cli.json | Loading commit data... | |
| package.json | Loading commit data... | |
| tsconfig.build.json | Loading commit data... | |
| tsconfig.json | Loading commit data... |