where('id', $userid)->first(); if (!$user || !$user->department_id) { return \Yz::Return(false, '当前用户未绑定科室', []); } $department_id = $user->department_id; $list = DB::table('s_department') ->where('pid', $department_id) ->where('is_del', 0) ->select('id', 'department_name', 'department_number', 'department_status', 'appointment_enabled') ->orderBy('id', 'asc') ->get(); return \Yz::Return(true, '查询成功', ['list' => $list]); } /** * 保存子科室配置(仅状态和预约属性) * @param array $info 包含 id, department_status, appointment_enabled * @param int $userid 当前登录用户ID(用于越权校验) * @return \Illuminate\Http\JsonResponse */ public function Save($info, $userid) { $id = $info['id'] ?? 0; if (!$id) { return \Yz::Return(false, '缺少子科室ID', []); } $user = DB::table('users')->where('id', $userid)->first(); if (!$user || !$user->department_id) { return \Yz::Return(false, '当前用户未绑定科室', []); } $department_id = $user->department_id; // 越权校验:该子科室的 pid 必须是当前用户的科室 $subDept = DB::table('s_department') ->where('id', $id) ->where('is_del', 0) ->first(); if (!$subDept) { return \Yz::Return(false, '子科室不存在', []); } if ($subDept->pid != $department_id) { return \Yz::Return(false, '无权修改该科室', []); } $updateData = []; if (isset($info['department_status'])) { $updateData['department_status'] = $info['department_status']; } if (isset($info['appointment_enabled'])) { $updateData['appointment_enabled'] = $info['appointment_enabled']; } if (empty($updateData)) { return \Yz::Return(false, '无更新内容', []); } $c = DB::table('s_department')->where('id', $id)->update($updateData); if ($c === false) { return \Yz::Return(false, '保存失败', []); } return \Yz::Return(true, '保存成功', []); } }