fix: 防止自审批并优化飞书响应

- 添加自审批检查（申请人不能审批自己的申请）
- 使用 response() 函数替代 new Response() 确保飞书回调正确

backend/app/controller/FeishuCardController.php

@@ -66,13 +66,8 @@ class FeishuCardController extends BaseController
         error_log('✅ URL 验证成功');
 
         // URL 验证需要直接返回 challenge，不用包装
-        return new \Webman\Http\Response(
-            200,
-            ['Content-Type' => 'application/json'],
-            json_encode([
-                'challenge' => $challenge,
-            ])
-        );
+        $response = json_encode(['challenge' => $challenge]);
+        return response($response, 200, ['Content-Type' => 'application/json']);
     }
 
     /**
@@ -431,12 +426,9 @@ class FeishuCardController extends BaseController
 
         error_log('📤 飞书卡片响应: ' . $json);
 
-        return new \Webman\Http\Response(
-            200,
-            [
-                'Content-Type' => 'application/json; charset=utf-8',
-            ],
-            $json
-        );
+        // 使用原始响应，确保没有任何额外包装
+        return response($json, 200, [
+            'Content-Type' => 'application/json; charset=utf-8',
+        ]);
     }
 }

backend/app/service/ApprovalService.php

@@ -67,6 +67,11 @@ class ApprovalService
         return $this->db->transaction(function () use ($orderId, $approverId, $comment) {
             $order = ApprovalOrder::with(['flow.nodes'])->findOrFail($orderId);
 
+            // 检查是否为自己审批自己的申请
+            if ($order->applicant_id === $approverId) {
+                throw new \Exception('不能审批自己提交的申请');
+            }
+
             if (!$order->canApprove()) {
                 throw new \Exception('当前状态无法审批');
             }
@@ -137,6 +142,11 @@ class ApprovalService
         return $this->db->transaction(function () use ($orderId, $approverId, $comment) {
             $order = ApprovalOrder::findOrFail($orderId);
 
+            // 检查是否为自己审批自己的申请
+            if ($order->applicant_id === $approverId) {
+                throw new \Exception('不能审批自己提交的申请');
+            }
+
             if (!$order->canApprove()) {
                 throw new \Exception('当前状态无法审批');
             }