From 1b0be5918d0dce6767f8e244e504fc206462da57 Mon Sep 17 00:00:00 2001
From: root <root@DESKTOP-J0QK89R.localdomain>
Date: Sat, 28 Feb 2026 14:19:58 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E9=98=B2=E6=AD=A2=E8=87=AA=E5=AE=A1?=
 =?UTF-8?q?=E6=89=B9=E5=B9=B6=E4=BC=98=E5=8C=96=E9=A3=9E=E4=B9=A6=E5=93=8D?=
 =?UTF-8?q?=E5=BA=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 添加自审批检查（申请人不能审批自己的申请）
- 使用 response() 函数替代 new Response() 确保飞书回调正确
---
 .../app/controller/FeishuCardController.php   | 20 ++++++-------------
 backend/app/service/ApprovalService.php       | 10 ++++++++++
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/backend/app/controller/FeishuCardController.php b/backend/app/controller/FeishuCardController.php
index e4e6d2c..8681f42 100644
--- a/backend/app/controller/FeishuCardController.php
+++ b/backend/app/controller/FeishuCardController.php
@@ -66,13 +66,8 @@ class FeishuCardController extends BaseController
         error_log('✅ URL 验证成功');
 
         // URL 验证需要直接返回 challenge，不用包装
-        return new \Webman\Http\Response(
-            200,
-            ['Content-Type' => 'application/json'],
-            json_encode([
-                'challenge' => $challenge,
-            ])
-        );
+        $response = json_encode(['challenge' => $challenge]);
+        return response($response, 200, ['Content-Type' => 'application/json']);
     }
 
     /**
@@ -431,12 +426,9 @@ class FeishuCardController extends BaseController
 
         error_log('📤 飞书卡片响应: ' . $json);
 
-        return new \Webman\Http\Response(
-            200,
-            [
-                'Content-Type' => 'application/json; charset=utf-8',
-            ],
-            $json
-        );
+        // 使用原始响应，确保没有任何额外包装
+        return response($json, 200, [
+            'Content-Type' => 'application/json; charset=utf-8',
+        ]);
     }
 }
diff --git a/backend/app/service/ApprovalService.php b/backend/app/service/ApprovalService.php
index 79b8530..ae1ef9a 100644
--- a/backend/app/service/ApprovalService.php
+++ b/backend/app/service/ApprovalService.php
@@ -67,6 +67,11 @@ class ApprovalService
         return $this->db->transaction(function () use ($orderId, $approverId, $comment) {
             $order = ApprovalOrder::with(['flow.nodes'])->findOrFail($orderId);
 
+            // 检查是否为自己审批自己的申请
+            if ($order->applicant_id === $approverId) {
+                throw new \Exception('不能审批自己提交的申请');
+            }
+
             if (!$order->canApprove()) {
                 throw new \Exception('当前状态无法审批');
             }
@@ -137,6 +142,11 @@ class ApprovalService
         return $this->db->transaction(function () use ($orderId, $approverId, $comment) {
             $order = ApprovalOrder::findOrFail($orderId);
 
+            // 检查是否为自己审批自己的申请
+            if ($order->applicant_id === $approverId) {
+                throw new \Exception('不能审批自己提交的申请');
+            }
+
             if (!$order->canApprove()) {
                 throw new \Exception('当前状态无法审批');
             }