feat:cms relation hospital bug fix

apps/organization/serializers.py

@@ -9,10 +9,15 @@ class CmsInstitutionSerializer(serializers.ModelSerializer):
     """CMS 机构（医院）序列化器。
 
     - `code` 显式声明以去掉默认 UniqueValidator，改用自定义错误码校验唯一性。
-    - `banner_url` 返回可访问的完整 URL（未配置时为空串，便于管理端识别「未设图」）。
+    - `banner_url` **可写**（新增/编辑可传，可选）：入参可为静态相对路径（如
+      `institutions/xxx.png`）或完整 `http(s)` URL；**输出**统一转为可访问的完整 URL
+      （未配置时为空串，便于管理端识别「未设图」）。传空串则清空。
     """
     code = serializers.CharField(max_length=100)
-    banner_url = serializers.SerializerMethodField()
+    banner_url = serializers.CharField(
+        max_length=500, required=False, allow_blank=True,
+        help_text='机构 Banner 图：相对静态路径或完整 http(s) URL；可选，传空串清空',
+    )
 
     class Meta:
         model = Institution
@@ -22,7 +27,12 @@ class CmsInstitutionSerializer(serializers.ModelSerializer):
         ]
         read_only_fields = ['id', 'created_at', 'updated_at']
 
-    def get_banner_url(self, obj):
+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        data['banner_url'] = self._full_banner_url(instance)
+        return data
+
+    def _full_banner_url(self, obj):
         if not obj.banner_url:
             return ''
         value = obj.banner_url
@@ -33,6 +43,9 @@ class CmsInstitutionSerializer(serializers.ModelSerializer):
         path = prefix + '/' + settings.STATIC_URL.strip('/') + '/' + value.lstrip('/')
         return request.build_absolute_uri(path) if request else path
 
+    def validate_banner_url(self, value):
+        return (value or '').strip()
+
     def validate_code(self, value):
         value = (value or '').strip()
         if not value:

apps/organization/views.py

@@ -11,7 +11,7 @@ from drf_spectacular.utils import extend_schema, extend_schema_view
 
 from config.exceptions import AppError
 from apps.user.models import Institution, Department
-from apps.cms.permissions import IsSuperAdmin
+from apps.cms.permissions import IsSuperAdmin, IsSuperOrHospitalAdmin, is_super
 from apps.common.excel import xlsx_response, rows_from_xlsx
 from .serializers import CmsInstitutionSerializer, CmsDepartmentSerializer
 
@@ -50,11 +50,25 @@ class CmsInstitutionViewSet(viewsets.ModelViewSet):
     # 仅 GET / POST：查=GET，增删改=POST（编辑→{id}/update/，停用→{id}/disable/）
     http_method_names = ['get', 'post', 'head', 'options']
 
+    def get_permissions(self):
+        # 编辑机构 / 上传 Banner：超管 + 医院管理员（医院管理员仅限本院，在动作内收口）；
+        # 其余动作（列表/新增/停用/导入导出等）仍仅超级管理员。
+        if getattr(self, 'action', None) in ('update_inst', 'banner'):
+            return [IsAuthenticated(), IsSuperOrHospitalAdmin()]
+        return [IsAuthenticated(), IsSuperAdmin()]
+
     @extend_schema(summary='CMS-INST-3 编辑机构', tags=['CMS-机构'])
     @action(detail=True, methods=['post'], url_path='update')
     def update_inst(self, request, pk=None):
-        """编辑机构（POST 局部更新，等价旧 PATCH /{id}/）。"""
+        """编辑机构（POST 局部更新，等价旧 PATCH /{id}/）。
+
+        - 超级管理员：可编辑任意机构。
+        - 医院管理员：仅能编辑**本院**机构（非本院 → 403），可改除机构 ID 外的信息；
+          不能停用/删除机构（停用动作仍仅超管）。
+        """
         instance = self.get_object()
+        if not is_super(request.user) and instance.id != request.user.institution_id:
+            raise AppError('CMS_PERMISSION_DENIED', '医院管理员只能修改本机构信息', status_code=403)
         serializer = self.get_serializer(instance, data=request.data, partial=True)
         serializer.is_valid(raise_exception=True)
         serializer.save()
@@ -71,8 +85,14 @@ class CmsInstitutionViewSet(viewsets.ModelViewSet):
     @action(detail=True, methods=['post'], url_path='banner',
             parser_classes=[MultiPartParser, FormParser])
     def banner(self, request, pk=None):
-        """上传机构 Banner 图（multipart/form-data，字段名 file）。"""
+        """上传机构 Banner 图（multipart/form-data，字段名 file）。
+
+        - 超级管理员：可为任意机构上传。
+        - 医院管理员：仅可为**本院**机构上传（非本院 → 403）。
+        """
         inst = self.get_object()
+        if not is_super(request.user) and inst.id != request.user.institution_id:
+            raise AppError('CMS_PERMISSION_DENIED', '医院管理员只能上传本机构 Banner 图', status_code=403)
         file = request.FILES.get('file')
         if not file:
             raise AppError('CMS_BANNER_FILE_REQUIRED', '请上传图片文件（字段名 file）', status_code=400)

apps/user/cms_relation.py

@@ -13,7 +13,7 @@ from apps.common.excel import xlsx_response, rows_from_xlsx
 from .models import User, TeacherStudentRelation
 
 REL_STATUS_LABEL = {0: '已结束', 1: '进行中'}
-REL_IMPORT_HEADERS = ['带教医生手机号', '学生手机号']
+REL_IMPORT_HEADERS = ['带教医生姓名', '带教医生手机号', '学生姓名', '学生手机号']
 REL_EXPORT_HEADERS = ['ID', '带教医生', '带教医生手机号', '学生', '学生手机号', '状态']
 
 
@@ -33,36 +33,48 @@ class CmsRelationSerializer(serializers.ModelSerializer):
         ]
 
 
+def _resolve_rel_user(name, phone, role, label, code):
+    """按 姓名 + 手机号 + 角色 解析用户；不匹配抛 400。"""
+    u = User.objects.filter(phone=phone, real_name=name, role_type=role).first()
+    if u is None:
+        raise AppError(code, f'{label}不存在或姓名与手机号不符：{name} / {phone}', status_code=400)
+    return u
+
+
 class CmsRelationWriteSerializer(serializers.ModelSerializer):
-    """新增 / 编辑：入参用**带教老师手机号 / 学生手机号**；按手机号解析为用户
+    """新增 / 编辑：入参用**带教老师姓名+手机号 / 学生姓名+手机号**；按姓名+手机号解析为用户
     （带教老师须 doctor、学生须 student）；医院管理员限本院。"""
+    teacher_name = serializers.CharField(write_only=True, required=False, help_text='带教老师姓名（新增必填）')
     teacher_phone = serializers.CharField(write_only=True, required=False, help_text='带教老师手机号（新增必填）')
+    student_name = serializers.CharField(write_only=True, required=False, help_text='学生姓名（新增必填）')
     student_phone = serializers.CharField(write_only=True, required=False, help_text='学生手机号（新增必填）')
 
     class Meta:
         model = TeacherStudentRelation
-        fields = ['teacher_phone', 'student_phone', 'relation_type', 'status']
+        fields = ['teacher_name', 'teacher_phone', 'student_name', 'student_phone', 'relation_type', 'status']
 
     def validate(self, attrs):
         actor = self.context['request'].user
         creating = self.instance is None
+        t_name = (attrs.pop('teacher_name', None) or '').strip()
         t_phone = (attrs.pop('teacher_phone', None) or '').strip()
+        s_name = (attrs.pop('student_name', None) or '').strip()
         s_phone = (attrs.pop('student_phone', None) or '').strip()
 
-        if creating and (not t_phone or not s_phone):
-            raise AppError('CMS_VALIDATION_ERROR', '带教老师手机号和学生手机号均必填', status_code=400)
+        if creating and not (t_name and t_phone and s_name and s_phone):
+            raise AppError('CMS_VALIDATION_ERROR', '带教老师姓名/手机号、学生姓名/手机号均必填', status_code=400)
 
-        # 按手机号解析（带教老师须 doctor、学生须 student）；编辑时未传则沿用原值
+        # 解析（编辑时该方未传任何字段则沿用原值；传了则姓名与手机号需成对）
         teacher = self.instance.teacher if self.instance else None
+        if t_name or t_phone:
+            if not (t_name and t_phone):
+                raise AppError('CMS_VALIDATION_ERROR', '带教老师姓名与手机号需同时提供', status_code=400)
+            teacher = _resolve_rel_user(t_name, t_phone, 'doctor', '带教老师', 'CMS_REL_TEACHER_NOT_FOUND')
         student = self.instance.student if self.instance else None
-        if t_phone:
-            teacher = User.objects.filter(phone=t_phone, role_type='doctor').first()
-            if teacher is None:
-                raise AppError('CMS_REL_TEACHER_NOT_FOUND', f'带教老师不存在或非医生：{t_phone}', status_code=400)
-        if s_phone:
-            student = User.objects.filter(phone=s_phone, role_type='student').first()
-            if student is None:
-                raise AppError('CMS_REL_STUDENT_NOT_FOUND', f'学生不存在或非学生：{s_phone}', status_code=400)
+        if s_name or s_phone:
+            if not (s_name and s_phone):
+                raise AppError('CMS_VALIDATION_ERROR', '学生姓名与手机号需同时提供', status_code=400)
+            student = _resolve_rel_user(s_name, s_phone, 'student', '学生', 'CMS_REL_STUDENT_NOT_FOUND')
         if teacher is None or student is None:
             raise AppError('CMS_VALIDATION_ERROR', '带教老师和学生均必填', status_code=400)
 
@@ -136,6 +148,25 @@ class CmsTeacherStudentRelationViewSet(viewsets.ModelViewSet):
         self.get_object().delete()
         return Response({'message': '已停用'})
 
+    # ── 下拉数据源（医院管理员本院 / 超管全平台；姓名+手机号一并返回）──────────
+    def _role_users(self, role):
+        qs = User.objects.filter(role_type=role).order_by('real_name', 'id')
+        if not is_super(self.request.user):
+            qs = qs.filter(institution_id=self.request.user.institution_id)
+        return [{'id': u.id, 'real_name': u.real_name, 'phone': u.phone} for u in qs]
+
+    @extend_schema(summary='CMS-REL-6 带教医生下拉（姓名+手机号）', tags=['CMS-师生关系'])
+    @action(detail=False, methods=['get'], url_path='doctors')
+    def doctors(self, request):
+        """新增/编辑师生关系的「带教医生」下拉数据源，返回 [{id, real_name, phone}]。"""
+        return Response(self._role_users('doctor'))
+
+    @extend_schema(summary='CMS-REL-7 学生下拉（姓名+手机号）', tags=['CMS-师生关系'])
+    @action(detail=False, methods=['get'], url_path='students')
+    def students(self, request):
+        """新增/编辑师生关系的「学生」下拉数据源，返回 [{id, real_name, phone}]。"""
+        return Response(self._role_users('student'))
+
     @extend_schema(summary='CMS-REL-4 下载师生关系导入模板', tags=['CMS-师生关系'])
     @action(detail=False, methods=['get'], url_path='import-template')
     def import_template(self, request):
@@ -174,14 +205,16 @@ class CmsTeacherStudentRelationViewSet(viewsets.ModelViewSet):
 
         success, errors = 0, []
         for idx, row in enumerate(rows, start=2):
+            t_name = (row.get('带教医生姓名') or '').strip()
             t_phone = (row.get('带教医生手机号') or '').strip()
+            s_name = (row.get('学生姓名') or '').strip()
             s_phone = (row.get('学生手机号') or '').strip()
-            teacher = User.objects.filter(phone=t_phone, role_type='doctor').first()
+            teacher = User.objects.filter(phone=t_phone, real_name=t_name, role_type='doctor').first()
             if teacher is None:
-                errors.append({'row': idx, 'reason': f'带教医生不存在或非医生：{t_phone}'}); continue
-            student = User.objects.filter(phone=s_phone, role_type='student').first()
+                errors.append({'row': idx, 'reason': f'带教医生不存在或姓名手机号不符：{t_name} / {t_phone}'}); continue
+            student = User.objects.filter(phone=s_phone, real_name=s_name, role_type='student').first()
             if student is None:
-                errors.append({'row': idx, 'reason': f'学生不存在或非学生：{s_phone}'}); continue
+                errors.append({'row': idx, 'reason': f'学生不存在或姓名手机号不符：{s_name} / {s_phone}'}); continue
             if not actor_is_super and (
                 teacher.institution_id != actor.institution_id
                 or student.institution_id != actor.institution_id