return [
    'app_host'         => env('app.host', ''),
    'app_namespace'    => '',
    'with_route'       => true,        // 启用路由
    'default_app'      => 'home',      // 默认应用
    'default_timezone' => 'Asia/Shanghai',
    
    'default_filter'   => 'htmlspecialchars',  // 全局XSS过滤
    
    'page_size'    => 20,               // 默认分页
    'file_size'    => 50,               // 附件大小50M
    'session_admin' => 'gougu_admin',   // Session键名
    
    'http_exception_template' => [
        401 => public_path() . 'tpl/401.html',
        403 => public_path() . 'tpl/403.html',
        404 => public_path() . 'tpl/404.html',
        405 => public_path() . 'tpl/405.html',  // 无权限
        500 => public_path() . 'tpl/500.html',
    ]
];

return [
    'default' => 'mysql',
    'auto_timestamp' => true,            // 自动写入时间戳
    'datetime_format' => 'Y-m-d H:i:s',
    'connections' => [
        'mysql' => [
            'type'     => 'mysql',
            'hostname' => '127.0.0.1',
            'database' => 'oa',
            'username' => 'root',
            'password' => '123456',
            'hostport' => '3306',
            'prefix'   => 'oa_',         // 表前缀 oa_
            'charset'  => 'utf8mb4',
            'fields_strict' => true,     // 严格检查字段
        ],
    ],
];

use think\facade\Route;

Route::get('think', function () {
    return 'hello,ThinkPHP6!';
});

Route::get('hello/:name', 'index/hello');

<?php
// 调整应用目录结构（base模块不对外访问）
namespace think;
require __DIR__ . '/../vendor/autoload.php';

$http = (new App())->http;
$response = $http->run();
$response->send();
$http->end($response);

namespace app\base;

use think\facade\Cache;
use think\facade\Db;
use think\facade\Request;
use think\facade\Session;
use think\facade\View;
use systematic\Systematic;

abstract class BaseController
{
    protected $batchValidate = false;
    protected $pageSize = 20;
    protected $middleware = [];
    protected $module;
    protected $controller;
    protected $action;
    protected $uid;
    protected $did;      // 部门ID
    protected $pid;      // 岗位ID
    protected $model;

    public function __construct()
    {
        // 解析当前请求的 模块/控制器/方法
        $this->module = strtolower(app('http')->getName());
        $this->controller = strtolower(Request::controller());
        $this->action = strtolower(Request::action());
        $this->uid = 0;
        $this->did = 0;
        $this->pid = 0;
        $this->initialize();
    }

    protected function initialize()
    {
        $this->checkLogin();
        $this->pageSize = Request::param('limit', 
            \think\facade\Config::get('app.page_size'));
    }
    
    // ... checkLogin 和 checkAuth 见下文
}

protected function checkLogin()
{
    // 1. 登录页和验证码页跳过检查
    if ($this->controller !== 'login' && $this->controller !== 'captcha') {
        $session_admin = get_config('app.session_admin');
        
        // 2. 未登录 → 重定向到登录页
        if (!Session::has($session_admin)) {
            if (request()->isAjax()) {
                return to_assign(404, '请先登录');
            } else {
                redirect('/home/login/index.html')->send();
                exit;
            }
        } else {
            // 3. 已登录 → 加载用户信息
            $this->uid = Session::get($session_admin);
            $login_admin = get_admin($this->uid);
            $this->did = $login_admin['did'];
            $this->pid = $login_admin['pid'];
            $is_lock = $login_admin['is_lock'];
            
            // 4. 10小时超时检查
            $last_login_time = Db::name('Admin')
                ->where(['id' => $this->uid])
                ->value('last_login_time');
            $timeDiff = time() - $last_login_time;
            if ($timeDiff > 36000) {  // 36000秒 = 10小时
                Session::delete($session_admin);
                redirect('/home/login/index.html')->send();
                exit;
            }
            
            // 5. 更新最后活动时间（滑动会话）
            Db::name('Admin')
                ->where(['id' => $this->uid])
                ->update(['last_login_time' => time()]);
            
            // 6. 锁屏检查
            if ($is_lock == 1) {
                redirect('/home/login/lock.html')->send();
                exit;
            }
            
            // 7. 将用户信息注入视图
            View::assign('login_admin', $login_admin);
            
            // 8. 部分控制器跳过权限检查
            $not_check = ['index','leaves','outs','overtimes','trips','message'];
            if ($this->module == 'home' && in_array($this->controller, $not_check)) {
                return true;
            } else {
                // 9. 强制修改初始密码
                $regPwd = $login_admin['reg_pwd'];
                if ($regPwd !== '') {
                    redirect('/home/index/edit_password.html')->send();
                    exit;
                }
                
                // 10. RBAC 权限检查
                if (!$this->checkAuth()) {
                    if (request()->isAjax()) {
                        return to_assign(405, '你没有权限');
                    } else {
                        redirect('/home/index/role')->send();
                        exit;
                    }
                }
            }
        }
    }
}

protected function checkAuth()
{
    $uid = $this->uid;
    $GOUGU = new Systematic();
    $GOUGU->auth($uid);  // 构建/读取权限缓存
    
    $auth_list = Cache::get('RulesSrc' . $uid);        // 当前用户权限
    $pathUrl = $this->module . '/' . $this->controller . '/' . $this->action;
    
    if (!in_array($pathUrl, $auth_list)) {
        return false;   // 无权限
    }
    return true;        // 有权限
}

abstract class BaseController
{
    protected $jwt_conf = [
        'secrect' => 'gouguoa',
        'iss' => 'www.gougucms.com',
        'aud' => 'gouguoa',
        'exptime' => 7200,  // 2小时过期
    ];
    
    protected function apiReturn($data, int $code = 0, $msg = '', 
        string $type = '', array $header = []): Response
    {
        $result = [
            'code' => $code,
            'msg'  => $msg,
            'time' => time(),
            'data' => $data,
        ];
        $response = Response::create($result, $type ?: 'json')->header($header);
        throw new HttpResponseException($response);
    }
}

class Login
{
    public function index()
    {
        // 检测企业微信环境
        $wxwork = is_wxwork();
        $mobile = is_mobile();
        if ($wxwork) {
            return redirect('/qiye/login/login');  // 企业微信端
        }
        if ($mobile) {
            return redirect('/qiye/login/index');  // 移动端
        }
        return View();  // PC端登录页
    }
}

public function login_submit()
{
    $param = get_params();
    
    // 1. 表单验证
    try {
        validate(UserCheck::class)->check($param);
    } catch (ValidateException $e) {
        return to_assign(1, $e->getError());
    }

    // 2. 支持用户名或手机号登录
    $admin = Db::name('Admin')
        ->where(['username' => $param['username'], 'delete_time' => 0])
        ->find();
    if (empty($admin)) {
        // 尝试用手机号查找
        $admin = Db::name('Admin')
            ->where(['mobile' => $param['username'], 'delete_time' => 0])
            ->find();
        if (empty($admin)) {
            return to_assign(1, '用户名或手机号码错误');
        }
    }
    
    // 3. 密码验证（salt + md5）
    $param['pwd'] = set_password($param['password'], $admin['salt']);
    if ($admin['pwd'] !== $param['pwd']) {
        return to_assign(1, '用户或密码错误');
    }
    
    // 4. 状态检查
    if ($admin['status'] != 1) {
        return to_assign(1, '该用户禁止登录');
    }
    
    // 5. 更新登录信息
    $data = [
        'is_lock' => 0,
        'last_login_time' => time(),
        'last_login_ip' => request()->ip(),
        'login_num' => $admin['login_num'] + 1,
    ];
    Db::name('admin')->where(['id' => $admin['id']])->update($data);
    
    // 6. 写入 Session
    $session_admin = get_config('app.session_admin');
    Session::set($session_admin, $admin['id']);
    
    // 7. 生成 Token（用于 API 调用）
    $token = make_token();
    set_cache($token, $admin, 7200);
    
    // 8. 记录登录日志
    $logdata = [
        'uid' => $admin['id'],
        'type' => 'login',
        'action' => '登录',
        'subject' => '系统',
        'param_id' => $admin['id'],
        'param' => '[]',
        'ip' => request()->ip(),
        'create_time' => time()
    ];
    Db::name('AdminLog')->strict(false)->field(true)->insert($logdata);
    
    return to_assign(0, '登录成功', ['uid' => $admin['id']]);
}

public function lock()
{
    $session_admin = get_config('app.session_admin');
    $admin_id = Session::get($session_admin);
    $admin = Db::name('admin')->where(['id' => $admin_id])->find();
    
    if (request()->isAjax()) {
        // 解锁：验证密码
        $param = get_params();
        $pwd = set_password($param['lock_password'], $admin['salt']);
        if ($admin['pwd'] !== $pwd) {
            return to_assign(1, '密码错误');
        }
        Db::name('admin')->where('id', $admin['id'])
            ->update(['is_lock' => 0]);
        return to_assign(0, '解锁成功', ['uid' => $admin['id']]);
    }
    
    // 锁屏：设置 is_lock = 1
    Db::name('admin')->where('id', $admin['id'])
        ->update(['is_lock' => 1]);
    return View();
}

namespace systematic;

use think\facade\Config;
use think\facade\Cache;
use think\facade\Db;

class Systematic
{	
    public function auth($uid)
    {
        // 缓存未命中时重建
        if (!Cache::get('RulesSrc' . $uid) || !Cache::get('RulesSrc0')) {
            
            // 1. 获取用户岗位
            $position_id = Db::name('Admin')
                ->where('id', $uid)
                ->value('position_id');
            
            // 2. 通过岗位 → 岗位角色组关联表 → 获取角色组
            $groups = Db::name('PositionGroup')
                ->alias('a')
                ->join("AdminGroup g", "a.group_id=g.id", 'LEFT')
                ->where([
                    ['a.pid', '=', $position_id],
                    ['g.status', '=', 1]
                ])
                ->select()->toArray();
            
            // 3. 合并所有角色组的权限规则ID
            $ids = [];
            foreach ($groups as $g) {
                $ids = array_merge($ids, explode(',', trim($g['rules'], ',')));
            }
            $ids = array_unique($ids);
            
            // 4. 读取所有权限规则（用于超级管理员判断）
            $rules_all = Db::name('AdminRule')
                ->field('src')->select()->toArray();
            
            // 5. 读取当前用户的权限规则
            $rules = Db::name('AdminRule')
                ->where('id', 'in', $ids)
                ->field('src')->select()->toArray();
            
            // 6. 提取规则路径（小写化）
            $auth_list_all = [];
            $auth_list = [];
            foreach ($rules_all as $rule_all) {
                $auth_list_all[] = strtolower($rule_all['src']);
            }
            foreach ($rules as $rule) {
                $auth_list[] = strtolower($rule['src']);
            }
            
            // 7. 缓存 10 小时（36000秒）
            Cache::tag('adminRules')->set('RulesSrc0', $auth_list_all, 36000);
            Cache::tag('adminRules')->set('RulesSrc' . $uid, $auth_list, 36000);
        }
    }
}

$pathUrl = $this->module . '/' . $this->controller . '/' . $this->action;
// 例如: "finance/expense/datalist"

if (!in_array($pathUrl, $auth_list)) {
    return false;  // 无权限
}
return true;       // 有权限

public function submit_check()
{
    $param = get_params();
    $flow_cate = Db::name('FlowCate')
        ->where(['name' => $param['check_name']])->find();
    $flow_list = Db::name('Flow')
        ->where('id', $param['flow_id'])->value('flow_list');
    $flow = unserialize($flow_list);
    
    $check_table = $flow_cate['check_table'];
    
    // 1. 删除原有的审批步骤和记录（重新提交场景）
    Db::name('FlowStep')
        ->where(['action_id' => $param['action_id'], 'flow_id' => $param['flow_id']])
        ->update(['delete_time' => time()]);
    Db::name('FlowRecord')
        ->where(['action_id' => $param['action_id'], 'check_table' => $check_table])
        ->update(['delete_time' => time()]);
    
    // 2. 创建提交记录
    $recordData = [
        'action_id' => $param['action_id'],
        'check_table' => $check_table,
        'step_id' => 0,
        'check_uid' => $this->uid,
        'check_status' => 0,    // 提交
        'content' => '提交申请',
        'create_time' => time()
    ];
    
    if (!isset($param['check_uids'])) {
        // ===== 固定流程模式 =====
        $step = [];
        $sort = 0;
        foreach ($flow as $value) {
            // 根据 check_role 解析审批人
            if ($value['check_role'] == 1) {
                $value['check_uids'] = get_department_leader($this->uid);
                $value['flow_name'] = '当前部门负责人';
            }
            if ($value['check_role'] == 2) {
                $value['check_uids'] = get_department_leader($this->uid, 1);
                $value['flow_name'] = '上级部门负责人';
            }
            if ($value['check_role'] == 3) {
                $check_uids = Db::name('Admin')
                    ->where(['position_id' => $value['check_position_id'], 'status' => 1])
                    ->column('id');
                $value['check_uids'] = implode(',', $check_uids);
                $value['flow_name'] = $check_position;
            }
            // ... check_role 4, 5 略
            
            if (!empty($value['check_uids'])) {
                $step[] = [
                    'action_id' => $param['action_id'],
                    'flow_id' => $param['flow_id'],
                    'check_uids' => $value['check_uids'],
                    'check_role' => $value['check_role'],
                    'check_types' => $value['check_types'],
                    'sort' => $sort
                ];
                $sort++;
            }
        }
        
        // 3. 批量插入审批步骤
        Db::name('FlowStep')->insertAll($step);
        
        // 4. 更新业务表状态
        Db::name($check_table)->where('id', $param['action_id'])->update([
            'check_flow_id' => $param['flow_id'],
            'check_status' => 1,              // 审批中
            'check_step_sort' => 0,           // 当前步骤
            'check_uids' => $step[0]['check_uids'],  // 当前审批人
            'check_copy_uids' => $param['check_copy_uids'] ?? ''
        ]);
        
        // 5. 发送消息通知（事件机制）
        if ($flow_cate['template_id'] > 0) {
            event('SendMessage', [
                'from_uid' => $this->uid,
                'to_uids' => $step[0]['check_uids'],
                'template_id' => $flow_cate['template_id'],
                'content' => ['action_id' => $param['action_id'], 'title' => $subject]
            ]);
        }
    } else {
        // ===== 自由审批模式 =====
        // 直接使用提交者指定的审批人
        Db::name('FlowStep')->insert([
            'action_id' => $param['action_id'],
            'flow_id' => $param['flow_id'],
            'check_uids' => $param['check_uids'],
            'flow_name' => '自由审批',
        ]);
        // ... 更新业务表 + 发送通知
    }
}

public function flow_check()
{
    $param = get_params();
    $detail = Db::name($check_table)->where('id', $action_id)->find();
    $step = Db::name('FlowStep')
        ->where(['action_id' => $action_id, 'sort' => $detail['check_step_sort']])
        ->find();
    
    if ($param['check'] == 1) {
        // === 审批通过 ===
        
        // 1. 验证当前用户是否有审批权限
        $check_uids = explode(",", $detail['check_uids']);
        if (!in_array($this->uid, $check_uids)) {
            return to_assign(1, '您没权限审核该审批');
        }
        
        if ($step['check_role'] == 0) {
            // 自由人审批
            if ($param['check_node'] == 2) {
                // 继续下一步（手动指定）
                $next_step = $detail['check_step_sort'] + 1;
                // ... 插入新步骤
            } else {
                // 审核结束
                $param['check_status'] = 2;  // 审核完成
            }
        } else {
            // 固定流程审批
            $check_count = Db::name('FlowRecord')
                ->where(['step_id' => $step['id']])->count();
            $flow_count = explode(',', $step['check_uids']);
            
            // 从当前审批人中移除自己
            $new_uids = array_diff($check_uids, [$this->uid]);
            $param['check_uids'] = implode(',', $new_uids);
            
            // 判断是否本步骤所有人审批完成
            // check_types=1: 会签（所有人通过才算通过）
            // check_types=2: 或签（任一人通过即通过）
            if ((($check_count + 1) >= count($flow_count) && $step['check_types'] == 1) 
                || $step['check_types'] == 2) {
                
                // 查找下一步
                $next_step = Db::name('FlowStep')
                    ->where(['sort' => $detail['check_step_sort'] + 1])
                    ->find();
                
                if ($next_step) {
                    // 存在下一步 → 解析下一步审批人
                    if ($next_step['check_role'] == 1) {
                        $param['check_uids'] = get_department_leader($detail['admin_id']);
                    } elseif ($next_step['check_role'] == 2) {
                        $param['check_uids'] = get_department_leader($detail['admin_id'], 1);
                    } elseif ($next_step['check_role'] == 3) {
                        $uids = Db::name('Admin')
                            ->where(['position_id' => $next_step['check_position_id']])
                            ->column('id');
                        $param['check_uids'] = implode(',', $uids);
                    } else {
                        $param['check_uids'] = $next_step['check_uids'];
                    }
                    $param['check_step_sort'] = $detail['check_step_sort'] + 1;
                    $param['check_status'] = 1;  // 仍审批中
                } else {
                    // 不存在下一步 → 审核结束
                    $param['check_status'] = 2;  // 审核完成
                    $param['check_uids'] = '';
                }
            } else {
                // 本步骤还有人未审批 → 不发送消息
                $param['send_msg'] = 0;
            }
        }
        
        // 2. 添加历史审核人
        $param['check_history_uids'] = empty($detail['check_history_uids'])
            ? $this->uid
            : $detail['check_history_uids'] . ',' . $this->uid;
        
        // 3. 更新业务表
        Db::name($check_table)->where('id', $action_id)->update($param);
        
        // 4. 记录审批日志
        Db::name('FlowRecord')->insert([
            'action_id' => $action_id,
            'check_uid' => $this->uid,
            'check_status' => 1,  // 通过
            'content' => $param['content'],
            'check_files' => $param['check_files'],
            'check_time' => time(),
        ]);
        
        // 5. 发送消息通知（审批中→下一审批人 / 审核完成→提交人+抄送人）
        if ($param['check_status'] == 1 && $param['send_msg'] == 1) {
            event('SendMessage', [...]);  // 通知下一审批人
        }
        if ($param['check_status'] == 2) {
            event('SendMessage', [...]);  // 通知提交人：审核通过
            if (!empty($detail['check_copy_uids'])) {
                event('SendMessage', [...]);  // 通知抄送人
            }
        }
    }
    
    // check=2: 审批拒绝（支持 check_role=5 回退到上一步）
    // check=3: 审批撤回（仅提交人可操作）
    // check=4: 审批反确认（打回重新提交）
}

namespace app\finance\controller;

use app\base\BaseController;
use app\finance\model\Expense as ExpenseModel;
use app\finance\validate\ExpenseValidate;
use think\exception\ValidateException;
use think\facade\Db;
use think\facade\View;

class Expense extends BaseController
{
    protected $model;
    
    public function __construct()
    {
        parent::__construct();  // 触发认证和权限检查
        $this->model = new ExpenseModel();
    }
    
    // 数据列表
    public function datalist() { ... }
    
    // 添加/编辑
    public function add() { ... }
    
    // 查看详情
    public function view($id) { ... }
    
    // 删除
    public function del() { ... }
    
    // 报销记录
    public function record() { ... }
}

public function datalist()
{
    $param = get_params();
    if (request()->isAjax()) {
        $tab = isset($param['tab']) ? $param['tab'] : 0;
        $uid = $this->uid;
        $where = [];
        $whereOr = [];
        $where[] = ['delete_time', '=', 0];  // 逻辑删除过滤
        
        if ($tab == 0) {
            // 全部（根据数据权限过滤）
            $auth = isAuthExpense($uid);
            if ($auth == 0) {
                // 非管理员只能看自己相关的
                $whereOr[] = ['admin_id', '=', $this->uid];
                $whereOr[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_uids)")];
                $whereOr[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_history_uids)")];
                $whereOr[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_copy_uids)")];
                $dids = array_merge(
                    get_leader_departments($uid),
                    get_role_departments($uid)
                );
                if (!empty($dids)) {
                    $whereOr[] = ['did', 'in', $dids];
                }
            }
        }
        if ($tab == 1) {
            // 我创建的
            $where[] = ['admin_id', '=', $this->uid];
        }
        if ($tab == 2) {
            // 待我审核的
            $where[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_uids)")];
        }
        if ($tab == 3) {
            // 我已审核的
            $where[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_history_uids)")];
        }
        if ($tab == 4) {
            // 抄送给我的
            $where[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_copy_uids)")];
        }
        if ($tab == 5) {
            // 已打款的
            $where[] = ['pay_status', '=', 1];
        }
        
        // 时间范围搜索
        if (!empty($param['diff_time'])) {
            $diff_time = explode('~', $param['diff_time']);
            $where[] = ['income_month', 'between', [
                strtotime(urldecode($diff_time[0])),
                strtotime(urldecode($diff_time[1] . ' 23:59:59'))
            ]];
        }
        
        $list = $this->model->datalist($param, $where, $whereOr);
        return table_assign(0, '', $list);
    } else {
        return view();  // 非Ajax请求返回HTML页面
    }
}

public function add()
{
    $param = get_params();
    if (request()->isAjax()) {
        // 时间戳转换
        $param['income_month'] = strtotime(urldecode($param['income_month']));
        $param['expense_time'] = strtotime(urldecode($param['expense_time']));
        
        // 计算报销总金额（多条报销明细）
        $cost = 0;
        foreach ($param['amount'] as $value) {
            if ($value == 0) {
                return to_assign(1, '金额不能为零');
            }
            $cost += $value;
        }
        
        $param['admin_id'] = $this->uid;
        $param['did'] = $this->did;
        $param['cost'] = $cost;
        $param['pay_amount'] = $cost;
        
        if (!empty($param['id']) && $param['id'] > 0) {
            // ===== 编辑 =====
            validate(ExpenseValidate::class)->scene('edit')->check($param);
            
            // 借支冲抵计算
            if (!empty($param['loan_id'])) {
                $loan = Db::name('Loan')->where('id', $param['loan_id'])->find();
                // 查询该借支已冲抵的总额
                $balance_cost = Db::name('Expense')
                    ->where([
                        ['delete_time', '=', 0],
                        ['loan_id', '=', $param['loan_id']],
                        ['id', '<>', $param['id']]
                    ])->sum('balance_cost');
                
                // ★ *100/100 避免浮点精度问题
                $un_balance_cost = ($loan['cost'] * 100 - $balance_cost * 100) / 100;
                
                if ($un_balance_cost < 0) {
                    return to_assign(1, '所选借支已经冲抵完毕');
                }
                
                $balance = $un_balance_cost * 100 - $cost * 100;
                if ($balance >= 0) {
                    // 全额冲抵
                    $param['balance_cost'] = $cost;
                    $param['pay_amount'] = 0;
                } else {
                    // 部分冲抵
                    $param['balance_cost'] = $un_balance_cost;
                    $param['pay_amount'] = ($cost * 100 - $un_balance_cost * 100) / 100;
                }
            }
            
            $this->model->edit($param);
        } else {
            // ===== 新增 =====
            validate(ExpenseValidate::class)->scene('add')->check($param);
            // ... 同样的借支冲抵逻辑
            $this->model->add($param);
        }
    } else {
        // 渲染表单页面
        $id = isset($param['id']) ? $param['id'] : 0;
        View::assign('expense_cate', Db::name('ExpenseCate')
            ->where(['status' => 1])->select()->toArray());
        
        if ($id > 0) {
            $detail = $this->model->getById($id);
            View::assign('detail', $detail);
            return view('edit');
        }
        return view();
    }
}

namespace app\finance\model;

use think\model;
use think\facade\Db;

class Expense extends Model
{
    // 1. 分页列表
    public function datalist($param = [], $where = [], $whereOr = [])
    {
        $rows = empty($param['limit']) 
            ? get_config('app.page_size') 
            : $param['limit'];
        $order = empty($param['order']) ? 'id desc' : $param['order'];
        
        try {
            $list = self::where($where)
                ->where(function ($query) use ($whereOr) {
                    if (!empty($whereOr)) {
                        $query->whereOr($whereOr);
                    }
                })
                ->order($order)
                ->paginate(['list_rows' => $rows])
                ->each(function ($item, $key) {
                    // 数据加工：关联查询、格式化
                    $item->check_status_str = check_status_name($item->check_status);
                    $item->admin_name = Db::name('Admin')
                        ->where(['id' => $item->admin_id])->value('name');
                    $item->department = Db::name('Department')
                        ->where(['id' => $item->did])->value('title');
                    $item->create_time = to_date($item->create_time);
                    // ...
                });
            return $list;
        } catch (\Exception $e) {
            return ['code' => 1, 'data' => [], 'msg' => $e->getMessage()];
        }
    }
    
    // 2. 新增
    public function add($param)
    {
        try {
            $param['create_time'] = time();
            $insertId = self::strict(false)->field(true)->insertGetId($param);
            
            // 处理子表（报销明细）
            if (isset($param['amount'])) {
                foreach ($param['amount'] as $key => $value) {
                    Db::name('ExpenseInterfix')->insert([
                        'exid' => $insertId,
                        'amount' => $value,
                        'cate_id' => $param['cate_id'][$key],
                        'remarks' => $param['remarks'][$key],
                        'create_time' => time(),
                    ]);
                }
            }
            
            // 更新借支冲抵
            if (!empty($param['loan_id'])) {
                $this->update_loan($param['loan_id']);
            }
            
            add_log('add', $insertId, $param);  // 操作日志
        } catch (\Exception $e) {
            return to_assign(1, '操作失败：' . $e->getMessage());
        }
        return to_assign(0, '操作成功', ['return_id' => $insertId]);
    }
    
    // 3. 编辑
    public function edit($param)
    {
        try {
            $param['update_time'] = time();
            self::where('id', $param['id'])->strict(false)->field(true)->update($param);
            // ... 处理子表更新
            add_log('edit', $param['id'], $param);
        } catch (\Exception $e) {
            return to_assign(1, '操作失败：' . $e->getMessage());
        }
        return to_assign(0, '操作成功', ['return_id' => $param['id']]);
    }
    
    // 4. 获取详情
    public function getById($id)
    {
        $info = self::find($id);
        // 关联查询补充字段
        $info['admin_name'] = Db::name('Admin')
            ->where(['id' => $info['admin_id']])->value('name');
        $info['department'] = Db::name('Department')
            ->where(['id' => $info['did']])->value('title');
        // 查询子表数据
        $info['list'] = Db::name('ExpenseInterfix')
            ->alias('a')
            ->join('ExpenseCate c', 'a.cate_id = c.id', 'LEFT')
            ->where(['a.exid' => $info['id']])
            ->select();
        return $info;
    }
    
    // 5. 删除（逻辑删除）
    public function delById($id, $type = 0)
    {
        if ($type == 0) {
            // 逻辑删除
            self::where('id', $id)->update(['delete_time' => time()]);
            add_log('delete', $id);
        } else {
            // 物理删除
            self::destroy($id);
        }
        return to_assign();
    }
    
    // 借支冲抵更新
    public function update_loan($id)
    {
        $balance_cost = Db::name('Expense')
            ->where(['delete_time' => 0, 'loan_id' => $id])
            ->sum('balance_cost');
        $loan = Db::name('Loan')->where('id', $id)->find();
        
        if ($balance_cost * 100 == $loan['cost'] * 100) {
            // 全额冲抵
            Db::name('Loan')->where('id', $id)->update([
                'balance_cost' => $balance_cost,
                'balance_status' => 2,
                'back_status' => 2
            ]);
        }
        // ... 部分冲抵、未冲抵
    }
}

// 在 datalist 中根据权限构建查询条件
$auth = isAuthExpense($uid);  // 返回数据权限级别
if ($auth == 0) {
    // 个人权限：只能看自己相关
    $whereOr[] = ['admin_id', '=', $this->uid];
    $whereOr[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_uids)")];
    $whereOr[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_history_uids)")];
    $whereOr[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_copy_uids)")];
    
    // 如果是部门负责人，可以看部门数据
    $dids = array_merge(
        get_leader_departments($uid),   // 作为负责人的部门
        get_role_departments($uid)      // 作为角色管理的部门
    );
    if (!empty($dids)) {
        $whereOr[] = ['did', 'in', $dids];
    }
}
// auth == 10 时不加额外条件，可看全部

$where[] = ['', 'exp', Db::raw("FIND_IN_SET('{$uid}',check_uids)")];