fix: tenant_super_admin 纳入身份证明文查看口径 + 建档失败清理评估副本孤儿对象

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/elder/elder.service.ts

@@ -105,21 +105,29 @@ export class ElderService extends BaseCrudService {
     }
     const treatStatus = resolveInitialStatus(dto.benefitStart, dto.benefitEnd);
     const { idCardNo: _idCardNo, ...dtoRest } = dto;
-    const created = await super.create({
-      ...dtoRest,
-      idCardNoHash: hash(idCardNo),
-      idCardNoEnc: encrypt(idCardNo),
-      birthDate: toDateOnly(birthDate),
-      treatStatus,
-      statusSource: 'manual',
-      benefitStart: toDateOnly(dto.benefitStart),
-      benefitEnd: toDateOnly(dto.benefitEnd),
-      assessDate: toDateOnly(dto.assessDate),
-      insurVerifyDate: toDateOnly(dto.insurVerifyDate),
-      hospStart: toDateOnly(dto.hospStart),
-      hospEnd: toDateOnly(dto.hospEnd),
-    });
-    return this.presentIdCard(created, false);
+    try {
+      const created = await super.create({
+        ...dtoRest,
+        idCardNoHash: hash(idCardNo),
+        idCardNoEnc: encrypt(idCardNo),
+        birthDate: toDateOnly(birthDate),
+        treatStatus,
+        statusSource: 'manual',
+        benefitStart: toDateOnly(dto.benefitStart),
+        benefitEnd: toDateOnly(dto.benefitEnd),
+        assessDate: toDateOnly(dto.assessDate),
+        insurVerifyDate: toDateOnly(dto.insurVerifyDate),
+        hospStart: toDateOnly(dto.hospStart),
+        hospEnd: toDateOnly(dto.hospEnd),
+      });
+      return this.presentIdCard(created, false);
+    } catch (err) {
+      // 建档失败时清理已上传的评估结论副本（避免 MinIO 孤儿对象）。
+      if (dto.assessEvidenceFile) {
+        await this.storage.delete(dto.assessEvidenceFile).catch(() => undefined);
+      }
+      throw err;
+    }
   }
 
   /** 详情：admin/qc（或平台超管）返回身份证明文并显式写审计；否则掩码。 */
@@ -202,7 +210,7 @@ export class ElderService extends BaseCrudService {
       where: { tenantCode: ctx.tenantCode, userId: ctx.userId },
       select: { roleCode: true },
     });
-    return rows.some((r) => r.roleCode === 'admin' || r.roleCode === 'qc');
+    return rows.some((r) => r.roleCode === 'admin' || r.roleCode === 'qc' || r.roleCode === 'tenant_super_admin');
   }
 
   private async assertIdCardUnique(idCardNo: string) {

src/storage/storage.service.ts

@@ -32,4 +32,9 @@ export class StorageService {
   async presignGet(key: string, expiry = 3600): Promise<string> {
     return this.client.presignedGetObject(this.bucket, key, expiry);
   }
+
+  /** 删除对象（幂等：对象不存在不抛错）。 */
+  async delete(key: string): Promise<void> {
+    await this.client.removeObject(this.bucket, key).catch(() => undefined);
+  }
 }