From 1cc7d51e03741710fefc098c90e6999403c18615 Mon Sep 17 00:00:00 2001 From: yueli Date: Fri, 17 Jul 2026 14:36:26 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20semi/product=20submit=20=E5=93=8D?= =?UTF-8?q?=E5=BA=94=E7=94=A8=20apply=5Fstrict=5Frbac=20=E6=9B=BF=E4=BB=A3?= =?UTF-8?q?=E7=A1=AC=E7=BC=96=E7=A0=81=20resp.pop=EF=BC=8C=E6=88=90?= =?UTF-8?q?=E6=9C=AC=E5=AD=97=E6=AE=B5=E7=BA=B3=E5=85=A5=20RBAC=20?= =?UTF-8?q?=E7=BB=9F=E4=B8=80=E7=AE=A1=E6=8E=A7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- inventory-backend/app/api/v1/inbound/product.py | 6 ++---- inventory-backend/app/api/v1/inbound/semi.py | 6 ++---- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/inventory-backend/app/api/v1/inbound/product.py b/inventory-backend/app/api/v1/inbound/product.py index 52a9df8..b299aa0 100644 --- a/inventory-backend/app/api/v1/inbound/product.py +++ b/inventory-backend/app/api/v1/inbound/product.py @@ -129,10 +129,8 @@ def submit(): perm_code = field_to_perm.get(field) if perm_code and perm_code not in user_permissions: data.pop(field, None) new_stock = ProductInboundService.handle_inbound(data) - # ★ Fail-Closed: 入库成功响应剥离成本/售价字段 - resp = new_stock.to_dict() - for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost', 'sale_price'): - resp.pop(k, None) + from app.utils.field_permissions import apply_strict_rbac + resp = apply_strict_rbac(new_stock.to_dict(), 'StockProduct', user_permissions) return jsonify({"code": 200, "msg": "入库成功", "data": resp}) except Exception as e: traceback.print_exc() diff --git a/inventory-backend/app/api/v1/inbound/semi.py b/inventory-backend/app/api/v1/inbound/semi.py index 79520b0..810bbbf 100644 --- a/inventory-backend/app/api/v1/inbound/semi.py +++ b/inventory-backend/app/api/v1/inbound/semi.py @@ -123,10 +123,8 @@ def submit(): if field in data and perm_code not in user_permissions: data.pop(field, None) new_stock = SemiInboundService.handle_inbound(data) - # ★ Fail-Closed: 入库成功响应剥离成本字段 - resp = new_stock.to_dict() - for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost', 'total_price'): - resp.pop(k, None) + from app.utils.field_permissions import apply_strict_rbac + resp = apply_strict_rbac(new_stock.to_dict(), 'StockSemi', user_permissions) return jsonify({"code": 200, "msg": "入库成功", "data": resp}) except Exception as e: traceback.print_exc()