feat: apply RBAC permission control to product module

Co-authored-by: aider (openai/DeepSeek-V3.2-Thinking) <aider@aider.chat>

inventory-web/src/views/stock/inbound/product.vue

@@ -41,13 +41,13 @@
       </div>
 
       <div class="right-tools">
-        <el-button type="primary" :icon="Plus" @click="handleCreate" class="action-btn">成品入库登记</el-button>
+        <el-button v-if="userStore.hasPermission('inbound_product:operation')" type="primary" :icon="Plus" @click="handleCreate" class="action-btn">成品入库登记</el-button>
         <el-button :icon="Refresh" @click="fetchData" class="action-btn">刷新</el-button>
         <el-popover placement="bottom-end" title="列配置" :width="500" trigger="click">
           <template #reference><el-button :icon="Setting" class="action-btn">表头</el-button></template>
           <el-checkbox-group v-model="visibleColumnProps" class="column-selector">
             <el-row :gutter="10">
-              <el-col :span="8" v-for="c in allColumns" :key="c.prop"><el-checkbox :label="c.prop">{{ c.label }}</el-checkbox></el-col>
+              <el-col :span="8" v-for="c in allColumns" :key="c.prop"><el-checkbox :label="c.prop" :disabled="!hasColumnPermission(c.prop)">{{ c.label }}</el-checkbox></el-col>
             </el-row>
           </el-checkbox-group>
         </el-popover>
@@ -137,7 +137,7 @@
         </el-table-column>
       </template>
 
-      <el-table-column label="操作" width="180" fixed="right" align="center">
+      <el-table-column v-if="userStore.hasPermission('inbound_product:operation')" label="操作" width="180" fixed="right" align="center">
         <template #default="{ row }">
           <el-button link type="warning" size="default" @click="handlePrint(row)">
             <el-icon><Printer/></el-icon>
@@ -432,6 +432,7 @@ import {
 import { uploadFile, deleteFile } from '@/api/inbound/buy'
 import WebRtcCamera from '@/components/Camera/WebRtcCamera.vue'
 import { getLabelPreview, executePrint } from '@/api/common/print'
+import { useUserStore } from '@/stores/user'
 
 // ------------------------------------
 // v-loadmore
@@ -455,6 +456,7 @@ const vLoadmore = {
   }
 }
 
+const userStore = useUserStore()
 const loading = ref(false)
 const submitting = ref(false)
 const visible = ref(false)
@@ -523,6 +525,69 @@ const allColumns = [
   { prop: 'detail_link', label: '详情', minWidth: '100' }
 ]
 
+// 列与权限Code的映射关系（数据库中的code）
+const permissionMap: Record<string, string> = {
+  company_name: 'inbound_product:company_name',
+  material_name: 'inbound_product:material_name',
+  sku: 'inbound_product:sku',
+  serial_number: 'inbound_product:serial_number',
+  qty_stock: 'inbound_product:stock_quantity',
+  status: 'inbound_product:status',
+  quality_status: 'inbound_product:quality_status',
+  spec_model: 'inbound_product:spec_model',
+  unit: 'inbound_product:unit',
+  product_photo: 'inbound_product:product_photo',
+  sale_price: 'inbound_product:sale_price',
+  order_id: 'inbound_product:order_id',
+  work_order_code: 'inbound_product:work_order_code',
+  quality_report_link: 'inbound_product:quality_report_link',
+  inspection_report_link: 'inbound_product:inspection_report_link',
+  bom_code: 'inbound_product:bom_code',
+  production_manager: 'inbound_product:production_manager',
+  raw_material_cost: 'inbound_product:raw_material_cost',
+  manual_cost: 'inbound_product:manual_cost',
+  inbound_date: 'inbound_product:inbound_date',
+  detail_link: 'inbound_product:detail_link',
+}
+
+// 根据用户权限初始化列显示状态
+const initColumnPermissions = () => {
+  // 超级管理员跳过权限检查，显示所有列
+  if (userStore.role === 'SUPER_ADMIN' || userStore.username === 'IRIS') {
+    return
+  }
+
+  // 普通用户：严格执行列级权限控制，没有权限的列必须隐藏
+  // 遍历 allColumns，将没有权限的列从 visibleColumnProps 中移除
+  const allowedColumns = allColumns.filter(col => {
+    const code = permissionMap[col.prop]
+    if (code) {
+      return userStore.hasPermission(code)
+    }
+    // 如果没有映射，默认隐藏
+    return false
+  }).map(col => col.prop)
+
+  // 更新 visibleColumnProps，只保留有权限的列
+  // 同时保持用户之前已经选择的有权限的列
+  const currentVisible = visibleColumnProps.value.filter(prop => allowedColumns.includes(prop))
+  // 如果当前没有可见列，则使用 allowedColumns 作为默认
+  if (currentVisible.length === 0) {
+    visibleColumnProps.value = allowedColumns
+  } else {
+    visibleColumnProps.value = currentVisible
+  }
+}
+
+// 检查列权限
+const hasColumnPermission = (prop: string) => {
+  if (userStore.role === 'SUPER_ADMIN' || userStore.username === 'IRIS') {
+    return true
+  }
+  const code = permissionMap[prop]
+  return code ? userStore.hasPermission(code) : false
+}
+
 const defaultVisibleCols = ['company_name', 'material_name', 'sku', 'serial_number', 'qty_stock', 'status', 'quality_status', 'product_photo', 'sale_price', 'order_id']
 const visibleColumnProps = ref(defaultVisibleCols)
 
@@ -834,6 +899,8 @@ const getStatusType = (s:string) => ({'在库':'success','出库':'info','借库
 const getQualityType = (s:string) => ({'合格':'success','不合格':'danger','待检':'info'}[s]||'info')
 const formatMoney = (val:any) => isNaN(Number(val)) ? '-' : `¥ ${Number(val).toFixed(2)}`
 onMounted(() => {
+  // 先根据权限初始化列显示状态
+  initColumnPermissions()
   fetchData()
   fetchOptions()
 })
@@ -905,4 +972,4 @@ onMounted(() => {
 .long-dropdown { width: 580px !important; }
 .long-dropdown .el-select-dropdown__wrap { max-height: 320px !important; }
 .long-dropdown .el-input__suffix { z-index: 10; }
-</style>
+</style>