feat(permission): “出库/借库需审批”开关权限化——仅主管/超管可见可改

- 新增权限码 material_list:isApprovalRequired，授予仅 SUPER_ADMIN/SUPERVISOR（收回其它角色）
- 物料列表该列仅持码角色可见；后端批量端点与字段脱敏均改按新码校验，其余角色看不到值也无法改

db_migrations/add_material_approval_perm.sql

@@ -0,0 +1,32 @@
+-- =============================================================================
+-- 一次性迁移：物料“出库/借库需审批”开关的独立权限项
+--   权限码 material_list:isApprovalRequired（操作级）
+--   仅授予：SUPER_ADMIN(超管)、SUPERVISOR(主管)。其余角色不可见、不可修改。
+--   幂等：重复执行安全（先收回“非主管/超管”的该权限，再确保主管/超管持有）。
+-- 执行: docker exec -i inventory_db psql -U test -d inventory_system < 本文件
+-- =============================================================================
+BEGIN;
+
+-- 1) 注册权限元素（幂等）
+INSERT INTO sys_element (menu_code, name, code, element_type)
+SELECT 'material_list', '出库/借库需审批(修改)', 'material_list:isApprovalRequired', 'operation'
+WHERE NOT EXISTS (SELECT 1 FROM sys_element WHERE code = 'material_list:isApprovalRequired');
+
+-- 2) 收回除主管/超管外所有角色的该权限（幂等）
+DELETE FROM sys_role_permission
+WHERE target_code = 'material_list:isApprovalRequired'
+  AND type = 'element'
+  AND role_code NOT IN ('SUPER_ADMIN', 'SUPERVISOR');
+
+-- 3) 确保主管/超管持有（幂等）
+INSERT INTO sys_role_permission (role_code, target_code, type, company_name)
+SELECT v.role_code, 'material_list:isApprovalRequired', 'element', NULL
+FROM (VALUES ('SUPER_ADMIN'), ('SUPERVISOR')) AS v(role_code)
+WHERE NOT EXISTS (
+    SELECT 1 FROM sys_role_permission r
+    WHERE r.role_code = v.role_code
+      AND r.target_code = 'material_list:isApprovalRequired'
+      AND r.type = 'element'
+);
+
+COMMIT;

inventory-backend/app/api/v1/inbound/base.py

@@ -543,7 +543,7 @@ def batch_set_inspection():
 # 2.8 批量设置“出库/借库需审批” (POST /api/v1/inbound/base/batch-approval)
 # ==============================================================================
 @inbound_base_bp.route('/batch-approval', methods=['POST'])
-@permission_required('material_list:operation')
+@permission_required('material_list:isApprovalRequired')
 def batch_set_approval_required():
     """
     批量设置物料“出库/借库需审批”标记（仿强制质检批量接口）。

inventory-backend/app/utils/field_permissions.py

@@ -14,7 +14,7 @@ STOCK_FIELD_RBAC_MAPPING = {
         "category": "material_list:category", "type": "material_list:type",
         "spec": "material_list:spec", "unit": "material_list:unit",
         "companyName": "material_list:companyName", "isInspectionRequired": "material_list:isInspectionRequired",
-        "isApprovalRequired": "material_list:operation",
+        "isApprovalRequired": "material_list:isApprovalRequired",
         "generalImage": "material_list:files", "generalManual": "material_list:files",
         "productImageRemark": "material_list:productImageRemark",
         "manualLinkRemark": "material_list:manualLinkRemark",

inventory-web/src/views/material/list.vue

@@ -328,11 +328,11 @@
             </el-tag>
           </template>
         </el-table-column>
-        <el-table-column v-if="columns.isApprovalRequired.visible" label="出库/借库需审批" min-width="130" align="center">
+        <el-table-column v-if="columns.isApprovalRequired.visible && userStore.hasPermission('material_list:isApprovalRequired')" label="出库/借库需审批" min-width="130" align="center">
           <template #default="scope">
             <el-switch
                 :model-value="!!scope.row.isApprovalRequired"
-                :disabled="!userStore.hasPermission('material_list:operation')"
+                :disabled="!userStore.hasPermission('material_list:isApprovalRequired')"
                 @change="(val: boolean) => toggleApprovalRequired(scope.row, val)"
             />
           </template>