refactor(audit): 审计架构清理——复活白名单监听器、停用噪声监听器、清除僵尸装饰器

一、统一为单一监听器实现原先两套 SQLAlchemy 事件监听器并存： · app/utils/audit_events.py —— 全局监听 db.Model、无白名单、无请求上下文守卫（实际在跑） · app/core/audit_listener.py —— 白名单制、有守卫、有模型级开关（从未生效）后者失效的根因：注册代码写在 extensions.py 的 init_extensions() 内，而该函数全仓库只有定义、没有任何调用（create_app 直接内联调用 db.init_app 等）。现统一由 app/core/audit_listener.py 承担，并在 create_app() 中显式注册。 extensions.py 的死函数 init_extensions 整体删除，避免后人误以为它是有效入口。二、修复监听器三处致命缺陷（此前注册了也写不进数据） 1. 事件回调第二个参数是 Connection，原代码却调用 Connection.add()（不存在），每次写日志都抛 AttributeError 并被 except 吞掉 → 改为 connection.execute() 2. register_audit_listeners 从 app.models 批量 import 多个未导出的模型， ImportError 被上层 try/except 吞掉 → 改为按表名从 db.metadata 取模型 3. 本项目有 31 处函数体内延迟导入模型（如 scrap.py 内部才 import ScrapApproval），一次性注册会静默漏表 → 增加 ensure_audit_listeners() 惰性补绑，并在模型预加载段补全审批单/BOM/采购等模型三、强约束 · WHITELIST_TABLES：仅 18 张核心业务表，系统表/草稿表/向量表不再自审 · has_request_context() 守卫：系统初始化与后台定时任务不再产生 username=system 噪声 · IGNORE_FIELDS 增加 password/password_hash/salt/token/secret/api_key（安全红线） · created_at 显式写 beijing_time()，与全系统时间口径一致四、清除僵尸装饰器 @audit_log 早已退化为直接透传的空壳（module/action 参数全被忽略，数据库中零星的中文 action 即其历史遗留产物），却仍挂在 38 处路由上。连同 13 个文件的 import 一并移除；audit_events.register_audit_events 改为空操作。验证：应用上下文中的写操作不产生日志；HTTP 请求产生 5 条日志，对象为业务单号（APR-SCRAP-... / SKU），模块中文，操作人真实，时间为北京时间。
2026-09-10 14:16:27 +08:00
parent 1ef9ae4ad9
commit 4808a48594
18 changed files with 513 additions and 527 deletions
--- a/inventory-backend/app/api/v1/auth.py
+++ b/inventory-backend/app/api/v1/auth.py
@ -20,7 +20,7 @@ from app.extensions import db
 # Service & Decorators
 # ==============================================================================
 from app.services.auth_service import AuthService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required

 auth_bp = Blueprint('auth', __name__)

@ -135,11 +135,6 @@ def refresh():
@auth_bp.route('/user/create', methods=['POST'])
@jwt_required()
@permission_required('system_user:operation')
-@audit_log(
-    module='用户管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('username') if request.get_json() else None
-)
 def create_user():
    try:
        data = request.get_json()
@ -225,11 +220,6 @@ def batch_create_user():
@auth_bp.route('/user/<int:user_id>', methods=['PUT'])
@jwt_required()
@permission_required('system_user:operation')
-@audit_log(
-    module='用户管理',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('user_id')
-)
 def update_user(user_id):
    try:
        data = request.get_json()
@ -288,11 +278,6 @@ def get_users():
@auth_bp.route('/user/<int:user_id>', methods=['DELETE'])
@jwt_required()
@permission_required('system_user:operation')
-@audit_log(
-    module='用户管理',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('user_id')
-)
 def delete_user(user_id):
    try:
        claims = get_jwt()
--- a/inventory-backend/app/api/v1/bom.py
+++ b/inventory-backend/app/api/v1/bom.py
@ -6,7 +6,7 @@ from app.models.base import MaterialBase
 from app.models.bom import BomTable
 from app.extensions import db
 from flask_jwt_extended import jwt_required, get_jwt
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 from app.services.auth_service import AuthService

 bom_bp = Blueprint('bom', __name__)
@ -111,11 +111,6 @@ def get_bom_summary():
@bom_bp.route('/status', methods=['POST'])
@jwt_required()
@permission_required('bom_manage:operation')
-@audit_log(
-    module='BOM管理',
-    action='更新状态',
-    get_target_name_fn=lambda: (request.get_json() or {}).get('bom_no')
-)
 def update_bom_status():
    """仅切换某 BOM 版本(整组)的启用/停用状态。"""
    try:
@ -140,11 +135,6 @@ def update_bom_status():
@bom_bp.route('/archive', methods=['POST'])
@jwt_required()
@permission_required('bom_manage:operation')
-@audit_log(
-    module='BOM管理',
-    action='归档/取消归档',
-    get_target_name_fn=lambda: (request.get_json() or {}).get('bom_no')
-)
 def update_bom_archive():
    """切换某 BOM 版本(整组)的归档状态。"""
    try:
@ -194,11 +184,6 @@ def get_bom_detail(bom_no):
@bom_bp.route('/save', methods=['POST'])
@jwt_required()
@permission_required('bom_manage:operation')
-@audit_log(
-    module='BOM管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('bom_no') if request.get_json() else None
-)
 def save_bom():
    """保存或更新 BOM 配方（支持自定义 bom_no 和 多版本）"""
    try:
@ -282,11 +267,6 @@ def get_bom_with_stock_by_no(bom_no):
@bom_bp.route('/<path:bom_no>', methods=['DELETE'])
@jwt_required()
@permission_required('bom_manage:operation')
-@audit_log(
-    module='BOM管理',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('bom_no')
-)
 def delete_bom(bom_no):
    """
    根据 BOM 编号删除
@ -349,11 +329,6 @@ def get_bom(parent_id):
@bom_bp.route('', methods=['POST'])
@jwt_required()
@permission_required('bom_manage:operation')
-@audit_log(
-    module='BOM管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('bom_no') if request.get_json() else None
-)
 def save_bom_legacy():
    try:
        req_data = request.get_json()
--- a/inventory-backend/app/api/v1/inbound/base.py
+++ b/inventory-backend/app/api/v1/inbound/base.py
@ -3,7 +3,7 @@
 from flask import Blueprint, request, jsonify, send_file, g, current_app
 from app.extensions import db, beijing_time
 from app.services.inbound.base_service import MaterialBaseService
-from app.utils.decorators import login_required, permission_required, audit_log
+from app.utils.decorators import login_required, permission_required
 from app.models.base import MaterialBase, MaterialWarningSetting
 import traceback
 import datetime
@ -239,11 +239,6 @@ def export_data():
 # ==============================================================================
@inbound_base_bp.route('/', methods=['POST'])
@permission_required('material_list:operation')
-@audit_log(
-    module='基础信息管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('name') if request.get_json() else None
-)
 def create():
    try:
        data = request.get_json()
@ -302,12 +297,6 @@ def create():
 # ==============================================================================
@inbound_base_bp.route('/<int:id>', methods=['PUT'])
@permission_required('material_list:operation')
-@audit_log(
-    module='基础信息管理',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('id'),
-    get_target_name_fn=lambda: request.get_json().get('name') if request.get_json() else None
-)
 def update(id):
    try:
        data = request.get_json()
@ -359,11 +348,6 @@ def update(id):
 # ==============================================================================
@inbound_base_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('material_list:operation')
-@audit_log(
-    module='基础信息管理',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('id')
-)
 def delete(id):
    try:
        material_name = MaterialBaseService.delete_material(id)
--- a/inventory-backend/app/api/v1/inbound/buy.py
+++ b/inventory-backend/app/api/v1/inbound/buy.py
@ -1,6 +1,6 @@
 from flask import Blueprint, request, jsonify
 from app.services.inbound.buy_service import BuyInboundService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 import traceback

 inbound_buy_bp = Blueprint('stock_buy', __name__)
@ -124,11 +124,6 @@ def get_list():
 # ------------------------------------------------------------------
@inbound_buy_bp.route('/submit', methods=['POST'])
@permission_required('inbound_buy:operation')
-@audit_log(
-    module='采购入库',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def submit():
    try:
        data = request.get_json()
@ -172,12 +167,6 @@ def submit():
 # ------------------------------------------------------------------
@inbound_buy_bp.route('/<int:id>', methods=['PUT'])
@permission_required('inbound_buy:operation')
-@audit_log(
-    module='采购入库',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('id'),
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def update_buy(id):
    try:
        data = request.get_json()
@ -245,11 +234,6 @@ def update_buy(id):
 # ------------------------------------------------------------------
@inbound_buy_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('inbound_buy:operation')
-@audit_log(
-    module='采购入库',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('id')
-)
 def delete_buy(id):
    try:
        material_name = BuyInboundService.delete_inbound(id)
--- a/inventory-backend/app/api/v1/inbound/product.py
+++ b/inventory-backend/app/api/v1/inbound/product.py
@ -1,7 +1,7 @@
 # inventory-backend/app/api/v1/inbound/product.py
 from flask import Blueprint, request, jsonify
 from app.services.inbound.product_service import ProductInboundService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 from app.models.base import MaterialBase
 from app.services.track_query_service import lookup_product
 import traceback
@ -108,11 +108,6 @@ def get_list():

@inbound_product_bp.route('/submit', methods=['POST'])
@permission_required('inbound_product:operation')
-@audit_log(
-    module='成品入库',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def submit():
    try:
        data = request.get_json()
@ -191,12 +186,6 @@ def track_lookup():

@inbound_product_bp.route('/<int:id>', methods=['PUT'])
@permission_required('inbound_product:operation')
-@audit_log(
-    module='成品入库',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('id'),
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def update(id):
    try:
        data = request.get_json()
@ -244,11 +233,6 @@ def update(id):

@inbound_product_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('inbound_product:operation')
-@audit_log(
-    module='成品入库',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('id')
-)
 def delete(id):
    try:
        material_name = ProductInboundService.delete_inbound(id)
--- a/inventory-backend/app/api/v1/inbound/repair.py
+++ b/inventory-backend/app/api/v1/inbound/repair.py
@ -1,7 +1,7 @@
 # inventory-backend/app/api/v1/inbound/repair.py
 from flask import Blueprint, request, jsonify
 from app.services.inbound.repair_service import RepairInboundService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 import traceback

 inbound_repair_bp = Blueprint('inbound_repair', __name__)
@ -35,11 +35,6 @@ def get_list():
 # ------------------------------------------------------------------
@inbound_repair_bp.route('/submit', methods=['POST'])
@permission_required('inbound_repair:add')
-@audit_log(
-    module='维修管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('repair_no') if request.get_json() else None
-)
 def create():
    try:
        data = request.get_json()
@ -55,11 +50,6 @@ def create():
 # ------------------------------------------------------------------
@inbound_repair_bp.route('/<int:id>', methods=['PUT'])
@permission_required('inbound_repair:edit')
-@audit_log(
-    module='维修管理',
-    action='更新',
-    get_target_name_fn=lambda: f"维修单ID:{request.view_args.get('id')}"
-)
 def update(id):
    try:
        data = request.get_json()
@ -77,11 +67,6 @@ def update(id):
 # ------------------------------------------------------------------
@inbound_repair_bp.route('/update-status', methods=['POST'])
@permission_required('inbound_repair:edit')
-@audit_log(
-    module='维修管理',
-    action='更新状态',
-    get_target_name_fn=lambda: f"维修单ID:{request.get_json().get('id')}"
-)
 def update_status():
    try:
        data = request.get_json()
@ -105,11 +90,6 @@ def update_status():
 # ------------------------------------------------------------------
@inbound_repair_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('inbound_repair:delete')
-@audit_log(
-    module='维修管理',
-    action='删除',
-    get_target_name_fn=lambda: f"维修单ID:{request.view_args.get('id')}"
-)
 def delete(id):
    try:
        success = RepairInboundService.delete(id)
@ -134,4 +114,4 @@ def get_detail(id):
        return jsonify({'code': 200, 'msg': 'success', 'data': result})
    except Exception as e:
        traceback.print_exc()
-        return jsonify({'code': 500, 'msg': str(e)}), 500
+        return jsonify({'code': 500, 'msg': str(e)}), 500
--- a/inventory-backend/app/api/v1/inbound/semi.py
+++ b/inventory-backend/app/api/v1/inbound/semi.py
@ -1,7 +1,7 @@
 # inventory-backend/app/api/v1/inbound/semi.py
 from flask import Blueprint, request, jsonify
 from app.services.inbound.semi_service import SemiInboundService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required
 from app.models.base import MaterialBase
 from app.services.track_query_service import lookup_product
 import traceback
@ -112,11 +112,6 @@ def get_list():

@inbound_semi_bp.route('/submit', methods=['POST'])
@permission_required('inbound_semi:operation')
-@audit_log(
-    module='半成品入库',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def submit():
    try:
        data = request.get_json()
@ -194,12 +189,6 @@ def track_lookup():

@inbound_semi_bp.route('/<int:id>', methods=['PUT'])
@permission_required('inbound_semi:operation')
-@audit_log(
-    module='半成品入库',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('id'),
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def update_semi(id):
    try:
        data = request.get_json()
@ -255,11 +244,6 @@ def update_semi(id):

@inbound_semi_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('inbound_semi:operation')
-@audit_log(
-    module='半成品入库',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('id')
-)
 def delete_semi(id):
    try:
        material_name = SemiInboundService.delete_inbound(id)
--- a/inventory-backend/app/api/v1/inbound/service.py
+++ b/inventory-backend/app/api/v1/inbound/service.py
@ -3,7 +3,7 @@ from flask import request, jsonify, current_app
 from flask_jwt_extended import jwt_required
 from . import inbound_bp
 from app.services.inbound.service_service import ServiceService
-from app.utils.decorators import role_required, permission_required, audit_log
+from app.utils.decorators import role_required, permission_required
 import traceback


@ -110,11 +110,6 @@ def get_service_list():

@inbound_bp.route('/service', methods=['POST'])
@permission_required('inbound_service:operation')
-@audit_log(
-    module='服务权益',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def create_service():
    """创建服务权益"""
    data = request.get_json()
@ -191,12 +186,6 @@ def get_service(service_id):

@inbound_bp.route('/service/<int:service_id>', methods=['PUT'])
@permission_required('inbound_service:operation')
-@audit_log(
-    module='服务权益',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('service_id'),
-    get_target_name_fn=lambda: request.get_json().get('material_name') if request.get_json() else None
-)
 def update_service(service_id):
    """更新服务权益"""
    data = request.get_json()
@ -256,11 +245,6 @@ def update_service(service_id):

@inbound_bp.route('/service/<int:service_id>', methods=['DELETE'])
@permission_required('inbound_service:operation')
-@audit_log(
-    module='服务权益',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('service_id')
-)
 def delete_service(service_id):
    """删除服务权益"""
    try:
--- a/inventory-backend/app/api/v1/outbound.py
+++ b/inventory-backend/app/api/v1/outbound.py
@ -1,7 +1,7 @@
 from flask import Blueprint, request, jsonify, current_app
 from app.services.outbound_service import OutboundService
 from flask_jwt_extended import jwt_required, get_jwt_identity, get_jwt
-from app.utils.decorators import permission_required, audit_log, prevent_double_submit, is_privileged_viewer
+from app.utils.decorators import permission_required, prevent_double_submit, is_privileged_viewer
 from app.services.auth_service import AuthService
 import traceback

@ -96,11 +96,6 @@ def scan_barcode():
@outbound_bp.route('', methods=['POST'])
@jwt_required()
@prevent_double_submit(lock_timeout=5)
-@audit_log(
-    module='出库管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('order_no') if request.get_json() else None
-)
 def create_outbound():
    # 权限检查：有 outbound_selection 菜单或操作权限即可提交
    claims = get_jwt()
--- a/inventory-backend/app/api/v1/permission.py
+++ b/inventory-backend/app/api/v1/permission.py
@ -2,7 +2,7 @@
 from flask import Blueprint, request, jsonify, current_app
 from flask_jwt_extended import jwt_required, get_jwt
 from app.services.permission_service import PermissionService
-from app.utils.decorators import permission_required, audit_log
+from app.utils.decorators import permission_required

 permission_bp = Blueprint('permission', __name__)

@ -67,11 +67,6 @@ def get_role_perms(role_code):
@permission_bp.route('/assign', methods=['POST'])
@jwt_required()
@permission_required('system_permission:operation')
-@audit_log(
-    module='权限管理',
-    action='分配',
-    get_target_name_fn=lambda: request.get_json().get('role_code') if request.get_json() else None
-)
 def assign_perms():
    """保存权限分配（自动带上当前操作者的公司标识）"""
    try:
@ -92,4 +87,4 @@ def assign_perms():
        return jsonify({'code': 200, 'msg': '保存成功'}), 200
    except Exception as e:
        current_app.logger.error(f"Assign Perms Failed: {str(e)}")
-        return jsonify({'code': 500, 'msg': str(e)}), 500
+        return jsonify({'code': 500, 'msg': str(e)}), 500
--- a/inventory-backend/app/api/v1/scrap.py
+++ b/inventory-backend/app/api/v1/scrap.py
@ -1,7 +1,7 @@
 # inventory-backend/app/api/v1/scrap.py
 from flask import Blueprint, request, jsonify
 from flask_jwt_extended import jwt_required, get_jwt_identity, get_jwt
-from app.utils.decorators import permission_required, audit_log, get_current_company_filter
+from app.utils.decorators import permission_required, get_current_company_filter
 from app.services.auth_service import AuthService
 from app.extensions import db
 from app.models.transaction import TransScrap, TransRepair
@ -89,11 +89,6 @@ def scan_barcode():
 # --------------------------------------------------------
@scrap_bp.route('', methods=['POST'])
@jwt_required()
-@audit_log(
-    module='报废管理',
-    action='报废出库',
-    get_target_name_fn=lambda: request.get_json().get('items')[0].get('sku') if request.get_json() and request.get_json().get('items') else None
-)
 def create_scrap():
    claims = get_jwt()
    user_role = claims.get('role')
--- a/inventory-backend/app/api/v1/transactions.py
+++ b/inventory-backend/app/api/v1/transactions.py
@ -1,6 +1,6 @@
 from flask import Blueprint, jsonify, request  # .material -> .base refactor checked
 from flask_jwt_extended import jwt_required, get_jwt_identity, get_jwt
-from app.utils.decorators import permission_required, audit_log, prevent_double_submit, is_privileged_viewer
+from app.utils.decorators import permission_required, prevent_double_submit, is_privileged_viewer
 from app.services.auth_service import AuthService
 from app.services.trans_service import TransService
 from app.services.borrow_service import BorrowApprovalService
@ -71,11 +71,6 @@ def filter_item_by_permissions(item_dict, user_permissions, prefix='op_records')
@trans_bp.route('/borrow', methods=['POST'])
@jwt_required()
@permission_required('op_borrow:operation')
-@audit_log(
-    module='借库管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('borrow_no') if request.get_json() else None
-)
 def create_borrow():
    data = request.get_json()
    try:
@ -105,11 +100,6 @@ def scan_borrowed_item():
@trans_bp.route('/return', methods=['POST'])
@jwt_required()
@permission_required('op_return:operation')
-@audit_log(
-    module='借库管理',
-    action='归还',
-    get_target_name_fn=lambda: request.get_json().get('borrow_no') if request.get_json() else None
-)
 def submit_return():
    data = request.get_json()
    # ★ 归还人存"姓名"，而非 JWT 数字 ID
@ -125,11 +115,6 @@ def submit_return():
@trans_bp.route('/borrow/scrap', methods=['POST'])
@jwt_required()
@permission_required('op_return:operation')  # 复用归还权限：能归还的库管即可报废
-@audit_log(
-    module='借库管理',
-    action='借库报废',
-    get_target_name_fn=lambda: request.get_json().get('reason') if request.get_json() else None
-)
 def scrap_borrow():
    """
    借库未归还直接报废（库管/主管操作）
--- a/inventory-backend/app/api/v1/warehouse.py
+++ b/inventory-backend/app/api/v1/warehouse.py
@ -3,7 +3,6 @@ from flask import Blueprint, request, jsonify
 from flask_jwt_extended import jwt_required
 from app.extensions import db
 from app.models.system import SysWarehouseLocation
-from app.utils.decorators import audit_log

 warehouse_bp = Blueprint('warehouse', __name__, url_prefix='/api/v1/warehouse')

@ -93,11 +92,6 @@ def get_children():

@warehouse_bp.route('', methods=['POST'])
@jwt_required()
-@audit_log(
-    module='库位管理',
-    action='新增',
-    get_target_name_fn=lambda: request.get_json().get('name') if request.get_json() else None
-)
 def create_location():
    """
    创建库位
@ -150,12 +144,6 @@ def create_location():

@warehouse_bp.route('/<int:location_id>', methods=['PUT'])
@jwt_required()
-@audit_log(
-    module='库位管理',
-    action='修改',
-    get_target_id_fn=lambda: request.view_args.get('location_id'),
-    get_target_name_fn=lambda: request.get_json().get('name') if request.get_json() else None
-)
 def update_location(location_id):
    """
    更新库位
@ -201,11 +189,6 @@ def update_location(location_id):

@warehouse_bp.route('/<int:location_id>', methods=['DELETE'])
@jwt_required()
-@audit_log(
-    module='库位管理',
-    action='删除',
-    get_target_id_fn=lambda: request.view_args.get('location_id')
-)
 def delete_location(location_id):
    """
    删除库位（级联删除子库位）
@ -247,10 +230,6 @@ def delete_location(location_id):

@warehouse_bp.route('/batch', methods=['DELETE'])
@jwt_required()
-@audit_log(
-    module='库位管理',
-    action='批量删除'
-)
 def batch_delete_locations():
    """
    批量删除库位
@ -299,10 +278,6 @@ def batch_delete_locations():

@warehouse_bp.route('/batch-generate', methods=['POST'])
@jwt_required()
-@audit_log(
-    module='库位管理',
-    action='批量生成'
-)
 def batch_generate_locations():
    """
    规则化批量新增库位