feat: add field-level permission control for inbound modules
Co-authored-by: aider (openai/DeepSeek-V3.2-Thinking) <aider@aider.chat>
This commit is contained in:
@ -158,8 +158,56 @@ def get_list():
|
||||
@permission_required('inbound_product:operation')
|
||||
def submit():
|
||||
try:
|
||||
data = request.get_json()
|
||||
if not data:
|
||||
return jsonify({"code": 400, "msg": "No data"}), 400
|
||||
|
||||
# 数据清洗：移除用户没有权限的字段
|
||||
user_permissions = get_current_user_permissions()
|
||||
# 超级管理员不过滤
|
||||
if 'inbound_product:*' not in user_permissions:
|
||||
field_to_perm = {
|
||||
'id': 'inbound_product:id',
|
||||
'base_id': 'inbound_product:base_id',
|
||||
'company_name': 'inbound_product:company_name',
|
||||
'material_name': 'inbound_product:material_name',
|
||||
'category': 'inbound_product:category',
|
||||
'material_type': 'inbound_product:material_type',
|
||||
'spec_model': 'inbound_product:spec_model',
|
||||
'unit': 'inbound_product:unit',
|
||||
'sku': 'inbound_product:sku',
|
||||
'inbound_date': 'inbound_product:inbound_date',
|
||||
'barcode': 'inbound_product:barcode',
|
||||
'serial_number': 'inbound_product:serial_number',
|
||||
'status': 'inbound_product:status',
|
||||
'quality_status': 'inbound_product:quality_status',
|
||||
'in_quantity': 'inbound_product:in_quantity',
|
||||
'stock_quantity': 'inbound_product:stock_quantity',
|
||||
'available_quantity': 'inbound_product:available_quantity',
|
||||
'warehouse_location': 'inbound_product:warehouse_location',
|
||||
'bom_code': 'inbound_product:bom_code',
|
||||
'bom_version': 'inbound_product:bom_version',
|
||||
'work_order_code': 'inbound_product:work_order_code',
|
||||
'order_id': 'inbound_product:order_id',
|
||||
'production_manager': 'inbound_product:production_manager',
|
||||
'production_start_time': 'inbound_product:production_start_time',
|
||||
'production_end_time': 'inbound_product:production_end_time',
|
||||
'raw_material_cost': 'inbound_product:raw_material_cost',
|
||||
'manual_cost': 'inbound_product:manual_cost',
|
||||
'sale_price': 'inbound_product:sale_price',
|
||||
'product_photo': 'inbound_product:product_photo',
|
||||
'quality_report_link': 'inbound_product:quality_report_link',
|
||||
'inspection_report_link': 'inbound_product:inspection_report_link',
|
||||
'detail_link': 'inbound_product:detail_link',
|
||||
}
|
||||
# 复制一份，避免遍历时修改字典
|
||||
for field in list(data.keys()):
|
||||
perm_code = field_to_perm.get(field)
|
||||
if perm_code and perm_code not in user_permissions:
|
||||
data.pop(field, None)
|
||||
|
||||
# 调用 Service 处理入库，获取新创建的对象
|
||||
new_stock = ProductInboundService.handle_inbound(request.get_json())
|
||||
new_stock = ProductInboundService.handle_inbound(data)
|
||||
|
||||
# 返回成功信息以及新创建的数据（包含生成的ID和SKU），供前端自动打印使用
|
||||
return jsonify({
|
||||
@ -179,7 +227,52 @@ def submit():
|
||||
@permission_required('inbound_product:operation')
|
||||
def update(id):
|
||||
try:
|
||||
ProductInboundService.update_inbound(id, request.get_json())
|
||||
data = request.get_json()
|
||||
# 数据清洗：移除用户没有权限的字段
|
||||
user_permissions = get_current_user_permissions()
|
||||
# 超级管理员不过滤
|
||||
if 'inbound_product:*' not in user_permissions:
|
||||
field_to_perm = {
|
||||
'id': 'inbound_product:id',
|
||||
'base_id': 'inbound_product:base_id',
|
||||
'company_name': 'inbound_product:company_name',
|
||||
'material_name': 'inbound_product:material_name',
|
||||
'category': 'inbound_product:category',
|
||||
'material_type': 'inbound_product:material_type',
|
||||
'spec_model': 'inbound_product:spec_model',
|
||||
'unit': 'inbound_product:unit',
|
||||
'sku': 'inbound_product:sku',
|
||||
'inbound_date': 'inbound_product:inbound_date',
|
||||
'barcode': 'inbound_product:barcode',
|
||||
'serial_number': 'inbound_product:serial_number',
|
||||
'status': 'inbound_product:status',
|
||||
'quality_status': 'inbound_product:quality_status',
|
||||
'in_quantity': 'inbound_product:in_quantity',
|
||||
'stock_quantity': 'inbound_product:stock_quantity',
|
||||
'available_quantity': 'inbound_product:available_quantity',
|
||||
'warehouse_location': 'inbound_product:warehouse_location',
|
||||
'bom_code': 'inbound_product:bom_code',
|
||||
'bom_version': 'inbound_product:bom_version',
|
||||
'work_order_code': 'inbound_product:work_order_code',
|
||||
'order_id': 'inbound_product:order_id',
|
||||
'production_manager': 'inbound_product:production_manager',
|
||||
'production_start_time': 'inbound_product:production_start_time',
|
||||
'production_end_time': 'inbound_product:production_end_time',
|
||||
'raw_material_cost': 'inbound_product:raw_material_cost',
|
||||
'manual_cost': 'inbound_product:manual_cost',
|
||||
'sale_price': 'inbound_product:sale_price',
|
||||
'product_photo': 'inbound_product:product_photo',
|
||||
'quality_report_link': 'inbound_product:quality_report_link',
|
||||
'inspection_report_link': 'inbound_product:inspection_report_link',
|
||||
'detail_link': 'inbound_product:detail_link',
|
||||
}
|
||||
# 复制一份，避免遍历时修改字典
|
||||
for field in list(data.keys()):
|
||||
perm_code = field_to_perm.get(field)
|
||||
if perm_code and perm_code not in user_permissions:
|
||||
data.pop(field, None)
|
||||
|
||||
ProductInboundService.update_inbound(id, data)
|
||||
return jsonify({"code": 200, "msg": "更新成功"})
|
||||
except Exception as e:
|
||||
traceback.print_exc()
|
||||
|
||||
@ -167,6 +167,50 @@ def submit():
|
||||
if not data:
|
||||
return jsonify({"code": 400, "msg": "No data"}), 400
|
||||
|
||||
# 数据清洗：移除用户没有权限的字段
|
||||
user_permissions = get_current_user_permissions()
|
||||
# 超级管理员不过滤
|
||||
if 'inbound_semi:*' not in user_permissions:
|
||||
# 字段名到权限码的映射（与前端 permissionMap 保持一致）
|
||||
field_to_perm = {
|
||||
'id': 'inbound_semi:id',
|
||||
'base_id': 'inbound_semi:base_id',
|
||||
'company_name': 'inbound_semi:company_name',
|
||||
'material_name': 'inbound_semi:material_name',
|
||||
'category': 'inbound_semi:category',
|
||||
'material_type': 'inbound_semi:material_type',
|
||||
'spec_model': 'inbound_semi:spec_model',
|
||||
'unit': 'inbound_semi:unit',
|
||||
'sku': 'inbound_semi:sku',
|
||||
'inbound_date': 'inbound_semi:inbound_date',
|
||||
'barcode': 'inbound_semi:barcode',
|
||||
'serial_number': 'inbound_semi:serial_number',
|
||||
'batch_number': 'inbound_semi:batch_number',
|
||||
'status': 'inbound_semi:status',
|
||||
'quality_status': 'inbound_semi:quality_status',
|
||||
'in_quantity': 'inbound_semi:in_quantity',
|
||||
'stock_quantity': 'inbound_semi:stock_quantity',
|
||||
'available_quantity': 'inbound_semi:available_quantity',
|
||||
'warehouse_location': 'inbound_semi:warehouse_location',
|
||||
'bom_code': 'inbound_semi:bom_code',
|
||||
'bom_version': 'inbound_semi:bom_version',
|
||||
'work_order_code': 'inbound_semi:work_order_code',
|
||||
'raw_material_cost': 'inbound_semi:raw_material_cost',
|
||||
'manual_cost': 'inbound_semi:manual_cost',
|
||||
'unit_total_cost': 'inbound_semi:unit_total_cost',
|
||||
'production_manager': 'inbound_semi:production_manager',
|
||||
'production_start_time': 'inbound_semi:production_start_time',
|
||||
'production_end_time': 'inbound_semi:production_end_time',
|
||||
'arrival_photo': 'inbound_semi:arrival_photo',
|
||||
'quality_report_link': 'inbound_semi:quality_report_link',
|
||||
'detail_link': 'inbound_semi:detail_link',
|
||||
}
|
||||
# 复制一份，避免遍历时修改字典
|
||||
for field in list(data.keys()):
|
||||
perm_code = field_to_perm.get(field)
|
||||
if perm_code and perm_code not in user_permissions:
|
||||
data.pop(field, None)
|
||||
|
||||
# 修改：调用 Service 处理入库，获取新创建的对象
|
||||
new_stock = SemiInboundService.handle_inbound(data)
|
||||
|
||||
@ -189,6 +233,49 @@ def submit():
|
||||
def update_semi(id):
|
||||
try:
|
||||
data = request.get_json()
|
||||
# 数据清洗：移除用户没有权限的字段
|
||||
user_permissions = get_current_user_permissions()
|
||||
# 超级管理员不过滤
|
||||
if 'inbound_semi:*' not in user_permissions:
|
||||
field_to_perm = {
|
||||
'id': 'inbound_semi:id',
|
||||
'base_id': 'inbound_semi:base_id',
|
||||
'company_name': 'inbound_semi:company_name',
|
||||
'material_name': 'inbound_semi:material_name',
|
||||
'category': 'inbound_semi:category',
|
||||
'material_type': 'inbound_semi:material_type',
|
||||
'spec_model': 'inbound_semi:spec_model',
|
||||
'unit': 'inbound_semi:unit',
|
||||
'sku': 'inbound_semi:sku',
|
||||
'inbound_date': 'inbound_semi:inbound_date',
|
||||
'barcode': 'inbound_semi:barcode',
|
||||
'serial_number': 'inbound_semi:serial_number',
|
||||
'batch_number': 'inbound_semi:batch_number',
|
||||
'status': 'inbound_semi:status',
|
||||
'quality_status': 'inbound_semi:quality_status',
|
||||
'in_quantity': 'inbound_semi:in_quantity',
|
||||
'stock_quantity': 'inbound_semi:stock_quantity',
|
||||
'available_quantity': 'inbound_semi:available_quantity',
|
||||
'warehouse_location': 'inbound_semi:warehouse_location',
|
||||
'bom_code': 'inbound_semi:bom_code',
|
||||
'bom_version': 'inbound_semi:bom_version',
|
||||
'work_order_code': 'inbound_semi:work_order_code',
|
||||
'raw_material_cost': 'inbound_semi:raw_material_cost',
|
||||
'manual_cost': 'inbound_semi:manual_cost',
|
||||
'unit_total_cost': 'inbound_semi:unit_total_cost',
|
||||
'production_manager': 'inbound_semi:production_manager',
|
||||
'production_start_time': 'inbound_semi:production_start_time',
|
||||
'production_end_time': 'inbound_semi:production_end_time',
|
||||
'arrival_photo': 'inbound_semi:arrival_photo',
|
||||
'quality_report_link': 'inbound_semi:quality_report_link',
|
||||
'detail_link': 'inbound_semi:detail_link',
|
||||
}
|
||||
# 复制一份，避免遍历时修改字典
|
||||
for field in list(data.keys()):
|
||||
perm_code = field_to_perm.get(field)
|
||||
if perm_code and perm_code not in user_permissions:
|
||||
data.pop(field, None)
|
||||
|
||||
SemiInboundService.update_inbound(id, data)
|
||||
return jsonify({"code": 200, "msg": "更新成功"})
|
||||
except Exception as e:
|
||||
|
||||
Reference in New Issue
Block a user