diff --git a/inventory-backend/app/utils/field_permissions.py b/inventory-backend/app/utils/field_permissions.py index 62a30a3..f0267eb 100644 --- a/inventory-backend/app/utils/field_permissions.py +++ b/inventory-backend/app/utils/field_permissions.py @@ -20,6 +20,12 @@ STOCK_FIELD_RBAC_MAPPING = { "referencePrice": "material_list:referencePrice", "inventoryCount": "material_list:inventoryCount", "availableCount": "material_list:availableCount", + "warningStatus": "material_list:view_warning", + "warningEnabled": "material_list:view_warning", + "warningRed": "material_list:view_warning", + "warningYellow": "material_list:view_warning", + "warningRedEmails": "material_list:view_warning", + "warningYellowEmails": "material_list:view_warning", }, "StockBuy": { "id": None, "request_id": None, "request_no": None, @@ -89,6 +95,21 @@ def _is_super_admin(user_permissions: list) -> bool: return '*' in user_permissions or any(p.endswith(':*') for p in user_permissions) +def _permits(perm_code: str, user_permissions: list) -> bool: + """检查用户权限列表是否覆盖指定的权限码(支持通配符匹配)""" + if perm_code is None: + return True # None = 公开字段 + if perm_code in user_permissions: + return True # 精确匹配 + # 通配符匹配: material_list:* 覆盖所有 material_list:xxx + for p in user_permissions: + if p.endswith(':*') and perm_code.startswith(p[:-2] + ':'): + return True + if '*' in user_permissions: + return True + return False + + def apply_strict_rbac(item_dict: dict, table_name: str, user_permissions: list) -> dict: """ Default Deny 字段过滤器: @@ -112,7 +133,7 @@ def apply_strict_rbac(item_dict: dict, table_name: str, user_permissions: list) del item_dict[key] # Default Deny else: perm_code = mapping[key] - if perm_code is not None and perm_code not in user_permissions: + if not _permits(perm_code, user_permissions): if isinstance(item_dict[key], (int, float)): item_dict[key] = 0 elif isinstance(item_dict[key], bool):