fix(borrow,outbound): 记录查看按角色收窄——普通只看自己，库管/主管/超管/跨域看全部

- decorators 新增 is_privileged_viewer（SUPER_ADMIN/SUPERVISOR/WAREHOUSE_MGR 或 crossDomain）
- 借库记录列表：非管理者强制 applicant_id=当前用户
- 出库记录列表+详情：非管理者强制只看自己/无权访问他人单(403)

inventory-backend/app/api/v1/outbound.py

@@ -1,7 +1,7 @@
 from flask import Blueprint, request, jsonify, current_app
 from app.services.outbound_service import OutboundService
 from flask_jwt_extended import jwt_required, get_jwt_identity, get_jwt
-from app.utils.decorators import permission_required, audit_log, prevent_double_submit
+from app.utils.decorators import permission_required, audit_log, prevent_double_submit, is_privileged_viewer
 from app.services.auth_service import AuthService
 import traceback
 
@@ -551,6 +551,11 @@ def get_outbound_request_list():
         if status is not None:
             status = int(status)
 
+        # ★ 数据权限：普通申请人只能看“自己的”出库记录；库管/主管/超管(或跨域)才可看他人
+        if not is_privileged_viewer():
+            identity = get_jwt_identity()
+            applicant_id = int(identity) if identity else None
+
         result = OutboundApprovalService.get_request_list(
             page=page,
             per_page=limit,
@@ -584,6 +589,12 @@ def get_outbound_request_detail(request_id):
         if not approval:
             return jsonify({'code': 404, 'msg': '审批单不存在'}), 404
 
+        # ★ 数据权限：普通申请人只能看自己的单；库管/主管/超管(或跨域)可看任意
+        if not is_privileged_viewer():
+            identity = get_jwt_identity()
+            if int(approval.applicant_id or 0) != int(identity or 0):
+                return jsonify({'code': 403, 'msg': '无权查看他人的出库记录'}), 403
+
         return jsonify({
             'code': 200,
             'msg': '获取成功',

inventory-backend/app/api/v1/transactions.py

@@ -1,6 +1,6 @@
 from flask import Blueprint, jsonify, request  # .material -> .base refactor checked
 from flask_jwt_extended import jwt_required, get_jwt_identity, get_jwt
-from app.utils.decorators import permission_required, audit_log, prevent_double_submit
+from app.utils.decorators import permission_required, audit_log, prevent_double_submit, is_privileged_viewer
 from app.services.auth_service import AuthService
 from app.services.trans_service import TransService
 from app.services.borrow_service import BorrowApprovalService
@@ -330,6 +330,11 @@ def get_borrow_request_list():
         if status is not None:
             status = int(status)
 
+        # ★ 数据权限：普通申请人只能看“自己的”借还记录；库管/主管/超管(或跨域)才可看他人
+        if not is_privileged_viewer():
+            identity = get_jwt_identity()
+            applicant_id = int(identity) if identity else None
+
         result = BorrowApprovalService.get_request_list(
             page=page, per_page=limit, applicant_id=applicant_id, status=status
         )