diff --git a/inventory-backend/app/api/v1/inbound/stock.py b/inventory-backend/app/api/v1/inbound/stock.py index 52c69f2..89a81ab 100644 --- a/inventory-backend/app/api/v1/inbound/stock.py +++ b/inventory-backend/app/api/v1/inbound/stock.py @@ -293,11 +293,17 @@ def _do_get_stock_list(permission_prefix=None): # ★ Fail-Closed: 选单/借用场景默认剥离所有价格成本字段 _strip_price_fields = _make_price_stripper(permission_prefix) + # ★ 行级公司隔离:普通用户只能看到本公司的库存(超管/跨域不受限) + from app.utils.decorators import get_current_company_filter + company_limit = get_current_company_filter() + all_items = [] # 1. 采购件 if StockBuy: q = StockBuy.query.filter(StockBuy.stock_quantity > 0) + if company_limit is not None: + q = q.filter(StockBuy.base.has(MaterialBase.company_name == company_limit)) if keyword: q = q.filter( db.or_( @@ -322,6 +328,8 @@ def _do_get_stock_list(permission_prefix=None): if StockSemi: try: q = StockSemi.query.filter(StockSemi.stock_quantity > 0) + if company_limit is not None: + q = q.filter(StockSemi.base.has(MaterialBase.company_name == company_limit)) if keyword: q = q.filter( db.or_( @@ -347,6 +355,8 @@ def _do_get_stock_list(permission_prefix=None): # 3. 成品 if StockProduct: q = StockProduct.query.filter(StockProduct.stock_quantity > 0) + if company_limit is not None: + q = q.filter(StockProduct.base.has(MaterialBase.company_name == company_limit)) if keyword: q = q.filter( db.or_(