From ca21294580985e8d2c98e91d979c543afa96be2b Mon Sep 17 00:00:00 2001 From: yueli Date: Tue, 21 Jul 2026 09:56:34 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20transactions=20filter=5Fitem=5Fby=5Fperm?= =?UTF-8?q?issions=20=E5=8F=AA=E4=BF=9D=E7=95=99=E7=AD=BE=E5=90=8D?= =?UTF-8?q?=E8=BF=87=E6=BB=A4=EF=BC=8C=E5=9F=BA=E7=A1=80=E5=AD=97=E6=AE=B5?= =?UTF-8?q?=E4=B8=8D=E5=86=8D=E5=89=A5=E7=A6=BB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- inventory-backend/app/api/v1/transactions.py | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-) diff --git a/inventory-backend/app/api/v1/transactions.py b/inventory-backend/app/api/v1/transactions.py index dbf652e..d72056e 100644 --- a/inventory-backend/app/api/v1/transactions.py +++ b/inventory-backend/app/api/v1/transactions.py @@ -47,28 +47,10 @@ def filter_item_by_permissions(item_dict, user_permissions, prefix='op_records') ★ Fail-Closed: 字段映射默认为完整列表，不再为空字典。 """ + # 仅过滤敏感字段（签名），基础字段在 sys_element 补齐前不过滤 field_to_perm = { - 'id': f'{prefix}:id', - 'borrow_no': f'{prefix}:borrow_no', - 'borrower_name': f'{prefix}:borrower_name', - 'sku': f'{prefix}:sku', - 'source_table': f'{prefix}:source_table', - 'stock_id': f'{prefix}:stock_id', - 'barcode': f'{prefix}:barcode', - 'quantity': f'{prefix}:quantity', - 'returned_quantity': f'{prefix}:returned_quantity', - 'borrow_time': f'{prefix}:borrow_time', - 'return_time': f'{prefix}:return_time', - 'return_operator': f'{prefix}:return_operator', - 'return_location': f'{prefix}:return_location', - 'status': f'{prefix}:status', - 'expected_return_time': f'{prefix}:expected_return_time', 'borrow_signature': f'{prefix}:borrow_signature', 'return_signature': f'{prefix}:return_signature', - 'remark': f'{prefix}:remark', - 'material_name': f'{prefix}:material_name', - 'is_returned': f'{prefix}:is_returned', - 'current_location': f'{prefix}:current_location', } if '*' in user_permissions or f'{prefix}:*' in user_permissions: return item_dict