duxingchen/KCGL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: resolve global permission code collision with material_list prefix

Browse Source 
Co-authored-by: aider (openai/DeepSeek-V3.2-Thinking) <aider@aider.chat>
This commit is contained in:
dxc
2026-02-27 10:43:32 +08:00
parent f178b9cd00
commit d6d9621bf3
2 changed files with 35 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
inventory-backend/app/api/v1/inbound/base.py
View File

@ -25,8 +25,8 @@ def get_current_user_permissions():
return []
# 超级管理员返回所有字段权限
if user_role == 'super_admin':
return ['id', 'companyName', 'name', 'commonName', 'category', 'type',
'spec', 'unit', 'inventoryCount', 'availableCount', 'files', 'isEnabled']
return ['material_list:id', 'material_list:companyName', 'material_list:name', 'material_list:commonName', 'material_list:category', 'material_list:type',
'material_list:spec', 'material_list:unit', 'material_list:inventoryCount', 'material_list:availableCount', 'material_list:files', 'material_list:isEnabled']
perm_dict = AuthService.get_user_permissions(user_role)
# 合并菜单和元素权限
perms = perm_dict.get('menus', []) + perm_dict.get('elements', [])
@ -39,19 +39,19 @@ def filter_item_by_permissions(item_dict, user_permissions):
"""
# 字段名到权限码的映射（与前端 permissionMap 保持一致）
field_to_perm = {
'id': 'id',
'companyName': 'companyName',
'name': 'name',
'commonName': 'commonName',
'category': 'category',
'type': 'type',
'spec': 'spec',
'unit': 'unit',
'inventoryCount': 'inventoryCount',
'availableCount': 'availableCount',
'generalManual': 'files',
'generalImage': 'files',
'isEnabled': 'isEnabled'
'id': 'material_list:id',
'companyName': 'material_list:companyName',
'name': 'material_list:name',
'commonName': 'material_list:commonName',
'category': 'material_list:category',
'type': 'material_list:type',
'spec': 'material_list:spec',
'unit': 'material_list:unit',
'inventoryCount': 'material_list:inventoryCount',
'availableCount': 'material_list:availableCount',
'generalManual': 'material_list:files',
'generalImage': 'material_list:files',
'isEnabled': 'material_list:isEnabled'
}
for field, perm_code in field_to_perm.items():
if field in item_dict and perm_code not in user_permissions:
@ -163,7 +163,7 @@ def export_data():
# 3. 新增接口 (POST /api/v1/inbound/base/)
# ==============================================================================
@inbound_base_bp.route('/', methods=['POST'])
@permission_required('operation')
@permission_required('material_list:operation')
def create():
try:
data = request.get_json()
@ -185,7 +185,7 @@ def create():
# 4. 修改接口 (PUT /api/v1/inbound/base/<id>)
# ==============================================================================
@inbound_base_bp.route('/<int:id>', methods=['PUT'])
@permission_required('operation')
@permission_required('material_list:operation')
def update(id):
try:
data = request.get_json()
@ -200,7 +200,7 @@ def update(id):
# 5. 删除接口 (DELETE /api/v1/inbound/base/<id>)
# ==============================================================================
@inbound_base_bp.route('/<int:id>', methods=['DELETE'])
@permission_required('operation')
@permission_required('material_list:operation')
def delete(id):
try:
MaterialBaseService.delete_material(id)

34
inventory-web/src/views/material/list.vue
View File

@ -71,7 +71,7 @@
<el-icon style="margin-right: 5px"><Download /></el-icon>导出库存统计
</el-button>
<el-button v-if="userStore.hasPermission('material:base:write')" type="primary" @click="handleAdd" style="margin-right: 10px">
<el-button v-if="userStore.hasPermission('material_list:operation')" type="primary" @click="handleAdd" style="margin-right: 10px">
<el-icon style="margin-right: 5px"><Plus /></el-icon>新增
</el-button>
@ -210,15 +210,15 @@
:active-value="1"
:inactive-value="0"
:loading="scope.row.statusLoading"
:disabled="!userStore.hasPermission('material:base:write')"
:disabled="!userStore.hasPermission('material_list:operation')"
@change="handleStatusChange(scope.row)"
/>
</template>
</el-table-column>
<el-table-column v-if="userStore.hasPermission('material:base:write') || userStore.hasPermission('material:base:delete')" label="操作" min-width="150" fixed="right" align="center">
<el-table-column v-if="userStore.hasPermission('material_list:operation')" label="操作" min-width="150" fixed="right" align="center">
<template #default="scope">
<el-button v-if="userStore.hasPermission('material:base:write')" link type="primary" size="small" @click="handleEdit(scope.row)">编辑</el-button>
<el-button v-if="userStore.hasPermission('material:base:delete')" link type="danger" size="small" @click="handleDelete(scope.row)">删除</el-button>
<el-button v-if="userStore.hasPermission('material_list:operation')" link type="primary" size="small" @click="handleEdit(scope.row)">编辑</el-button>
<el-button v-if="userStore.hasPermission('material_list:operation')" link type="danger" size="small" @click="handleDelete(scope.row)">删除</el-button>
</template>
</el-table-column>
</el-table>
@ -507,18 +507,18 @@ const columns = reactive({
// 列与权限Code的映射关系（数据库中的code）
const permissionMap: Record<string, string> = {
id: 'id',
companyName: 'companyName',
name: 'name',
commonName: 'commonName',
category: 'category',
type: 'type',
spec: 'spec',
unit: 'unit',
inventory: 'inventoryCount', // 前端变量是 inventory，数据库Code是 inventoryCount
available: 'availableCount', // 前端变量是 available，数据库Code是 availableCount
files: 'files',
isEnabled: 'isEnabled'
id: 'material_list:id',
companyName: 'material_list:companyName',
name: 'material_list:name',
commonName: 'material_list:commonName',
category: 'material_list:category',
type: 'material_list:type',
spec: 'material_list:spec',
unit: 'material_list:unit',
inventory: 'material_list:inventoryCount', // 前端变量是 inventory，数据库Code是 inventoryCount
available: 'material_list:availableCount', // 前端变量是 available，数据库Code是 availableCount
files: 'material_list:files',
isEnabled: 'material_list:isEnabled'
};
// 根据用户权限初始化列显示状态