From d80edc961c8fc09f9e234461b3000b665f3e448b Mon Sep 17 00:00:00 2001 From: yueli Date: Mon, 20 Jul 2026 14:26:22 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=B8=89=E4=B8=AA=E6=A8=A1=E5=9D=97=20u?= =?UTF-8?q?pdate=20endpoint=20=E7=BB=9F=E4=B8=80=20Default=20Deny=20+=20?= =?UTF-8?q?=E6=9D=83=E9=99=90=E7=A0=81=E5=85=A8=E9=87=8F=E5=AF=B9=E9=BD=90?= =?UTF-8?q?=20sys=5Felement?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- inventory-backend/app/api/v1/inbound/buy.py | 19 ++++---- .../app/api/v1/inbound/product.py | 34 +++++++++++++- inventory-backend/app/api/v1/inbound/semi.py | 44 +++++++++++++++++-- 3 files changed, 84 insertions(+), 13 deletions(-) diff --git a/inventory-backend/app/api/v1/inbound/buy.py b/inventory-backend/app/api/v1/inbound/buy.py index 67b8426..3d5d696 100644 --- a/inventory-backend/app/api/v1/inbound/buy.py +++ b/inventory-backend/app/api/v1/inbound/buy.py @@ -182,9 +182,9 @@ def update_buy(id): 'global_print_id': 'inbound_buy:global_print_id', 'sku': 'inbound_buy:sku', 'barcode': 'inbound_buy:barcode', - 'in_date': 'inbound_buy:in_date', - 'serial_number': 'inbound_buy:serial_number', - 'batch_number': 'inbound_buy:batch_number', + 'in_date': 'inbound_buy:inbound_date', + 'serial_number': 'inbound_buy:sn_bn', + 'batch_number': 'inbound_buy:sn_bn', 'status': 'inbound_buy:status', 'in_quantity': 'inbound_buy:in_quantity', 'stock_quantity': 'inbound_buy:stock_quantity', @@ -198,9 +198,6 @@ def update_buy(id): 'currency': 'inbound_buy:currency', 'exchange_rate': 'inbound_buy:exchange_rate', 'supplier_name': 'inbound_buy:supplier_name', - 'buyer_name': 'inbound_buy:buyer_name', - 'buyer_email': 'inbound_buy:buyer_email', - 'original_link': 'inbound_buy:original_link', 'detail_link': 'inbound_buy:detail_link', 'arrival_photo': 'inbound_buy:arrival_photo', 'inspection_report': 'inbound_buy:inspection_report', @@ -210,12 +207,18 @@ def update_buy(id): 'unit': 'inbound_buy:unit', 'material_type': 'inbound_buy:material_type', 'company_name': 'inbound_buy:company_name', + 'purchaser': 'inbound_buy:purchaser', + 'purchaser_email': 'inbound_buy:purchaser_email', + 'source_link': 'inbound_buy:source_link', + 'request_id': 'inbound_buy:request_id', + 'print_copies': 'inbound_buy:print_copies', } # 复制一份，避免遍历时修改字典 for field in list(data.keys()): perm_code = field_to_perm.get(field) - if not perm_code: - continue # 不在映射中的字段跳过（不参与权限过滤） + if perm_code is None: + data.pop(field, None) # Default Deny: 不在映射中的字段直接剥离 + continue # 提取不带前缀的基础权限码（如 'serial_number'） base_perm_code = perm_code.split(':')[-1] if ':' in perm_code else perm_code # 如果用户的权限列表中，既没有长格式，也没有短格式，才移除该字段 diff --git a/inventory-backend/app/api/v1/inbound/product.py b/inventory-backend/app/api/v1/inbound/product.py index b299aa0..4b55cd7 100644 --- a/inventory-backend/app/api/v1/inbound/product.py +++ b/inventory-backend/app/api/v1/inbound/product.py @@ -149,10 +149,40 @@ def update(id): data = request.get_json() user_permissions = get_current_user_permissions() if 'inbound_product:*' not in user_permissions: - field_to_perm = {'id': 'inbound_product:id', 'company_name': 'inbound_product:company_name', 'material_name': 'inbound_product:material_name', 'category': 'inbound_product:category', 'material_type': 'inbound_product:material_type', 'spec_model': 'inbound_product:spec_model', 'unit': 'inbound_product:unit', 'sku': 'inbound_product:sku', 'inbound_date': 'inbound_product:inbound_date', 'barcode': 'inbound_product:barcode', 'serial_number': 'inbound_product:serial_number', 'status': 'inbound_product:status', 'quality_status': 'inbound_product:quality_status', 'in_quantity': 'inbound_product:in_quantity', 'stock_quantity': 'inbound_product:stock_quantity', 'available_quantity': 'inbound_product:available_quantity', 'bom_code': 'inbound_product:bom_code', 'bom_version': 'inbound_product:bom_version', 'work_order_code': 'inbound_product:work_order_code', 'order_id': 'inbound_product:order_id', 'production_manager': 'inbound_product:production_manager', 'production_start_time': 'inbound_product:production_start_time', 'production_end_time': 'inbound_product:production_end_time', 'raw_material_cost': 'inbound_product:raw_material_cost', 'manual_cost': 'inbound_product:manual_cost', 'sale_price': 'inbound_product:sale_price', 'product_photo': 'inbound_product:product_photo', 'quality_report_link': 'inbound_product:quality_report_link', 'inspection_report_link': 'inbound_product:inspection_report_link', 'detail_link': 'inbound_product:detail_link'} + field_to_perm = { + 'id': 'inbound_product:id', 'base_id': 'inbound_product:base_id', + 'company_name': 'material_list:companyName', 'material_name': 'material_list:name', + 'category': 'material_list:category', 'material_type': 'material_list:type', + 'spec_model': 'material_list:spec', 'unit': 'material_list:unit', + 'sku': 'inbound_product:sku', 'inbound_date': 'inbound_product:inbound_date', + 'barcode': 'inbound_product:barcode', 'serial_number': 'inbound_product:serial_number', + 'warehouse_location': 'inbound_product:warehouse_loc', + 'status': 'inbound_product:status', 'quality_status': 'inbound_product:quality_status', + 'in_quantity': 'inbound_product:in_quantity', 'stock_quantity': 'inbound_product:stock_quantity', + 'available_quantity': 'inbound_product:available_quantity', + 'bom_code': 'inbound_product:bom_code', 'bom_version': 'inbound_product:bom_version', + 'work_order_code': 'inbound_product:work_order_code', 'order_id': 'inbound_product:order_id', + 'production_manager': 'inbound_product:production_manager', + 'production_start_time': 'inbound_product:production_start_time', + 'production_end_time': 'inbound_product:production_end_time', + 'raw_material_cost': 'inbound_product:raw_material_cost', + 'manual_cost': 'inbound_product:manual_cost', + 'unit_total_cost': 'inbound_product:unit_total_cost', + 'total_price': 'inbound_product:total_price', + 'sale_price': 'inbound_product:sale_price', + 'product_photo': 'inbound_product:product_photo', + 'quality_report_link': 'inbound_product:quality_report_link', + 'inspection_report_link': 'inbound_product:inspection_report_link', + 'detail_link': 'inbound_product:detail_link', + 'remark': 'inbound_product:remark', + 'print_copies': 'inbound_product:print_copies', + } for field in list(data.keys()): perm_code = field_to_perm.get(field) - if perm_code and perm_code not in user_permissions: data.pop(field, None) + if perm_code is None: + data.pop(field, None) # Default Deny + elif perm_code not in user_permissions: + data.pop(field, None) ProductInboundService.update_inbound(id, data) return jsonify({"code": 200, "msg": "更新成功"}) except Exception as e: diff --git a/inventory-backend/app/api/v1/inbound/semi.py b/inventory-backend/app/api/v1/inbound/semi.py index 810bbbf..4aaed8e 100644 --- a/inventory-backend/app/api/v1/inbound/semi.py +++ b/inventory-backend/app/api/v1/inbound/semi.py @@ -143,9 +143,47 @@ def update_semi(id): data = request.get_json() user_permissions = get_current_user_permissions() if 'inbound_semi:*' not in user_permissions: - for field in ('raw_material_cost', 'manual_cost', 'unit_total_cost', 'total_price'): - perm_code = f'inbound_semi:{field}' - if field in data and perm_code not in user_permissions: + field_to_perm = { + 'id': 'inbound_semi:id', + 'base_id': 'inbound_semi:base_id', + 'company_name': 'material_list:companyName', + 'material_name': 'material_list:name', + 'spec_model': 'material_list:spec', + 'category': 'material_list:category', + 'material_type': 'material_list:type', + 'unit': 'material_list:unit', + 'sku': 'inbound_semi:sku', + 'in_date': 'inbound_semi:inbound_date', + 'barcode': 'inbound_semi:barcode', + 'serial_number': 'inbound_semi:sn_bn', + 'batch_number': 'inbound_semi:sn_bn', + 'warehouse_location': 'inbound_semi:warehouse_loc', + 'status': 'inbound_semi:status', + 'quality_status': 'inbound_semi:quality_status', + 'in_quantity': 'inbound_semi:in_quantity', + 'stock_quantity': 'inbound_semi:stock_quantity', + 'available_quantity': 'inbound_semi:available_quantity', + 'bom_code': 'inbound_semi:bom_code', + 'bom_version': 'inbound_semi:bom_version', + 'work_order_code': 'inbound_semi:work_order_code', + 'raw_material_cost': 'inbound_semi:raw_material_cost', + 'manual_cost': 'inbound_semi:manual_cost', + 'unit_total_cost': 'inbound_semi:unit_total_cost', + 'total_price': 'inbound_semi:total_price', + 'production_manager': 'inbound_semi:production_manager', + 'production_start_time': 'inbound_semi:production_start_time', + 'production_end_time': 'inbound_semi:production_end_time', + 'arrival_photo': 'inbound_semi:arrival_photo', + 'quality_report_link': 'inbound_semi:quality_report_link', + 'detail_link': 'inbound_semi:detail_link', + 'remark': 'inbound_semi:remark', + 'print_copies': 'inbound_semi:print_copies', + } + for field in list(data.keys()): + perm_code = field_to_perm.get(field) + if perm_code is None: + data.pop(field, None) # Default Deny + elif perm_code not in user_permissions: data.pop(field, None) SemiInboundService.update_inbound(id, data) return jsonify({"code": 200, "msg": "更新成功"})