duxingchen/KCGL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 三个模块 update endpoint 统一 Default Deny + 权限码全量对齐 sys_element

Browse Source
This commit is contained in:
yueli
2026-07-20 14:26:22 +08:00
parent 3dca2b9254
commit d80edc961c
3 changed files with 84 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
inventory-backend/app/api/v1/inbound/buy.py
View File

@ -182,9 +182,9 @@ def update_buy(id):
'global_print_id': 'inbound_buy:global_print_id', 'global_print_id': 'inbound_buy:global_print_id',
'sku': 'inbound_buy:sku', 'sku': 'inbound_buy:sku',
'barcode': 'inbound_buy:barcode', 'barcode': 'inbound_buy:barcode',
'in_date': 'inbound_buy:in_date', 'in_date': 'inbound_buy:inbound_date',
'serial_number': 'inbound_buy:serial_number', 'serial_number': 'inbound_buy:sn_bn',
'batch_number': 'inbound_buy:batch_number', 'batch_number': 'inbound_buy:sn_bn',
'status': 'inbound_buy:status', 'status': 'inbound_buy:status',
'in_quantity': 'inbound_buy:in_quantity', 'in_quantity': 'inbound_buy:in_quantity',
'stock_quantity': 'inbound_buy:stock_quantity', 'stock_quantity': 'inbound_buy:stock_quantity',
@ -198,9 +198,6 @@ def update_buy(id):
'currency': 'inbound_buy:currency', 'currency': 'inbound_buy:currency',
'exchange_rate': 'inbound_buy:exchange_rate', 'exchange_rate': 'inbound_buy:exchange_rate',
'supplier_name': 'inbound_buy:supplier_name', 'supplier_name': 'inbound_buy:supplier_name',
'buyer_name': 'inbound_buy:buyer_name',
'buyer_email': 'inbound_buy:buyer_email',
'original_link': 'inbound_buy:original_link',
'detail_link': 'inbound_buy:detail_link', 'detail_link': 'inbound_buy:detail_link',
'arrival_photo': 'inbound_buy:arrival_photo', 'arrival_photo': 'inbound_buy:arrival_photo',
'inspection_report': 'inbound_buy:inspection_report', 'inspection_report': 'inbound_buy:inspection_report',
@ -210,12 +207,18 @@ def update_buy(id):
'unit': 'inbound_buy:unit', 'unit': 'inbound_buy:unit',
'material_type': 'inbound_buy:material_type', 'material_type': 'inbound_buy:material_type',
'company_name': 'inbound_buy:company_name', 'company_name': 'inbound_buy:company_name',
'purchaser': 'inbound_buy:purchaser',
'purchaser_email': 'inbound_buy:purchaser_email',
'source_link': 'inbound_buy:source_link',
'request_id': 'inbound_buy:request_id',
'print_copies': 'inbound_buy:print_copies',
} }
# 复制一份，避免遍历时修改字典 # 复制一份，避免遍历时修改字典
for field in list(data.keys()): for field in list(data.keys()):
perm_code = field_to_perm.get(field) perm_code = field_to_perm.get(field)
if not perm_code: if perm_code is None:
continue # 不在映射中的字段跳过（不参与权限过滤） data.pop(field, None) # Default Deny: 不在映射中的字段直接剥离
continue
# 提取不带前缀的基础权限码（如 'serial_number'） # 提取不带前缀的基础权限码（如 'serial_number'）
base_perm_code = perm_code.split(':')[-1] if ':' in perm_code else perm_code base_perm_code = perm_code.split(':')[-1] if ':' in perm_code else perm_code
# 如果用户的权限列表中，既没有长格式，也没有短格式，才移除该字段 # 如果用户的权限列表中，既没有长格式，也没有短格式，才移除该字段

34
inventory-backend/app/api/v1/inbound/product.py
View File

@ -149,10 +149,40 @@ def update(id):
data = request.get_json() data = request.get_json()
user_permissions = get_current_user_permissions() user_permissions = get_current_user_permissions()
if 'inbound_product:*' not in user_permissions: if 'inbound_product:*' not in user_permissions:
field_to_perm = {'id': 'inbound_product:id', 'company_name': 'inbound_product:company_name', 'material_name': 'inbound_product:material_name', 'category': 'inbound_product:category', 'material_type': 'inbound_product:material_type', 'spec_model': 'inbound_product:spec_model', 'unit': 'inbound_product:unit', 'sku': 'inbound_product:sku', 'inbound_date': 'inbound_product:inbound_date', 'barcode': 'inbound_product:barcode', 'serial_number': 'inbound_product:serial_number', 'status': 'inbound_product:status', 'quality_status': 'inbound_product:quality_status', 'in_quantity': 'inbound_product:in_quantity', 'stock_quantity': 'inbound_product:stock_quantity', 'available_quantity': 'inbound_product:available_quantity', 'bom_code': 'inbound_product:bom_code', 'bom_version': 'inbound_product:bom_version', 'work_order_code': 'inbound_product:work_order_code', 'order_id': 'inbound_product:order_id', 'production_manager': 'inbound_product:production_manager', 'production_start_time': 'inbound_product:production_start_time', 'production_end_time': 'inbound_product:production_end_time', 'raw_material_cost': 'inbound_product:raw_material_cost', 'manual_cost': 'inbound_product:manual_cost', 'sale_price': 'inbound_product:sale_price', 'product_photo': 'inbound_product:product_photo', 'quality_report_link': 'inbound_product:quality_report_link', 'inspection_report_link': 'inbound_product:inspection_report_link', 'detail_link': 'inbound_product:detail_link'} field_to_perm = {
'id': 'inbound_product:id', 'base_id': 'inbound_product:base_id',
'company_name': 'material_list:companyName', 'material_name': 'material_list:name',
'category': 'material_list:category', 'material_type': 'material_list:type',
'spec_model': 'material_list:spec', 'unit': 'material_list:unit',
'sku': 'inbound_product:sku', 'inbound_date': 'inbound_product:inbound_date',
'barcode': 'inbound_product:barcode', 'serial_number': 'inbound_product:serial_number',
'warehouse_location': 'inbound_product:warehouse_loc',
'status': 'inbound_product:status', 'quality_status': 'inbound_product:quality_status',
'in_quantity': 'inbound_product:in_quantity', 'stock_quantity': 'inbound_product:stock_quantity',
'available_quantity': 'inbound_product:available_quantity',
'bom_code': 'inbound_product:bom_code', 'bom_version': 'inbound_product:bom_version',
'work_order_code': 'inbound_product:work_order_code', 'order_id': 'inbound_product:order_id',
'production_manager': 'inbound_product:production_manager',
'production_start_time': 'inbound_product:production_start_time',
'production_end_time': 'inbound_product:production_end_time',
'raw_material_cost': 'inbound_product:raw_material_cost',
'manual_cost': 'inbound_product:manual_cost',
'unit_total_cost': 'inbound_product:unit_total_cost',
'total_price': 'inbound_product:total_price',
'sale_price': 'inbound_product:sale_price',
'product_photo': 'inbound_product:product_photo',
'quality_report_link': 'inbound_product:quality_report_link',
'inspection_report_link': 'inbound_product:inspection_report_link',
'detail_link': 'inbound_product:detail_link',
'remark': 'inbound_product:remark',
'print_copies': 'inbound_product:print_copies',
}
for field in list(data.keys()): for field in list(data.keys()):
perm_code = field_to_perm.get(field) perm_code = field_to_perm.get(field)
if perm_code and perm_code not in user_permissions: data.pop(field, None) if perm_code is None:
data.pop(field, None) # Default Deny
elif perm_code not in user_permissions:
data.pop(field, None)
ProductInboundService.update_inbound(id, data) ProductInboundService.update_inbound(id, data)
return jsonify({"code": 200, "msg": "更新成功"}) return jsonify({"code": 200, "msg": "更新成功"})
except Exception as e: except Exception as e:

44
inventory-backend/app/api/v1/inbound/semi.py
View File

@ -143,9 +143,47 @@ def update_semi(id):
data = request.get_json() data = request.get_json()
user_permissions = get_current_user_permissions() user_permissions = get_current_user_permissions()
if 'inbound_semi:*' not in user_permissions: if 'inbound_semi:*' not in user_permissions:
for field in ('raw_material_cost', 'manual_cost', 'unit_total_cost', 'total_price'): field_to_perm = {
perm_code = f'inbound_semi:{field}' 'id': 'inbound_semi:id',
if field in data and perm_code not in user_permissions: 'base_id': 'inbound_semi:base_id',
'company_name': 'material_list:companyName',
'material_name': 'material_list:name',
'spec_model': 'material_list:spec',
'category': 'material_list:category',
'material_type': 'material_list:type',
'unit': 'material_list:unit',
'sku': 'inbound_semi:sku',
'in_date': 'inbound_semi:inbound_date',
'barcode': 'inbound_semi:barcode',
'serial_number': 'inbound_semi:sn_bn',
'batch_number': 'inbound_semi:sn_bn',
'warehouse_location': 'inbound_semi:warehouse_loc',
'status': 'inbound_semi:status',
'quality_status': 'inbound_semi:quality_status',
'in_quantity': 'inbound_semi:in_quantity',
'stock_quantity': 'inbound_semi:stock_quantity',
'available_quantity': 'inbound_semi:available_quantity',
'bom_code': 'inbound_semi:bom_code',
'bom_version': 'inbound_semi:bom_version',
'work_order_code': 'inbound_semi:work_order_code',
'raw_material_cost': 'inbound_semi:raw_material_cost',
'manual_cost': 'inbound_semi:manual_cost',
'unit_total_cost': 'inbound_semi:unit_total_cost',
'total_price': 'inbound_semi:total_price',
'production_manager': 'inbound_semi:production_manager',
'production_start_time': 'inbound_semi:production_start_time',
'production_end_time': 'inbound_semi:production_end_time',
'arrival_photo': 'inbound_semi:arrival_photo',
'quality_report_link': 'inbound_semi:quality_report_link',
'detail_link': 'inbound_semi:detail_link',
'remark': 'inbound_semi:remark',
'print_copies': 'inbound_semi:print_copies',
}
for field in list(data.keys()):
perm_code = field_to_perm.get(field)
if perm_code is None:
data.pop(field, None) # Default Deny
elif perm_code not in user_permissions:
data.pop(field, None) data.pop(field, None)
SemiInboundService.update_inbound(id, data) SemiInboundService.update_inbound(id, data)
return jsonify({"code": 200, "msg": "更新成功"}) return jsonify({"code": 200, "msg": "更新成功"})