diff --git a/inventory-web/src/views/material/buyOdoo.vue b/inventory-web/src/views/material/buyOdoo.vue
index 0a9f486..3e8be27 100644
--- a/inventory-web/src/views/material/buyOdoo.vue
+++ b/inventory-web/src/views/material/buyOdoo.vue
@@ -437,7 +437,7 @@
             </div>
           </div>
         </template>
-        <el-form ref="formRef" :model="form" :rules="rules" label-width="110px">
+        <el-form ref="formRef" :model="form" :rules="rules" label-width="110px" :disabled="formDisabled">
 
           <el-row>
             <el-col :span="12">
@@ -655,7 +655,7 @@
         <template #footer>
           <div class="dialog-footer">
             <el-button @click="cancel" :disabled="isUploading">取 消</el-button>
-            <el-button type="primary" @click="submitForm" :loading="submitLoading || isUploading">确 定</el-button>
+            <el-button type="primary" @click="submitForm" :loading="submitLoading || isUploading" :disabled="formDisabled">确 定</el-button>
           </div>
         </template>
       </el-dialog>
@@ -789,6 +789,16 @@ const canEditRemark = computed(() => {
   return userStore.hasPermission('material_list:remark_edit');
 });
 
+// 表单全局禁用：没有 material_list:operation 权限时，所有表单字段不可编辑
+// ★ 为什么必须有：列表页的「编辑/新增」按钮虽然有权限守卫，但 URL 深链
+//   ?edit_id= 不受守卫，可直接打开本弹窗。若此处不禁用，用户能改完并点确定，
+//   最终被后端 @permission_required('material_list:operation') 拦下 —— 白填一遍。
+//   （与 list.vue 对齐）
+const formDisabled = computed(() => {
+  if (userStore.role === 'SUPER_ADMIN' || userStore.username === 'IRIS') return false;
+  return !userStore.hasPermission('material_list:operation');
+});
+
 // --- 类型定义 ---
 interface MaterialBaseVO {
   id: number;