From f2bb95beccaff3d3e3ccbc50475d13438701e39e Mon Sep 17 00:00:00 2001
From: yueli <yueli@example.com>
Date: Fri, 18 Sep 2026 10:07:21 +0800
Subject: [PATCH] =?UTF-8?q?fix(material):=20=E5=9F=BA=E7=A1=80=E4=BF=A1?=
 =?UTF-8?q?=E6=81=AF(Odoo)=E8=A1=A5=E5=9B=9E=E8=A1=A8=E5=8D=95=E7=A6=81?=
 =?UTF-8?q?=E7=94=A8=E6=9D=83=E9=99=90=E5=AE=88=E5=8D=AB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

buyOdoo.vue 是 list.vue 的手工副本。68fd93b 给 list.vue 加了 formDisabled
（无 material_list:operation 权限时整个表单只读），未同步到 Odoo 页。

列表页的「编辑/新增」按钮虽有权限守卫，但 URL 深链 ?edit_id= 不受守卫，
可直接打开 Odoo 页弹窗：字段能改、确定能点，提交后才被后端
@permission_required('material_list:operation') 拦下，用户白填一遍。

补上 formDisabled computed 及表单、确定按钮两处绑定，与 list.vue 对齐。
---
 inventory-web/src/views/material/buyOdoo.vue | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/inventory-web/src/views/material/buyOdoo.vue b/inventory-web/src/views/material/buyOdoo.vue
index 0a9f486..3e8be27 100644
--- a/inventory-web/src/views/material/buyOdoo.vue
+++ b/inventory-web/src/views/material/buyOdoo.vue
@@ -437,7 +437,7 @@
             </div>
           </div>
         </template>
-        <el-form ref="formRef" :model="form" :rules="rules" label-width="110px">
+        <el-form ref="formRef" :model="form" :rules="rules" label-width="110px" :disabled="formDisabled">
 
           <el-row>
             <el-col :span="12">
@@ -655,7 +655,7 @@
         <template #footer>
           <div class="dialog-footer">
             <el-button @click="cancel" :disabled="isUploading">取 消</el-button>
-            <el-button type="primary" @click="submitForm" :loading="submitLoading || isUploading">确 定</el-button>
+            <el-button type="primary" @click="submitForm" :loading="submitLoading || isUploading" :disabled="formDisabled">确 定</el-button>
           </div>
         </template>
       </el-dialog>
@@ -789,6 +789,16 @@ const canEditRemark = computed(() => {
   return userStore.hasPermission('material_list:remark_edit');
 });
 
+// 表单全局禁用：没有 material_list:operation 权限时，所有表单字段不可编辑
+// ★ 为什么必须有：列表页的「编辑/新增」按钮虽然有权限守卫，但 URL 深链
+//   ?edit_id= 不受守卫，可直接打开本弹窗。若此处不禁用，用户能改完并点确定，
+//   最终被后端 @permission_required('material_list:operation') 拦下 —— 白填一遍。
+//   （与 list.vue 对齐）
+const formDisabled = computed(() => {
+  if (userStore.role === 'SUPER_ADMIN' || userStore.username === 'IRIS') return false;
+  return !userStore.hasPermission('material_list:operation');
+});
+
 // --- 类型定义 ---
 interface MaterialBaseVO {
   id: number;