4808a48594
一、统一为单一监听器实现
原先两套 SQLAlchemy 事件监听器并存：
· app/utils/audit_events.py —— 全局监听 db.Model、无白名单、无请求上下文守卫（实际在跑）
· app/core/audit_listener.py —— 白名单制、有守卫、有模型级开关（从未生效）
后者失效的根因：注册代码写在 extensions.py 的 init_extensions() 内，
而该函数全仓库只有定义、没有任何调用（create_app 直接内联调用 db.init_app 等）。
现统一由 app/core/audit_listener.py 承担，并在 create_app() 中显式注册。
extensions.py 的死函数 init_extensions 整体删除，避免后人误以为它是有效入口。
二、修复监听器三处致命缺陷（此前注册了也写不进数据）
1. 事件回调第二个参数是 Connection，原代码却调用 Connection.add()（不存在），
每次写日志都抛 AttributeError 并被 except 吞掉 → 改为 connection.execute()
2. register_audit_listeners 从 app.models 批量 import 多个未导出的模型，
ImportError 被上层 try/except 吞掉 → 改为按表名从 db.metadata 取模型
3. 本项目有 31 处函数体内延迟导入模型（如 scrap.py 内部才 import ScrapApproval），
一次性注册会静默漏表 → 增加 ensure_audit_listeners() 惰性补绑，
并在模型预加载段补全审批单/BOM/采购等模型
三、强约束
· WHITELIST_TABLES：仅 18 张核心业务表，系统表/草稿表/向量表不再自审
· has_request_context() 守卫：系统初始化与后台定时任务不再产生 username=system 噪声
· IGNORE_FIELDS 增加 password/password_hash/salt/token/secret/api_key（安全红线）
· created_at 显式写 beijing_time()，与全系统时间口径一致
四、清除僵尸装饰器
@audit_log 早已退化为直接透传的空壳（module/action 参数全被忽略，
数据库中零星的中文 action 即其历史遗留产物），却仍挂在 38 处路由上。
连同 13 个文件的 import 一并移除；audit_events.register_audit_events 改为空操作。
验证：应用上下文中的写操作不产生日志；HTTP 请求产生 5 条日志，
对象为业务单号（APR-SCRAP-... / SKU），模块中文，操作人真实，时间为北京时间。
646 lines
24 KiB
Python
646 lines
24 KiB
Python
from flask import Blueprint, request, jsonify, current_app
|
||
from app.services.outbound_service import OutboundService
|
||
from flask_jwt_extended import jwt_required, get_jwt_identity, get_jwt
|
||
from app.utils.decorators import permission_required, prevent_double_submit, is_privileged_viewer
|
||
from app.services.auth_service import AuthService
|
||
import traceback
|
||
|
||
outbound_bp = Blueprint('outbound', __name__, url_prefix='/outbound')
|
||
|
||
|
||
# ==============================================================================
|
||
# 辅助函数：获取当前用户的完整权限列表（基于角色查询）
|
||
# ==============================================================================
|
||
def get_current_user_permissions():
|
||
"""
|
||
返回当前用户拥有的所有权限码列表（包括菜单和元素）
|
||
此函数根据角色查询数据库得到权限。
|
||
"""
|
||
from flask_jwt_extended import get_jwt
|
||
from app.services.auth_service import AuthService
|
||
claims = get_jwt()
|
||
user_role = claims.get('role')
|
||
user_company = claims.get('company_name', '')
|
||
if not user_role:
|
||
return []
|
||
# 超级管理员返回所有字段权限 (忽略大小写)
|
||
if user_role.upper() == 'SUPER_ADMIN':
|
||
return ['outbound_list:*']
|
||
perm_dict = AuthService.get_user_permissions(user_role, company_name=user_company)
|
||
# 合并菜单和元素权限
|
||
perms = perm_dict.get('menus', []) + perm_dict.get('elements', [])
|
||
return perms
|
||
|
||
|
||
def filter_item_by_permissions(item_dict, user_permissions):
|
||
"""
|
||
根据用户权限过滤 item 字典，无权限的字段值置为 None
|
||
与前端 permissionMap 对齐：仅 total_amount/unit_price/subtotal 需权限
|
||
"""
|
||
field_to_perm = {
|
||
'total_amount': 'outbound_list:total_amount',
|
||
'unit_price': 'outbound_list:unit_price',
|
||
'subtotal': 'outbound_list:subtotal',
|
||
}
|
||
if 'outbound_list:*' in user_permissions:
|
||
return item_dict
|
||
for field, perm_code in field_to_perm.items():
|
||
if field in item_dict and perm_code not in user_permissions:
|
||
item_dict[field] = None
|
||
# 递归处理明细子项
|
||
if 'items' in item_dict and isinstance(item_dict['items'], list):
|
||
for sub_item in item_dict['items']:
|
||
filter_item_by_permissions(sub_item, user_permissions)
|
||
return item_dict
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 1. 扫码查询库存接口 (关联三个库存表)
|
||
# GET /api/v1/outbound/scan?barcode=...
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('/scan', methods=['GET'])
|
||
@jwt_required()
|
||
@permission_required('outbound_selection')
|
||
def scan_barcode():
|
||
barcode = request.args.get('barcode')
|
||
if not barcode:
|
||
return jsonify({'code': 400, 'msg': '请提供条码'}), 400
|
||
|
||
try:
|
||
# 调用 Service 层去三个表中查找 (Service已更新，会返回价格)
|
||
result = OutboundService.get_stock_by_barcode(barcode)
|
||
|
||
if result:
|
||
# ★ Fail-Closed: 扫码响应剥离价格字段
|
||
result.pop('price', None)
|
||
return jsonify({
|
||
'code': 200,
|
||
'msg': '扫描成功',
|
||
'data': result
|
||
})
|
||
else:
|
||
return jsonify({
|
||
'code': 404,
|
||
'msg': '未找到对应的库存记录，请确认条码是否正确'
|
||
}), 404
|
||
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': f'扫描查询出错: {str(e)}'}), 500
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 2. 提交出库单接口 (批量)
|
||
# POST /api/v1/outbound
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('', methods=['POST'])
|
||
@jwt_required()
|
||
@prevent_double_submit(lock_timeout=5)
|
||
def create_outbound():
|
||
# 权限检查：有 outbound_selection 菜单或操作权限即可提交
|
||
claims = get_jwt()
|
||
user_role = claims.get('role')
|
||
user_company = claims.get('company_name', '')
|
||
if not user_role:
|
||
return jsonify({'code': 403, 'msg': '未授权'}), 403
|
||
|
||
if user_role.upper() != 'SUPER_ADMIN':
|
||
perm_dict = AuthService.get_user_permissions(user_role, company_name=user_company)
|
||
perms = perm_dict.get('menus', []) + perm_dict.get('elements', [])
|
||
outbound_perms = [p for p in perms if 'outbound' in p.lower() or 'selection' in p.lower() or 'create' in p.lower()]
|
||
current_app.logger.warning(
|
||
f"[出库权限调试] role={user_role}, company={user_company}, "
|
||
f"出库相关权限={outbound_perms}, 全部权限数={len(perms)}"
|
||
)
|
||
if 'outbound_selection' not in perms and not any(
|
||
p.startswith('outbound_selection:') or p.startswith('outbound_create:') for p in perms
|
||
):
|
||
return jsonify({'code': 403, 'msg': '权限不足'}), 403
|
||
|
||
data = request.get_json()
|
||
if not data:
|
||
return jsonify({'code': 400, 'msg': '无有效数据'}), 400
|
||
|
||
# 获取当前登录用户名 (JWT identity)
|
||
current_user_name = get_jwt_identity()
|
||
if not current_user_name:
|
||
current_user_name = 'Unknown'
|
||
|
||
# 获取最终的操作员名称
|
||
final_operator = data.get('operator_name')
|
||
if not final_operator:
|
||
final_operator = current_user_name
|
||
|
||
# 必填校验 (针对整个单据)
|
||
# items 必须是列表且不为空，consumer_name 和 signature_path 必填
|
||
if 'items' not in data or not data['items']:
|
||
return jsonify({'code': 400, 'msg': '出库商品列表不能为空'}), 400
|
||
|
||
if not data.get('consumer_name') or not data.get('signature_path'):
|
||
return jsonify({'code': 400, 'msg': '领用人及签名信息缺失'}), 400
|
||
|
||
try:
|
||
# ★ [修改] 调用批量创建服务
|
||
outbound_no = OutboundService.create_outbound_batch(data, operator_name=final_operator)
|
||
return jsonify({
|
||
'code': 200,
|
||
'msg': '出库成功',
|
||
'data': {'outbound_no': outbound_no}
|
||
})
|
||
except ValueError as e:
|
||
# 业务逻辑错误 (如库存不足)
|
||
return jsonify({'code': 400, 'msg': str(e)}), 400
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 3. 获取出库记录列表 (分组展示)
|
||
# GET /api/v1/outbound
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('', methods=['GET'])
|
||
@jwt_required()
|
||
@permission_required('outbound_list')
|
||
def get_outbound_list():
|
||
try:
|
||
page = int(request.args.get('page', 1))
|
||
limit = int(request.args.get('limit', 10))
|
||
keyword = request.args.get('keyword', '')
|
||
search_type = request.args.get('search_type', 'all')
|
||
company = request.args.get('company', '')
|
||
|
||
# ★ 高级筛选：JSON 字符串 → 条件列表（解析失败退化为空，不影响主查询）
|
||
from app.utils.advanced_filter import parse_advanced_filters
|
||
advanced_filters = parse_advanced_filters(
|
||
request.args.get('advancedFilters', '')
|
||
)
|
||
|
||
# ★ 数据权限：普通用户只看“领用人=本人姓名(不含账号前缀)”的出库记录；管理者看全部
|
||
consumer_name = None
|
||
if not is_privileged_viewer():
|
||
_identity = get_jwt_identity()
|
||
if _identity:
|
||
from app.models.system import SysUser
|
||
_u = SysUser.query.get(int(_identity))
|
||
# username 形如 “中文名/xiaolongxia” → 取“/”前的领用人姓名
|
||
_uname = _u.username if _u else ''
|
||
consumer_name = _uname.split('/')[0].strip() if _uname else None
|
||
|
||
# ★ [修改] 调用分组查询服务，支持搜索类型
|
||
result = OutboundService.get_grouped_list(
|
||
page, limit, keyword, search_type=search_type,
|
||
company=company, consumer_name=consumer_name,
|
||
advanced_filters=advanced_filters,
|
||
)
|
||
|
||
# 字段级脱敏
|
||
user_permissions = get_current_user_permissions()
|
||
if result.get('items'):
|
||
result['items'] = [filter_item_by_permissions(item, user_permissions) for item in result['items']]
|
||
|
||
return jsonify({
|
||
'code': 200,
|
||
'msg': '获取成功',
|
||
'data': result
|
||
})
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': str(e)}), 500
|
||
|
||
|
||
# ==============================================================================
|
||
# BOM 匹配库存接口 (POST /api/v1/outbound/bom-match-stock)
|
||
# 替代前端 while(true) 全量加载：服务端按 child_ids 精确查询匹配库存
|
||
# ==============================================================================
|
||
@outbound_bp.route('/bom-match-stock', methods=['POST'])
|
||
@jwt_required()
|
||
def bom_match_stock():
|
||
"""
|
||
根据 BOM 子件 base_id 列表，查询三张库存表中有库存的匹配记录。
|
||
|
||
Body: { "child_ids": [1, 2, 3, ...] }
|
||
Returns: { "code": 200, "data": { "items": [...] } }
|
||
"""
|
||
try:
|
||
data = request.get_json() or {}
|
||
child_ids = data.get('child_ids', [])
|
||
if not child_ids:
|
||
return jsonify({'code': 400, 'msg': 'child_ids 不能为空'}), 400
|
||
|
||
# 去重
|
||
child_ids = list(set(int(x) for x in child_ids))
|
||
|
||
# ★ 行级公司隔离：普通用户只能匹配本公司的库存（超管/跨域不受限）
|
||
from app.utils.decorators import get_current_company_filter
|
||
from app.models.base import MaterialBase
|
||
company_limit = get_current_company_filter()
|
||
|
||
from app.models.inbound.buy import StockBuy
|
||
from app.models.inbound.semi import StockSemi
|
||
from app.models.inbound.product import StockProduct
|
||
from sqlalchemy.orm import joinedload
|
||
|
||
all_items = []
|
||
|
||
# 采购件
|
||
buy_items = StockBuy.query.filter(
|
||
StockBuy.base_id.in_(child_ids),
|
||
StockBuy.stock_quantity > 0
|
||
)
|
||
if company_limit is not None:
|
||
buy_items = buy_items.filter(StockBuy.base.has(MaterialBase.company_name == company_limit))
|
||
buy_items = buy_items.options(joinedload(StockBuy.base)).all()
|
||
for s in buy_items:
|
||
d = s.to_dict()
|
||
d['type'] = 'material'
|
||
d['stock_type'] = 'material'
|
||
d['typeLabel'] = '采购件'
|
||
d['uniqueKey'] = f"material_{s.id}"
|
||
d['name'] = d.get('material_name', '')
|
||
d['standard'] = d.get('spec_model', '')
|
||
all_items.append(d)
|
||
|
||
# 半成品
|
||
try:
|
||
semi_items = StockSemi.query.filter(
|
||
StockSemi.base_id.in_(child_ids),
|
||
StockSemi.stock_quantity > 0
|
||
)
|
||
if company_limit is not None:
|
||
semi_items = semi_items.filter(StockSemi.base.has(MaterialBase.company_name == company_limit))
|
||
semi_items = semi_items.options(joinedload(StockSemi.base)).all()
|
||
for s in semi_items:
|
||
d = s.to_dict()
|
||
d['type'] = 'semi'
|
||
d['stock_type'] = 'semi'
|
||
d['typeLabel'] = '半成品'
|
||
d['uniqueKey'] = f"semi_{s.id}"
|
||
d['name'] = d.get('material_name', '')
|
||
d['standard'] = d.get('spec_model', '')
|
||
all_items.append(d)
|
||
except Exception:
|
||
pass
|
||
|
||
# 成品
|
||
try:
|
||
prod_items = StockProduct.query.filter(
|
||
StockProduct.base_id.in_(child_ids),
|
||
StockProduct.stock_quantity > 0
|
||
)
|
||
if company_limit is not None:
|
||
prod_items = prod_items.filter(StockProduct.base.has(MaterialBase.company_name == company_limit))
|
||
prod_items = prod_items.options(joinedload(StockProduct.base)).all()
|
||
for s in prod_items:
|
||
d = s.to_dict()
|
||
d['type'] = 'product'
|
||
d['stock_type'] = 'product'
|
||
d['typeLabel'] = '成品'
|
||
d['uniqueKey'] = f"product_{s.id}"
|
||
d['name'] = d.get('material_name', '')
|
||
d['standard'] = d.get('spec_model', '')
|
||
all_items.append(d)
|
||
except Exception:
|
||
pass
|
||
|
||
# ★ Fail-Closed: 剥离所有价格成本字段（BOM 匹配用于出库选单，无需价格）
|
||
for d in all_items:
|
||
stype = d.get('stock_type', '')
|
||
if stype == 'material':
|
||
for k in ('unit_price', 'post_tax_unit_price', 'total_price',
|
||
'tax_rate', 'currency', 'exchange_rate'):
|
||
d.pop(k, None)
|
||
elif stype == 'semi':
|
||
for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost',
|
||
'total_price', 'unit_price'):
|
||
d.pop(k, None)
|
||
elif stype == 'product':
|
||
for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost',
|
||
'sale_price', 'unit_price'):
|
||
d.pop(k, None)
|
||
|
||
return jsonify({'code': 200, 'msg': 'success', 'data': {'items': all_items}})
|
||
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': str(e)}), 500
|
||
|
||
|
||
# ==============================================================================
|
||
# 出库审批相关接口
|
||
# ==============================================================================
|
||
|
||
from app.services.outbound_service import OutboundApprovalService
|
||
|
||
|
||
def get_current_user_id():
|
||
"""获取当前用户ID"""
|
||
from app.models.system import SysUser
|
||
identity = get_jwt_identity()
|
||
if not identity:
|
||
return None
|
||
# JWT identity 是数据库主键整数，直接用 .get() 查询
|
||
user = SysUser.query.get(identity)
|
||
return user.id if user else None
|
||
|
||
|
||
def get_current_user_info():
|
||
"""获取当前用户信息和角色"""
|
||
from app.models.system import SysUser
|
||
identity = get_jwt_identity()
|
||
if not identity:
|
||
return None, None
|
||
# JWT identity 是数据库主键整数，直接用 .get() 查询
|
||
user = SysUser.query.get(identity)
|
||
return user.id if user else None, user.role if user else None
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 4. 创建出库审批单
|
||
# POST /api/v1/outbound/request
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('/request', methods=['POST'])
|
||
@jwt_required()
|
||
@permission_required('outbound_selection')
|
||
def create_outbound_request():
|
||
"""
|
||
创建出库审批单（申请阶段，用户只需提交宏观物料信息，无需关联具体库存记录）
|
||
|
||
请求体示例:
|
||
{
|
||
"items": [
|
||
{
|
||
"name": "物料A", // 物料名称 (必填)
|
||
"spec_model": "规格1", // 规格型号 (必填)
|
||
"quantity": 10, // 计划出库数量 (必填)
|
||
"warehouse_location": "A区-01-01", // 库位 (可选)
|
||
"remark": "备注信息" // 物品备注 (可选)
|
||
}
|
||
],
|
||
"allowed_approvers": [
|
||
{"type": "role", "value": "SUPERVISOR"},
|
||
{"type": "role", "value": "SUPER_ADMIN"}
|
||
],
|
||
"remark": "紧急出库申请"
|
||
}
|
||
"""
|
||
try:
|
||
user_id, user_role = get_current_user_info()
|
||
if not user_id:
|
||
return jsonify({'code': 401, 'msg': '用户未登录'}), 401
|
||
|
||
data = request.get_json()
|
||
if not data:
|
||
return jsonify({'code': 400, 'msg': '无有效数据'}), 400
|
||
|
||
items = data.get('items', [])
|
||
if not items:
|
||
return jsonify({'code': 400, 'msg': '出库物品列表不能为空'}), 400
|
||
|
||
# ★ 申请阶段仅校验宏观字段：名称、规格、数量
|
||
required_fields = ['name', 'spec_model', 'quantity']
|
||
for idx, item in enumerate(items):
|
||
missing = [f for f in required_fields if f not in item or item.get(f) is None or str(item.get(f)).strip() == '']
|
||
if missing:
|
||
return jsonify({
|
||
'code': 400,
|
||
'msg': f'第{idx + 1}条物品缺少必填字段: {", ".join(missing)}。'
|
||
f'必须包含: name(名称), spec_model(规格), quantity(数量)'
|
||
}), 400
|
||
try:
|
||
qty = float(item.get('quantity', 0))
|
||
if qty <= 0:
|
||
return jsonify({'code': 400, 'msg': f'第{idx + 1}条物品的出库数量必须大于0'}), 400
|
||
except (TypeError, ValueError):
|
||
return jsonify({'code': 400, 'msg': f'第{idx + 1}条物品的 quantity 格式无效'}), 400
|
||
|
||
# ★ 指定审批人：前端传 approver_id 则精准通知，否则用默认角色规则
|
||
approver_id = data.get('approver_id')
|
||
_default_approvers = [
|
||
{"type": "role", "value": "SUPERVISOR"},
|
||
{"type": "role", "value": "SUPER_ADMIN"}
|
||
]
|
||
allowed_approvers = data.get('allowed_approvers') or _default_approvers
|
||
|
||
# 创建审批单（直接存储前端传来的宏观信息快照，不查询库存）
|
||
approval = OutboundApprovalService.create_request(
|
||
applicant_id=user_id,
|
||
items=items,
|
||
allowed_approvers=allowed_approvers,
|
||
remark=data.get('remark'),
|
||
approver_id=approver_id,
|
||
outbound_type=data.get('outbound_type'), # 出库类型（申请时确定）
|
||
force_approval=((user_role or '').upper() == 'WAREHOUSE_MGR') # 库管代建 → 强制审批
|
||
)
|
||
|
||
return jsonify({
|
||
'code': 200,
|
||
'msg': '审批单创建成功',
|
||
'data': approval.to_dict()
|
||
}), 200
|
||
|
||
except ValueError as e:
|
||
return jsonify({'code': 400, 'msg': str(e)}), 400
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 4.1 出库申请预检（判断所选物料是否需审批，驱动前端是否显示审批人）
|
||
# POST /api/v1/outbound/request/check-approval
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('/request/check-approval', methods=['POST'])
|
||
@jwt_required()
|
||
@permission_required('outbound_selection')
|
||
def check_outbound_approval():
|
||
try:
|
||
data = request.get_json() or {}
|
||
items = data.get('items', []) or []
|
||
from app.services.approval_control import resolve_approval_control
|
||
need_approval, flagged = resolve_approval_control(items)
|
||
return jsonify({
|
||
"code": 200, "msg": "success",
|
||
"data": {"need_approval": need_approval, "materials": flagged}
|
||
}), 200
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({"code": 500, "msg": f"预检失败: {str(e)}"}), 500
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 5. 审批出库申请
|
||
# PATCH /api/v1/outbound/request/<id>/approve
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('/request/<int:request_id>/approve', methods=['PATCH'])
|
||
@jwt_required()
|
||
@permission_required('outbound_approval')
|
||
def approve_outbound_request(request_id):
|
||
"""
|
||
审批出库申请
|
||
|
||
请求体示例:
|
||
{
|
||
"action": "approve", // "approve" 通过, "reject" 驳回
|
||
"reject_reason": "库存不足" // 仅在驳回时需要
|
||
}
|
||
"""
|
||
try:
|
||
user_id, user_role = get_current_user_info()
|
||
if not user_id:
|
||
return jsonify({'code': 401, 'msg': '用户未登录'}), 401
|
||
|
||
data = request.get_json() or {}
|
||
action = data.get('action', 'approve')
|
||
reject_reason = data.get('reject_reason')
|
||
|
||
if action not in ('approve', 'reject'):
|
||
return jsonify({'code': 400, 'msg': '无效的审批操作，仅支持 approve 或 reject'}), 400
|
||
|
||
if action == 'reject' and not reject_reason:
|
||
return jsonify({'code': 400, 'msg': '驳回时必须提供原因'}), 400
|
||
|
||
success, message, approval = OutboundApprovalService.approve(
|
||
request_id=request_id,
|
||
user_id=user_id,
|
||
user_role=user_role,
|
||
action=action,
|
||
reject_reason=reject_reason
|
||
)
|
||
|
||
if not success:
|
||
return jsonify({'code': 400, 'msg': message}), 400
|
||
|
||
return jsonify({
|
||
'code': 200,
|
||
'msg': message,
|
||
'data': approval.to_dict() if approval else None
|
||
}), 200
|
||
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 5.5 手动完结/作废审批单
|
||
# POST /api/v1/outbound/request/<id>/close
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('/request/<int:request_id>/close', methods=['POST'])
|
||
@jwt_required()
|
||
@permission_required('outbound_approval')
|
||
def close_outbound_request(request_id):
|
||
"""
|
||
手动完结/作废已通过的审批单（状态 1-已通过 → 4-已完结）
|
||
|
||
适用场景：已通过但无法出库/作废的单据，库管手动清理，
|
||
使其从"已审批通过"列表中消失。
|
||
"""
|
||
try:
|
||
user_id, user_role = get_current_user_info()
|
||
if not user_id:
|
||
return jsonify({'code': 401, 'msg': '用户未登录'}), 401
|
||
|
||
success, message, approval = OutboundApprovalService.close_request(
|
||
request_id=request_id,
|
||
user_id=user_id,
|
||
user_role=user_role
|
||
)
|
||
|
||
if not success:
|
||
return jsonify({'code': 400, 'msg': message}), 400
|
||
|
||
return jsonify({
|
||
'code': 200,
|
||
'msg': message,
|
||
'data': approval.to_dict() if approval else None
|
||
}), 200
|
||
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 6. 获取审批单列表
|
||
# GET /api/v1/outbound/request
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('/request', methods=['GET'])
|
||
@jwt_required()
|
||
@permission_required('outbound_approval')
|
||
def get_outbound_request_list():
|
||
"""
|
||
获取出库审批单列表
|
||
|
||
Query参数:
|
||
- page: 页码 (默认1)
|
||
- limit: 每页数量 (默认10)
|
||
- applicant_id: 按申请人筛选 (可选)
|
||
- status: 按状态筛选 (0待审/1通过/2驳回/3完成, 可选)
|
||
"""
|
||
try:
|
||
page = int(request.args.get('page', 1))
|
||
limit = int(request.args.get('limit', 10))
|
||
|
||
applicant_id = request.args.get('applicant_id')
|
||
if applicant_id:
|
||
applicant_id = int(applicant_id)
|
||
|
||
status = request.args.get('status')
|
||
if status is not None:
|
||
status = int(status)
|
||
|
||
# ★ 数据权限：普通申请人只能看“自己的”出库记录；库管/主管/超管(或跨域)才可看他人
|
||
if not is_privileged_viewer():
|
||
identity = get_jwt_identity()
|
||
applicant_id = int(identity) if identity else None
|
||
|
||
result = OutboundApprovalService.get_request_list(
|
||
page=page,
|
||
per_page=limit,
|
||
applicant_id=applicant_id,
|
||
status=status
|
||
)
|
||
|
||
return jsonify({
|
||
'code': 200,
|
||
'msg': '获取成功',
|
||
'data': result
|
||
}), 200
|
||
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': str(e)}), 500
|
||
|
||
|
||
# --------------------------------------------------------
|
||
# 7. 获取单个审批单详情
|
||
# GET /api/v1/outbound/request/<id>
|
||
# --------------------------------------------------------
|
||
@outbound_bp.route('/request/<int:request_id>', methods=['GET'])
|
||
@jwt_required()
|
||
@permission_required('outbound_approval')
|
||
def get_outbound_request_detail(request_id):
|
||
"""获取出库审批单详情"""
|
||
try:
|
||
approval = OutboundApprovalService.get_request_by_id(request_id)
|
||
|
||
if not approval:
|
||
return jsonify({'code': 404, 'msg': '审批单不存在'}), 404
|
||
|
||
# ★ 数据权限：普通申请人只能看自己的单；库管/主管/超管(或跨域)可看任意
|
||
if not is_privileged_viewer():
|
||
identity = get_jwt_identity()
|
||
if int(approval.applicant_id or 0) != int(identity or 0):
|
||
return jsonify({'code': 403, 'msg': '无权查看他人的出库记录'}), 403
|
||
|
||
return jsonify({
|
||
'code': 200,
|
||
'msg': '获取成功',
|
||
'data': approval.to_dict()
|
||
}), 200
|
||
|
||
except Exception as e:
|
||
traceback.print_exc()
|
||
return jsonify({'code': 500, 'msg': str(e)}), 500
|