KCGL/inventory-backend/app/api/v1/outbound.py

from flask import Blueprint, request, jsonify, current_app
from app.services.outbound_service import OutboundService
from flask_jwt_extended import jwt_required, get_jwt_identity, get_jwt
from app.utils.decorators import permission_required, audit_log, prevent_double_submit
from app.services.auth_service import AuthService
import traceback

outbound_bp = Blueprint('outbound', __name__, url_prefix='/outbound')


# ==============================================================================
# 辅助函数：获取当前用户的完整权限列表（基于角色查询）
# ==============================================================================
def get_current_user_permissions():
    """
    返回当前用户拥有的所有权限码列表（包括菜单和元素）
    此函数根据角色查询数据库得到权限。
    """
    from flask_jwt_extended import get_jwt
    from app.services.auth_service import AuthService
    claims = get_jwt()
    user_role = claims.get('role')
    user_company = claims.get('company_name', '')
    if not user_role:
        return []
    # 超级管理员返回所有字段权限 (忽略大小写)
    if user_role.upper() == 'SUPER_ADMIN':
        return ['outbound_list:*']
    perm_dict = AuthService.get_user_permissions(user_role, company_name=user_company)
    # 合并菜单和元素权限
    perms = perm_dict.get('menus', []) + perm_dict.get('elements', [])
    return perms


def filter_item_by_permissions(item_dict, user_permissions):
    """
    根据用户权限过滤 item 字典，无权限的字段值置为 None
    与前端 permissionMap 对齐：仅 total_amount/unit_price/subtotal 需权限
    """
    field_to_perm = {
        'total_amount': 'outbound_list:total_amount',
        'unit_price': 'outbound_list:unit_price',
        'subtotal': 'outbound_list:subtotal',
    }
    if 'outbound_list:*' in user_permissions:
        return item_dict
    for field, perm_code in field_to_perm.items():
        if field in item_dict and perm_code not in user_permissions:
            item_dict[field] = None
    # 递归处理明细子项
    if 'items' in item_dict and isinstance(item_dict['items'], list):
        for sub_item in item_dict['items']:
            filter_item_by_permissions(sub_item, user_permissions)
    return item_dict


# --------------------------------------------------------
# 1. 扫码查询库存接口 (关联三个库存表)
# GET /api/v1/outbound/scan?barcode=...
# --------------------------------------------------------
@outbound_bp.route('/scan', methods=['GET'])
@jwt_required()
@permission_required('outbound_selection')
def scan_barcode():
    barcode = request.args.get('barcode')
    if not barcode:
        return jsonify({'code': 400, 'msg': '请提供条码'}), 400

    try:
        # 调用 Service 层去三个表中查找 (Service已更新，会返回价格)
        result = OutboundService.get_stock_by_barcode(barcode)

        if result:
            # ★ Fail-Closed: 扫码响应剥离价格字段
            result.pop('price', None)
            return jsonify({
                'code': 200,
                'msg': '扫描成功',
                'data': result
            })
        else:
            return jsonify({
                'code': 404,
                'msg': '未找到对应的库存记录，请确认条码是否正确'
            }), 404

    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': f'扫描查询出错: {str(e)}'}), 500


# --------------------------------------------------------
# 2. 提交出库单接口 (批量)
# POST /api/v1/outbound
# --------------------------------------------------------
@outbound_bp.route('', methods=['POST'])
@jwt_required()
@prevent_double_submit(lock_timeout=5)
@audit_log(
    module='出库管理',
    action='新增',
    get_target_name_fn=lambda: request.get_json().get('order_no') if request.get_json() else None
)
def create_outbound():
    # 权限检查：有 outbound_selection 菜单或操作权限即可提交
    claims = get_jwt()
    user_role = claims.get('role')
    user_company = claims.get('company_name', '')
    if not user_role:
        return jsonify({'code': 403, 'msg': '未授权'}), 403

    if user_role.upper() != 'SUPER_ADMIN':
        perm_dict = AuthService.get_user_permissions(user_role, company_name=user_company)
        perms = perm_dict.get('menus', []) + perm_dict.get('elements', [])
        outbound_perms = [p for p in perms if 'outbound' in p.lower() or 'selection' in p.lower() or 'create' in p.lower()]
        current_app.logger.warning(
            f"[出库权限调试] role={user_role}, company={user_company}, "
            f"出库相关权限={outbound_perms}, 全部权限数={len(perms)}"
        )
        if 'outbound_selection' not in perms and not any(
            p.startswith('outbound_selection:') or p.startswith('outbound_create:') for p in perms
        ):
            return jsonify({'code': 403, 'msg': '权限不足'}), 403

    data = request.get_json()
    if not data:
        return jsonify({'code': 400, 'msg': '无有效数据'}), 400

    # 获取当前登录用户名 (JWT identity)
    current_user_name = get_jwt_identity()
    if not current_user_name:
        current_user_name = 'Unknown'

    # 获取最终的操作员名称
    final_operator = data.get('operator_name')
    if not final_operator:
        final_operator = current_user_name

    # 必填校验 (针对整个单据)
    # items 必须是列表且不为空，consumer_name 和 signature_path 必填
    if 'items' not in data or not data['items']:
        return jsonify({'code': 400, 'msg': '出库商品列表不能为空'}), 400

    if not data.get('consumer_name') or not data.get('signature_path'):
        return jsonify({'code': 400, 'msg': '领用人及签名信息缺失'}), 400

    try:
        # ★ [修改] 调用批量创建服务
        outbound_no = OutboundService.create_outbound_batch(data, operator_name=final_operator)
        return jsonify({
            'code': 200,
            'msg': '出库成功',
            'data': {'outbound_no': outbound_no}
        })
    except ValueError as e:
        # 业务逻辑错误 (如库存不足)
        return jsonify({'code': 400, 'msg': str(e)}), 400
    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500


# --------------------------------------------------------
# 3. 获取出库记录列表 (分组展示)
# GET /api/v1/outbound
# --------------------------------------------------------
@outbound_bp.route('', methods=['GET'])
@jwt_required()
@permission_required('outbound_list')
def get_outbound_list():
    try:
        page = int(request.args.get('page', 1))
        limit = int(request.args.get('limit', 10))
        keyword = request.args.get('keyword', '')
        search_type = request.args.get('search_type', 'all')
        company = request.args.get('company', '')

        # ★ [修改] 调用分组查询服务，支持搜索类型
        result = OutboundService.get_grouped_list(page, limit, keyword, search_type=search_type, company=company)

        # 字段级脱敏
        user_permissions = get_current_user_permissions()
        if result.get('items'):
            result['items'] = [filter_item_by_permissions(item, user_permissions) for item in result['items']]

        return jsonify({
            'code': 200,
            'msg': '获取成功',
            'data': result
        })
    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': str(e)}), 500


# ==============================================================================
# BOM 匹配库存接口 (POST /api/v1/outbound/bom-match-stock)
# 替代前端 while(true) 全量加载：服务端按 child_ids 精确查询匹配库存
# ==============================================================================
@outbound_bp.route('/bom-match-stock', methods=['POST'])
@jwt_required()
def bom_match_stock():
    """
    根据 BOM 子件 base_id 列表，查询三张库存表中有库存的匹配记录。

    Body: { "child_ids": [1, 2, 3, ...] }
    Returns: { "code": 200, "data": { "items": [...] } }
    """
    try:
        data = request.get_json() or {}
        child_ids = data.get('child_ids', [])
        if not child_ids:
            return jsonify({'code': 400, 'msg': 'child_ids 不能为空'}), 400

        # 去重
        child_ids = list(set(int(x) for x in child_ids))

        from app.models.inbound.buy import StockBuy
        from app.models.inbound.semi import StockSemi
        from app.models.inbound.product import StockProduct
        from sqlalchemy.orm import joinedload

        all_items = []

        # 采购件
        buy_items = StockBuy.query.filter(
            StockBuy.base_id.in_(child_ids),
            StockBuy.stock_quantity > 0
        ).options(joinedload(StockBuy.base)).all()
        for s in buy_items:
            d = s.to_dict()
            d['type'] = 'material'
            d['stock_type'] = 'material'
            d['typeLabel'] = '采购件'
            d['uniqueKey'] = f"material_{s.id}"
            d['name'] = d.get('material_name', '')
            d['standard'] = d.get('spec_model', '')
            all_items.append(d)

        # 半成品
        try:
            semi_items = StockSemi.query.filter(
                StockSemi.base_id.in_(child_ids),
                StockSemi.stock_quantity > 0
            ).options(joinedload(StockSemi.base)).all()
            for s in semi_items:
                d = s.to_dict()
                d['type'] = 'semi'
                d['stock_type'] = 'semi'
                d['typeLabel'] = '半成品'
                d['uniqueKey'] = f"semi_{s.id}"
                d['name'] = d.get('material_name', '')
                d['standard'] = d.get('spec_model', '')
                all_items.append(d)
        except Exception:
            pass

        # 成品
        try:
            prod_items = StockProduct.query.filter(
                StockProduct.base_id.in_(child_ids),
                StockProduct.stock_quantity > 0
            ).options(joinedload(StockProduct.base)).all()
            for s in prod_items:
                d = s.to_dict()
                d['type'] = 'product'
                d['stock_type'] = 'product'
                d['typeLabel'] = '成品'
                d['uniqueKey'] = f"product_{s.id}"
                d['name'] = d.get('material_name', '')
                d['standard'] = d.get('spec_model', '')
                all_items.append(d)
        except Exception:
            pass

        # ★ Fail-Closed: 剥离所有价格成本字段（BOM 匹配用于出库选单，无需价格）
        for d in all_items:
            stype = d.get('stock_type', '')
            if stype == 'material':
                for k in ('unit_price', 'post_tax_unit_price', 'total_price',
                          'tax_rate', 'currency', 'exchange_rate'):
                    d.pop(k, None)
            elif stype == 'semi':
                for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost',
                          'total_price', 'unit_price'):
                    d.pop(k, None)
            elif stype == 'product':
                for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost',
                          'sale_price', 'unit_price'):
                    d.pop(k, None)

        return jsonify({'code': 200, 'msg': 'success', 'data': {'items': all_items}})

    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': str(e)}), 500


# ==============================================================================
# 出库审批相关接口
# ==============================================================================

from app.services.outbound_service import OutboundApprovalService


def get_current_user_id():
    """获取当前用户ID"""
    from app.models.system import SysUser
    identity = get_jwt_identity()
    if not identity:
        return None
    # JWT identity 是数据库主键整数，直接用 .get() 查询
    user = SysUser.query.get(identity)
    return user.id if user else None


def get_current_user_info():
    """获取当前用户信息和角色"""
    from app.models.system import SysUser
    identity = get_jwt_identity()
    if not identity:
        return None, None
    # JWT identity 是数据库主键整数，直接用 .get() 查询
    user = SysUser.query.get(identity)
    return user.id if user else None, user.role if user else None


# --------------------------------------------------------
# 4. 创建出库审批单
# POST /api/v1/outbound/request
# --------------------------------------------------------
@outbound_bp.route('/request', methods=['POST'])
@jwt_required()
@permission_required('outbound_selection')
def create_outbound_request():
    """
    创建出库审批单（申请阶段，用户只需提交宏观物料信息，无需关联具体库存记录）

    请求体示例:
    {
        "items": [
            {
                "name": "物料A",           // 物料名称 (必填)
                "spec_model": "规格1",     // 规格型号 (必填)
                "quantity": 10,            // 计划出库数量 (必填)
                "warehouse_location": "A区-01-01", // 库位 (可选)
                "remark": "备注信息"       // 物品备注 (可选)
            }
        ],
        "allowed_approvers": [
            {"type": "role", "value": "SUPERVISOR"},
            {"type": "role", "value": "SUPER_ADMIN"}
        ],
        "remark": "紧急出库申请"
    }
    """
    try:
        user_id, user_role = get_current_user_info()
        if not user_id:
            return jsonify({'code': 401, 'msg': '用户未登录'}), 401

        data = request.get_json()
        if not data:
            return jsonify({'code': 400, 'msg': '无有效数据'}), 400

        items = data.get('items', [])
        if not items:
            return jsonify({'code': 400, 'msg': '出库物品列表不能为空'}), 400

        # ★ 申请阶段仅校验宏观字段：名称、规格、数量
        required_fields = ['name', 'spec_model', 'quantity']
        for idx, item in enumerate(items):
            missing = [f for f in required_fields if f not in item or item.get(f) is None or str(item.get(f)).strip() == '']
            if missing:
                return jsonify({
                    'code': 400,
                    'msg': f'第{idx + 1}条物品缺少必填字段: {", ".join(missing)}。'
                           f'必须包含: name(名称), spec_model(规格), quantity(数量)'
                }), 400
            try:
                qty = float(item.get('quantity', 0))
                if qty <= 0:
                    return jsonify({'code': 400, 'msg': f'第{idx + 1}条物品的出库数量必须大于0'}), 400
            except (TypeError, ValueError):
                return jsonify({'code': 400, 'msg': f'第{idx + 1}条物品的 quantity 格式无效'}), 400

        # ★ 指定审批人：前端传 approver_id 则精准通知，否则用默认角色规则
        approver_id = data.get('approver_id')
        _default_approvers = [
            {"type": "role", "value": "SUPERVISOR"},
            {"type": "role", "value": "SUPER_ADMIN"}
        ]
        allowed_approvers = data.get('allowed_approvers') or _default_approvers

        # 创建审批单（直接存储前端传来的宏观信息快照，不查询库存）
        approval = OutboundApprovalService.create_request(
            applicant_id=user_id,
            items=items,
            allowed_approvers=allowed_approvers,
            remark=data.get('remark'),
            approver_id=approver_id
        )

        return jsonify({
            'code': 200,
            'msg': '审批单创建成功',
            'data': approval.to_dict()
        }), 200

    except ValueError as e:
        return jsonify({'code': 400, 'msg': str(e)}), 400
    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500


# --------------------------------------------------------
# 5. 审批出库申请
# PATCH /api/v1/outbound/request/<id>/approve
# --------------------------------------------------------
@outbound_bp.route('/request/<int:request_id>/approve', methods=['PATCH'])
@jwt_required()
@permission_required('outbound_approval')
def approve_outbound_request(request_id):
    """
    审批出库申请

    请求体示例:
    {
        "action": "approve",    // "approve" 通过, "reject" 驳回
        "reject_reason": "库存不足"  // 仅在驳回时需要
    }
    """
    try:
        user_id, user_role = get_current_user_info()
        if not user_id:
            return jsonify({'code': 401, 'msg': '用户未登录'}), 401

        data = request.get_json() or {}
        action = data.get('action', 'approve')
        reject_reason = data.get('reject_reason')

        if action not in ('approve', 'reject'):
            return jsonify({'code': 400, 'msg': '无效的审批操作，仅支持 approve 或 reject'}), 400

        if action == 'reject' and not reject_reason:
            return jsonify({'code': 400, 'msg': '驳回时必须提供原因'}), 400

        success, message, approval = OutboundApprovalService.approve(
            request_id=request_id,
            user_id=user_id,
            user_role=user_role,
            action=action,
            reject_reason=reject_reason
        )

        if not success:
            return jsonify({'code': 400, 'msg': message}), 400

        return jsonify({
            'code': 200,
            'msg': message,
            'data': approval.to_dict() if approval else None
        }), 200

    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500


# --------------------------------------------------------
# 5.5 手动完结/作废审批单
# POST /api/v1/outbound/request/<id>/close
# --------------------------------------------------------
@outbound_bp.route('/request/<int:request_id>/close', methods=['POST'])
@jwt_required()
@permission_required('outbound_approval')
def close_outbound_request(request_id):
    """
    手动完结/作废已通过的审批单（状态 1-已通过 → 4-已完结）

    适用场景：已通过但无法出库/作废的单据，库管手动清理，
    使其从"已审批通过"列表中消失。
    """
    try:
        user_id, user_role = get_current_user_info()
        if not user_id:
            return jsonify({'code': 401, 'msg': '用户未登录'}), 401

        success, message, approval = OutboundApprovalService.close_request(
            request_id=request_id,
            user_id=user_id,
            user_role=user_role
        )

        if not success:
            return jsonify({'code': 400, 'msg': message}), 400

        return jsonify({
            'code': 200,
            'msg': message,
            'data': approval.to_dict() if approval else None
        }), 200

    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': f'服务器内部错误: {str(e)}'}), 500


# --------------------------------------------------------
# 6. 获取审批单列表
# GET /api/v1/outbound/request
# --------------------------------------------------------
@outbound_bp.route('/request', methods=['GET'])
@jwt_required()
@permission_required('outbound_approval')
def get_outbound_request_list():
    """
    获取出库审批单列表

    Query参数:
    - page: 页码 (默认1)
    - limit: 每页数量 (默认10)
    - applicant_id: 按申请人筛选 (可选)
    - status: 按状态筛选 (0待审/1通过/2驳回/3完成, 可选)
    """
    try:
        page = int(request.args.get('page', 1))
        limit = int(request.args.get('limit', 10))

        applicant_id = request.args.get('applicant_id')
        if applicant_id:
            applicant_id = int(applicant_id)

        status = request.args.get('status')
        if status is not None:
            status = int(status)

        result = OutboundApprovalService.get_request_list(
            page=page,
            per_page=limit,
            applicant_id=applicant_id,
            status=status
        )

        return jsonify({
            'code': 200,
            'msg': '获取成功',
            'data': result
        }), 200

    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': str(e)}), 500


# --------------------------------------------------------
# 7. 获取单个审批单详情
# GET /api/v1/outbound/request/<id>
# --------------------------------------------------------
@outbound_bp.route('/request/<int:request_id>', methods=['GET'])
@jwt_required()
@permission_required('outbound_approval')
def get_outbound_request_detail(request_id):
    """获取出库审批单详情"""
    try:
        approval = OutboundApprovalService.get_request_by_id(request_id)

        if not approval:
            return jsonify({'code': 404, 'msg': '审批单不存在'}), 404

        return jsonify({
            'code': 200,
            'msg': '获取成功',
            'data': approval.to_dict()
        }), 200

    except Exception as e:
        traceback.print_exc()
        return jsonify({'code': 500, 'msg': str(e)}), 500