duxingchen/KCGL
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: semi/product submit 响应用 apply_strict_rbac 替代硬编码 resp.pop，成本字段纳入 RBAC 统一管控

Browse Source
This commit is contained in:
yueli
2026-07-17 14:36:26 +08:00
parent cac8a360ec
commit 1cc7d51e03
2 changed files with 4 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
inventory-backend/app/api/v1/inbound/product.py
View File

@ -129,10 +129,8 @@ def submit():
perm_code = field_to_perm.get(field)
if perm_code and perm_code not in user_permissions: data.pop(field, None)
new_stock = ProductInboundService.handle_inbound(data)
# ★ Fail-Closed: 入库成功响应剥离成本/售价字段
resp = new_stock.to_dict()
for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost', 'sale_price'):
resp.pop(k, None)
from app.utils.field_permissions import apply_strict_rbac
resp = apply_strict_rbac(new_stock.to_dict(), 'StockProduct', user_permissions)
return jsonify({"code": 200, "msg": "入库成功", "data": resp})
except Exception as e:
traceback.print_exc()

6
inventory-backend/app/api/v1/inbound/semi.py
View File

@ -123,10 +123,8 @@ def submit():
if field in data and perm_code not in user_permissions:
data.pop(field, None)
new_stock = SemiInboundService.handle_inbound(data)
# ★ Fail-Closed: 入库成功响应剥离成本字段
resp = new_stock.to_dict()
for k in ('raw_material_cost', 'manual_cost', 'unit_total_cost', 'total_price'):
resp.pop(k, None)
from app.utils.field_permissions import apply_strict_rbac
resp = apply_strict_rbac(new_stock.to_dict(), 'StockSemi', user_permissions)
return jsonify({"code": 200, "msg": "入库成功", "data": resp})
except Exception as e:
traceback.print_exc()