fix: 补全审计/出库审批/采购管理/借库审批的权限保护+公司隔离

- audit.py: 补@permission_required(system_audit)+import, 审计日志通过split_part关联用户表过滤公司
- outbound.py: 出库审批5个端点全补@permission_required(outbound_list)
- purchase.py: 采购管理7个端点全补@permission_required(inbound_buy)
- borrow_service: 借库审批列表通过applicant_id关联用户表过滤公司
- outbound_service: 出库审批列表通过applicant_id关联用户表过滤公司
- purchase_service: 采购列表通过base_id+requester_id双路过滤公司
- base_service/search_material: 去除debug日志
- decorators: 去除debug日志

inventory-backend/app/services/borrow_service.py

@@ -356,6 +356,8 @@ class BorrowApprovalService:
         """
         获取审批单列表
         """
+        from app.models.system import SysUser
+        from app.utils.decorators import get_current_company_filter
         from sqlalchemy import desc
 
         query = BorrowApproval.query
@@ -366,6 +368,12 @@ class BorrowApprovalService:
         if status is not None:
             query = query.filter(BorrowApproval.status == status)
 
+        # 【行级数据隔离】通过申请人关联用户表过滤公司
+        company_limit = get_current_company_filter()
+        if company_limit is not None:
+            query = query.join(SysUser, BorrowApproval.applicant_id == SysUser.id) \
+                         .filter(SysUser.department == company_limit)
+
         query = query.order_by(desc(BorrowApproval.created_at))
 
         pagination = query.paginate(page=page, per_page=per_page, error_out=False)

inventory-backend/app/services/outbound_service.py

@@ -995,6 +995,8 @@ class OutboundApprovalService:
             分页结果
         """
         from app.models.outbound import OutboundApproval
+        from app.models.system import SysUser
+        from app.utils.decorators import get_current_company_filter
         from sqlalchemy import desc
 
         query = OutboundApproval.query
@@ -1005,6 +1007,12 @@ class OutboundApprovalService:
         if status is not None:
             query = query.filter(OutboundApproval.status == status)
 
+        # 【行级数据隔离】通过申请人关联用户表过滤公司
+        company_limit = get_current_company_filter()
+        if company_limit is not None:
+            query = query.join(SysUser, OutboundApproval.applicant_id == SysUser.id) \
+                         .filter(SysUser.department == company_limit)
+
         query = query.order_by(desc(OutboundApproval.created_at))
 
         pagination = query.paginate(page=page, per_page=per_page, error_out=False)

inventory-backend/app/services/purchase_service.py

@@ -128,6 +128,10 @@ class PurchaseService:
     @staticmethod
     def get_purchase_list(page=1, per_page=20, requester_id=None, status=None):
         """获取采购申请列表，普通用户只看自己的，主管/超管看全部"""
+        from app.utils.decorators import get_current_company_filter
+        from app.models.system import SysUser
+        from sqlalchemy import or_
+
         query = PurchaseRequest.query
 
         if requester_id is not None:
@@ -136,6 +140,16 @@ class PurchaseService:
         if status is not None:
             query = query.filter(PurchaseRequest.status == status)
 
+        # 【行级数据隔离】通过 base_id→MaterialBase 或 requester_id→SysUser 双重过滤
+        company_limit = get_current_company_filter()
+        if company_limit is not None:
+            query = query.outerjoin(MaterialBase, PurchaseRequest.base_id == MaterialBase.id) \
+                         .outerjoin(SysUser, PurchaseRequest.requester_id == SysUser.id) \
+                         .filter(or_(
+                             MaterialBase.company_name == company_limit,
+                             SysUser.department == company_limit
+                         ))
+
         query = query.order_by(PurchaseRequest.created_at.desc())
         pagination = query.paginate(page=page, per_page=per_page, error_out=False)