修复：收紧托盘业务权限与数据契约

shierfeng-fastapi-backend/module_business/dao/report_dao.py

@@ -1,14 +1,14 @@
 from datetime import datetime, time, timedelta
 from typing import Any
 
-from sqlalchemy import ColumnElement, Select, false, or_, select
+from sqlalchemy import ColumnElement, Select, and_, false, or_, select
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import aliased
 from sqlalchemy.orm.attributes import InstrumentedAttribute
 
 from common.vo import PageModel
 from module_admin.entity.do.user_do import SysUser
-from module_business.domain.enums import DocumentStatus
+from module_business.domain.enums import DocumentStatus, PalletEventType
 from module_business.entity.do.master_do import (
     BizCustomer,
     BizCustomerSite,
@@ -86,6 +86,41 @@ class ReportDao:
         ]
         return [or_(*conditions)] if conditions else []
 
+    @classmethod
+    def _pallet_trace_scope_conditions(
+        cls,
+        warehouse_ids: list[int] | None,
+        site_ids: list[int] | None,
+    ) -> list[ColumnElement[bool]]:
+        participant_scopes = [
+            condition
+            for column, scope_ids in (
+                (BizPalletEvent.before_warehouse_id, warehouse_ids),
+                (BizPalletEvent.after_warehouse_id, warehouse_ids),
+                (BizPalletEvent.before_site_id, site_ids),
+                (BizPalletEvent.after_site_id, site_ids),
+            )
+            if (condition := cls._scope_condition(column, scope_ids)) is not None
+        ]
+        if not participant_scopes:
+            return []
+
+        shipment_scopes = [
+            condition
+            for column, scope_ids in (
+                (BizPalletEvent.before_warehouse_id, warehouse_ids),
+                (BizPalletEvent.after_site_id, site_ids),
+            )
+            if (condition := cls._scope_condition(column, scope_ids)) is not None
+        ]
+        shipment_type = PalletEventType.SHIPMENT_CONFIRMED.value
+        return [
+            or_(
+                and_(BizPalletEvent.event_type == shipment_type, *shipment_scopes),
+                and_(BizPalletEvent.event_type != shipment_type, or_(*participant_scopes)),
+            )
+        ]
+
     @staticmethod
     async def _paginate(
         db: AsyncSession,
@@ -433,12 +468,7 @@ class ReportDao:
         before_line = aliased(BizProductionLine, name='before_line')
         after_line = aliased(BizProductionLine, name='after_line')
         operator_user = aliased(SysUser, name='operator_user')
-        conditions = cls._or_scope_conditions(
-            (BizPalletEvent.before_warehouse_id, warehouse_ids),
-            (BizPalletEvent.after_warehouse_id, warehouse_ids),
-            (BizPalletEvent.before_site_id, site_ids),
-            (BizPalletEvent.after_site_id, site_ids),
-        )
+        conditions = cls._pallet_trace_scope_conditions(warehouse_ids, site_ids)
         if query_object.pallet_code:
             conditions.append(BizPallet.pallet_code.like(f'%{query_object.pallet_code}%'))
         if query_object.event_type: