修复：收紧托盘业务权限与数据契约

shierfeng-fastapi-backend/tests/module_business/test_report_service.py

@@ -607,6 +607,33 @@ class TestReportDaoQueries(unittest.IsolatedAsyncioTestCase):
                 sql,
             )
 
+    async def test_trace_shipment_events_require_both_route_scopes(self) -> None:
+        statement = await self._capture_statement(
+            ReportDao.get_pallet_trace_list,
+            PalletTraceReportQueryModel(),
+            warehouse_ids=[8, 7],
+            site_ids=[10, 9],
+        )
+
+        for sql in self._assert_compiles_for_supported_databases(statement):
+            self.assertIn(
+                "biz_pallet_event.event_type = 'shipment_confirmed' "
+                'and biz_pallet_event.before_warehouse_id in (7, 8) '
+                'and biz_pallet_event.after_site_id in (9, 10)',
+                sql,
+            )
+            self.assertIn(
+                "biz_pallet_event.event_type != 'shipment_confirmed' and (",
+                sql,
+            )
+            self.assertIn(
+                'biz_pallet_event.before_warehouse_id in (7, 8) '
+                'or biz_pallet_event.after_warehouse_id in (7, 8) '
+                'or biz_pallet_event.before_site_id in (9, 10) '
+                'or biz_pallet_event.after_site_id in (9, 10)',
+                sql,
+            )
+
 
 @unittest.skipUnless(ReportService is not None, 'ReportService 尚未实现')
 class TestReportServices(unittest.IsolatedAsyncioTestCase):