安全：隔离主数据并封闭单条删除

shierfeng-fastapi-backend/tests/module_business/test_vo_contract.py

@@ -97,7 +97,6 @@ MASTER_MODEL_FIELDS = {
         'update_by',
         'update_time',
         'remark',
-        'can_remove',
     },
     StrainPageQueryModel: {'page_num', 'page_size', 'strain_code', 'strain_name', 'status'},
     DeleteStrainModel: {'strain_ids'},
@@ -111,7 +110,6 @@ MASTER_MODEL_FIELDS = {
         'update_by',
         'update_time',
         'remark',
-        'can_remove',
     },
     CustomerPageQueryModel: {'page_num', 'page_size', 'customer_code', 'customer_name', 'status'},
     DeleteCustomerModel: {'customer_ids'},
@@ -127,7 +125,6 @@ MASTER_MODEL_FIELDS = {
         'update_by',
         'update_time',
         'remark',
-        'can_remove',
     },
     SitePageQueryModel: {'page_num', 'page_size', 'customer_id', 'site_code', 'site_name', 'status'},
     DeleteSiteModel: {'site_ids'},
@@ -142,7 +139,6 @@ MASTER_MODEL_FIELDS = {
         'update_by',
         'update_time',
         'remark',
-        'can_remove',
     },
     LinePageQueryModel: {'page_num', 'page_size', 'site_id', 'line_code', 'line_name', 'status'},
     DeleteLineModel: {'line_ids'},
@@ -157,7 +153,6 @@ MASTER_MODEL_FIELDS = {
         'update_by',
         'update_time',
         'remark',
-        'can_remove',
     },
     WarehousePageQueryModel: {'page_num', 'page_size', 'warehouse_code', 'warehouse_name', 'status'},
     DeleteWarehouseModel: {'warehouse_ids'},
@@ -172,7 +167,6 @@ MASTER_MODEL_FIELDS = {
         'create_time',
         'update_by',
         'update_time',
-        'can_remove',
     },
     PalletCreateModel: {'pallet_code', 'capacity_packages', 'remark'},
     PalletEditModel: {'pallet_id', 'capacity_packages', 'asset_status', 'remark'},
@@ -858,6 +852,26 @@ class BusinessVoContractTest(unittest.TestCase):
             with self.subTest(model=model_class.__name__):
                 self.assertEqual('forbid', model_class.model_config.get('extra'))
 
+    def test_master_write_models_reject_untrusted_test_batch_id(self) -> None:
+        payloads = (
+            (StrainModel, {'strainCode': 'S-1', 'strainName': '菌种'}),
+            (CustomerModel, {'customerCode': 'C-1', 'customerName': '客户'}),
+            (
+                SiteModel,
+                {'customerId': 1, 'siteCode': 'SITE-1', 'siteName': '现场'},
+            ),
+            (LineModel, {'siteId': 1, 'lineCode': 'L-1', 'lineName': '产线'}),
+            (WarehouseModel, {'warehouseCode': 'W-1', 'warehouseName': '仓库'}),
+            (PalletCreateModel, {'palletCode': 'P-1', 'capacityPackages': 20}),
+            (
+                PalletEditModel,
+                {'palletId': 1, 'capacityPackages': 20, 'assetStatus': '0'},
+            ),
+        )
+        for model_class, payload in payloads:
+            with self.subTest(model=model_class.__name__), self.assertRaises(ValidationError):
+                model_class.model_validate(payload | {'testBatchId': 9})
+
     def test_all_test_batch_models_forbid_extra_fields(self) -> None:
         for model_class in TEST_BATCH_MODEL_FIELDS:
             with self.subTest(model=model_class.__name__):