安全：隔离报表选项扫码与首页数据

shierfeng-fastapi-backend/module_business/dao/access_dao.py

@@ -1,7 +1,8 @@
 from sqlalchemy import delete, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from module_business.entity.do.master_do import BizUserSite, BizUserWarehouse
+from module_business.domain.test_batch_scope import TestBatchScope, batch_scope_condition
+from module_business.entity.do.master_do import BizCustomerSite, BizUserSite, BizUserWarehouse, BizWarehouse
 
 
 class AccessDao:
@@ -48,16 +49,44 @@ class AccessDao:
         return mapped_user_id is not None
 
     @classmethod
-    async def list_user_warehouse_ids(cls, db: AsyncSession, user_id: int) -> list[int]:
-        """获取用户关联的仓库 ID 列表。"""
-        result = await db.execute(select(BizUserWarehouse.warehouse_id).where(BizUserWarehouse.user_id == user_id))
+    async def list_user_warehouse_ids(
+        cls,
+        db: AsyncSession,
+        user_id: int,
+        scope: TestBatchScope | None = None,
+    ) -> list[int]:
+        """获取用户关联且处于当前批次作用域的仓库 ID 列表。"""
+        conditions = [BizUserWarehouse.user_id == user_id]
+        if scope is not None:
+            conditions.append(batch_scope_condition(BizWarehouse.test_batch_id, scope))
+        statement = (
+            select(BizUserWarehouse.warehouse_id)
+            .select_from(BizUserWarehouse)
+            .join(BizWarehouse, BizWarehouse.warehouse_id == BizUserWarehouse.warehouse_id)
+            .where(*conditions)
+        )
+        result = await db.execute(statement)
 
         return list(result.scalars().all())
 
     @classmethod
-    async def list_user_site_ids(cls, db: AsyncSession, user_id: int) -> list[int]:
-        """获取用户关联的客户现场 ID 列表。"""
-        result = await db.execute(select(BizUserSite.site_id).where(BizUserSite.user_id == user_id))
+    async def list_user_site_ids(
+        cls,
+        db: AsyncSession,
+        user_id: int,
+        scope: TestBatchScope | None = None,
+    ) -> list[int]:
+        """获取用户关联且处于当前批次作用域的客户现场 ID 列表。"""
+        conditions = [BizUserSite.user_id == user_id]
+        if scope is not None:
+            conditions.append(batch_scope_condition(BizCustomerSite.test_batch_id, scope))
+        statement = (
+            select(BizUserSite.site_id)
+            .select_from(BizUserSite)
+            .join(BizCustomerSite, BizCustomerSite.site_id == BizUserSite.site_id)
+            .where(*conditions)
+        )
+        result = await db.execute(statement)
 
         return list(result.scalars().all())