安全：隔离报表选项扫码与首页数据

shierfeng-fastapi-backend/module_business/dao/report_dao.py

@@ -9,6 +9,7 @@ from sqlalchemy.orm.attributes import InstrumentedAttribute
 from common.vo import PageModel
 from module_admin.entity.do.user_do import SysUser
 from module_business.domain.enums import DocumentStatus, PalletEventType
+from module_business.domain.test_batch_scope import TestBatchScope, batch_scope_condition
 from module_business.entity.do.master_do import (
     BizCustomer,
     BizCustomerSite,
@@ -74,6 +75,15 @@ class ReportDao:
         normalized_ids = sorted(set(scope_ids))
         return column.in_(normalized_ids) if normalized_ids else false()
 
+    @staticmethod
+    def _joined_scope_condition(
+        id_column: InstrumentedAttribute,
+        scope_column: InstrumentedAttribute,
+        scope: TestBatchScope,
+    ) -> ColumnElement[bool]:
+        """保留空的可选 join，同时拒绝已存在的跨批次关联记录。"""
+        return or_(id_column.is_(None), batch_scope_condition(scope_column, scope))
+
     @classmethod
     def _or_scope_conditions(
         cls,
@@ -140,6 +150,7 @@ class ReportDao:
         cls,
         db: AsyncSession,
         query_object: PalletInventoryReportQueryModel,
+        scope: TestBatchScope,
         warehouse_ids: list[int] | None = None,
         site_ids: list[int] | None = None,
     ) -> PageModel[PalletInventoryReportModel]:
@@ -148,9 +159,19 @@ class ReportDao:
         current_line = aliased(BizProductionLine, name='current_line')
         active_filling = aliased(BizFillingRecord, name='active_filling')
 
-        conditions = cls._or_scope_conditions(
-            (BizPalletInventory.warehouse_id, warehouse_ids),
-            (BizPalletInventory.site_id, site_ids),
+        conditions = [
+            batch_scope_condition(BizPalletInventory.test_batch_id, scope),
+            batch_scope_condition(BizPallet.test_batch_id, scope),
+            cls._joined_scope_condition(active_filling.filling_id, active_filling.test_batch_id, scope),
+            cls._joined_scope_condition(current_warehouse.warehouse_id, current_warehouse.test_batch_id, scope),
+            cls._joined_scope_condition(current_site.site_id, current_site.test_batch_id, scope),
+            cls._joined_scope_condition(current_line.line_id, current_line.test_batch_id, scope),
+        ]
+        conditions.extend(
+            cls._or_scope_conditions(
+                (BizPalletInventory.warehouse_id, warehouse_ids),
+                (BizPalletInventory.site_id, site_ids),
+            )
         )
         if query_object.pallet_code:
             conditions.append(BizPallet.pallet_code.like(f'%{query_object.pallet_code}%'))
@@ -209,10 +230,15 @@ class ReportDao:
         cls,
         db: AsyncSession,
         query_object: FillingReportQueryModel,
+        scope: TestBatchScope,
         warehouse_ids: list[int] | None = None,
     ) -> PageModel[FillingReportModel]:
         operator_user = aliased(SysUser, name='operator_user')
-        conditions = []
+        conditions = [
+            batch_scope_condition(BizFillingRecord.test_batch_id, scope),
+            batch_scope_condition(BizPallet.test_batch_id, scope),
+            cls._joined_scope_condition(BizWarehouse.warehouse_id, BizWarehouse.test_batch_id, scope),
+        ]
         warehouse_scope = cls._scope_condition(BizFillingRecord.warehouse_id, warehouse_ids)
         if warehouse_scope is not None:
             conditions.append(warehouse_scope)
@@ -264,13 +290,22 @@ class ReportDao:
         cls,
         db: AsyncSession,
         query_object: ShipmentReportQueryModel,
+        scope: TestBatchScope,
         warehouse_ids: list[int] | None = None,
         site_ids: list[int] | None = None,
     ) -> PageModel[ShipmentReportModel]:
         source_warehouse = aliased(BizWarehouse, name='source_warehouse')
         target_site = aliased(BizCustomerSite, name='target_site')
         target_customer = aliased(BizCustomer, name='target_customer')
-        conditions = [BizShipmentOrder.status == DocumentStatus.CONFIRMED.value]
+        conditions = [
+            batch_scope_condition(BizShipmentOrder.test_batch_id, scope),
+            batch_scope_condition(BizShipmentItem.test_batch_id, scope),
+            batch_scope_condition(BizPallet.test_batch_id, scope),
+            cls._joined_scope_condition(source_warehouse.warehouse_id, source_warehouse.test_batch_id, scope),
+            cls._joined_scope_condition(target_site.site_id, target_site.test_batch_id, scope),
+            cls._joined_scope_condition(target_customer.customer_id, target_customer.test_batch_id, scope),
+            BizShipmentOrder.status == DocumentStatus.CONFIRMED.value,
+        ]
         warehouse_scope = cls._scope_condition(BizShipmentOrder.source_warehouse_id, warehouse_ids)
         site_scope = cls._scope_condition(BizShipmentOrder.target_site_id, site_ids)
         if warehouse_scope is not None:
@@ -334,10 +369,18 @@ class ReportDao:
         cls,
         db: AsyncSession,
         query_object: ConsumptionReportQueryModel,
+        scope: TestBatchScope,
         site_ids: list[int] | None = None,
     ) -> PageModel[ConsumptionReportModel]:
         operator_user = aliased(SysUser, name='operator_user')
-        conditions = []
+        conditions = [
+            batch_scope_condition(BizUsageRecord.test_batch_id, scope),
+            batch_scope_condition(BizPallet.test_batch_id, scope),
+            batch_scope_condition(BizFillingRecord.test_batch_id, scope),
+            batch_scope_condition(BizCustomerSite.test_batch_id, scope),
+            batch_scope_condition(BizProductionLine.test_batch_id, scope),
+            cls._joined_scope_condition(BizCustomer.customer_id, BizCustomer.test_batch_id, scope),
+        ]
         site_scope = cls._scope_condition(BizUsageRecord.site_id, site_ids)
         if site_scope is not None:
             conditions.append(site_scope)
@@ -400,14 +443,24 @@ class ReportDao:
         cls,
         db: AsyncSession,
         query_object: ReturnReportQueryModel,
+        scope: TestBatchScope,
         site_ids: list[int] | None = None,
         warehouse_ids: list[int] | None = None,
     ) -> PageModel[ReturnReportModel]:
         source_site = aliased(BizCustomerSite, name='source_site')
         target_warehouse = aliased(BizWarehouse, name='target_warehouse')
-        conditions = cls._or_scope_conditions(
-            (BizReturnOrder.source_site_id, site_ids),
-            (BizReturnOrder.target_warehouse_id, warehouse_ids),
+        conditions = [
+            batch_scope_condition(BizReturnOrder.test_batch_id, scope),
+            batch_scope_condition(BizReturnItem.test_batch_id, scope),
+            batch_scope_condition(BizPallet.test_batch_id, scope),
+            cls._joined_scope_condition(source_site.site_id, source_site.test_batch_id, scope),
+            cls._joined_scope_condition(target_warehouse.warehouse_id, target_warehouse.test_batch_id, scope),
+        ]
+        conditions.extend(
+            cls._or_scope_conditions(
+                (BizReturnOrder.source_site_id, site_ids),
+                (BizReturnOrder.target_warehouse_id, warehouse_ids),
+            )
         )
         if query_object.return_no:
             conditions.append(BizReturnOrder.return_no.like(f'%{query_object.return_no}%'))
@@ -458,6 +511,7 @@ class ReportDao:
         cls,
         db: AsyncSession,
         query_object: PalletTraceReportQueryModel,
+        scope: TestBatchScope,
         warehouse_ids: list[int] | None = None,
         site_ids: list[int] | None = None,
     ) -> PageModel[PalletTraceReportModel]:
@@ -468,7 +522,17 @@ class ReportDao:
         before_line = aliased(BizProductionLine, name='before_line')
         after_line = aliased(BizProductionLine, name='after_line')
         operator_user = aliased(SysUser, name='operator_user')
-        conditions = cls._pallet_trace_scope_conditions(warehouse_ids, site_ids)
+        conditions = [
+            batch_scope_condition(BizPalletEvent.test_batch_id, scope),
+            batch_scope_condition(BizPallet.test_batch_id, scope),
+            cls._joined_scope_condition(before_warehouse.warehouse_id, before_warehouse.test_batch_id, scope),
+            cls._joined_scope_condition(after_warehouse.warehouse_id, after_warehouse.test_batch_id, scope),
+            cls._joined_scope_condition(before_site.site_id, before_site.test_batch_id, scope),
+            cls._joined_scope_condition(after_site.site_id, after_site.test_batch_id, scope),
+            cls._joined_scope_condition(before_line.line_id, before_line.test_batch_id, scope),
+            cls._joined_scope_condition(after_line.line_id, after_line.test_batch_id, scope),
+        ]
+        conditions.extend(cls._pallet_trace_scope_conditions(warehouse_ids, site_ids))
         if query_object.pallet_code:
             conditions.append(BizPallet.pallet_code.like(f'%{query_object.pallet_code}%'))
         if query_object.event_type: