添加了更多功能

routes/afterSales.js

@@ -1,5 +1,6 @@
 // routes/afterSales.js —— 售后管理 CRUD
 const { pool } = require('../db')
+const { getDataScope } = require('../middleware/permissions')
 
 function pagination(query) {
   const page = Math.max(Number(query.page) || 1, 1)
@@ -27,6 +28,18 @@ async function list(req, res) {
     let where = 'WHERE 1=1'
     const params = []
 
+    // 数据范围过滤
+    const scope = getDataScope(req.user, 'after_sales')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      // list 查询有 JOIN，需要表别名前缀避免列名歧义
+      const scopeCol = scope.tableAlias ? scope.where.replace('responsible_user_id', `${scope.tableAlias}.responsible_user_id`) : scope.where
+      where += ' AND ' + scopeCol
+      params.push(...scope.values)
+    }
+
     if (handle_status) {
       where += ' AND a.handle_status = ?'
       params.push(handle_status)
@@ -69,10 +82,20 @@ async function list(req, res) {
 // GET /api/after-sales/:id —— 详情
 async function detail(req, res) {
   try {
-    const [rows] = await pool.query(
-      `${LIST_SELECT} WHERE a.id = ?`,
-      [req.params.id]
-    )
+    let sql = `${LIST_SELECT} WHERE a.id = ?`
+    const params = [req.params.id]
+
+    const scope = getDataScope(req.user, 'after_sales')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      const scopeCol = scope.tableAlias ? scope.where.replace('responsible_user_id', `${scope.tableAlias}.responsible_user_id`) : scope.where
+      sql += ' AND ' + scopeCol
+      params.push(...scope.values)
+    }
+
+    const [rows] = await pool.query(sql, params)
     if (rows.length === 0) {
       return res.status(404).json({ code: 404, message: '售后记录不存在' })
     }
@@ -87,7 +110,7 @@ async function detail(req, res) {
 async function create(req, res) {
   const {
     customer_id, feedback, employee_id, handle_method,
-    handle_status, service_date, remark,
+    handle_status, service_date, remark, responsible_user_id,
   } = req.body || {}
 
   if (!customer_id) {
@@ -111,16 +134,20 @@ async function create(req, res) {
       }
     }
 
+    // 如果没指定负责人，默认设为当前用户
+    const ownerId = responsible_user_id || req.user.id
+
     const [result] = await pool.query(
       `INSERT INTO after_sales
-         (customer_id, feedback, employee_id, handle_method, handle_status, service_date, remark)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+         (customer_id, feedback, employee_id, handle_method, handle_status, service_date, remark, responsible_user_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
       [customer_id, feedback,
         employee_id || null,
         handle_method || null,
         handle_status || '待处理',
         service_date || null,
-        remark || null]
+        remark || null,
+        ownerId]
     )
 
     const [rows] = await pool.query(`${LIST_SELECT} WHERE a.id = ?`, [result.insertId])
@@ -136,13 +163,24 @@ async function update(req, res) {
   const { id } = req.params
   const fields = [
     'customer_id', 'feedback', 'employee_id', 'handle_method',
-    'handle_status', 'service_date', 'remark',
+    'handle_status', 'service_date', 'remark', 'responsible_user_id',
   ]
 
   try {
-    const [existing] = await pool.query('SELECT id FROM after_sales WHERE id = ?', [id])
+    // 确认记录存在且在数据范围内
+    let checkSql = 'SELECT id FROM after_sales WHERE id = ?'
+    const checkParams = [id]
+    const scope = getDataScope(req.user, 'after_sales')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      checkSql += ' AND ' + scope.where
+      checkParams.push(...scope.values)
+    }
+    const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
-      return res.status(404).json({ code: 404, message: '售后记录不存在' })
+      return res.status(404).json({ code: 404, message: '售后记录不存在或无权操作' })
     }
 
     if (req.body.customer_id) {
@@ -185,9 +223,19 @@ async function update(req, res) {
 async function remove(req, res) {
   const { id } = req.params
   try {
-    const [existing] = await pool.query('SELECT id FROM after_sales WHERE id = ?', [id])
+    let checkSql = 'SELECT id FROM after_sales WHERE id = ?'
+    const checkParams = [id]
+    const scope = getDataScope(req.user, 'after_sales')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      checkSql += ' AND ' + scope.where
+      checkParams.push(...scope.values)
+    }
+    const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
-      return res.status(404).json({ code: 404, message: '售后记录不存在' })
+      return res.status(404).json({ code: 404, message: '售后记录不存在或无权操作' })
     }
     await pool.query('DELETE FROM after_sales WHERE id = ?', [id])
     res.json({ code: 0, message: 'ok' })