添加了更多功能

routes/contracts.js

@@ -1,5 +1,6 @@
 // routes/contracts.js —— 合同管理 CRUD
 const { pool } = require('../db')
+const { getDataScope } = require('../middleware/permissions')
 
 function pagination(query) {
   const page = Math.max(Number(query.page) || 1, 1)
@@ -31,6 +32,16 @@ async function list(req, res) {
     let where = 'WHERE 1=1'
     const params = []
 
+    // 数据范围过滤
+    const scope = getDataScope(req.user, 'contracts')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      where += ' AND ' + scope.where
+      params.push(...scope.values)
+    }
+
     if (status) {
       where += ' AND c.status = ?'
       params.push(status)
@@ -81,10 +92,19 @@ async function list(req, res) {
 // GET /api/contracts/:id —— 详情
 async function detail(req, res) {
   try {
-    const [rows] = await pool.query(
-      `${DETAIL_SELECT} WHERE c.id = ?`,
-      [req.params.id]
-    )
+    let sql = `${DETAIL_SELECT} WHERE c.id = ?`
+    const params = [req.params.id]
+
+    const scope = getDataScope(req.user, 'contracts')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      sql += ' AND ' + scope.where
+      params.push(...scope.values)
+    }
+
+    const [rows] = await pool.query(sql, params)
     if (rows.length === 0) {
       return res.status(404).json({ code: 404, message: '合同不存在' })
     }
@@ -125,8 +145,8 @@ async function create(req, res) {
 
     const [result] = await pool.query(
       `INSERT INTO contracts
-         (customer_id, contract_name, contract_no, contract_content, amount, effective_date, expiry_date, employee_id, status, remark)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+         (customer_id, contract_name, contract_no, contract_content, amount, effective_date, expiry_date, employee_id, status, remark, type, responsible_user_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [customer_id, contract_name,
         contract_no || null,
         contract_content || null,
@@ -135,7 +155,9 @@ async function create(req, res) {
         expiry_date || null,
         employee_id || null,
         status || '生效',
-        remark || null]
+        remark || null,
+        req.body.type || (req.user.roleName === 'procurement_manager' ? 'supply' : 'franchise'),
+        req.body.responsible_user_id || req.user.id]
     )
 
     const [rows] = await pool.query(`${DETAIL_SELECT} WHERE c.id = ?`, [result.insertId])
@@ -151,13 +173,24 @@ async function update(req, res) {
   const { id } = req.params
   const fields = [
     'customer_id', 'contract_name', 'contract_no', 'contract_content',
-    'amount', 'effective_date', 'expiry_date', 'employee_id', 'status', 'remark',
+    'amount', 'effective_date', 'expiry_date', 'employee_id', 'status', 'remark', 'type', 'responsible_user_id',
   ]
 
   try {
-    const [existing] = await pool.query('SELECT id FROM contracts WHERE id = ?', [id])
+    // 确认记录存在且在数据范围内
+    let checkSql = 'SELECT id FROM contracts WHERE id = ?'
+    const checkParams = [id]
+    const scope = getDataScope(req.user, 'contracts')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      checkSql += ' AND ' + scope.where
+      checkParams.push(...scope.values)
+    }
+    const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
-      return res.status(404).json({ code: 404, message: '合同不存在' })
+      return res.status(404).json({ code: 404, message: '合同不存在或无权操作' })
     }
 
     // 如果更新了 customer_id 或 employee_id，需要校验
@@ -201,9 +234,19 @@ async function update(req, res) {
 async function remove(req, res) {
   const { id } = req.params
   try {
-    const [existing] = await pool.query('SELECT id FROM contracts WHERE id = ?', [id])
+    let checkSql = 'SELECT id FROM contracts WHERE id = ?'
+    const checkParams = [id]
+    const scope = getDataScope(req.user, 'contracts')
+    if (scope.deny) {
+      return res.status(403).json({ code: 403, message: '无权访问此资源' })
+    }
+    if (scope.where) {
+      checkSql += ' AND ' + scope.where
+      checkParams.push(...scope.values)
+    }
+    const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
-      return res.status(404).json({ code: 404, message: '合同不存在' })
+      return res.status(404).json({ code: 404, message: '合同不存在或无权操作' })
     }
     await pool.query('DELETE FROM contracts WHERE id = ?', [id])
     res.json({ code: 0, message: 'ok' })