重构后端，使其更加权责分明

routes/afterSales.js

@@ -1,6 +1,5 @@
-// routes/afterSales.js —— 售后管理 CRUD
+// routes/afterSales.js —— 售后管理 CRUD（纯数据库操作，权限由中间件层控制）
 const { pool } = require('../db')
-const { getDataScope } = require('../middleware/permissions')
 
 // 格式化日期为 YYYY-MM-DD
 function formatDate(dateStr) {
@@ -46,16 +45,10 @@ async function list(req, res) {
     let where = 'WHERE 1=1'
     const params = []
 
-    // 数据范围过滤
-    const scope = getDataScope(req.user, 'after_sales')
-    if (scope.deny) {
-      return res.status(403).json({ code: 403, message: '无权访问此资源' })
-    }
-    if (scope.where) {
-      // list 查询有 JOIN，需要表别名前缀避免列名歧义
-      const scopeCol = scope.tableAlias ? scope.where.replace(/\bresponsible_user_id\b/g, `${scope.tableAlias}.responsible_user_id`) : scope.where
-      where += ' AND ' + scopeCol
-      params.push(...scope.values)
+    // 数据范围过滤（由中间件注入 req.scope，已含表别名前缀）
+    if (req.scope && req.scope.sql) {
+      where += ' ' + req.scope.sql
+      params.push(...req.scope.params)
     }
 
     if (id) {
@@ -115,14 +108,10 @@ async function detail(req, res) {
     let sql = `${LIST_SELECT} WHERE a.id = ?`
     const params = [req.params.id]
 
-    const scope = getDataScope(req.user, 'after_sales')
-    if (scope.deny) {
-      return res.status(403).json({ code: 403, message: '无权访问此资源' })
-    }
-    if (scope.where) {
-      const scopeCol = scope.tableAlias ? scope.where.replace('responsible_user_id', `${scope.tableAlias}.responsible_user_id`) : scope.where
-      sql += ' AND ' + scopeCol
-      params.push(...scope.values)
+    // 数据范围过滤（由中间件注入 req.scope，已含表别名前缀）
+    if (req.scope && req.scope.sql) {
+      sql += ' ' + req.scope.sql
+      params.push(...req.scope.params)
     }
 
     const [rows] = await pool.query(sql, params)
@@ -140,7 +129,7 @@ async function detail(req, res) {
 async function create(req, res) {
   const {
     customer_id, feedback, employee_id, handle_method,
-    handle_status, service_date, remark, responsible_user_id,
+    handle_status, service_date, remark,
   } = req.body || {}
 
   if (!customer_id) {
@@ -156,17 +145,20 @@ async function create(req, res) {
     if (cust.length === 0) {
       return res.status(400).json({ code: 400, message: '关联客户不存在' })
     }
-    // 校验业务员
+    // 校验业务员，并通过 employee_id 自动推导负责人
+    let ownerId = req.user.id
     if (employee_id) {
       const [emp] = await pool.query('SELECT id FROM employees WHERE id = ?', [employee_id])
       if (emp.length === 0) {
         return res.status(400).json({ code: 400, message: '关联业务员不存在' })
       }
+      // 业务员即负责人：查找该员工对应的系统用户
+      const [userRows] = await pool.query('SELECT id FROM users WHERE employee_id = ? LIMIT 1', [employee_id])
+      if (userRows.length > 0) {
+        ownerId = userRows[0].id
+      }
     }
 
-    // 如果没指定负责人，默认设为当前用户
-    const ownerId = responsible_user_id || req.user.id
-
     const [result] = await pool.query(
       `INSERT INTO after_sales
          (customer_id, feedback, employee_id, handle_method, handle_status, service_date, remark, responsible_user_id)
@@ -198,15 +190,11 @@ async function update(req, res) {
 
   try {
     // 确认记录存在且在数据范围内
-    let checkSql = 'SELECT id FROM after_sales WHERE id = ?'
-    const checkParams = [id]
-    const scope = getDataScope(req.user, 'after_sales')
-    if (scope.deny) {
-      return res.status(403).json({ code: 403, message: '无权访问此资源' })
-    }
-    if (scope.where) {
-      checkSql += ' AND ' + scope.where
-      checkParams.push(...scope.values)
+    let checkSql = 'SELECT id, employee_id FROM after_sales WHERE id = ?'
+    let checkParams = [id]
+    if (req.scope && req.scope.sql) {
+      checkSql += ' ' + req.scope.sql
+      checkParams.push(...req.scope.params)
     }
     const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {
@@ -226,6 +214,22 @@ async function update(req, res) {
       }
     }
 
+    // 业务员即负责人：当 employee_id 变更时自动推导 responsible_user_id
+    if (req.body.employee_id !== undefined) {
+      if (req.body.employee_id) {
+        const [userRows] = await pool.query('SELECT id FROM users WHERE employee_id = ? LIMIT 1', [req.body.employee_id])
+        if (userRows.length > 0) {
+          req.body.responsible_user_id = userRows[0].id
+        } else {
+          // 该员工无对应系统用户时，设为当前登录用户
+          req.body.responsible_user_id = req.user.id
+        }
+      } else {
+        // 业务员被清空时，清空负责人
+        req.body.responsible_user_id = null
+      }
+    }
+
     const sets = []
     const params = []
     for (const f of fields) {
@@ -259,14 +263,10 @@ async function remove(req, res) {
   const { id } = req.params
   try {
     let checkSql = 'SELECT id FROM after_sales WHERE id = ?'
-    const checkParams = [id]
-    const scope = getDataScope(req.user, 'after_sales')
-    if (scope.deny) {
-      return res.status(403).json({ code: 403, message: '无权访问此资源' })
-    }
-    if (scope.where) {
-      checkSql += ' AND ' + scope.where
-      checkParams.push(...scope.values)
+    let checkParams = [id]
+    if (req.scope && req.scope.sql) {
+      checkSql += ' ' + req.scope.sql
+      checkParams.push(...req.scope.params)
     }
     const [existing] = await pool.query(checkSql, checkParams)
     if (existing.length === 0) {