fix(cma): entity isolation batch5 (budget writes, kpi objectives scope, quality logs join, growth-quality db source, expenses scope)

backend/app/api/budget.py

@@ -150,9 +150,12 @@ def update_budget_plan(
     plan_id: int,
     data: dict,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """更新预算计划"""
-    plan = db.query(BudgetPlan).filter(BudgetPlan.id == plan_id).first()
+    """更新预算计划（账套隔离 2026-09-21：跨账套 id → 404）"""
+    plan = db.query(BudgetPlan).filter(
+        BudgetPlan.id == plan_id, BudgetPlan.entity_id == entity_id,
+    ).first()
     if not plan:
         raise HTTPException(404, "预算计划不存在")
 
@@ -173,9 +176,12 @@ def update_budget_plan(
 def delete_budget_plan(
     plan_id: int,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """删除预算计划"""
-    plan = db.query(BudgetPlan).filter(BudgetPlan.id == plan_id).first()
+    """删除预算计划（账套隔离 2026-09-21：跨账套 id → 404）"""
+    plan = db.query(BudgetPlan).filter(
+        BudgetPlan.id == plan_id, BudgetPlan.entity_id == entity_id,
+    ).first()
     if not plan:
         raise HTTPException(404, "预算计划不存在")
     db.delete(plan)
@@ -311,7 +317,9 @@ def auto_decompose_budget(
     if annual_budget is None:
         raise HTTPException(400, "缺少必要参数: annual_budget（单KPI分解需传年度预算值）")
 
-    kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
+    kpi = db.query(KPIDefinition).filter(
+        KPIDefinition.id == kpi_id, KPIDefinition.entity_id == entity_id,
+    ).first()
     if not kpi:
         raise HTTPException(404, "KPI不存在")
 
@@ -338,6 +346,7 @@ def auto_decompose_budget(
 
             existing = db.query(BudgetPlan).filter(
                 BudgetPlan.kpi_id == kpi_id,
+                BudgetPlan.entity_id == entity_id,
                 BudgetPlan.period == period,
                 BudgetPlan.version == version,
                 BudgetPlan.status == "active",
@@ -347,6 +356,7 @@ def auto_decompose_budget(
                 existing.budget_value = monthly_value
             else:
                 bp = BudgetPlan(
+                    entity_id=entity_id,
                     kpi_id=kpi_id, period=period,
                     budget_value=monthly_value, budget_year=year,
                     budget_month=m, version=version, status="active",
@@ -362,6 +372,7 @@ def auto_decompose_budget(
             period = f"{year}-{m:02d}"
             existing = db.query(BudgetPlan).filter(
                 BudgetPlan.kpi_id == kpi_id,
+                BudgetPlan.entity_id == entity_id,
                 BudgetPlan.period == period,
                 BudgetPlan.version == version,
                 BudgetPlan.status == "active",
@@ -370,6 +381,7 @@ def auto_decompose_budget(
                 existing.budget_value = monthly
             else:
                 bp = BudgetPlan(
+                    entity_id=entity_id,
                     kpi_id=kpi_id, period=period,
                     budget_value=monthly, budget_year=year,
                     budget_month=m, version=version, status="active",
@@ -1119,10 +1131,14 @@ def update_deviation_alert(
     alert_id: int,
     data: dict,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """更新偏差预警（如标记已解决）"""
+    """更新偏差预警（如标记已解决）（账套隔离 2026-09-21：跨账套 id → 404）"""
     from app.models import BudgetDeviationAlert
-    alert = db.query(BudgetDeviationAlert).filter(BudgetDeviationAlert.id == alert_id).first()
+    alert = db.query(BudgetDeviationAlert).filter(
+        BudgetDeviationAlert.id == alert_id,
+        BudgetDeviationAlert.entity_id == entity_id,
+    ).first()
     if not alert:
         raise HTTPException(404, "预警记录不存在")
     if "status" in data: