fix(cma): entity isolation batch5 (budget writes, kpi objectives scope, quality logs join, growth-quality db source, expenses scope)

backend/app/api/data_quality.py

@@ -177,9 +177,19 @@ def list_quality_logs(
     check_type: Optional[str] = None,
     status: Optional[str] = None,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """获取数据质量日志"""
-    query = db.query(KpiDataQualityLog)
+    """获取数据质量日志（账套隔离 2026-09-21）
+
+    kpi_data_quality_log 表无 entity_id 列（见本文件 :235 说明），按本单选项(1)
+    经 kpi_id join kpi_definitions 以 kpi_definitions.entity_id 收口（零迁移）。
+    join 为内连接：kpi_id 无对应 KPI 行的孤儿日志无法归属账套，一律不返回。
+    """
+    query = (
+        db.query(KpiDataQualityLog)
+        .join(KPIDefinition, KPIDefinition.id == KpiDataQualityLog.kpi_id)
+        .filter(KPIDefinition.entity_id == entity_id)
+    )
     if kpi_id:
         query = query.filter(KpiDataQualityLog.kpi_id == kpi_id)
     if severity:
@@ -201,10 +211,22 @@ def list_quality_logs(
     return {"data": result, "total": len(result)}
 
 
+def _scoped_quality_log(db: Session, log_id: int, entity_id: int):
+    """按会话账套取质量日志行（表无 entity_id 列 → 经 kpi_id join kpi_definitions 归属）"""
+    return (
+        db.query(KpiDataQualityLog)
+        .join(KPIDefinition, KPIDefinition.id == KpiDataQualityLog.kpi_id)
+        .filter(KpiDataQualityLog.id == log_id,
+                KPIDefinition.entity_id == entity_id)
+        .first()
+    )
+
+
 @router.put("/logs/{log_id}")
-def update_quality_log(log_id: int, data: dict, db: Session = Depends(get_db), user=WRITE_ROLES):
-    """更新质量日志（解决/忽略）"""
-    log = db.query(KpiDataQualityLog).filter(KpiDataQualityLog.id == log_id).first()
+def update_quality_log(log_id: int, data: dict, db: Session = Depends(get_db), user=WRITE_ROLES,
+                       entity_id: int = Depends(get_entity_id)):
+    """更新质量日志（解决/忽略）（账套隔离 2026-09-21：跨账套 → 404）"""
+    log = _scoped_quality_log(db, log_id, entity_id)
     if not log:
         raise HTTPException(404, "日志不存在")
     if "status" in data:
@@ -218,14 +240,18 @@ def update_quality_log(log_id: int, data: dict, db: Session = Depends(get_db), u
 
 
 @router.delete("/logs/{log_id}")
-def delete_quality_log(log_id: int, db: Session = Depends(get_db), user=WRITE_ROLES):
-    log = db.query(KpiDataQualityLog).filter(KpiDataQualityLog.id == log_id).first()
-    if log:
-        db.delete(log)
-        db.commit()
+def delete_quality_log(log_id: int, db: Session = Depends(get_db), user=WRITE_ROLES,
+                       entity_id: int = Depends(get_entity_id)):
+    """删除质量日志（账套隔离 2026-09-21：跨账套 → 404；不存在 → 404，对齐 PUT 语义）"""
+    log = _scoped_quality_log(db, log_id, entity_id)
+    if not log:
+        raise HTTPException(404, "日志不存在")
+    db.delete(log)
+    db.commit()
     return {"message": "已删除"}
 
 
+
 # ============================================================
 # 数据质量看板统计
 # ============================================================