fix(cma): entity isolation batch5 (budget writes, kpi objectives scope, quality logs join, growth-quality db source, expenses scope)

backend/app/api/expenses.py

@@ -404,8 +404,9 @@ def list_reimbursements(
     entity_id: int = Depends(get_entity_id),
     _=Depends(require_auth),
 ):
-    """查询报销单列表（支持状态/类型/申请人/关键字筛选）"""
-    q = db.query(ExpenseReimbursement)
+    """查询报销单列表（支持状态/类型/申请人/关键字筛选）（账套隔离 2026-09-21：列表按会话账套）"""
+    q = db.query(ExpenseReimbursement).filter(ExpenseReimbursement.entity_id == entity_id)
+
     if status:
         q = q.filter(ExpenseReimbursement.status == status)
     if expense_type:
@@ -427,20 +428,29 @@ def list_reimbursements(
 def get_reimbursement(
     reimb_id: int,
     db: Session = Depends(get_db),
+    entity_id: int = Depends(get_entity_id),
     _=Depends(require_auth),
 ):
-    """报销单详情"""
-    r = db.query(ExpenseReimbursement).filter(ExpenseReimbursement.id == reimb_id).first()
+    """报销单详情（账套隔离 2026-09-21：跨账套 → 404）"""
+    r = db.query(ExpenseReimbursement).filter(
+        ExpenseReimbursement.id == reimb_id,
+        ExpenseReimbursement.entity_id == entity_id,
+    ).first()
     if not r:
         raise HTTPException(404, "报销单不存在")
     return _reimb_to_dict(r)
 
 
-def _do_approve(db: Session, reimb_id: int, action: str, comment: str, approver: str):
-    """执行审批动作: approve/reject/return"""
-    r = db.query(ExpenseReimbursement).filter(ExpenseReimbursement.id == reimb_id).first()
+def _do_approve(db: Session, reimb_id: int, action: str, comment: str, approver: str,
+                entity_id: int = None):
+    """执行审批动作: approve/reject/return（账套隔离 2026-09-21：跨账套 → 404）"""
+    q = db.query(ExpenseReimbursement).filter(ExpenseReimbursement.id == reimb_id)
+    if entity_id is not None:
+        q = q.filter(ExpenseReimbursement.entity_id == entity_id)
+    r = q.first()
     if not r:
         raise HTTPException(404, "报销单不存在")
+
     if r.status not in ("pending", "returned"):
         raise HTTPException(400, f"当前状态({r.status})不可审批")
 
@@ -464,10 +474,11 @@ def approve_reimbursement(
     data: dict = None,
     db: Session = Depends(get_db),
     current_user=Depends(require_role("ceo", "finance")),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """审批通过"""
+    """审批通过（账套隔离 2026-09-21：跨账套 → 404）"""
     approver = current_user.name if hasattr(current_user, "name") else current_user.username
-    r = _do_approve(db, reimb_id, "approve", (data or {}).get("comment", ""), approver)
+    r = _do_approve(db, reimb_id, "approve", (data or {}).get("comment", ""), approver, entity_id)
     return {"message": "已审批通过", "data": _reimb_to_dict(r)}
 
 
@@ -477,13 +488,14 @@ def reject_reimbursement(
     data: dict = None,
     db: Session = Depends(get_db),
     current_user=Depends(require_role("ceo", "finance")),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """审批拒绝"""
+    """审批拒绝（账套隔离 2026-09-21：跨账套 → 404）"""
     comment = (data or {}).get("comment", "")
     if not comment:
         raise HTTPException(400, "拒绝时必须填写审批意见")
     approver = current_user.name if hasattr(current_user, "name") else current_user.username
-    r = _do_approve(db, reimb_id, "reject", comment, approver)
+    r = _do_approve(db, reimb_id, "reject", comment, approver, entity_id)
     return {"message": "已拒绝", "data": _reimb_to_dict(r)}
 
 
@@ -493,10 +505,11 @@ def return_reimbursement(
     data: dict = None,
     db: Session = Depends(get_db),
     current_user=Depends(require_role("ceo", "finance")),
+    entity_id: int = Depends(get_entity_id),
 ):
-    """人工打回"""
+    """人工打回（账套隔离 2026-09-21：跨账套 → 404）"""
     approver = current_user.name if hasattr(current_user, "name") else current_user.username
-    r = _do_approve(db, reimb_id, "return", (data or {}).get("comment", "人工打回"), approver)
+    r = _do_approve(db, reimb_id, "return", (data or {}).get("comment", "人工打回"), approver, entity_id)
     return {"message": "已打回", "data": _reimb_to_dict(r)}