fix(cma): entity isolation batch5 (budget writes, kpi objectives scope, quality logs join, growth-quality db source, expenses scope)

backend/app/api/kpis.py

@@ -918,9 +918,16 @@ def _log(db, user_id, action, target_type, target_id, detail):
 
 
 @router.get("/{kpi_id}/objectives")
-def get_kpi_objectives(kpi_id: int, db: Session = Depends(get_db)):
-    """查看KPI所属的目标和战略地图"""
-    kpi = db.query(KPIDefinition).filter(KPIDefinition.id == kpi_id).first()
+def get_kpi_objectives(kpi_id: int, db: Session = Depends(get_db),
+                       entity_id: int = Depends(get_entity_id)):
+    """查看KPI所属的目标和战略地图（账套隔离 2026-09-21：跨账套 id → 404）
+
+    鉴权口径：本 router 级 `dependencies=[Depends(require_role(...))]` 已覆盖本端点
+    （无 token → 401），此处不再重复挂 require_auth，只补缺失的账套收口。
+    """
+    kpi = db.query(KPIDefinition).filter(
+        KPIDefinition.id == kpi_id, KPIDefinition.entity_id == entity_id,
+    ).first()
     if not kpi:
         raise HTTPException(404, "KPI不存在")
 
@@ -933,15 +940,19 @@ def get_kpi_objectives(kpi_id: int, db: Session = Depends(get_db)):
     }
 
     if kpi.map_id:
-        m = db.query(StrategicMap).filter(StrategicMap.id == kpi.map_id).first()
+        m = db.query(StrategicMap).filter(
+            StrategicMap.id == kpi.map_id, StrategicMap.entity_id == entity_id,
+        ).first()
         if m:
             result["map"] = {"id": m.id, "title": m.title, "status": m.status}
 
     if kpi.objective:
         objs = db.query(MapObjective).filter(
             MapObjective.map_id == kpi.map_id,
+            MapObjective.entity_id == entity_id,
             MapObjective.name == kpi.objective,
         ).all()
         result["objectives"] = [{"id": o.id, "name": o.name, "dimension_key": o.dimension_key} for o in objs]
 
     return result
+