sxbh_admin/cma-management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: 战略地图多租户隔离 — 酣客/博海地图按企业显示

Browse Source 
- strategic_maps/map_objectives 加 entity_id 列+模型+回填(按标题: 酣客→1/博海→2)
- maps: list按企业过滤, create/create-with-template强制token企业, update/delete/batch-delete/connections/review 跨企业404
- objectives/versions: 按map归属过滤
- _sync_map_objectives 继承地图entity
- 实证: 酣客token→map32(酣客), 博海token→map49(博海), 跨企业读404
- pytest 482 passed
- 多租户隔离专项最终收官(含周报遗留项)
This commit is contained in:
Hermes CI Fix
2026-08-25 16:58:27 +08:00
parent 6b6043536a
commit 54107b50cd
4 changed files with 41 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/api/maps.py
+27 -17
View File
@@ -3,6 +3,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query
from sqlalchemy.orm import Session
from typing import Optional
from app.database import get_db
from app.deps import get_entity_id
from app.auth_middleware import require_auth, require_role
from app.models import StrategicMap, OperationLog, MapObjective
import json
@@ -60,12 +61,13 @@ STRATEGIC_MAP_TEMPLATE = [
# ── CRUD ────────────────────────────────────
@router.get("")
def list_maps(db: Session = Depends(get_db)):
maps = db.query(StrategicMap).order_by(StrategicMap.updated_at.desc()).all()
def list_maps(db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
# 账套隔离: 仅当前企业地图 (2026-08-25)
maps = db.query(StrategicMap).filter(StrategicMap.entity_id == entity_id).order_by(StrategicMap.updated_at.desc()).all()
return {"data": [m_to_dict(m, db) for m in maps]}
@router.post("")
def create_map(data: dict, db: Session = Depends(get_db)):
def create_map(data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
# 空白地图默认四层空结构（避免dimensions=NULL导致加载报错）
if "dimensions" not in data or data.get("dimensions") is None:
data = {**data, "dimensions": [
@@ -76,6 +78,7 @@ def create_map(data: dict, db: Session = Depends(get_db)):
]}
if "canvas_data" not in data or data.get("canvas_data") is None:
data = {**data, "canvas_data": {"connections": []}}
data["entity_id"] = entity_id # 账套隔离: 强制token企业
m = StrategicMap(**data)
db.add(m)
db.commit()
@@ -85,12 +88,13 @@ def create_map(data: dict, db: Session = Depends(get_db)):
@router.post("/create-with-template")
def create_map_with_template(data: dict, db: Session = Depends(get_db)):
"""一键创建带四维度模板的战略地图"""
def create_map_with_template(data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""一键创建带四维度模板的战略地图（账套隔离: 强制token企业）"""
m = StrategicMap(
title=data.get("title", "新建战略地图"),
version=data.get("version", "v1.0"),
status="draft",
entity_id=entity_id,
dimensions=STRATEGIC_MAP_TEMPLATE,
canvas_data={"connections": []},
)
@@ -102,10 +106,13 @@ def create_map_with_template(data: dict, db: Session = Depends(get_db)):
@router.put("/{map_id}")
def update_map(map_id: int, data: dict, db: Session = Depends(get_db)):
def update_map(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
if not m:
raise HTTPException(404, "战略地图不存在")
# 账套隔离: 禁止跨企业修改
if m.entity_id != entity_id:
raise HTTPException(404, "战略地图不存在")
old_status = m.status
for k, v in data.items():
@@ -127,25 +134,27 @@ def update_map(map_id: int, data: dict, db: Session = Depends(get_db)):
@router.delete("/{map_id}")
def delete_map(map_id: int, db: Session = Depends(get_db)):
"""删除战略地图"""
def delete_map(map_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""删除战略地图（账套隔离: 禁止跨企业删除）"""
m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
if not m:
raise HTTPException(404, "战略地图不存在")
if m.entity_id != entity_id:
raise HTTPException(404, "战略地图不存在")
db.delete(m)
db.commit()
return {"message": "已删除"}
@router.post("/batch-delete")
def batch_delete_maps(data: dict, db: Session = Depends(get_db)):
"""批量删除战略地图"""
def batch_delete_maps(data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""批量删除战略地图（账套隔离: 仅本企业地图）"""
ids = data.get("ids", [])
if not ids:
raise HTTPException(400, "请选择要删除的地图")
deleted = 0
for mid in ids:
m = db.query(StrategicMap).filter(StrategicMap.id == mid).first()
m = db.query(StrategicMap).filter(StrategicMap.id == mid, StrategicMap.entity_id == entity_id).first()
if m:
db.delete(m)
deleted += 1
@@ -169,9 +178,9 @@ def _get_connections(m: StrategicMap) -> list:
@router.post("/{map_id}/connections")
def add_connection(map_id: int, data: dict, db: Session = Depends(get_db)):
def add_connection(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""新增因果连线: {"from": "learning-0", "to": "process-0"}"""
m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
m = db.query(StrategicMap).filter(StrategicMap.id == map_id, StrategicMap.entity_id == entity_id).first()
if not m:
raise HTTPException(404, "战略地图不存在")
@@ -209,9 +218,9 @@ def add_connection(map_id: int, data: dict, db: Session = Depends(get_db)):
@router.delete("/{map_id}/connections")
def delete_connection_by_key(map_id: int, data: dict, db: Session = Depends(get_db)):
def delete_connection_by_key(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""根据 from/to 删除连线"""
m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
m = db.query(StrategicMap).filter(StrategicMap.id == map_id, StrategicMap.entity_id == entity_id).first()
if not m:
raise HTTPException(404, "战略地图不存在")
@@ -298,6 +307,7 @@ def _sync_map_objectives(m, db):
for i, obj in enumerate(dim.get("objectives", [])):
mo = MapObjective(
map_id=m.id,
entity_id=getattr(m, "entity_id", 1) or 1, # 账套隔离: 继承地图企业
dimension_key=dim.get("key", ""),
name=obj.get("name", ""),
description=obj.get("description", ""),
@@ -345,14 +355,14 @@ def _merge_map_objectives(m, db):
@router.get("/{map_id}/review")
def get_map_review(map_id: int, level: Optional[str] = None, db: Session = Depends(get_db)):
def get_map_review(map_id: int, level: Optional[str] = None, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""战略回顾会：返回目标状态、KPI值、改善行动
level: 可选 strategic/operational — 战略回顾(默认strategic)只显示战略级KPI；
不传则返回全部KPI（向后兼容）。
"""
from app.models import KPIDefinition, KPIValue, ActionPlan
m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
m = db.query(StrategicMap).filter(StrategicMap.id == map_id, StrategicMap.entity_id == entity_id).first()
if not m:
raise HTTPException(404, "战略地图不存在")
backend/app/api/objectives.py
+7 -6
View File
@@ -2,6 +2,7 @@
from fastapi import APIRouter, Depends, HTTPException
from sqlalchemy.orm import Session
from app.database import get_db
from app.deps import get_entity_id
from app.auth_middleware import require_role
from app.models import MapObjective, StrategicMap, KPIDefinition
@@ -11,7 +12,7 @@ router = APIRouter(prefix="/api/cma/maps", tags=["战略地图目标"],
@router.get("/{map_id}/objectives")
def list_objectives(map_id: int, db: Session = Depends(get_db)):
def list_objectives(map_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""获取某地图下的所有目标"""
objs = db.query(MapObjective).filter(
MapObjective.map_id == map_id
@@ -20,9 +21,9 @@ def list_objectives(map_id: int, db: Session = Depends(get_db)):
@router.post("/{map_id}/objectives")
def create_objective(map_id: int, data: dict, db: Session = Depends(get_db)):
def create_objective(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""新增目标"""
m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
m = db.query(StrategicMap).filter(StrategicMap.id == map_id), StrategicMap.entity_id == entity_id.first()
if not m:
raise HTTPException(404, "战略地图不存在")
obj = MapObjective(
@@ -40,7 +41,7 @@ def create_objective(map_id: int, data: dict, db: Session = Depends(get_db)):
@router.put("/{map_id}/objectives/{obj_id}")
def update_objective(map_id: int, obj_id: int, data: dict, db: Session = Depends(get_db)):
def update_objective(map_id: int, obj_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""修改目标"""
obj = db.query(MapObjective).filter(
MapObjective.id == obj_id, MapObjective.map_id == map_id
@@ -55,7 +56,7 @@ def update_objective(map_id: int, obj_id: int, data: dict, db: Session = Depends
@router.delete("/{map_id}/objectives/{obj_id}")
def delete_objective(map_id: int, obj_id: int, db: Session = Depends(get_db)):
def delete_objective(map_id: int, obj_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""删除目标"""
obj = db.query(MapObjective).filter(
MapObjective.id == obj_id, MapObjective.map_id == map_id
@@ -68,7 +69,7 @@ def delete_objective(map_id: int, obj_id: int, db: Session = Depends(get_db)):
@router.put("/{map_id}/objectives/sort")
def sort_objectives(map_id: int, data: dict, db: Session = Depends(get_db)):
def sort_objectives(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""批量排序: {"ids": [3, 1, 2]}"""
ids = data.get("ids", [])
for idx, obj_id in enumerate(ids):
backend/app/api/versions.py
+5 -4
View File
@@ -2,6 +2,7 @@
from fastapi import APIRouter, Depends, HTTPException
from sqlalchemy.orm import Session
from app.database import get_db
from app.deps import get_entity_id
from app.auth_middleware import require_role
from app.models import StrategicMap, StrategicMapVersion
@@ -11,7 +12,7 @@ router = APIRouter(prefix="/api/cma/maps", tags=["战略地图版本"],
@router.get("/{map_id}/versions")
def list_versions(map_id: int, db: Session = Depends(get_db)):
def list_versions(map_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""查看版本历史"""
versions = db.query(StrategicMapVersion).filter(
StrategicMapVersion.map_id == map_id
@@ -20,9 +21,9 @@ def list_versions(map_id: int, db: Session = Depends(get_db)):
@router.post("/{map_id}/versions/snapshot")
def create_snapshot(map_id: int, data: dict, db: Session = Depends(get_db)):
def create_snapshot(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""手动创建快照"""
m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
m = db.query(StrategicMap).filter(StrategicMap.id == map_id), StrategicMap.entity_id == entity_id.first()
if not m:
raise HTTPException(404, "战略地图不存在")
@@ -61,7 +62,7 @@ def create_snapshot(map_id: int, data: dict, db: Session = Depends(get_db)):
@router.post("/{map_id}/versions/{ver_id}/rollback")
def rollback_version(map_id: int, ver_id: int, db: Session = Depends(get_db)):
def rollback_version(map_id: int, ver_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
"""回滚到指定版本"""
m = db.query(StrategicMap).filter(StrategicMap.id == map_id).first()
if not m: