fix(cma): action plan entity_id on create + okr decomposition entity scope

create_plan wrote no entity_id (fell back to model default 1) while the OKR decomposition view filtered weekly_actions by objective_id only, so cross-entity plans leaked into the other tenant view. Write the session entity on create (before adding the read-side condition - order matters) and scope weekly_actions by entity_id. Adds 4 regression tests (both directions + same-entity positive control).
2026-09-18 20:03:55 +08:00
parent bab6137aa2
commit b072602191
3 changed files with 278 additions and 0 deletions
@@ -547,6 +547,11 @@ def get_okr_decomposition(okr_id: int, db: Session = Depends(get_db),
    week_end = week_start + timedelta(days=7)
    action_plans = db.query(ActionPlan).filter(
        ActionPlan.objective_id == okr_id,
+        # 账套隔离（2026-09-18 batch3 派生单）：objective_id 已由
+        # _get_objective_or_404 校验归属，但计划侧此前无账套条件 →
+        # 对端账套计划（含脏行）会出现在本账套分解视图（实测 OBS2）。
+        # 前置条件：create_plan 必须已写会话账套 entity_id（顺序铁律）。
+        ActionPlan.entity_id == entity_id,
        ActionPlan.due_date.between(week_start, week_end)
    ).all()