Hermes CI Fix
9b61c48051
安全: - ⑦ update_map 字段白名单(禁entity_id篡改, status限值域) - ⑧ objectives 全端点补entity校验(原括号错位导致隔离失效) + update白名单 - ⑨ strategic_map_versions 加entity_id列+回填, list/snapshot/rollback过滤 - ⑩ get_map_review KPI查询加entity(同编码跨企业混入) - ⑪ _sync_map_objectives 强制继承地图entity 逻辑: - ③ MapCanvas 自动保存 currentMap.value 解包(30s自动保存修复) - ④ 乐观锁字段 version_num→version 对齐 - ⑤ 红黄绿灯: 越低越好型反向 + 负值修正 + 月目标优先 - ⑥ review 补 action_plan_summary 字段 验证: 跨企业写目标404✓ entity_id注入被拒✓ pytest 531 passed✓
95 lines
3.7 KiB
Python
95 lines
3.7 KiB
Python
"""战略地图目标 API"""
|
||
from fastapi import APIRouter, Depends, HTTPException
|
||
from sqlalchemy.orm import Session
|
||
from app.database import get_db
|
||
from app.deps import get_entity_id
|
||
from app.auth_middleware import require_role
|
||
from app.models import MapObjective, StrategicMap, KPIDefinition
|
||
|
||
router = APIRouter(prefix="/api/cma/maps", tags=["战略地图目标"],
|
||
dependencies=[Depends(require_role("ceo", "finance"))],
|
||
)
|
||
|
||
|
||
@router.get("/{map_id}/objectives")
|
||
def list_objectives(map_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
|
||
"""获取某地图下的所有目标"""
|
||
objs = db.query(MapObjective).filter(
|
||
MapObjective.map_id == map_id
|
||
).order_by(MapObjective.sort_order).all()
|
||
return {"data": [_obj_to_dict(o) for o in objs]}
|
||
|
||
|
||
@router.post("/{map_id}/objectives")
|
||
def create_objective(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
|
||
"""新增目标"""
|
||
m = db.query(StrategicMap).filter(StrategicMap.id == map_id, StrategicMap.entity_id == entity_id).first()
|
||
if not m:
|
||
raise HTTPException(404, "战略地图不存在")
|
||
obj = MapObjective(
|
||
map_id=map_id,
|
||
dimension_key=data["dimension_key"],
|
||
name=data["name"],
|
||
description=data.get("description"),
|
||
icon=data.get("icon", "target"),
|
||
sort_order=data.get("sort_order", 0),
|
||
)
|
||
db.add(obj)
|
||
db.commit()
|
||
db.refresh(obj)
|
||
return _obj_to_dict(obj)
|
||
|
||
|
||
@router.put("/{map_id}/objectives/{obj_id}")
|
||
def update_objective(map_id: int, obj_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
|
||
"""修改目标（账套隔离 + 字段白名单, OpenCode审查#8）"""
|
||
m = db.query(StrategicMap).filter(StrategicMap.id == map_id, StrategicMap.entity_id == entity_id).first()
|
||
if not m:
|
||
raise HTTPException(404, "战略地图不存在")
|
||
obj = db.query(MapObjective).filter(
|
||
MapObjective.id == obj_id, MapObjective.map_id == map_id
|
||
).first()
|
||
if not obj:
|
||
raise HTTPException(404, "目标不存在")
|
||
ALLOWED_OBJ_FIELDS = {"name", "description", "icon", "sort_order", "kpis", "dimension_key"}
|
||
for k, v in data.items():
|
||
if k in ALLOWED_OBJ_FIELDS and hasattr(obj, k) and v is not None:
|
||
setattr(obj, k, v)
|
||
db.commit()
|
||
return _obj_to_dict(obj)
|
||
|
||
|
||
@router.delete("/{map_id}/objectives/{obj_id}")
|
||
def delete_objective(map_id: int, obj_id: int, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
|
||
"""删除目标（账套隔离）"""
|
||
m = db.query(StrategicMap).filter(StrategicMap.id == map_id, StrategicMap.entity_id == entity_id).first()
|
||
if not m:
|
||
raise HTTPException(404, "战略地图不存在")
|
||
obj = db.query(MapObjective).filter(
|
||
MapObjective.id == obj_id, MapObjective.map_id == map_id
|
||
).first()
|
||
if not obj:
|
||
raise HTTPException(404, "目标不存在")
|
||
db.delete(obj)
|
||
db.commit()
|
||
return {"message": "已删除"}
|
||
|
||
|
||
@router.put("/{map_id}/objectives/sort")
|
||
def sort_objectives(map_id: int, data: dict, db: Session = Depends(get_db), entity_id: int = Depends(get_entity_id)):
|
||
"""批量排序: {"ids": [3, 1, 2]}（账套隔离）"""
|
||
m = db.query(StrategicMap).filter(StrategicMap.id == map_id, StrategicMap.entity_id == entity_id).first()
|
||
if not m:
|
||
raise HTTPException(404, "战略地图不存在")
|
||
ids = data.get("ids", [])
|
||
for idx, obj_id in enumerate(ids):
|
||
db.query(MapObjective).filter(
|
||
MapObjective.id == obj_id, MapObjective.map_id == map_id
|
||
).update({"sort_order": idx})
|
||
db.commit()
|
||
return {"message": "排序已更新"}
|
||
|
||
|
||
def _obj_to_dict(o):
|
||
return {c.name: getattr(o, c.name) for c in o.__table__.columns}
|