提交

backend/scripts/patch_pr3_api.py

@@ -0,0 +1,276 @@
+#!/usr/bin/env python3
+"""PR3 Task 2.4–2.7: API 层注入 user_info。"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _inject_user_info_after_tenant(body: str) -> str:
+    if "user_info = crm_user_info(_user)" in body:
+        return body
+    lines = body.split("\n")
+    for i, line in enumerate(lines):
+        if "tenant_no = get_tenant_no(db, _user)" in line:
+            indent = line[: len(line) - len(line.lstrip())]
+            lines.insert(i + 1, f"{indent}user_info = crm_user_info(_user)")
+            return "\n".join(lines)
+    return body
+
+
+def patch_route_file(path: Path, route_prefixes: tuple[str, ...]):
+    c = path.read_text()
+    parts = re.split(r'(@router\.(?:post|get|put|delete)\("[^"]+"\))', c)
+    if len(parts) < 2:
+        # register_* pattern
+        parts = re.split(r'(    @router\.(?:post|get|put|delete)\("[^"]+"\))', c)
+    out = [parts[0]]
+    for i in range(1, len(parts), 2):
+        dec = parts[i]
+        body = parts[i + 1] if i + 1 < len(parts) else ""
+        m = re.search(r'@router\.(?:post|get|put|delete)\("([^"]+)"\)', dec)
+        rp = m.group(1) if m else ""
+        if any(rp.startswith(p) for p in route_prefixes):
+            body = _inject_user_info_after_tenant(body)
+        out.append(dec)
+        out.append(body)
+    c = "".join(out)
+    path.write_text(c)
+    print(f"injected user_info blocks in {path.name}")
+
+
+def patch_crm_py_calls():
+    path = ROOT / "app/api/crm.py"
+    c = path.read_text()
+
+    # imports
+    if "ensure_crm_contact_row_in_scope" not in c:
+        c = c.replace(
+            "    ensure_crm_owner_row_in_scope,\n)",
+            "    ensure_crm_contact_row_in_scope,\n    ensure_crm_customer_linked_row_in_scope,\n    ensure_crm_owner_row_in_scope,\n)",
+        )
+
+    replacements = [
+        # product categories
+        (
+            "rows = list_category_tree(\n            db,\n            tenant_no,\n            category_name=category_name,\n            status=status,\n        )",
+            "rows = list_category_tree(\n            db,\n            tenant_no,\n            category_name=category_name,\n            status=status,\n            user_info=user_info,\n        )",
+        ),
+        (
+            "obj = update_category(db, category_id, user_id=user_id, **data)",
+            "obj = update_category(db, category_id, user_id=user_id, user_info=user_info, **data)",
+        ),
+        ("soft_delete_category(db, body.id)", "soft_delete_category(db, body.id, user_info=user_info)"),
+        # products
+        (
+            "rows, total = list_products(\n            db,\n            tenant_no,\n            page=body.page,\n            page_size=body.pageSize,\n            keyword=body.keyword,\n            category_id=body.category_id,\n            status=body.status,\n        )",
+            "rows, total = list_products(\n            db,\n            tenant_no,\n            page=body.page,\n            page_size=body.pageSize,\n            keyword=body.keyword,\n            category_id=body.category_id,\n            status=body.status,\n            user_info=user_info,\n        )",
+        ),
+        (
+            "obj = get_product(db, body.id)\n        if not obj:\n            return error_response(404, \"产品不存在\")\n        return success_response(_product_row_to_dict(obj))",
+            "tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        obj = get_product(db, body.id)\n        if not obj:\n            return error_response(404, \"产品不存在\")\n        ensure_crm_create_by_row_in_scope(db, obj, user_info, tenant_no, message=\"无权访问该产品\")\n        return success_response(_product_row_to_dict(obj))",
+        ),
+        (
+            "obj = update_product(db, product_id, user_id=user_id, **data)",
+            "tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        obj = update_product(db, product_id, user_id=user_id, user_info=user_info, **data)",
+        ),
+        (
+            "soft_delete_product(db, pid)",
+            "soft_delete_product(db, pid, user_info=user_info)",
+        ),
+        (
+            "update_product(db, pid, user_id=user_id, status=body.status)",
+            "update_product(db, pid, user_id=user_id, user_info=user_info, status=body.status)",
+        ),
+        (
+            "options = list_product_options(\n            db,\n            tenant_no,\n            keyword=body.keyword,\n            category_id=body.category_id,\n        )",
+            "options = list_product_options(\n            db,\n            tenant_no,\n            keyword=body.keyword,\n            category_id=body.category_id,\n            user_info=user_info,\n        )",
+        ),
+        # contact
+        (
+            "rows, total = list_contacts(\n            db, tenant_no, page=page, page_size=page_size,",
+            "user_info = crm_user_info(_user)\n        rows, total = list_contacts(\n            db, tenant_no, page=page, page_size=page_size, user_info=user_info,",
+        ),
+        (
+            "row = get_contact(db, contact_id)\n        if not row:\n            return error_response(404, \"联系人不存在\")\n        return success_response(contact_row_to_dict(row))",
+            "tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        row = get_contact(db, contact_id)\n        if not row:\n            return error_response(404, \"联系人不存在\")\n        ensure_crm_contact_row_in_scope(db, row, user_info, tenant_no, message=\"无权访问该联系人\")\n        return success_response(contact_row_to_dict(row))",
+        ),
+        (
+            "rows = list_contacts_by_customer(db, tenant_no, customer_id)",
+            "user_info = crm_user_info(_user)\n        rows = list_contacts_by_customer(db, tenant_no, customer_id, user_info=user_info)",
+        ),
+        (
+            "obj = create_contact(\n            db, tenant_no=tenant_no, user_id=user_id,",
+            "user_info = crm_user_info(_user)\n        obj = create_contact(\n            db, tenant_no=tenant_no, user_id=user_id, user_info=user_info,",
+        ),
+        (
+            "obj = update_contact(db, contact_id, user_id=user_id, **data)",
+            "tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        obj = update_contact(db, contact_id, user_id=user_id, tenant_no=tenant_no, user_info=user_info, **data)",
+        ),
+        (
+            "soft_delete_contact(db, cid)",
+            "tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        user_id = _user.get(\"user_id\", \"\") or _user.get(\"id\", \"\")\n            soft_delete_contact(db, cid, user_id=user_id, tenant_no=tenant_no, user_info=user_info)",
+        ),
+        (
+            "obj = set_primary_contact(db, contact_id, user_id=user_id)",
+            "tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        obj = set_primary_contact(db, contact_id, user_id=user_id, tenant_no=tenant_no, user_info=user_info)",
+        ),
+    ]
+
+    for old, new in replacements:
+        if old in c and new not in c:
+            c = c.replace(old, new, 1)
+
+    # Fix contact delete indentation if broken
+    c = c.replace(
+        "for cid in body.ids:\n        tenant_no = get_tenant_no(db, _user)",
+        "tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        user_id = _user.get(\"user_id\", \"\") or _user.get(\"id\", \"\")\n        for cid in body.ids:",
+    )
+
+    # supplier / invoice - inject user_info in list handlers via route patch; add call params
+    c = re.sub(
+        r"list_supplier_info\(\s*\n\s*db, tenant_no,",
+        "list_supplier_info(\n            db, tenant_no, user_info=user_info,",
+        c,
+    )
+    c = re.sub(
+        r"list_all_supplier_info\(\s*\n\s*db, tenant_no,",
+        "list_all_supplier_info(\n            db, tenant_no, user_info=user_info,",
+        c,
+    )
+    c = c.replace(
+        "obj = update_supplier_info(\n            db,\n            supplier_id,\n            tenant_no=tenant_no,\n            user_id=user_id,",
+        "obj = update_supplier_info(\n            db,\n            supplier_id,\n            tenant_no=tenant_no,\n            user_id=user_id,\n            user_info=user_info,",
+    )
+    c = c.replace(
+        "soft_delete_supplier_info(\n            db,\n            sid,\n            tenant_no=tenant_no,\n            user_id=user_id,",
+        "soft_delete_supplier_info(\n            db,\n            sid,\n            tenant_no=tenant_no,\n            user_id=user_id,\n            user_info=user_info,",
+    )
+    c = c.replace(
+        "rows = list_invoice_info_by_customer(db, tenant_no, customer_id)",
+        "rows = list_invoice_info_by_customer(db, tenant_no, customer_id, user_info=user_info)",
+    )
+    c = c.replace(
+        "obj = create_invoice_info(\n            db,\n            tenant_no=tenant_no,\n            user_id=user_id,",
+        "obj = create_invoice_info(\n            db,\n            tenant_no=tenant_no,\n            user_id=user_id,\n            user_info=user_info,",
+    )
+    c = c.replace(
+        "obj = update_invoice_info(\n            db,\n            invoice_id,\n            tenant_no=tenant_no,\n            user_id=user_id,",
+        "obj = update_invoice_info(\n            db,\n            invoice_id,\n            tenant_no=tenant_no,\n            user_id=user_id,\n            user_info=user_info,",
+    )
+    c = c.replace(
+        "soft_delete_invoice_info(db, invoice_id, user_id=user_id)",
+        "soft_delete_invoice_info(db, invoice_id, user_id=user_id, tenant_no=tenant_no, user_info=user_info)",
+    )
+    c = c.replace(
+        "obj = set_default_invoice_info(\n            db,\n            invoice_id,\n            customer_id,\n            tenant_no=tenant_no,\n            user_id=user_id,",
+        "obj = set_default_invoice_info(\n            db,\n            invoice_id,\n            customer_id,\n            tenant_no=tenant_no,\n            user_id=user_id,\n            user_info=user_info,",
+    )
+
+    # product list/export need user_info at start of try
+    c = c.replace(
+        '"""分页查询产品列表"""\n    try:\n        tenant_no = get_tenant_no(db, _user)\n        rows, total = list_products(',
+        '"""分页查询产品列表"""\n    try:\n        tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        rows, total = list_products(',
+    )
+    c = c.replace(
+        '"""获取产品分类树"""\n    try:\n        tenant_no = get_tenant_no(db, _user)',
+        '"""获取产品分类树"""\n    try:\n        tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)',
+    )
+    c = c.replace(
+        '"""删除产品（支持单条 body.id 和批量 body.ids）"""\n    try:\n        ids_to_delete',
+        '"""删除产品（支持单条 body.id 和批量 body.ids）"""\n    try:\n        tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        ids_to_delete',
+    )
+    c = c.replace(
+        '"""批量上架/下架"""\n    try:\n        user_id = _user.get("user_id", "") or _user.get("id", "")',
+        '"""批量上架/下架"""\n    try:\n        tenant_no = get_tenant_no(db, _user)\n        user_info = crm_user_info(_user)\n        user_id = _user.get("user_id", "") or _user.get("id", "")',
+    )
+
+    path.write_text(c)
+    print("patched crm.py calls")
+
+
+def patch_quote_routes():
+    path = ROOT / "app/api/crm_quote_routes.py"
+    c = path.read_text()
+    if "crm_user_info" not in c:
+        c = c.replace(
+            "from app.core.tenant_context import get_tenant_no\n",
+            "from app.core.tenant_context import get_tenant_no\n"
+            "from app.crud.crm.data_scope_helpers import crm_user_info\n",
+        )
+
+    # inject user_info in each handler try block after tenant_no
+    parts = re.split(r'(    @router\.post\("[^"]+"\))', c)
+    out = [parts[0]]
+    for i in range(1, len(parts), 2):
+        dec, body = parts[i], parts[i + 1] if i + 1 < len(parts) else ""
+        body = _inject_user_info_after_tenant(body)
+        out.extend([dec, body])
+    c = "".join(out)
+
+    # pass user_info to crud calls
+    c = re.sub(
+        r"list_quotes\(\s*\n\s*db,\s*\n\s*tenant_no,",
+        "list_quotes(\n                db,\n                tenant_no,\n                user_info=user_info,",
+        c,
+    )
+    c = re.sub(
+        r"get_quote_detail\(\s*\n\s*db,",
+        "get_quote_detail(\n                db,",
+        c,
+    )
+    c = c.replace(
+        "tenant_no=tenant_no,\n            )",
+        "tenant_no=tenant_no,\n                user_info=user_info,\n            )",
+    )
+    # Too broad - fix manually with targeted replaces
+    path.write_text(c)
+    print("patched crm_quote_routes.py (partial)")
+
+
+def patch_contract_routes():
+    path = ROOT / "app/api/crm_contract_routes.py"
+    c = path.read_text()
+    if "crm_user_info" not in c:
+        c = c.replace(
+            "from app.core.tenant_context import get_tenant_no\n",
+            "from app.core.tenant_context import get_tenant_no\n"
+            "from app.crud.crm.data_scope_helpers import crm_user_info\n",
+        )
+    parts = re.split(r'(    @router\.(?:get|post|put|delete)\("[^"]+"\))', c)
+    out = [parts[0]]
+    for i in range(1, len(parts), 2):
+        dec, body = parts[i], parts[i + 1] if i + 1 < len(parts) else ""
+        body = _inject_user_info_after_tenant(body)
+        out.extend([dec, body])
+    c = "".join(out)
+    c = re.sub(
+        r"list_contracts\(\s*\n\s*db,\s*\n\s*tenant_no,",
+        "list_contracts(\n                db,\n                tenant_no,\n                user_info=user_info,",
+        c,
+    )
+    c = re.sub(
+        r"get_contract_detail\(\s*\n\s*db,",
+        "get_contract_detail(\n                db,",
+        c,
+    )
+    path.write_text(c)
+    print("patched crm_contract_routes.py (partial)")
+
+
+if __name__ == "__main__":
+    patch_route_file(
+        ROOT / "app/api/crm.py",
+        (
+            "/product-categories/",
+            "/products/",
+            "/contact/",
+            "/supplierInfo/",
+            "/invoice-info/",
+        ),
+    )
+    patch_crm_py_calls()
+    patch_quote_routes()
+    patch_contract_routes()

backend/scripts/patch_pr3_api_calls.py

@@ -0,0 +1,116 @@
+#!/usr/bin/env python3
+"""为 quote/contract 路由 CRUD 调用补全 user_info=user_info。"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+QUOTE_FUNCS = (
+    "get_quote_detail",
+    "update_quote",
+    "soft_delete_quotes",
+    "submit_quote",
+    "save_template",
+    "get_template",
+    "generate_pdf",
+    "generate_share",
+    "accept_quote",
+    "reject_quote",
+    "to_contract",
+    "create_new_version",
+    "query_versions",
+    "withdraw_quote_approval",
+    "invalid_quote",
+    "statistics_overview",
+    "statistics_status",
+    "statistics_trend",
+    "list_quote_approvals",
+    "approve_quote",
+    "withdraw_approval",
+    "refresh_approver_names",
+    "list_quote_products",
+    "insert_quote_product",
+    "update_quote_product",
+    "soft_delete_quote_products",
+    "list_share_logs",
+    "share_log_statistics",
+)
+
+CONTRACT_FUNCS = (
+    "get_contract_detail",
+    "get_contract",
+    "update_contract",
+    "soft_delete_contracts",
+    "submit_contract_approval",
+    "withdraw_contract_approval",
+    "sign_contract",
+    "start_execute",
+    "finish_contract",
+    "invalid_contract",
+    "renew_contract",
+    "batch_assign_owner",
+    "batch_submit_contract_approval",
+    "upload_attachments",
+    "upload_attachments_with_category",
+    "upload_file",
+    "save_template",
+    "get_template",
+    "download_contract_pdf",
+    "create_from_quote",
+    "create_from_opportunity",
+    "export_contracts",
+    "query_expiring",
+    "statistics_overview",
+    "statistics_by_status",
+    "statistics_by_type",
+    "statistics_trend",
+    "list_contract_approvals",
+    "approve_contract_by_contract_id",
+    "list_contract_changes",
+    "get_contract_change_detail",
+    "update_contract_change",
+    "soft_delete_contract_changes",
+    "list_contract_templates",
+    "update_contract_template",
+    "soft_delete_contract_templates",
+)
+
+
+def _add_user_info_kwarg(content: str, func_names: tuple[str, ...]) -> str:
+    for fn in func_names:
+        pattern = rf"({re.escape(fn)}\([^)]*?)(\n\s*\))"
+        while True:
+            m = re.search(pattern, content, re.DOTALL)
+            if not m:
+                break
+            call = m.group(1)
+            if "user_info=" in call:
+                content = content[: m.start()] + call + m.group(2) + content[m.end() :]
+                break
+            new_call = call.rstrip() + ",\n                user_info=user_info,"
+            content = content[: m.start()] + new_call + m.group(2) + content[m.end() :]
+    return content
+
+
+def patch_file(rel: str, funcs: tuple[str, ...]):
+    path = ROOT / rel
+    c = path.read_text()
+    if "crm_user_info" not in c:
+        c = c.replace(
+            "from app.core.tenant_context import get_tenant_no\n",
+            "from app.core.tenant_context import get_tenant_no\n"
+            "from app.crud.crm.data_scope_helpers import crm_user_info\n",
+        )
+    c2 = _add_user_info_kwarg(c, funcs)
+    path.write_text(c2)
+    print(f"patched {rel}")
+
+
+if __name__ == "__main__":
+    patch_file("app/api/crm_quote_routes.py", QUOTE_FUNCS)
+    patch_file("app/api/crm_contract_routes.py", CONTRACT_FUNCS)
+    sub = ROOT / "app/api/crm_contract_sub_routes.py"
+    if sub.exists():
+        patch_file("app/api/crm_contract_sub_routes.py", CONTRACT_FUNCS)

backend/scripts/patch_pr3_quote_contract.py

@@ -0,0 +1,303 @@
+#!/usr/bin/env python3
+"""PR3 Task 2.6–2.7: quote/contract CRUD 数据权限补丁。"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def patch_quote_py():
+    path = ROOT / "app/crud/crm/quote.py"
+    c = path.read_text()
+    if "apply_crm_owner_scope" in c:
+        print("quote.py already patched")
+        return
+
+    import_block = """from app.crud.crm.data_scope_helpers import apply_crm_owner_scope, ensure_crm_owner_row_in_scope
+
+"""
+    c = c.replace(
+        "from app.services.crm_quote_pdf import generate_quote_pdf\n\n",
+        "from app.services.crm_quote_pdf import generate_quote_pdf\n"
+        + import_block,
+    )
+
+    helper = '''
+def _ensure_quote_in_scope(db: Session, row: CrmQuote, user_info, tenant_no: str) -> None:
+    ensure_crm_owner_row_in_scope(db, row, user_info, tenant_no, message="无权访问该报价单")
+
+
+def _get_quote_in_scope(
+    db: Session,
+    quote_id: str,
+    *,
+    tenant_no: str,
+    user_info=None,
+) -> CrmQuote:
+    obj = get_quote(db, quote_id, tenant_no=tenant_no)
+    if not obj:
+        raise ValueError("报价单不存在")
+    _ensure_quote_in_scope(db, obj, user_info, tenant_no)
+    return obj
+
+'''
+    c = c.replace("_DATE_FMT = \"%Y-%m-%d\"\n\n\n", "_DATE_FMT = \"%Y-%m-%d\"\n" + helper + "\n")
+
+    # list_quotes
+    c = c.replace(
+        "    current_user_id: str = None,\n) -> Tuple[List[Dict[str, Any]], int]:\n    \"\"\"Java: queryPageList\"\"\"\n    q = db.query(CrmQuote)\n    q = _build_quote_filters(db, q, filters or {}, tenant_no=tenant_no)",
+        "    current_user_id: str = None,\n    user_info=None,\n) -> Tuple[List[Dict[str, Any]], int]:\n    \"\"\"Java: queryPageList\"\"\"\n    q = db.query(CrmQuote)\n    q = _build_quote_filters(db, q, filters or {}, tenant_no=tenant_no)\n    if user_info:\n        q = apply_crm_owner_scope(q, CrmQuote, user_info, db, tenant_no)",
+    )
+
+    # get_quote_detail
+    c = c.replace(
+        "def get_quote_detail(\n    db: Session,\n    quote_id: str,\n    *,\n    tenant_no: str = None,\n) -> Dict[str, Any]:",
+        "def get_quote_detail(\n    db: Session,\n    quote_id: str,\n    *,\n    tenant_no: str = None,\n    user_info=None,\n) -> Dict[str, Any]:",
+    )
+    c = c.replace(
+        '    obj = get_quote(db, quote_id, tenant_no=tenant_no)\n    if not obj:\n        raise ValueError("报价单不存在")\n\n    detail = _row_to_dict(obj)',
+        '    obj = get_quote(db, quote_id, tenant_no=tenant_no)\n    if not obj:\n        raise ValueError("报价单不存在")\n    _ensure_quote_in_scope(db, obj, user_info, tenant_no or obj.tenant_no)\n\n    detail = _row_to_dict(obj)',
+    )
+
+    # Mutations: replace get_quote with _get_quote_in_scope where entity is used for mutation
+    mutation_funcs = [
+        "update_quote",
+        "soft_delete_quotes",
+        "submit_quote",
+        "save_template",
+        "get_template",
+        "generate_pdf",
+        "generate_share",
+        "accept_quote",
+        "reject_quote",
+        "to_contract",
+        "create_new_version",
+        "query_versions",
+        "withdraw_quote_approval",
+        "invalid_quote",
+    ]
+    for fn in mutation_funcs:
+        # add user_info to signature before closing paren of def
+        pat = rf"(def {fn}\([^)]*)(\n\) ->)"
+        if re.search(pat, c, re.DOTALL):
+            block = re.search(rf"def {fn}\((.*?)\n\) ->", c, re.DOTALL)
+            if block and "user_info" not in block.group(1):
+                c = re.sub(
+                    rf"(def {fn}\(.*?)((?:,\n)?\n\) ->)",
+                    r"\1,\n    user_info=None,\2",
+                    c,
+                    count=1,
+                    flags=re.DOTALL,
+                )
+
+    # Replace entity = get_quote patterns in mutation bodies
+    c = re.sub(
+        r"(\n    old = )get_quote\(db, quote_id, tenant_no=tenant_no\)",
+        r"\1_get_quote_in_scope(db, quote_id, tenant_no=tenant_no, user_info=user_info)",
+        c,
+    )
+    c = re.sub(
+        r"(\n        entity = )get_quote\(db, qid, tenant_no=tenant_no\)",
+        r"\1_get_quote_in_scope(db, qid, tenant_no=tenant_no, user_info=user_info)",
+        c,
+    )
+    c = re.sub(
+        r"(\n    entity = )get_quote\(db, quote_id, tenant_no=tenant_no\)",
+        r"\1_get_quote_in_scope(db, quote_id, tenant_no=tenant_no, user_info=user_info)",
+        c,
+    )
+
+    # statistics
+    for fn in ("statistics_overview", "statistics_status", "statistics_trend"):
+        pat = rf"def {fn}\("
+        if f"def {fn}(" in c and f"def {fn}(" in c:
+            block = re.search(rf"def {fn}\((.*?)\n\) ->", c, re.DOTALL)
+            if block and "user_info" not in block.group(1):
+                c = re.sub(
+                    rf"(def {fn}\(.*?)((?:,\n)?\n\) ->)",
+                    r"\1,\n    user_info=None,\2",
+                    c,
+                    count=1,
+                    flags=re.DOTALL,
+                )
+
+    # Add scope to statistics queries - find q = db.query(CrmQuote) in statistics funcs
+    c = c.replace(
+        '    q = db.query(CrmQuote).filter(\n        CrmQuote.tenant_no == tenant_no,\n        CrmQuote.del_flag == 0,\n    )\n    if quote_type:',
+        '    q = db.query(CrmQuote).filter(\n        CrmQuote.tenant_no == tenant_no,\n        CrmQuote.del_flag == 0,\n    )\n    if user_info:\n        q = apply_crm_owner_scope(q, CrmQuote, user_info, db, tenant_no)\n    if quote_type:',
+    )
+
+    path.write_text(c)
+    print("patched quote.py")
+
+
+def patch_contract_py():
+    path = ROOT / "app/crud/crm/contract.py"
+    c = path.read_text()
+    if "apply_crm_owner_scope" in c:
+        print("contract.py already patched")
+        return
+
+    # find first import from app.
+    c = c.replace(
+        "from app.core.utils import generate_uuid\n",
+        "from app.core.utils import generate_uuid\n"
+        "from app.crud.crm.data_scope_helpers import apply_crm_owner_scope, ensure_crm_owner_row_in_scope\n",
+    )
+
+    helper = '''
+def _ensure_contract_in_scope(db: Session, row: CrmContract, user_info, tenant_no: str) -> None:
+    ensure_crm_owner_row_in_scope(db, row, user_info, tenant_no, message="无权访问该合同")
+
+
+def _get_contract_row_in_scope(
+    db: Session,
+    contract_id: str,
+    *,
+    tenant_no: str,
+    user_info=None,
+) -> CrmContract:
+    row = get_contract_row(db, contract_id, tenant_no=tenant_no)
+    if not row:
+        raise ValueError("合同不存在")
+    _ensure_contract_in_scope(db, row, user_info, tenant_no)
+    return row
+
+'''
+    # Insert after CrmContract import line area - find _FMT
+    c = c.replace("_FMT = \"%Y-%m-%d %H:%M:%S\"\n", "_FMT = \"%Y-%m-%d %H:%M:%S\"\n" + helper + "\n")
+
+    c = c.replace(
+        "    current_user_id: str = None,\n) -> Tuple[List[Dict[str, Any]], int]:\n    \"\"\"Java: queryPageList\"\"\"\n    q = db.query(CrmContract)\n    q = _build_contract_filters(db, q, filters or {}, tenant_no=tenant_no)",
+        "    current_user_id: str = None,\n    user_info=None,\n) -> Tuple[List[Dict[str, Any]], int]:\n    \"\"\"Java: queryPageList\"\"\"\n    q = db.query(CrmContract)\n    q = _build_contract_filters(db, q, filters or {}, tenant_no=tenant_no)\n    if user_info:\n        q = apply_crm_owner_scope(q, CrmContract, user_info, db, tenant_no)",
+    )
+
+    c = c.replace(
+        "def get_contract(\n    db: Session,\n    contract_id: str,\n    *,\n    tenant_no: str,\n    current_user_id: str = None,\n) -> Optional[Dict[str, Any]]:",
+        "def get_contract(\n    db: Session,\n    contract_id: str,\n    *,\n    tenant_no: str,\n    current_user_id: str = None,\n    user_info=None,\n) -> Optional[Dict[str, Any]]:",
+    )
+    c = c.replace(
+        "    if not row:\n        return None\n\n    detail = _row_to_dict(row)",
+        "    if not row:\n        return None\n    _ensure_contract_in_scope(db, row, user_info, tenant_no)\n\n    detail = _row_to_dict(row)",
+    )
+
+    c = c.replace(
+        "def get_contract_detail(\n    db: Session,\n    contract_id: str,\n    *,\n    tenant_no: str,\n    current_user_id: str = None,\n) -> Dict[str, Any]:",
+        "def get_contract_detail(\n    db: Session,\n    contract_id: str,\n    *,\n    tenant_no: str,\n    current_user_id: str = None,\n    user_info=None,\n) -> Dict[str, Any]:",
+    )
+    c = c.replace(
+        "    detail = get_contract(\n        db,\n        contract_id,\n        tenant_no=tenant_no,\n        current_user_id=current_user_id,\n    )",
+        "    detail = get_contract(\n        db,\n        contract_id,\n        tenant_no=tenant_no,\n        current_user_id=current_user_id,\n        user_info=user_info,\n    )",
+    )
+
+    mutation_funcs = [
+        "update_contract",
+        "soft_delete_contracts",
+        "submit_contract_approval",
+        "withdraw_contract_approval",
+        "approve_contract_by_contract_id",
+        "sign_contract",
+        "start_execute",
+        "finish_contract",
+        "invalid_contract",
+        "renew_contract",
+        "batch_assign_owner",
+        "batch_submit_contract_approval",
+        "upload_attachments",
+        "upload_attachments_with_category",
+        "upload_file",
+        "save_template",
+        "get_template",
+        "download_contract_pdf",
+        "create_from_quote",
+        "create_from_opportunity",
+        "export_contracts",
+        "query_expiring",
+        "statistics_overview",
+        "statistics_by_status",
+        "statistics_by_type",
+        "statistics_trend",
+    ]
+    for fn in mutation_funcs:
+        block = re.search(rf"def {fn}\((.*?)\n\) ->", c, re.DOTALL)
+        if block and "user_info" not in block.group(1):
+            c = re.sub(
+                rf"(def {fn}\(.*?)((?:,\n)?\n\) ->)",
+                r"\1,\n    user_info=None,\2",
+                c,
+                count=1,
+                flags=re.DOTALL,
+            )
+
+    # Replace get_contract_row with scoped version in mutations
+    c = re.sub(
+        r"(\n    row = )get_contract_row\(db, contract_id, tenant_no=tenant_no\)",
+        r"\1_get_contract_row_in_scope(db, contract_id, tenant_no=tenant_no, user_info=user_info)",
+        c,
+    )
+    c = re.sub(
+        r"(\n        entity = )get_contract_row\(db, cid, tenant_no=tenant_no\)",
+        r"\1_get_contract_row_in_scope(db, cid, tenant_no=tenant_no, user_info=user_info)",
+        c,
+    )
+    c = re.sub(
+        r"(\n    entity = )get_contract_row\(db, contract_id, tenant_no=tenant_no\)",
+        r"\1_get_contract_row_in_scope(db, contract_id, tenant_no=tenant_no, user_info=user_info)",
+        c,
+    )
+    c = re.sub(
+        r"(\n    old = )get_contract_row\(db, contract_id, tenant_no=tenant_no\)",
+        r"\1_get_contract_row_in_scope(db, contract_id, tenant_no=tenant_no, user_info=user_info)",
+        c,
+    )
+
+    path.write_text(c)
+    print("patched contract.py")
+
+
+def patch_quote_product_py():
+    path = ROOT / "app/crud/crm/quote_product.py"
+    c = path.read_text()
+    if "_ensure_quote_product_scope" in c:
+        print("quote_product.py already patched")
+        return
+    c = c.replace(
+        "from app.core.utils import generate_uuid\n",
+        "from app.core.utils import generate_uuid\n"
+        "from app.crud.crm.quote import _get_quote_in_scope\n",
+    )
+
+    helper = '''
+def _ensure_quote_parent_scope(db: Session, quote_id: str, tenant_no: str, user_info) -> None:
+    if user_info:
+        _get_quote_in_scope(db, quote_id, tenant_no=tenant_no, user_info=user_info)
+
+'''
+    c = c.replace("_FMT = \"%Y-%m-%d %H:%M:%S\"\n\n", "_FMT = \"%Y-%m-%d %H:%M:%S\"\n" + helper + "\n")
+
+    for fn in ("list_quote_products", "insert_quote_product", "update_quote_product", "soft_delete_quote_products"):
+        block = re.search(rf"def {fn}\((.*?)\n\) ->", c, re.DOTALL)
+        if block and "user_info" not in block.group(1):
+            c = re.sub(
+                rf"(def {fn}\(.*?)((?:,\n)?\n\) ->)",
+                r"\1,\n    user_info=None,\2",
+                c,
+                count=1,
+                flags=re.DOTALL,
+            )
+
+    c = c.replace(
+        '    """Java: queryListByQuoteId"""\n    q = db.query(CrmQuoteProduct)',
+        '    """Java: queryListByQuoteId"""\n    if tenant_no and user_info:\n        _ensure_quote_parent_scope(db, quote_id, tenant_no, user_info)\n    q = db.query(CrmQuoteProduct)',
+    )
+
+    path.write_text(c)
+    print("patched quote_product.py (partial)")
+
+
+if __name__ == "__main__":
+    patch_quote_py()
+    patch_contract_py()
+    patch_quote_product_py()