feat(pl): 运输计划模块接入数据权限过滤

新增 pl_data_scope 辅助，PL 列表/统计 apply_pl_scope，详情与改删 assert_pl_row_in_scope；运费结算待办审批 skip_scope。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/pl/base_data.py

@@ -7,6 +7,7 @@ from sqlalchemy.orm import Session
 
 from app.core.database import get_db
 from app.core.db_auth import DbUserContext, get_db_current_user
+from app.services.pl_data_scope import apply_pl_scope, assert_pl_row_in_scope
 from app.core.tenant_context import get_tenant_no
 from app.core.utils import generate_uuid
 from app.models.pl_models import (
@@ -77,6 +78,8 @@ def list_carriers(
             )
         )
 
+    query = apply_pl_scope(query, PlCarrier, user, db, tenant_no)
+
     query = query.order_by(
         case((PlCarrier.order_num.is_(None), 1), else_=0).asc(),
         PlCarrier.create_time.desc(),
@@ -116,7 +119,7 @@ def get_carrier(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> CarrierRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    carrier = _get_carrier(db, tenant_no, id)
+    carrier = _get_carrier(db, tenant_no, id, user)
     return carrier
 
 
@@ -128,7 +131,7 @@ def update_carrier(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> CarrierRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    carrier = _get_carrier(db, tenant_no, id)
+    carrier = _get_carrier(db, tenant_no, id, user)
 
     for key, value in payload.model_dump(exclude_unset=True).items():
         setattr(carrier, key, value)
@@ -146,13 +149,13 @@ def delete_carrier(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> None:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    carrier = _get_carrier(db, tenant_no, id)
+    carrier = _get_carrier(db, tenant_no, id, user)
     carrier.del_flag = 1
     carrier.update_by = user.id
     db.commit()
 
 
-def _get_carrier(db: Session, tenant_no: str, carrier_id: str) -> PlCarrier:
+def _get_carrier(db: Session, tenant_no: str, carrier_id: str, user: DbUserContext) -> PlCarrier:
     carrier = (
         db.query(PlCarrier)
         .filter(
@@ -164,6 +167,7 @@ def _get_carrier(db: Session, tenant_no: str, carrier_id: str) -> PlCarrier:
     )
     if not carrier:
         raise HTTPException(status_code=404, detail="承运商不存在")
+    assert_pl_row_in_scope(db, carrier, PlCarrier, user, tenant_no)
     return carrier
 
 
@@ -229,6 +233,8 @@ def list_vehicles(
     if q:
         query = query.filter(PlVehicle.license_plate.contains(q))
 
+    query = apply_pl_scope(query, PlVehicle, user, db, tenant_no)
+
     query = query.order_by(
         case((PlVehicle.order_num.is_(None), 1), else_=0).asc(),
         PlVehicle.create_time.desc(),
@@ -269,6 +275,7 @@ def create_vehicle(
         carrier_id=payload.carrier_id,
         carrier_name=payload.carrier_name,
         license_plate=payload.license_plate,
+        trailer_no=payload.trailer_no,
         load_capacity=payload.load_capacity,
         vehicle_status=payload.vehicle_status,
         remark=payload.remark,
@@ -315,7 +322,7 @@ def get_vehicle(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> VehicleDetailRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    vehicle = _get_vehicle(db, tenant_no, id)
+    vehicle = _get_vehicle(db, tenant_no, id, user)
     return _vehicle_to_detail(db, tenant_no, vehicle)
 
 
@@ -327,7 +334,7 @@ def update_vehicle(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> VehicleDetailRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    vehicle = _get_vehicle(db, tenant_no, id)
+    vehicle = _get_vehicle(db, tenant_no, id, user)
 
     personnel_list = payload.personnel_list
     cert_list = payload.cert_list
@@ -379,13 +386,13 @@ def delete_vehicle(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> None:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    vehicle = _get_vehicle(db, tenant_no, id)
+    vehicle = _get_vehicle(db, tenant_no, id, user)
     vehicle.del_flag = 1
     vehicle.update_by = user.id
     db.commit()
 
 
-def _get_vehicle(db: Session, tenant_no: str, vehicle_id: str) -> PlVehicle:
+def _get_vehicle(db: Session, tenant_no: str, vehicle_id: str, user: DbUserContext) -> PlVehicle:
     vehicle = (
         db.query(PlVehicle)
         .filter(
@@ -397,6 +404,7 @@ def _get_vehicle(db: Session, tenant_no: str, vehicle_id: str) -> PlVehicle:
     )
     if not vehicle:
         raise HTTPException(status_code=404, detail="车辆不存在")
+    assert_pl_row_in_scope(db, vehicle, PlVehicle, user, tenant_no)
     return vehicle
 
 
@@ -451,6 +459,8 @@ def list_personnel(
             )
         )
 
+    query = apply_pl_scope(query, PlPersonnel, user, db, tenant_no)
+
     query = query.order_by(
         case((PlPersonnel.order_num.is_(None), 1), else_=0).asc(),
         PlPersonnel.create_time.desc(),
@@ -508,7 +518,7 @@ def get_personnel(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> PersonnelDetailRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    personnel = _get_personnel(db, tenant_no, id)
+    personnel = _get_personnel(db, tenant_no, id, user)
     return _personnel_to_detail(db, tenant_no, personnel)
 
 
@@ -520,7 +530,7 @@ def update_personnel(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> PersonnelDetailRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    personnel = _get_personnel(db, tenant_no, id)
+    personnel = _get_personnel(db, tenant_no, id, user)
 
     cert_list = payload.cert_list
     data = payload.model_dump(exclude_unset=True, exclude={"cert_list"})
@@ -557,13 +567,13 @@ def delete_personnel(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> None:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    personnel = _get_personnel(db, tenant_no, id)
+    personnel = _get_personnel(db, tenant_no, id, user)
     personnel.del_flag = 1
     personnel.update_by = user.id
     db.commit()
 
 
-def _get_personnel(db: Session, tenant_no: str, personnel_id: str) -> PlPersonnel:
+def _get_personnel(db: Session, tenant_no: str, personnel_id: str, user: DbUserContext) -> PlPersonnel:
     personnel = (
         db.query(PlPersonnel)
         .filter(
@@ -575,6 +585,7 @@ def _get_personnel(db: Session, tenant_no: str, personnel_id: str) -> PlPersonne
     )
     if not personnel:
         raise HTTPException(status_code=404, detail="人员不存在")
+    assert_pl_row_in_scope(db, personnel, PlPersonnel, user, tenant_no)
     return personnel
 
 
@@ -621,6 +632,8 @@ def list_drivers(
             )
         )
 
+    query = apply_pl_scope(query, PlPersonnel, user, db, tenant_no)
+
     query = query.order_by(
         case((PlPersonnel.order_num.is_(None), 1), else_=0).asc(),
         PlPersonnel.create_time.desc(),
@@ -660,7 +673,7 @@ def get_driver(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> DriverRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    personnel = _get_personnel(db, tenant_no, id)
+    personnel = _get_personnel(db, tenant_no, id, user)
     return _personnel_to_driver_read(personnel)
 
 
@@ -672,7 +685,7 @@ def update_driver(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> DriverRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    personnel = _get_personnel(db, tenant_no, id)
+    personnel = _get_personnel(db, tenant_no, id, user)
 
     if payload.driver_name is not None:
         personnel.personnel_name = payload.driver_name
@@ -696,7 +709,7 @@ def delete_driver(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> None:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    personnel = _get_personnel(db, tenant_no, id)
+    personnel = _get_personnel(db, tenant_no, id, user)
     personnel.del_flag = 1
     personnel.update_by = user.id
     db.commit()
@@ -714,6 +727,8 @@ def bind_vehicle_driver(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> dict:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
+    _get_vehicle(db, tenant_no, payload.vehicle_id, user)
+    _get_personnel(db, tenant_no, payload.driver_id, user)
 
     if payload.is_default == 1:
         db.query(PlVehiclePersonnel).filter(
@@ -764,5 +779,9 @@ def unbind_vehicle_driver(
             .first()
         )
     if vd:
+        if isinstance(vd, PlVehiclePersonnel):
+            assert_pl_row_in_scope(db, vd, PlVehiclePersonnel, user, tenant_no)
+        else:
+            assert_pl_row_in_scope(db, vd, PlVehicleDriver, user, tenant_no)
         vd.del_flag = 1
         db.commit()