feat(pl): 运输计划模块接入数据权限过滤

新增 pl_data_scope 辅助，PL 列表/统计 apply_pl_scope，详情与改删 assert_pl_row_in_scope；运费结算待办审批 skip_scope。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/pl/plan.py

@@ -9,6 +9,7 @@ from sqlalchemy.orm import Session
 from app.core.config import settings
 from app.core.database import get_db
 from app.core.db_auth import DbUserContext, get_db_current_user
+from app.services.pl_data_scope import apply_pl_scope, assert_pl_row_in_scope
 from app.core.tenant_context import get_tenant_no
 from app.core.utils import generate_uuid
 from app.models.crm_models import CrmContract, CrmContractProduct, CrmProduct
@@ -171,6 +172,8 @@ def list_plans(
     if plan_date_to:
         query = query.filter(PlPlan.plan_date <= plan_date_to)
 
+    query = apply_pl_scope(query, PlPlan, user, db, tenant_no)
+
     # 统计总数
     total = query.count()
 
@@ -234,9 +237,8 @@ def count_plans_by_contract(
             PlPlan.del_flag == 0,
             PlPlan.contract_id.in_(ids),
         )
-        .group_by(PlPlan.contract_id)
-        .all()
     )
+    rows = apply_pl_scope(rows, PlPlan, user, db, tenant_no).group_by(PlPlan.contract_id).all()
     return {"counts": {contract_id: count for contract_id, count in rows}}
 
 
@@ -544,7 +546,7 @@ def get_plan(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> PlanWithProducts:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    plan = _get_plan(db, tenant_no, id)
+    plan = _get_plan(db, tenant_no, id, user)
 
     products = (
         db.query(PlPlanProduct)
@@ -588,7 +590,7 @@ def update_plan(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> PlanRead:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    plan = _get_plan(db, tenant_no, id)
+    plan = _get_plan(db, tenant_no, id, user)
 
     # 更新主表字段
     update_data = payload.model_dump(exclude_unset=True, exclude={"products", "transport"})
@@ -698,6 +700,7 @@ def patch_plan_product_certs(
 ) -> PlanWithProducts:
     """更新计划危化品产品购买证/运输证（不触发安排运输）"""
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
+    _get_plan(db, tenant_no, id, user)
     update_plan_product_certs(
         db,
         tenant_no=tenant_no,
@@ -705,7 +708,7 @@ def patch_plan_product_certs(
         items=payload.products,
         user_id=user.id,
     )
-    plan = _get_plan(db, tenant_no, id)
+    plan = _get_plan(db, tenant_no, id, user)
     products = (
         db.query(PlPlanProduct)
         .filter(
@@ -733,7 +736,7 @@ def get_plan_arrange_info(
 ) -> PlanArrangeInfoRead:
     """获取计划已安排运输后的司机链接与地磅出入库关联（供查看弹窗复制简述/二维码）。"""
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    plan = _get_plan(db, tenant_no, id)
+    plan = _get_plan(db, tenant_no, id, user)
 
     empty = PlanArrangeInfoRead(driver_url=None, license_plate=None, site_records=[], inventory_records=[])
     if plan.follow_status == "cancelled" or plan.transport_status != "arranged" or not plan.transport_id:
@@ -847,7 +850,7 @@ def cancel_plan(
 ) -> PlanRead:
     """作废运输计划：取消跟进状态、作废关联地磅出入库单、取消运输单。"""
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    plan = _get_plan(db, tenant_no, id)
+    plan = _get_plan(db, tenant_no, id, user)
 
     if plan.follow_status == "cancelled":
         raise HTTPException(status_code=400, detail="计划已作废")
@@ -905,7 +908,7 @@ def archive_plan(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> PlanWithProducts:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    plan = _get_plan(db, tenant_no, id)
+    plan = _get_plan(db, tenant_no, id, user)
 
     if plan.follow_status == "cancelled":
         raise HTTPException(status_code=400, detail="已作废的计划不能归档")
@@ -965,7 +968,7 @@ def delete_plan(
     user: DbUserContext = Depends(get_db_current_user),
 ) -> None:
     tenant_no = get_tenant_no(db, user.to_tenant_user_dict())
-    plan = _get_plan(db, tenant_no, id)
+    plan = _get_plan(db, tenant_no, id, user)
 
     plan.del_flag = 1
     plan.update_by = user.id
@@ -990,7 +993,7 @@ def delete_plan(
 # =============================================================================
 
 
-def _get_plan(db: Session, tenant_no: str, plan_id: str) -> PlPlan:
+def _get_plan(db: Session, tenant_no: str, plan_id: str, user: DbUserContext) -> PlPlan:
     plan = (
         db.query(PlPlan)
         .filter(
@@ -1002,4 +1005,5 @@ def _get_plan(db: Session, tenant_no: str, plan_id: str) -> PlPlan:
     )
     if not plan:
         raise HTTPException(status_code=404, detail="计划不存在")
+    assert_pl_row_in_scope(db, plan, PlPlan, user, tenant_no)
     return plan