feat: auto complete stock change

api_man/serializers.py

@@ -2,62 +2,105 @@ from rest_framework import serializers
 from basic_info import models as basic_models
 
 
-class ProductCategorySerializer(serializers.ModelSerializer):
+class BaseSerializer(serializers.ModelSerializer):
+    merchant = serializers.PrimaryKeyRelatedField(
+        queryset=basic_models.Merchant.objects.all(),
+        required=False  # 创建时由视图层设置
+    )
+
+    def to_representation(self, instance):
+        try:
+            merchant = self.context['request'].user.employee.merchant
+            if instance.merchant != merchant:
+                # 数据保护手段
+                raise PermissionError("无权限访问该对象")
+        except (KeyError, AttributeError):
+            # TODO: log something?
+            raise PermissionError("无权限访问该对象")
+
+        result = super().to_representation(instance)
+        if self.context.get('expand_merchant', False):
+            result['merchant'] = {
+                'id': instance.merchant.id,
+                'name': instance.merchant.name
+            }
+        return result
+
+
+class QuickInputSerializer(serializers.ModelSerializer):
+    class Meta:
+        model = basic_models.QuickInput
+        fields = ['name', 'value', 'group']
+
+
+class ProductCategorySerializer(BaseSerializer):
     class Meta:
         model = basic_models.ProductCategory
         fields = '__all__'
 
 
-class ProductSerializer(serializers.ModelSerializer):
+class ProductSerializer(BaseSerializer):
     class Meta:
         model = basic_models.Product
         fields = '__all__'
-        depth = 1  # 展开外键关系
+
+    def to_representation(self, instance):
+        result = super().to_representation(instance)
+        result['category'] = {
+            'id': instance.category.id,
+            'name': instance.category.name
+        }
+        return result
 
 
-class WareHouseSerializer(serializers.ModelSerializer):
+class WareHouseSerializer(BaseSerializer):
     class Meta:
         model = basic_models.WareHouse
         fields = '__all__'
 
 
-class SupplierSerializer(serializers.ModelSerializer):
+class SupplierSerializer(BaseSerializer):
     class Meta:
         model = basic_models.Supplier
         fields = '__all__'
 
 
-class EmployeeSerializer(serializers.ModelSerializer):
+class EmployeeSerializer(BaseSerializer):
     class Meta:
         model = basic_models.Employee
         fields = '__all__'
 
 
-class CustomerSerializer(serializers.ModelSerializer):
+class CustomerSerializer(BaseSerializer):
+    created_by = serializers.PrimaryKeyRelatedField(
+        queryset=basic_models.Employee.objects.all(),
+        required=False,
+    )
+
     class Meta:
         model = basic_models.Customer
         fields = '__all__'
 
 
-class VehicleTypeSerializer(serializers.ModelSerializer):
+class VehicleTypeSerializer(BaseSerializer):
     class Meta:
         model = basic_models.VehicleType
         fields = '__all__'
 
 
-class BankAccountSerializer(serializers.ModelSerializer):
+class BankAccountSerializer(BaseSerializer):
     class Meta:
         model = basic_models.BankAccount
         fields = '__all__'
 
 
-class DeviceInfoSerializer(serializers.ModelSerializer):
+class DeviceInfoSerializer(BaseSerializer):
     class Meta:
         model = basic_models.DeviceInfo
         fields = '__all__'
 
 
-class VehicleTransportRecordSerializer(serializers.ModelSerializer):
+class VehicleTransportRecordSerializer(BaseSerializer):
     vehicle_type_name = serializers.CharField(source='vehicle_type.name', read_only=True)
     
     class Meta:

api_man/urls.py

@@ -2,6 +2,8 @@ from django.urls import path, include
 from rest_framework import routers
 from . import views
 
+quick_input_router = routers.DefaultRouter()
+quick_input_router.register(prefix='', viewset=views.QuickInputViewSet)
 
 product_router = routers.DefaultRouter()
 product_router.register(prefix='', viewset=views.ProductViewSet)
@@ -35,6 +37,7 @@ vehicle_transport_record_router.register(prefix='', viewset=views.VehicleTranspo
 
 
 urlpatterns = [
+    path('quick-inputs/', include(quick_input_router.urls)),
     path('products/', include(product_router.urls)),
     path('warehouses/', include(warehouse_router.urls)),
     path('product-categories/', include(product_category_router.urls)),

api_man/views.py

@@ -1,9 +1,38 @@
 from rest_framework import viewsets
+from rest_framework.exceptions import PermissionDenied
+from rest_framework.pagination import LimitOffsetPagination
 from . import serializers
 
 
 class BaseViewSet(viewsets.ModelViewSet):
-    permission_classes = []  # 允许所有访问
+    pagination_class = LimitOffsetPagination
+
+    def get_queryset(self):
+        qs = super().get_queryset()
+        # 如果是超级用户，返回所有数据
+        # TODO: 测试结束后要取注释
+        # if self.request.user.is_superuser:
+        #     return qs
+        return qs.filter(merchant=self.request.user.employee.merchant)
+
+    def perform_create(self, serializer):
+        try:
+            merchant = self.request.user.employee.merchant
+            serializer.save(merchant_id=merchant.id)
+        except AttributeError:
+            raise PermissionDenied("无权限创建该对象")
+
+
+class QuickInputViewSet(viewsets.ModelViewSet):
+    queryset = serializers.basic_models.QuickInput.objects
+    serializer_class = serializers.QuickInputSerializer
+
+    def filter_queryset(self, queryset):
+        qs = super().filter_queryset(queryset)
+        group = self.request.query_params.get('group')
+        if group:
+            qs = qs.filter(group=group)
+        return qs
 
 
 class ProductViewSet(BaseViewSet):
@@ -35,6 +64,17 @@ class CustomerViewSet(BaseViewSet):
     queryset = serializers.basic_models.Customer.objects
     serializer_class = serializers.CustomerSerializer
 
+    def perform_create(self, serializer):
+        merchant = self.request.user.employee.merchant
+        employee = self.request.user.employee
+        serializer.save(merchant=merchant, created_by=employee)
+
+    def get_queryset(self):
+        qs = super().get_queryset()
+        # 应用可见性过滤
+        from basic_info.services import CustomerVisibilityService
+        return CustomerVisibilityService.filter_customers_for_employee(qs, self.request.user)
+
 
 class VehicleTypeViewSet(BaseViewSet):
     queryset = serializers.basic_models.VehicleType.objects