fix: added permission for plate_order and printing_order api

api_v1/views/printing/test_api.py

@@ -46,12 +46,13 @@ class PrintingOrderAPITestCase(TestCase):
             status=basic_models.EmployeeStatusEnum.ACTIVE
         )
         
-        # 创建客户
+        # 创建客户（设置 created_by 以便客户可见性过滤）
         self.customer = basic_models.Customer.objects.create(
             merchant=self.merchant,
             name='测试客户',
             mobile='13900139000',
-            area='测试地区'
+            area='测试地区',
+            created_by=self.employee
         )
         
         # 创建流程
@@ -72,7 +73,9 @@ class PrintingOrderAPITestCase(TestCase):
         view_perm = Permission.objects.get(codename='view_printingorder')
         add_perm = Permission.objects.get(codename='add_printingorder')
         change_perm = Permission.objects.get(codename='change_printingorder')
-        self.user.user_permissions.add(view_perm, add_perm, change_perm)
+        # 添加 view_all 权限以便测试 API 功能（权限过滤逻辑在专门的测试类中验证）
+        view_all_perm = Permission.objects.get(codename='view_all_printingorders')
+        self.user.user_permissions.add(view_perm, add_perm, change_perm, view_all_perm)
     
     def test_create_printing_order(self):
         """测试创建印染订单"""
@@ -113,11 +116,13 @@ class PrintingOrderAPITestCase(TestCase):
         """测试获取订单列表"""
         # 创建测试订单
         printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='布料1',
             width='150cm'
         )
         printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='布料2',
             width='160cm'
@@ -131,6 +136,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_retrieve_printing_order(self):
         """测试获取订单详情"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -148,6 +154,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_update_printing_order(self):
         """测试更新订单"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='旧布料',
             width='150cm'
@@ -176,6 +183,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_partial_update_printing_order(self):
         """测试部分更新订单"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='原布料',
             width='150cm',
@@ -206,6 +214,7 @@ class PrintingOrderAPITestCase(TestCase):
         self.user.user_permissions.add(delete_perm)
         
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm'
@@ -227,6 +236,7 @@ class PrintingOrderAPITestCase(TestCase):
         self.user.user_permissions.add(invalidate_perm)
         
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -243,6 +253,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_invalidate_without_permission(self):
         """测试没有权限时作废订单失败"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm'
@@ -259,6 +270,7 @@ class PrintingOrderAPITestCase(TestCase):
         self.user.user_permissions.add(activate_perm)
         
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -275,6 +287,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_activate_without_permission(self):
         """测试没有权限时恢复订单失败"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -288,6 +301,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_mark_fabric_received(self):
         """测试标记布料已收"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -304,6 +318,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_mark_fabric_received_already_received(self):
         """测试重复标记布料已收"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -319,15 +334,18 @@ class PrintingOrderAPITestCase(TestCase):
         customer2 = basic_models.Customer.objects.create(
             merchant=self.merchant,
             name='客户2',
-            mobile='13900139001'
+            mobile='13900139001',
+            created_by=self.employee
         )
         
         printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='布料1',
             width='150cm'
         )
         printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=customer2,
             fabric='布料2',
             width='160cm'
@@ -340,12 +358,14 @@ class PrintingOrderAPITestCase(TestCase):
     def test_filter_by_urgent(self):
         """测试按紧急状态过滤"""
         printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='布料1',
             width='150cm',
             is_urgent=True
         )
         printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='布料2',
             width='160cm',
@@ -360,11 +380,13 @@ class PrintingOrderAPITestCase(TestCase):
     def test_search_by_fabric(self):
         """测试按布料搜索"""
         printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='纯棉布料',
             width='150cm'
         )
         printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='涤纶布料',
             width='160cm'
@@ -378,11 +400,13 @@ class PrintingOrderAPITestCase(TestCase):
     def test_ordering(self):
         """测试排序"""
         order1 = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='布料1',
             width='150cm'
         )
         order2 = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='布料2',
             width='160cm'
@@ -406,6 +430,7 @@ class PrintingOrderAPITestCase(TestCase):
         from datetime import date
         
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm'
@@ -452,6 +477,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_order_progress_in_list(self):
         """测试订单列表包含进度字段"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -466,6 +492,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_update_process_when_no_jobs(self):
         """测试没有任务时可以修改流程"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -491,6 +518,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_cannot_update_process_when_job_started(self):
         """测试有已开始的任务时不能修改流程"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -549,6 +577,7 @@ class PrintingOrderAPITestCase(TestCase):
         """测试订单列表包含 jobs_status_summary 字段（PrintingJob 状态汇总）"""
         # 创建订单
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='测试布料',
             width='150cm',
@@ -622,6 +651,7 @@ class PrintingOrderAPITestCase(TestCase):
     def test_jobs_status_summary_empty_when_no_jobs(self):
         """测试没有任务时 jobs_status_summary 为空列表"""
         order = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
             customer=self.customer,
             fabric='无任务订单',
             width='150cm',
@@ -640,3 +670,174 @@ class PrintingOrderAPITestCase(TestCase):
         
         summary = response.data['results'][0]['jobs_status_summary']
         self.assertEqual(summary, [])
+
+
+class CustomerVisibilityFilterTestCase(TestCase):
+    """测试客户可见性过滤"""
+    
+    def setUp(self):
+        from django.core.cache import cache
+        cache.clear()
+        
+        self.client = APIClient()
+        
+        # 创建商户
+        self.merchant = basic_models.Merchant.objects.create(
+            name='测试印花厂',
+            type=basic_models.MerchantTypeEnum.FACTORY
+        )
+        
+        # 创建第二个商户（用于测试 merchant 隔离）
+        self.merchant2 = basic_models.Merchant.objects.create(
+            name='其他印花厂',
+            type=basic_models.MerchantTypeEnum.FACTORY
+        )
+        
+        # 创建用户和员工
+        self.user = User.objects.create_user(
+            username='testuser',
+            password='testpass123',
+            email='test@example.com'
+        )
+        self.employee = basic_models.Employee.objects.create(
+            sys_user=self.user,
+            merchant=self.merchant,
+            name='测试员工',
+            mobile='13800138000',
+            status=basic_models.EmployeeStatusEnum.ACTIVE
+        )
+        
+        # 创建第二个员工（同商户，用于测试客户可见性）
+        self.user2 = User.objects.create_user(
+            username='testuser2',
+            password='testpass123',
+            email='test2@example.com'
+        )
+        self.employee2 = basic_models.Employee.objects.create(
+            sys_user=self.user2,
+            merchant=self.merchant,
+            name='测试员工2',
+            mobile='13800138001',
+            status=basic_models.EmployeeStatusEnum.ACTIVE
+        )
+        
+        # 创建客户（employee 创建的，employee 可见）
+        self.customer_by_emp1 = basic_models.Customer.objects.create(
+            merchant=self.merchant,
+            name='员工1的客户',
+            mobile='13900139000',
+            created_by=self.employee
+        )
+        
+        # 创建客户（employee2 创建的，默认 employee 不可见）
+        self.customer_by_emp2 = basic_models.Customer.objects.create(
+            merchant=self.merchant,
+            name='员工2的客户',
+            mobile='13900139001',
+            created_by=self.employee2
+        )
+        
+        # 创建 employee 可见客户的订单
+        self.order_visible = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
+            customer=self.customer_by_emp1,
+            fabric='可见订单',
+            width='150cm'
+        )
+        
+        # 创建 employee 不可见客户的订单
+        self.order_invisible = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant,
+            customer=self.customer_by_emp2,
+            fabric='不可见订单',
+            width='150cm'
+        )
+        
+        # 创建其他商户的订单（merchant 隔离测试）
+        self.customer_other_merchant = basic_models.Customer.objects.create(
+            merchant=self.merchant2,
+            name='其他商户客户',
+            mobile='13900139002'
+        )
+        self.order_other_merchant = printing_models.PrintingOrder.objects.create(
+            merchant=self.merchant2,
+            customer=self.customer_other_merchant,
+            fabric='其他商户订单',
+            width='150cm'
+        )
+        
+        # 给用户添加基础权限（不含 view_all）
+        view_perm = Permission.objects.get(codename='view_printingorder')
+        self.user.user_permissions.add(view_perm)
+        self.user2.user_permissions.add(view_perm)
+        
+        self.client.force_authenticate(user=self.user)
+    
+    def test_list_only_visible_orders(self):
+        """测试普通员工只能看到可见客户的订单"""
+        response = self.client.get('/api/v1/printing-orders/')
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        
+        # 应该只能看到自己创建的客户的订单 = 1
+        self.assertEqual(response.data['count'], 1)
+        
+        fabrics = [r['fabric'] for r in response.data['results']]
+        self.assertIn('可见订单', fabrics)
+        self.assertNotIn('不可见订单', fabrics)
+        self.assertNotIn('其他商户订单', fabrics)
+    
+    def test_retrieve_visible_order(self):
+        """测试可以获取可见订单详情"""
+        response = self.client.get(f'/api/v1/printing-orders/{self.order_visible.id}/')
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+    
+    def test_retrieve_invisible_order_404(self):
+        """测试无法获取不可见订单详情"""
+        response = self.client.get(f'/api/v1/printing-orders/{self.order_invisible.id}/')
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+    
+    def test_retrieve_other_merchant_order_404(self):
+        """测试无法获取其他商户的订单"""
+        response = self.client.get(f'/api/v1/printing-orders/{self.order_other_merchant.id}/')
+        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+    
+    def test_customer_in_visible_employees_can_see(self):
+        """测试被加入 visible_employees 后可以看到订单"""
+        # 将 employee 加入 customer_by_emp2 的可见员工列表
+        self.customer_by_emp2.visible_employees.add(self.employee)
+        
+        response = self.client.get('/api/v1/printing-orders/')
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        
+        # 现在应该能看到 2 个订单（自己创建的 + 被加入可见列表的）
+        self.assertEqual(response.data['count'], 2)
+        
+        fabrics = [r['fabric'] for r in response.data['results']]
+        self.assertIn('不可见订单', fabrics)
+    
+    def test_view_all_permission_bypasses_filter(self):
+        """测试 view_all 权限可以突破客户可见性限制"""
+        # 添加 view_all 权限
+        view_all_perm = Permission.objects.get(codename='view_all_printingorders')
+        self.user.user_permissions.add(view_all_perm)
+        
+        response = self.client.get('/api/v1/printing-orders/')
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        
+        # 应该能看到本商户的所有订单（2个），但不能看到其他商户的
+        self.assertEqual(response.data['count'], 2)
+        
+        fabrics = [r['fabric'] for r in response.data['results']]
+        self.assertIn('不可见订单', fabrics)
+        self.assertNotIn('其他商户订单', fabrics)
+    
+    def test_superuser_sees_all(self):
+        """测试超级用户可以看到所有订单"""
+        self.user.is_superuser = True
+        self.user.save()
+        
+        response = self.client.get('/api/v1/printing-orders/')
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        
+        # 超级用户可以看到所有订单（包括其他商户）
+        self.assertEqual(response.data['count'], 3)