29 lines
1.1 KiB
Python
29 lines
1.1 KiB
Python
"""数据权限校验（仅本人名下客户，PRD §五「最小权限原则」）。
|
|
|
|
customer_relation.advisor_id = 当前投顾 id 是数据权限唯一判据；越权一律 403。
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from model.customer_relation import CustomerRelation
|
|
from repositories.customer_relation import CustomerRelationRepo
|
|
from utils.exceptions import ForbiddenError
|
|
|
|
|
|
async def require_owned_relation(
|
|
db: AsyncSession, advisor_id: int, customer_id: int
|
|
) -> CustomerRelation:
|
|
"""校验客户归属并返回关系记录（调用方可继续判断签约状态）；越权抛 403。"""
|
|
rel = await CustomerRelationRepo(db).get_by_customer_advisor(customer_id, advisor_id)
|
|
if rel is None:
|
|
raise ForbiddenError("无权操作该客户数据")
|
|
return rel
|
|
|
|
|
|
async def ensure_customer_owned(
|
|
db: AsyncSession, advisor_id: int, customer_id: int
|
|
) -> None:
|
|
"""仅校验归属，不返回关系（不需要签约状态时用）。"""
|
|
await require_owned_relation(db, advisor_id, customer_id)
|