site+'%'

src/utils/subSiteAuth.js

@@ -0,0 +1,80 @@
+/**
+ * 统一格式化站点编码，避免大小写和空白导致匹配失败
+ * @param {*} siteCode
+ * @returns {string}
+ */
+function normalizeSiteCode(siteCode) {
+  return String(siteCode || '')
+    .replace(/%/g, '')
+    .trim()
+    .toUpperCase();
+}
+
+/**
+ * 站点编码去重并清理空值
+ * @param {Array} siteCodeList
+ * @returns {Array<string>}
+ */
+function normalizeSiteCodeList(siteCodeList) {
+  if (!Array.isArray(siteCodeList)) {
+    return [];
+  }
+  return Array.from(
+    new Set(
+      siteCodeList
+        .map(code => normalizeSiteCode(code))
+        .filter(code => !!code)
+    )
+  );
+}
+
+/**
+ * 获取当前用户授权子site编码列表
+ * 优先读取Vuex，若为空再回退localStorage，避免页面刷新后Vuex丢失
+ * @param {Array} storeSubSiteCodeList
+ * @returns {Array<string>}
+ */
+export function getAuthorizedSubSiteCodeList(storeSubSiteCodeList) {
+  const subSiteCodeListFromStore = normalizeSiteCodeList(storeSubSiteCodeList);
+  if (subSiteCodeListFromStore.length > 0) {
+    return subSiteCodeListFromStore;
+  }
+
+  try {
+    const localSubSiteCodeList = JSON.parse(localStorage.getItem('userSubSiteCodeList') || '[]');
+    return normalizeSiteCodeList(localSubSiteCodeList);
+  } catch (error) {
+    console.error('解析userSubSiteCodeList失败:', error);
+    return [];
+  }
+}
+
+/**
+ * 按授权子site过滤列表数据，避免接口按site前缀查询后返回越权数据
+ * @param {Array} rows 列表原始数据
+ * @param {Array} authorizedSubSiteCodeList 用户授权子site编码列表
+ * @param {Array} siteFieldList 数据中可能存放站点编码的字段
+ * @returns {Array}
+ */
+export function filterRowsByAuthorizedSubSite(rows, authorizedSubSiteCodeList, siteFieldList = ['contract']) {
+  const sourceRows = Array.isArray(rows) ? rows : [];
+  const normalizedAuthorizedList = normalizeSiteCodeList(authorizedSubSiteCodeList);
+
+  // 未拿到授权子site时，返回空列表，避免放行越权数据
+  if (normalizedAuthorizedList.length === 0) {
+    return [];
+  }
+
+  const authorizedSiteSet = new Set(normalizedAuthorizedList);
+  const validSiteFieldList = Array.isArray(siteFieldList) && siteFieldList.length > 0 ? siteFieldList : ['contract'];
+
+  return sourceRows.filter(row => {
+    if (!row || typeof row !== 'object') {
+      return false;
+    }
+    return validSiteFieldList.some(field => {
+      const rowSiteCode = normalizeSiteCode(row[field]);
+      return rowSiteCode && authorizedSiteSet.has(rowSiteCode);
+    });
+  });
+}

src/views/modules/other-transaction/inventory-move.vue

@@ -142,7 +142,7 @@ export default {
         targetLocationId: ''
       },
       scannedItems: [],
-      site: localStorage.getItem('site') || 'SITE01',
+      site: '',
       loading: false
     };
   },
@@ -236,9 +236,10 @@ export default {
         return;
       }
 
-      // 校验HU是否属于当前站点
+      this.site = this.scannedItems.length > 0 ? this.scannedItems[0].site : huInfo.site; // 设置当前站点为第一个扫描的HU的站点
+      // 所有标签site必须一致
       if (huInfo.site && huInfo.site !== this.site) {
-        this.$message.error('HandlingUnit站点不匹配');
+        this.$message.error('所有标签site必须一致');
         return;
       }
 
@@ -260,7 +261,8 @@ export default {
         batchNo: huInfo.batchNo,
         locationId: huInfo.locationId,
         wdr: huInfo.wdr,
-        expiredDate: huInfo.expiredDate
+        expiredDate: huInfo.expiredDate,
+        site: huInfo.site
       });
 
       this.$message.success('扫描成功');

src/views/modules/production-inbound/inboundRegister.vue

@@ -213,6 +213,7 @@
 <script>
 import { getShopOrderFromIfs, getNextSequenceNo, submitShopOrderInbound, validateMaterialIssued, printLabelCommon } from "@/api/production/production-inbound.js";
 import { getHandlingUnitDetail } from "@/api/handlingunit/handlingunit.js";
+import { filterRowsByAuthorizedSubSite, getAuthorizedSubSiteCodeList } from "@/utils/subSiteAuth.js";
 
 export default {
   data() {
@@ -325,7 +326,10 @@ export default {
 
       getShopOrderFromIfs(requestData).then(({ data }) => {
         if (data.code === 0) {
-          this.shopOrderList = data.data || []
+          const sourceRows = data.data || [];
+          const authorizedSubSiteCodeList = getAuthorizedSubSiteCodeList(this.$store.state.user.subSiteCodeList);
+          // 接口按site前缀查询会返回同前缀下的所有子site，这里按当前用户授权子site做二次过滤
+          this.shopOrderList = filterRowsByAuthorizedSubSite(sourceRows, authorizedSubSiteCodeList, ['contract']);
           if (this.shopOrderList.length === 0) {
             this.$message.warning('未找到匹配的工单');
           } else if (this.shopOrderList.length === 1) {

src/views/modules/production-withdrawal/order-list.vue

@@ -60,7 +60,7 @@
 
 <script>
 import { getShopOrderReceiveHist } from '@/api/production/productionWithdrawal'
-
+import { filterRowsByAuthorizedSubSite, getAuthorizedSubSiteCodeList } from "@/utils/subSiteAuth.js";
 export default {
   name: 'ProductionWithdrawalOrderList',
 
@@ -121,8 +121,10 @@ export default {
         this.fullscreenLoading = false;
 
         if (data && data.code === 0) {
-          this.orderList = data.data || []
-
+          const sourceRows = data.data || [];
+          const authorizedSubSiteCodeList = getAuthorizedSubSiteCodeList(this.$store.state.user.subSiteCodeList);
+          // 接口按site前缀查询会返回同前缀下的所有子site，这里按当前用户授权子site做二次过滤
+          this.orderList = filterRowsByAuthorizedSubSite(sourceRows, authorizedSubSiteCodeList, ['contract']);
           if (this.orderList.length === 0) {
             this.$message.success('暂无接收历史记录')
           }

src/views/modules/recv/qualifiedStorage.vue

@@ -252,7 +252,7 @@
 
 <script>
 import { getPurchaseOrderReceiptList, confirmQualifiedStorage, validateHandlingUnitForQualifiedStorage, getInboundHistory, validateLocationForPicking } from "@/api/po/po.js";
-
+import { filterRowsByAuthorizedSubSite, getAuthorizedSubSiteCodeList } from "@/utils/subSiteAuth.js";
 export default {
   data() {
     return {
@@ -299,7 +299,10 @@ export default {
 
       getPurchaseOrderReceiptList(params).then(({ data }) => {
         if (data.code === 0) {
-          this.receiptList = data.rows || [];
+          const sourceRows = data.rows || [];
+          const authorizedSubSiteCodeList = getAuthorizedSubSiteCodeList(this.$store.state.user.subSiteCodeList);
+          // 接口按site前缀查询会返回同前缀下的所有子site，这里按当前用户授权子site做二次过滤
+          this.receiptList = filterRowsByAuthorizedSubSite(sourceRows, authorizedSubSiteCodeList, ['contract']);
           if (this.receiptList.length === 0) {
             this.$message.success("暂无To be Received状态的接收记录");
           }

src/views/modules/recv/recv.vue

@@ -184,6 +184,7 @@
 
 <script>
 import { getPoList, receivePo, printLabel, getNextItemNo, validateLocationForReceiveCase,getPartAttributeInfo } from "@/api/po/po.js";
+import { filterRowsByAuthorizedSubSite, getAuthorizedSubSiteCodeList } from "@/utils/subSiteAuth.js";
 
 export default {
   data() {
@@ -262,9 +263,10 @@ export default {
       this.fullscreenLoading = true;
       getPoList({ poNumber: this.scanCode,site: this.site+'%' }).then(({ data }) => {
         if (data.code === 0) {
-          /*let subSiteCodeList = localStorage.getItem('userSubSiteCodeList') ;
-          let subSiteCodeList2 = this.$store.state.user.subSiteCodeList;*/
-          this.poList = data.rows
+          const sourceRows = data.rows || [];
+          const authorizedSubSiteCodeList = getAuthorizedSubSiteCodeList(this.$store.state.user.subSiteCodeList);
+          // 接口按site前缀查询会返回同前缀下的所有子site，这里按当前用户授权子site做二次过滤
+          this.poList = filterRowsByAuthorizedSubSite(sourceRows, authorizedSubSiteCodeList, ['contract']);
         } else {
           this.$message.error(data.msg || '操作失败');
         }