feat(backend): 库存成本仅管理员可见——List 抹空 unit_price、Summary 抹零货值

与出库 stripStockOutCost 同口径：operator/readonly 服务端兜底抹除，防抓包看到成本；sale_price 与数量等字段不受影响。CLAUDE.md 口径同步。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JJ1g8XV1YhhmHRzhwWEW7o
2026-07-06 08:11:05 +08:00
parent 3fc0ca5f0c
commit 75d0accb14
3 changed files with 67 additions and 1 deletions
@@ -393,3 +393,52 @@ func TestInventoryHandler_AfterStockInApprove(t *testing.T) {
 	invItem := data[0].(map[string]interface{})
 	assert.Equal(t, float64(20), invItem["quantity"])
 }
+
+// 库存成本仅管理员可见（stripInventoryCost）：operator/readonly 的 List unit_price 抹空、
+// Summary 货值抹零；admin 原样返回。与出库 stripStockOutCost 同口径。
+func TestInventoryHandler_CostVisibility(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "INV_COST")
+	admin := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	operator := testutil.CreateTestUser(db, shop.ID, "op", "pass", "operator")
+	readonly := testutil.CreateTestUser(db, shop.ID, "ro", "pass", "readonly")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	product := testutil.CreateTestProduct(db, shop.ID, "Beer")
+	r := setupProtectedRouter(db)
+
+	price := 100.0
+	require.NoError(t, db.Create(&model.Inventory{
+		ShopID: shop.ID, WarehouseID: &warehouse.ID, ProductID: &product.ID,
+		Quantity: 10, UnitPrice: &price,
+	}).Error)
+
+	// admin：unit_price / stock_value 原样可见
+	adminToken := getAuthToken(admin.ID, shop.ID, "admin")
+	w := makeRequest(r, "GET", "/api/v1/inventory", adminToken, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+	row := parseResponse(w)["data"].([]interface{})[0].(map[string]interface{})
+	assert.Equal(t, float64(100), row["unit_price"])
+
+	w = makeRequest(r, "GET", "/api/v1/inventory/summary", adminToken, nil)
+	assert.Equal(t, float64(1000), parseResponse(w)["stock_value"].(float64))
+
+	// operator / readonly：unit_price 抹空、货值抹零，其余字段不受影响
+	for _, u := range []struct {
+		id   uint64
+		role string
+	}{{operator.ID, "operator"}, {readonly.ID, "readonly"}} {
+		token := getAuthToken(u.id, shop.ID, u.role)
+		w = makeRequest(r, "GET", "/api/v1/inventory", token, nil)
+		assert.Equal(t, http.StatusOK, w.Code)
+		row = parseResponse(w)["data"].([]interface{})[0].(map[string]interface{})
+		assert.Nil(t, row["unit_price"], "role=%s unit_price 应被抹空", u.role)
+		assert.Equal(t, float64(10), row["quantity"])
+
+		w = makeRequest(r, "GET", "/api/v1/inventory/summary", token, nil)
+		resp := parseResponse(w)
+		assert.Equal(t, float64(0), resp["stock_value"].(float64), "role=%s 货值应抹零", u.role)
+		assert.Equal(t, float64(0), resp["last_month_value"].(float64))
+		assert.Equal(t, float64(1), resp["sku_count"].(float64))
+		assert.Equal(t, float64(10), resp["in_stock_qty"].(float64))
+	}
+}