未知（继上次中断）

backend/app/api/v1/fees_contracts.py

@@ -6,7 +6,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
 
-from app.core.deps import get_current_user, get_db_session, require_study_not_locked
+from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked
 from app.crud import audit as audit_crud
 from app.crud import contract_fee as contract_fee_crud
 from app.crud import contract_fee_payment as payment_crud
@@ -84,7 +84,17 @@ async def list_contract_fees(
     current_user=Depends(get_current_user),
 ) -> FeeApiResponse[list[ContractFeeListItem]]:
     await _ensure_project_access(db, project_id, current_user, write=False)
-    rows = await contract_fee_crud.list_contract_fees(db, project_id, center_id=center_id, q=q)
+    cra_scope = await get_cra_site_scope(db, project_id, current_user)
+    center_ids = cra_scope[0] if cra_scope else None
+    if center_id and center_ids is not None and center_id not in center_ids:
+        return FeeApiResponse(data=[], meta={"total": 0})
+    rows = await contract_fee_crud.list_contract_fees(
+        db,
+        project_id,
+        center_id=center_id,
+        center_ids=center_ids,
+        q=q,
+    )
     items: list[ContractFeeListItem] = []
     for contract, center_name, paid_total, verified_total, last_paid_date, last_verified_date in rows:
         paid_total_decimal = _to_decimal(paid_total)
@@ -130,6 +140,9 @@ async def get_contract_fee(
     if not contract:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同费用不存在")
     await _ensure_project_access(db, contract.project_id, current_user, write=False)
+    cra_scope = await get_cra_site_scope(db, contract.project_id, current_user)
+    if cra_scope and contract.center_id not in cra_scope[0]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
 
     payments = await payment_crud.list_payments(db, contract.id)
     attachment_types = ["contract_fee_contract", "contract_fee_voucher", "contract_fee_invoice"]