未知（继上次中断）

backend/app/api/v1/fees_specials.py

@@ -4,7 +4,7 @@ from datetime import date
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_not_locked
+from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked
 from app.crud import audit as audit_crud
 from app.crud import member as member_crud
 from app.crud import special_expense as special_crud
@@ -76,10 +76,15 @@ async def list_special_expenses(
 ) -> FeeApiResponse[list[SpecialExpenseListItem]]:
     await _ensure_project_access(db, project_id, current_user, write=False)
     _validate_category(category)
+    cra_scope = await get_cra_site_scope(db, project_id, current_user)
+    center_ids = cra_scope[0] if cra_scope else None
+    if center_id and center_ids is not None and center_id not in center_ids:
+        return FeeApiResponse(data=[], meta={"total": 0})
     rows = await special_crud.list_special_expenses(
         db,
         project_id,
         center_id=center_id,
+        center_ids=center_ids,
         category=category,
         date_from=date_from,
         date_to=date_to,
@@ -123,6 +128,9 @@ async def get_special_expense(
     if not expense:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="特殊费用不存在")
     await _ensure_project_access(db, expense.project_id, current_user, write=False)
+    cra_scope = await get_cra_site_scope(db, expense.project_id, current_user)
+    if cra_scope and expense.center_id not in cra_scope[0]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     return FeeApiResponse(data=SpecialExpenseRead.model_validate(expense))