From 179348ad662ca4f4fa030afd862f43e7d5712560 Mon Sep 17 00:00:00 2001 From: terrylee Date: Mon, 29 Jun 2026 14:24:47 +0800 Subject: [PATCH] =?UTF-8?q?feat(sales):=20=E6=89=B9=E6=AC=A1=E7=94=A2?= =?UTF-8?q?=E7=A2=BC=E6=95=B8=E9=87=8F=E4=B8=8A=E9=99=90=E4=BE=9D=E8=A7=92?= =?UTF-8?q?=E8=89=B2=E5=88=86=E7=B4=9A=EF=BC=88=E5=AE=A2=E6=88=B6=E7=AB=AF?= =?UTF-8?q?=E6=9C=80=E5=A4=9A20=E3=80=81=E7=AE=A1=E7=90=86=E5=93=A1?= =?UTF-8?q?=E6=9C=80=E5=A4=9A1000=EF=BC=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 平台管理員(isSystemAdmin)：數量上限 1000，快捷 10/50/100/1000 - 客戶端(租戶)：數量上限 20，快捷 10/20，欄位輸入超過自動夾回 20 - 後端 store 以角色動態 max 驗證，防止前端被繞過送出大量產碼 - 取貨碼/通行碼兩表單同步；前端 max 與快捷選項由後端依角色下發 Co-Authored-By: Claude Opus 4.8 (1M context) --- .../Controllers/Admin/SalesController.php | 21 +++++++++++++++++-- .../admin/sales/pass-codes/index.blade.php | 11 ++++++---- .../admin/sales/pickup-codes/index.blade.php | 13 +++++++----- 3 files changed, 34 insertions(+), 11 deletions(-) diff --git a/app/Http/Controllers/Admin/SalesController.php b/app/Http/Controllers/Admin/SalesController.php index 4e5eeeb..9a735be 100644 --- a/app/Http/Controllers/Admin/SalesController.php +++ b/app/Http/Controllers/Admin/SalesController.php @@ -374,6 +374,11 @@ class SalesController extends Controller 'tab' => $tab, ]; + // 批次產生數量上限/快捷選項依角色分級：平台管理員 1000（10/50/100/1000）、客戶端 20（10/20） + $isSystemAdmin = Auth::user()->isSystemAdmin(); + $data['maxBatchQuantity'] = $isSystemAdmin ? 1000 : 20; + $data['batchQuickOptions'] = $isSystemAdmin ? [10, 50, 100, 1000] : [10, 20]; + // 1. 取貨碼列表 (list) if (!$isAjax || $tab === 'list') { // 僅顯示目前帳號可存取機台的取貨碼（機台授權以 machine_user 為準，whereHas 會套用 Machine 的 machine_access 全域 scope） @@ -475,6 +480,10 @@ class SalesController extends Controller */ public function storePickupCode(Request $request) { + // 批次數量上限依角色分級：平台管理員最多 1000 筆；客戶端（租戶）最多 20 筆。 + // 後端強制把關，避免前端被繞過送出大量產碼請求。 + $maxQuantity = Auth::user()->isSystemAdmin() ? 1000 : 20; + $validated = $request->validate([ 'machine_id' => 'required|exists:machines,id', // 取貨碼改綁「商品」：新流程傳 product_id；舊的綁「貨道」流程仍可傳 slot_no（向後相容）。 @@ -484,7 +493,7 @@ class SalesController extends Controller 'expires_hours' => 'nullable|integer|min:1|max:720', 'expires_at' => 'nullable|date|after:now', 'custom_code' => 'nullable|string|min:4|max:12', - 'quantity' => 'nullable|integer|min:1|max:1000', + 'quantity' => 'nullable|integer|min:1|max:' . $maxQuantity, ]); $machine = Machine::findOrFail($validated['machine_id']); @@ -704,6 +713,11 @@ class SalesController extends Controller 'tab' => $tab, ]; + // 批次產生數量上限/快捷選項依角色分級：平台管理員 1000（10/50/100/1000）、客戶端 20（10/20） + $isSystemAdmin = Auth::user()->isSystemAdmin(); + $data['maxBatchQuantity'] = $isSystemAdmin ? 1000 : 20; + $data['batchQuickOptions'] = $isSystemAdmin ? [10, 50, 100, 1000] : [10, 20]; + // 1. 通行碼列表 (list) if (!$isAjax || $tab === 'list') { // 僅顯示目前帳號可存取機台的通行碼（機台授權以 machine_user 為準，whereHas 會套用 Machine 的 machine_access 全域 scope） @@ -813,12 +827,15 @@ class SalesController extends Controller */ public function storePassCode(Request $request) { + // 批次數量上限依角色分級：平台管理員最多 1000 筆；客戶端（租戶）最多 20 筆（後端強制把關）。 + $maxQuantity = Auth::user()->isSystemAdmin() ? 1000 : 20; + $validated = $request->validate([ 'machine_id' => 'required|exists:machines,id', 'name' => 'required|string|max:50', 'expires_days' => 'nullable|integer|min:0', 'custom_code' => 'nullable|string|min:4|max:12', - 'quantity' => 'nullable|integer|min:1|max:1000', + 'quantity' => 'nullable|integer|min:1|max:' . $maxQuantity, ]); $machine = Machine::findOrFail($validated['machine_id']); diff --git a/resources/views/admin/sales/pass-codes/index.blade.php b/resources/views/admin/sales/pass-codes/index.blade.php index c4e77c9..41c38dc 100644 --- a/resources/views/admin/sales/pass-codes/index.blade.php +++ b/resources/views/admin/sales/pass-codes/index.blade.php @@ -13,6 +13,8 @@ expiresDays: 7, customCode: '', quantity: 1, + maxBatchQty: {{ (int) ($maxBatchQuantity ?? 20) }}, + batchQuickOptions: @js($batchQuickOptions ?? [10, 20]), status: '{{ request('status', '') }}', showQrModal: false, activeQrCode: '', @@ -309,7 +311,7 @@ {{-- Quantity (Batch Generate) --}}
@@ -318,16 +320,17 @@
-
-
-