31 lines
1012 B
Plaintext
31 lines
1012 B
Plaintext
# cockpit_project_picker.dspy - Returns projects as {value, text} for dropdown
|
||
# Used by cockpit context bar project picker
|
||
#
|
||
# 跨租户修复（2026-09-18 银联事故实锤）：旧版全表无过滤，任何登录用户能枚举
|
||
# 全部机构的全部项目（含他机构标书项目），配合 cockpit_context_update 无归属
|
||
# 校验可把他机构项目写进自己的会话指针 → 工作空间/读文件端点随之越权看到他
|
||
# 机构文件。可见范围对齐 agent_project_popup 切换门禁（用户 2026-09-11 拍板）：
|
||
# 本产线 + 本人创建。
|
||
|
||
dbname = get_module_dbname('pipeline-sdlc')
|
||
|
||
uid = await get_user()
|
||
if not uid:
|
||
return []
|
||
|
||
async with DBPools().sqlorContext(dbname) as sor:
|
||
recs = await sor.sqlExe(
|
||
"SELECT id, name FROM sd_projects WHERE pipeline_id='sdlc_general' "
|
||
"AND created_by=${u}$ ORDER BY name",
|
||
{"u": uid}
|
||
)
|
||
|
||
rows = []
|
||
for r in recs:
|
||
rows.append({
|
||
'value': r.id,
|
||
'text': r.name,
|
||
})
|
||
|
||
return rows
|