fix: move product_org_auth sync to distribution_agreement_items (not supply_contract_items)

- supply_contract_items: revert — products already belong to reseller's own org
- distribution_agreement_items: create → insert product_org_auth for sub_reseller
- distribution_agreement_items: delete → remove product_org_auth
- org_id in product_org_auth = sub_reseller_id (二级分销商)

supplychain/init.py

@@ -300,17 +300,10 @@ async def update_supply_contract_item(request, params_kw):
 async def delete_supply_contract_item(request, params_kw):
     """Delete a supply contract item."""
     data = params_kw
-    item_id = data["id"]
     db, dbname = _get_sor()
     async with db.sqlorContext(dbname) as sor:
-        await sor.D("supply_contract_items", {"id": item_id})
-    # Also remove product_org_auth
-    async with DBPools().sqlorContext("sage") as sor_sage:
-        await sor_sage.sqlExe(
-            "DELETE FROM product_org_auth WHERE auth_source_id = ${sid}$",
-            {"sid": item_id}
-        )
-    return json.dumps({"status": "ok", "message": "删除成功"})
+        await sor.D("supply_contract_items", {"id": data["id"]})
+        return json.dumps({"status": "ok", "message": "删除成功"})
 
 
 # ============================================================
@@ -488,12 +481,19 @@ async def update_distribution_agreement_item(request, params_kw):
 
 
 async def delete_distribution_agreement_item(request, params_kw):
-    """Delete a distribution agreement item."""
+    """Delete a distribution agreement item and its product_org_auth."""
     data = params_kw
+    item_id = data["id"]
     db, dbname = _get_sor()
     async with db.sqlorContext(dbname) as sor:
-        await sor.D("distribution_agreement_items", {"id": data["id"]})
-        return json.dumps({"status": "ok", "message": "删除成功"})
+        await sor.D("distribution_agreement_items", {"id": item_id})
+    # Also remove product_org_auth
+    async with DBPools().sqlorContext("sage") as sor_sage:
+        await sor_sage.sqlExe(
+            "DELETE FROM product_org_auth WHERE auth_source_id = ${sid}$",
+            {"sid": item_id}
+        )
+    return json.dumps({"status": "ok", "message": "删除成功"})
 
 
 # ============================================================

wwwroot/api/distribution_agreement_items_create.dspy

@@ -6,15 +6,36 @@ try:
     dbname = get_module_dbname('supplychain')
 
     data = dict(params_kw)
-    data['id'] = getID()
+    item_id = getID()
+    data['id'] = item_id
     data['resellerid'] = user_orgid
-    data['created_by'] = user_id
     data['created_at'] = timestampstr()
     data['updated_at'] = timestampstr()
 
+    product_id = data.get('productid')
+    agreement_id = data.get('agreement_id')
+
     async with DBPools().sqlorContext(dbname) as sor:
         await sor.C('distribution_agreement_items', data)
 
+    # Sync product_org_auth: sub_reseller's org gets product auth
+    if product_id and agreement_id:
+        async with DBPools().sqlorContext(dbname) as sor:
+            ag_recs = await sor.sqlExe(
+                'SELECT sub_reseller_id FROM distribution_agreements WHERE id = ${aid}$',
+                {'aid': agreement_id}
+            )
+        if ag_recs:
+            sub_id = ag_recs[0].sub_reseller_id
+            async with DBPools().sqlorContext('sage') as sor_sage:
+                await sor_sage.C('product_org_auth', {
+                    'id': getID(),
+                    'product_id': product_id,
+                    'org_id': sub_id,
+                    'auth_source': 'distribution_agreement',
+                    'auth_source_id': item_id,
+                })
+
     result = {'widgettype': 'Message', 'options': {'title': 'Success', 'message': '分销协议项目创建成功', 'type': 'success'}}
 
 except Exception as e:

wwwroot/api/supply_contract_items_create.dspy

@@ -6,29 +6,14 @@ try:
     dbname = get_module_dbname('supplychain')
 
     data = dict(params_kw)
-    item_id = getID()
-    data['id'] = item_id
+    data['id'] = getID()
     data['resellerid'] = user_orgid
     data['created_at'] = timestampstr()
     data['updated_at'] = timestampstr()
 
-    product_id = data.get('productid')
-    contract_id = data.get('contract_id')
-
     async with DBPools().sqlorContext(dbname) as sor:
         await sor.C('supply_contract_items', data)
 
-    # Sync product_org_auth
-    if product_id:
-        async with DBPools().sqlorContext('sage') as sor_sage:
-            await sor_sage.C('product_org_auth', {
-                'id': getID(),
-                'product_id': product_id,
-                'org_id': user_orgid,
-                'auth_source': 'supply_contract',
-                'auth_source_id': item_id,
-            })
-
     result = {'widgettype': 'Message', 'options': {'title': 'Success', 'message': '供应合同项目创建成功', 'type': 'success'}}
 
 except Exception as e: