test: 第二轮深度审计(越权隔离/引用完整性/公开面/持久化 16项, 修复4处缺陷)

src/huamenchuang/api/contracts.py

@@ -122,9 +122,11 @@ async def convert_contract(body: ConvertBody, user: CurrentUser, db: DbSession):
 
 @router.delete("/{contract_id}")
 async def delete_contract(contract_id: int, user: CurrentUser, db: DbSession):
-    """删除合同。"""
+    """删除合同（有订单/有效收款时拒绝）。"""
     try:
         await ContractService(db).delete(user, contract_id)
     except KeyError as e:
         return fail(str(e))
+    except ValueError as e:
+        return fail(str(e))
     return ok(message="删除成功")

src/huamenchuang/api/customers.py

@@ -62,11 +62,13 @@ async def update_customer(customer_id: int, body: CustomerBody, user: CurrentUse
 
 @router.delete("/{customer_id}")
 async def delete_customer(customer_id: int, user: CurrentUser, db: DbSession):
-    """删除客户。"""
+    """删除客户（有合同/量尺/跟进时拒绝）。"""
     try:
         await CustomerService(db).delete(user, customer_id)
     except KeyError as e:
         return fail(str(e))
+    except ValueError as e:
+        return fail(str(e))
     return ok(message="删除成功")
 
 

src/huamenchuang/api/orders.py

@@ -133,11 +133,13 @@ async def update_order(order_id: int, body: OrderUpdate, user: CurrentUser, db:
 
 @router.delete("/{order_id}")
 async def delete_order(order_id: int, user: CurrentUser, db: DbSession):
-    """删除订单（软动作：记日志后物理删除）。"""
+    """删除订单（已完工订单拒绝）。"""
     try:
         await OrderService(db).delete_order(user, order_id)
     except KeyError as e:
         return fail(str(e))
+    except ValueError as e:
+        return fail(str(e))
     return ok(message="删除成功")