# Requirements Document

## Introduction

本功能用于限制营部及以下级别账号在上报消耗页面和上报历史中的数据可见性。当前系统允许用户查看所有下级单位的上报记录，但营部及以下级别用户不应看到同级单位及同级单位下级的上报记录，只能查看本单位及本单位直接下级的记录。

## Glossary

- **Consumption_Report_System**: 消耗上报管理系统，负责处理物资消耗的上报、查询和历史记录展示
- **Battalion_Level**: 营级组织层级（OrganizationalLevel.Battalion = 3）
- **Company_Level**: 连级组织层级（OrganizationalLevel.Company = 4）
- **Sibling_Unit**: 同级单位，指与当前用户所属单位具有相同父级单位的其他组织单位
- **Subordinate_Unit**: 下级单位，指当前用户所属单位的直接或间接子单位
- **Report_History**: 上报历史，包含已提交的消耗上报记录列表

## Requirements

### Requirement 1

**User Story:** As a battalion-level or company-level user, I want to only see consumption reports from my own unit and my direct subordinates, so that I cannot access data from sibling units or their subordinates.

#### Acceptance Criteria

1. WHEN a user with Battalion_Level or Company_Level accesses the report history THEN the Consumption_Report_System SHALL return only records belonging to the user's own unit and the user's direct subordinate units
2. WHEN a user with Battalion_Level or Company_Level queries consumption reports THEN the Consumption_Report_System SHALL exclude all records from sibling units
3. WHEN a user with Battalion_Level or Company_Level queries consumption reports THEN the Consumption_Report_System SHALL exclude all records from subordinates of sibling units
4. WHILE a user is at Division_Level or Regiment_Level THEN the Consumption_Report_System SHALL continue to display all subordinate unit records without filtering

### Requirement 2

**User Story:** As a system administrator, I want the visibility filtering to be applied consistently across all report-related API endpoints, so that data access control is enforced uniformly.

#### Acceptance Criteria

1. WHEN the GetDetailedReports endpoint is called by a Battalion_Level or Company_Level user THEN the Consumption_Report_System SHALL apply the visibility filter to exclude sibling unit records
2. WHEN the GetAggregatedData endpoint is called by a Battalion_Level or Company_Level user THEN the Consumption_Report_System SHALL apply the visibility filter to aggregation calculations
3. WHEN the GetByUnit endpoint is called by a Battalion_Level or Company_Level user THEN the Consumption_Report_System SHALL verify the target unit is within the user's visibility scope before returning data

### Requirement 3

**User Story:** As a developer, I want a reusable visibility filter function, so that the filtering logic can be consistently applied and easily tested.

#### Acceptance Criteria

1. WHEN determining visible units for a user THEN the Consumption_Report_System SHALL provide a method that returns only the user's own unit ID and all subordinate unit IDs
2. WHEN the user's organizational level is Battalion_Level or Company_Level THEN the Consumption_Report_System SHALL use the restricted visibility scope
3. WHEN the user's organizational level is Division_Level or Regiment_Level THEN the Consumption_Report_System SHALL use the full subordinate visibility scope
