fix: 角色分配按俱乐部超管权限隔离

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/views/roles.py

@@ -510,7 +510,7 @@ class GetAdminUserListView(APIView):
                     'UpdateTime': user.KefuProfile.UpdateTime.strftime('%Y-%m-%d %H:%M:%S') if getattr(user.KefuProfile, 'UpdateTime', None) else '',
                 })
 
-            from jituan.services.admin_context import can_manage_admin_assignments
+            from jituan.services.admin_context import can_manage_admin_assignments, get_manageable_club_ids
             return Response({
                 'code': 0,
                 'data': {
@@ -519,6 +519,7 @@ class GetAdminUserListView(APIView):
                     'page': page,
                     'pageSize': page_size,
                     'can_manage_club_assignments': can_manage_admin_assignments(request.user, permissions),
+                    'manageable_club_ids': sorted(get_manageable_club_ids(request.user, permissions)),
                 }
             })
 
@@ -543,12 +544,19 @@ class GetAdminRolesView(APIView):
         if '000001' not in permissions:
             return Response({'code': 403, 'msg': '您无权访问此页面'})
 
+        from jituan.services.admin_context import can_manage_admin_assignments, get_manageable_club_ids
         from jituan.services.club_rbac import filter_roles_for_request
         all_clubs = request.data.get('all_clubs') in (True, 1, '1', 'true', 'yes')
-        if all_clubs:
+        if all_clubs and can_manage_admin_assignments(request.user, permissions):
             roles = Role.objects.filter(RoleStatus=1).order_by('ClubID', 'RoleName').values('RoleName', 'ClubID')
         else:
-            roles = filter_roles_for_request(request).values('RoleName', 'ClubID')
+            manageable = get_manageable_club_ids(request.user, permissions)
+            if manageable:
+                roles = Role.objects.filter(
+                    RoleStatus=1, ClubID__in=manageable,
+                ).order_by('ClubID', 'RoleName').values('RoleName', 'ClubID')
+            else:
+                roles = filter_roles_for_request(request).values('RoleName', 'ClubID')
         return Response({
             'code': 0,
             'data': {
@@ -651,12 +659,15 @@ class ModifyAdminUserView(APIView):
         if kefu is None:
             return permissions
 
-        from jituan.services.admin_context import can_manage_admin_assignments
+        from jituan.services.admin_context import can_manage_admin_assignments, can_manage_roles_for_club
 
         club_assign_actions = {'add_club_assignment', 'remove_club_assignment'}
+        role_manage_actions = {'add_user_roles', 'remove_user_role'}
         if action in club_assign_actions:
             if not can_manage_admin_assignments(request.user, permissions):
-                return Response({'code': 403, 'msg': '仅集团高层（集团总负责人/集团超管）可分配俱乐部任职'})
+                return Response({'code': 403, 'msg': '无权分配俱乐部任职'})
+        elif action in role_manage_actions:
+            pass
         elif '000001' not in permissions:
             return Response({'code': 403, 'msg': '您无权进行此操作'})
 
@@ -707,6 +718,8 @@ class ModifyAdminUserView(APIView):
                 bind_club_id = (request.data.get('target_club_id') or '').strip()
                 if not bind_club_id:
                     bind_club_id = resolve_club_id_from_request(request)
+                if not can_manage_roles_for_club(request.user, permissions, bind_club_id):
+                    return Response({'code': 403, 'msg': '您无权管理该俱乐部的角色分配'})
                 added, missing = [], []
                 for rc in role_codes:
                     role = resolve_role_by_name(rc, bind_club_id)
@@ -746,6 +759,8 @@ class ModifyAdminUserView(APIView):
                 bind_club_id = (request.data.get('target_club_id') or '').strip()
                 if not bind_club_id:
                     bind_club_id = resolve_club_id_from_request(request)
+                if not can_manage_roles_for_club(request.user, permissions, bind_club_id):
+                    return Response({'code': 403, 'msg': '您无权管理该俱乐部的角色分配'})
                 role = resolve_role_by_name(role_code, bind_club_id)
                 if not role:
                     return Response({'code': 404, 'msg': '角色不存在或与所选俱乐部不匹配'})