fix: 角色分配按俱乐部超管权限隔离

Co-authored-by: Cursor <cursoragent@cursor.com>

jituan/services/admin_context.py

@@ -171,6 +171,31 @@ def can_manage_admin_assignments(user, permissions=None):
     )
 
 
+def can_manage_roles_for_club(user, permissions, club_id):
+    """
+    是否可为指定俱乐部分配/移除功能角色。
+    集团高层：全部俱乐部；否则须在该俱乐部拥有 000001 超级管理权限。
+    """
+    if can_manage_admin_assignments(user, permissions):
+        return True
+    cid = (club_id or '').strip()
+    if not cid:
+        return False
+    from jituan.services.club_rbac import resolve_permission_codes_for_club
+    codes = resolve_permission_codes_for_club(user, cid)
+    return '000001' in codes
+
+
+def get_manageable_club_ids(user, permissions=None):
+    """当前操作者可管理角色分配的俱乐部集合。"""
+    if can_manage_admin_assignments(user, permissions):
+        return {c.club_id for c in Club.query.filter(status=1)}
+    return {
+        c.club_id for c in Club.query.filter(status=1)
+        if can_manage_roles_for_club(user, permissions, c.club_id)
+    }
+
+
 def _pack(scope, club_id, is_group_admin, assignments, clubs, can_switch_club,
           role_code, role_name):
     allowed_club_ids = sorted({

jituan/services/club_rbac.py

@@ -152,6 +152,29 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id
     return list(qs.filter(Q(ClubID=cid) | Q(ClubID='')).values_list('RoleUUID', flat=True))
 
 
+def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None):
+    """指定俱乐部 SINGLE 视图下用户的 gvsdsdk 权限码。"""
+    from jituan.constants import DATA_SCOPE_SINGLE
+    from gvsdsdk.models import Permission as SdkPermission, RolePermission as SdkRolePermission, UserRole as SdkUserRole
+
+    role_uuids = list(SdkUserRole.objects.filter(
+        UserUUID=user.UserUUID,
+    ).values_list('RoleUUID', flat=True))
+    role_uuids = filter_role_uuids_for_club_scope(
+        role_uuids, club_id, DATA_SCOPE_SINGLE, allowed_club_ids,
+    )
+    if not role_uuids:
+        return []
+    perm_uuids = SdkRolePermission.objects.filter(
+        RoleUUID__in=role_uuids,
+    ).values_list('PermUUID', flat=True)
+    return list(
+        SdkPermission.objects.filter(
+            PermUUID__in=perm_uuids, PermStatus=1,
+        ).values_list('PermCode', flat=True).distinct()
+    )
+
+
 def user_bound_role_names(user, club_id=None, scope=None, allowed_club_ids=None):
     from backend.utils import _legacy_backend_role_permissions