feat: 多俱乐部后台权限与管理员用户俱乐部分配

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/utils.py

@@ -166,12 +166,32 @@ def verify_kefu_permission(request, username_from_frontend=None):
 
     # ---------- 4. 获取用户的所有权限 ----------
     # 使用 gvsdsdk RBAC 表（UserRole → RolePermission → Permission）
+    from jituan.constants import CLUB_ID_DEFAULT, DATA_SCOPE_SINGLE
+    from jituan.services.admin_context import resolve_admin_effective_club, get_allowed_club_ids, is_system_super_admin
+    from jituan.services.club_rbac import filter_role_uuids_for_club_scope
+
+    eff_club = getattr(request, 'club_id', None) or CLUB_ID_DEFAULT
+    eff_scope = getattr(request, 'club_scope', None) or DATA_SCOPE_SINGLE
+    allowed_club_ids = None
+    if not is_system_super_admin(current_user):
+        eff_club, eff_scope, club_err = resolve_admin_effective_club(current_user, request)
+        if club_err:
+            return None, Response({'code': 403, 'msg': club_err}, status=403)
+        request.club_id = eff_club
+        request.club_scope = eff_scope
+        allowed_club_ids = list(get_allowed_club_ids(current_user))
+
     try:
         user_uuid = current_user.UserUUID
         role_uuids = list(SdkUserRole.objects.filter(
             UserUUID=user_uuid
         ).values_list('RoleUUID', flat=True))
 
+        if role_uuids and not is_system_super_admin(current_user):
+            role_uuids = filter_role_uuids_for_club_scope(
+                role_uuids, eff_club, eff_scope, allowed_club_ids,
+            )
+
         if role_uuids:
             perm_uuids = list(SdkRolePermission.objects.filter(
                 RoleUUID__in=role_uuids