feat: 多俱乐部后台权限与管理员用户俱乐部分配

Co-authored-by: Cursor <cursoragent@cursor.com>

jituan/services/admin_context.py

@@ -14,6 +14,50 @@ GROUP_MANAGE_ROLES = frozenset({
 })
 
 
+def get_allowed_club_ids(user):
+    """用户可切换/访问的子公司 club_id 集合（不含集团汇总）。"""
+    if is_system_super_admin(user):
+        return {c.club_id for c in Club.query.filter(status=1)}
+    assignments = AdminAssignment.query.filter(yonghuid=user.UserUID, status=1)
+    has_group = assignments.filter(
+        club_id__isnull=True
+    ).exists() or assignments.filter(data_scope=DATA_SCOPE_ALL).exists()
+    if has_group:
+        return {c.club_id for c in Club.query.filter(status=1)}
+    return {
+        a.club_id for a in assignments if a.club_id
+    }
+
+
+def resolve_admin_effective_club(user, request):
+    """
+    校验后台用户请求的俱乐部/范围，返回 (club_id, scope, error_msg)。
+    无权限访问请求的俱乐部时，回退到主任职俱乐部（避免 localStorage 脏数据串俱乐部）。
+    """
+    from jituan.services.club_context import resolve_club_id_from_request, resolve_club_scope
+
+    requested_club = resolve_club_id_from_request(request)
+    requested_scope = resolve_club_scope(request)
+
+    if is_system_super_admin(user):
+        return requested_club, requested_scope, None
+
+    ctx = build_admin_club_context(user)
+    allowed = get_allowed_club_ids(user)
+
+    if requested_scope == DATA_SCOPE_ALL:
+        if not ctx.get('is_group_admin'):
+            primary = ctx.get('club_id') or CLUB_ID_DEFAULT
+            return primary, DATA_SCOPE_SINGLE, None
+        return ctx.get('club_id') or CLUB_ID_DEFAULT, DATA_SCOPE_ALL, None
+
+    if requested_club not in allowed:
+        primary = ctx.get('club_id') or CLUB_ID_DEFAULT
+        return primary, DATA_SCOPE_SINGLE, None
+
+    return requested_club, DATA_SCOPE_SINGLE, None
+
+
 def build_admin_club_context(user):
     """
     根据 admin_assignment + 超管推断后台登录后的俱乐部上下文。
@@ -129,16 +173,21 @@ def can_manage_admin_assignments(user, permissions=None):
 
 def _pack(scope, club_id, is_group_admin, assignments, clubs, can_switch_club,
           role_code, role_name):
+    allowed_club_ids = sorted({
+        c['club_id'] for c in clubs if c.get('club_id')
+    })
     return {
         'scope': scope,
         'club_id': club_id,
         'is_group_admin': is_group_admin,
         'role_code': role_code,
         'role_name': role_name,
+        'allowed_club_ids': allowed_club_ids,
         'perm_source': 'gvsdsdk',
         'perm_note': (
-            '【功能权限】在「角色管理」绑 gvsdsdk 角色（如 caiwu、dingdan、000001）；'
-            '【数据范围】在「数据范围配置」维护任职（能看/管哪个俱乐部）。两套独立。'
+            '【功能权限】在「角色管理」为各俱乐部创建角色，在「管理员用户」绑定；'
+            '切换俱乐部后菜单按该俱乐部角色生效。'
+            '【数据范围】在本页添加任职，可分配多个俱乐部，无需集团权限即可切换。'
         ),
         'assignments': [
             {