From 2003ee01a5172d2b098d0e0b92ef0f32187bb831 Mon Sep 17 00:00:00 2001 From: XingQue Date: Sun, 28 Jun 2026 16:52:25 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=B1=E4=B9=90=E9=83=A8000001?= =?UTF-8?q?=E4=B8=8D=E5=86=8D=E5=B1=95=E7=A4=BA=E9=9B=86=E5=9B=A2=E7=BA=A7?= =?UTF-8?q?=E5=90=8E=E5=8F=B0=E8=8F=9C=E5=8D=95=E4=B8=8E=E4=BF=B1=E4=B9=90?= =?UTF-8?q?=E9=83=A8=E5=AF=86=E9=92=A5=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Cursor --- jituan/management/commands/seed_kefu_menu.py | 2 +- jituan/services/admin_context.py | 19 ++++++----- jituan/services/kefu_menu.py | 33 ++++++++++++++------ jituan/views.py | 4 +-- 4 files changed, 36 insertions(+), 22 deletions(-) diff --git a/jituan/management/commands/seed_kefu_menu.py b/jituan/management/commands/seed_kefu_menu.py index bcaea58..3ae68c4 100644 --- a/jituan/management/commands/seed_kefu_menu.py +++ b/jituan/management/commands/seed_kefu_menu.py @@ -64,7 +64,7 @@ MENU_ROWS = [ {'page_id': 'admin.data-scope', 'name': '数据范围配置', 'path': '/admin/data-scope', 'parent_id': 'admin', 'sort_order': 72, 'require_group_manage': True}, {'page_id': 'admin.club-config', 'name': '俱乐部密钥配置', 'path': '/admin/club-config', 'parent_id': 'admin', 'sort_order': 73, - 'require_super': True}, + 'require_group_manage': True}, {'page_id': 'admin.user', 'name': '后台用户', 'path': '/admin/user', 'parent_id': 'admin', 'sort_order': 74, 'require_super': True}, {'page_id': 'admin.operation-log', 'name': '操作日志', 'path': '/admin/operation-log', 'parent_id': 'admin', 'sort_order': 75, diff --git a/jituan/services/admin_context.py b/jituan/services/admin_context.py index 8c59022..7da229d 100644 --- a/jituan/services/admin_context.py +++ b/jituan/services/admin_context.py @@ -20,11 +20,7 @@ def build_admin_club_context(user): 返回 dict 供前端存储与请求头使用。 """ yonghuid = user.UserUID - is_super = ( - bool(user.IsSuperuser) - or user.UserType == 'admin' - or getattr(user, 'Phone', '') in SUPER_ADMIN_PHONES - ) + is_super = is_system_super_admin(user) assignments = list( AdminAssignment.query.filter(yonghuid=yonghuid, status=1).order_by('-is_primary', 'club_id') @@ -96,15 +92,18 @@ def build_admin_club_context(user): ) -def can_manage_admin_assignments(user, permissions=None): - """是否可维护数据范围任职（超管 / 000001 / 集团超管任职）。""" - permissions = permissions or [] - is_super = ( +def is_system_super_admin(user): + """系统级超管（Django 超管 / admin 账号 / 白名单手机号），非俱乐部 000001 角色。""" + return ( bool(user.IsSuperuser) or user.UserType == 'admin' or getattr(user, 'Phone', '') in SUPER_ADMIN_PHONES ) - if is_super or '000001' in permissions: + + +def can_manage_admin_assignments(user, permissions=None): + """是否可维护数据范围任职、俱乐部密钥等集团级配置（不含俱乐部 000001）。""" + if is_system_super_admin(user): return True ctx = build_admin_club_context(user) if ctx.get('is_group_admin') and ctx.get('role_code') in GROUP_MANAGE_ROLES: diff --git a/jituan/services/kefu_menu.py b/jituan/services/kefu_menu.py index b95414c..65d2909 100644 --- a/jituan/services/kefu_menu.py +++ b/jituan/services/kefu_menu.py @@ -1,21 +1,37 @@ """客服后台菜单可见性（侧栏展示，不影响各页面原有权限校验）。""" from backend.utils import _AllPermissions, verify_kefu_permission from jituan.models import KefuMenuPage -from jituan.services.admin_context import build_admin_club_context, can_manage_admin_assignments +from jituan.services.admin_context import ( + build_admin_club_context, + can_manage_admin_assignments, + is_system_super_admin, +) def _is_super_permissions(permissions): return isinstance(permissions, _AllPermissions) -def _page_visible(page, permissions, user, is_super): - if is_super: +def _has_super_perm(permissions): + """俱乐部超级管理权限 000001（角色/后台用户等），不含集团级配置。""" + if _is_super_permissions(permissions): return True - if page.require_super: - return False + return '000001' in permissions + + +def _page_visible(page, permissions, user): + # 集团级页面：数据范围、俱乐部密钥等，俱乐部 000001 不可见 if page.require_group_manage: - perms_list = list(permissions) if not _is_super_permissions(permissions) else ['000001'] - return can_manage_admin_assignments(user, perms_list) + return can_manage_admin_assignments(user) + + # 俱乐部超管页面：角色管理、后台用户等 + if page.require_super: + return _has_super_perm(permissions) or is_system_super_admin(user) + + # 000001 拥有全部业务功能菜单（订单/用户/财务等），但不绕过上面的集团级限制 + if _is_super_permissions(permissions): + return True + codes = page.perm_codes or [] if not codes: return False @@ -32,7 +48,6 @@ def build_menu_access_payload(request, username=None): if kefu is None: return None, permissions - is_super = _is_super_permissions(permissions) pages = list(KefuMenuPage.query.all().order_by('sort_order', 'page_id')) need_seed = not pages or not any(p.page_id == 'miniapp.assets' for p in pages) if need_seed: @@ -48,7 +63,7 @@ def build_menu_access_payload(request, username=None): for page in pages: if not page.path: continue - if _page_visible(page, permissions, request.user, is_super): + if _page_visible(page, permissions, request.user): visible_ids.append(page.page_id) for page in pages: diff --git a/jituan/views.py b/jituan/views.py index 4045ca5..629e2bf 100644 --- a/jituan/views.py +++ b/jituan/views.py @@ -420,8 +420,8 @@ class ClubManageView(APIView): kefu_obj, permissions = verify_kefu_permission(request, username) if kefu_obj is None: return permissions - if '000001' not in permissions: - return Response({'code': 403, 'msg': '仅超级管理员可管理俱乐部配置'}, status=403) + if not can_manage_admin_assignments(request.user): + return Response({'code': 403, 'msg': '仅集团超管可管理俱乐部配置'}, status=403) action = (request.data.get('action') or 'get').strip() club_id = (request.data.get('club_id') or '').strip() or CLUB_ID_DEFAULT