fix: 俱乐部000001不再展示集团级后台菜单与俱乐部密钥配置

Co-authored-by: Cursor <cursoragent@cursor.com>

jituan/management/commands/seed_kefu_menu.py

@@ -64,7 +64,7 @@ MENU_ROWS = [
     {'page_id': 'admin.data-scope', 'name': '数据范围配置', 'path': '/admin/data-scope', 'parent_id': 'admin', 'sort_order': 72,
      'require_group_manage': True},
     {'page_id': 'admin.club-config', 'name': '俱乐部密钥配置', 'path': '/admin/club-config', 'parent_id': 'admin', 'sort_order': 73,
-     'require_super': True},
+     'require_group_manage': True},
     {'page_id': 'admin.user', 'name': '后台用户', 'path': '/admin/user', 'parent_id': 'admin', 'sort_order': 74,
      'require_super': True},
     {'page_id': 'admin.operation-log', 'name': '操作日志', 'path': '/admin/operation-log', 'parent_id': 'admin', 'sort_order': 75,

jituan/services/admin_context.py

@@ -20,11 +20,7 @@ def build_admin_club_context(user):
     返回 dict 供前端存储与请求头使用。
     """
     yonghuid = user.UserUID
-    is_super = (
-        bool(user.IsSuperuser)
-        or user.UserType == 'admin'
-        or getattr(user, 'Phone', '') in SUPER_ADMIN_PHONES
-    )
+    is_super = is_system_super_admin(user)
 
     assignments = list(
         AdminAssignment.query.filter(yonghuid=yonghuid, status=1).order_by('-is_primary', 'club_id')
@@ -96,15 +92,18 @@ def build_admin_club_context(user):
     )
 
 
-def can_manage_admin_assignments(user, permissions=None):
-    """是否可维护数据范围任职（超管 / 000001 / 集团超管任职）。"""
-    permissions = permissions or []
-    is_super = (
+def is_system_super_admin(user):
+    """系统级超管（Django 超管 / admin 账号 / 白名单手机号），非俱乐部 000001 角色。"""
+    return (
         bool(user.IsSuperuser)
         or user.UserType == 'admin'
         or getattr(user, 'Phone', '') in SUPER_ADMIN_PHONES
     )
-    if is_super or '000001' in permissions:
+
+
+def can_manage_admin_assignments(user, permissions=None):
+    """是否可维护数据范围任职、俱乐部密钥等集团级配置（不含俱乐部 000001）。"""
+    if is_system_super_admin(user):
         return True
     ctx = build_admin_club_context(user)
     if ctx.get('is_group_admin') and ctx.get('role_code') in GROUP_MANAGE_ROLES:

jituan/services/kefu_menu.py

@@ -1,21 +1,37 @@
 """客服后台菜单可见性（侧栏展示，不影响各页面原有权限校验）。"""
 from backend.utils import _AllPermissions, verify_kefu_permission
 from jituan.models import KefuMenuPage
-from jituan.services.admin_context import build_admin_club_context, can_manage_admin_assignments
+from jituan.services.admin_context import (
+    build_admin_club_context,
+    can_manage_admin_assignments,
+    is_system_super_admin,
+)
 
 
 def _is_super_permissions(permissions):
     return isinstance(permissions, _AllPermissions)
 
 
-def _page_visible(page, permissions, user, is_super):
-    if is_super:
+def _has_super_perm(permissions):
+    """俱乐部超级管理权限 000001（角色/后台用户等），不含集团级配置。"""
+    if _is_super_permissions(permissions):
         return True
-    if page.require_super:
-        return False
+    return '000001' in permissions
+
+
+def _page_visible(page, permissions, user):
+    # 集团级页面：数据范围、俱乐部密钥等，俱乐部 000001 不可见
     if page.require_group_manage:
-        perms_list = list(permissions) if not _is_super_permissions(permissions) else ['000001']
-        return can_manage_admin_assignments(user, perms_list)
+        return can_manage_admin_assignments(user)
+
+    # 俱乐部超管页面：角色管理、后台用户等
+    if page.require_super:
+        return _has_super_perm(permissions) or is_system_super_admin(user)
+
+    # 000001 拥有全部业务功能菜单（订单/用户/财务等），但不绕过上面的集团级限制
+    if _is_super_permissions(permissions):
+        return True
+
     codes = page.perm_codes or []
     if not codes:
         return False
@@ -32,7 +48,6 @@ def build_menu_access_payload(request, username=None):
     if kefu is None:
         return None, permissions
 
-    is_super = _is_super_permissions(permissions)
     pages = list(KefuMenuPage.query.all().order_by('sort_order', 'page_id'))
     need_seed = not pages or not any(p.page_id == 'miniapp.assets' for p in pages)
     if need_seed:
@@ -48,7 +63,7 @@ def build_menu_access_payload(request, username=None):
     for page in pages:
         if not page.path:
             continue
-        if _page_visible(page, permissions, request.user, is_super):
+        if _page_visible(page, permissions, request.user):
             visible_ids.append(page.page_id)
 
     for page in pages:

jituan/views.py

@@ -420,8 +420,8 @@ class ClubManageView(APIView):
             kefu_obj, permissions = verify_kefu_permission(request, username)
             if kefu_obj is None:
                 return permissions
-            if '000001' not in permissions:
-                return Response({'code': 403, 'msg': '仅超级管理员可管理俱乐部配置'}, status=403)
+            if not can_manage_admin_assignments(request.user):
+                return Response({'code': 403, 'msg': '仅集团超管可管理俱乐部配置'}, status=403)
 
             action = (request.data.get('action') or 'get').strip()
             club_id = (request.data.get('club_id') or '').strip() or CLUB_ID_DEFAULT