fix: 俱乐部角色ORM过滤+商家订单权限002ab/003aa+legacy兜底+perm-debug

users/views/kefu_orders.py

@@ -56,7 +56,7 @@ from orders.utils import (
 from backend.utils import (
     update_dashou_daily_by_action, update_guanshi_daily_by_action,
     update_shangjia_daily, update_zuzhang_daily_by_action,
-    verify_kefu_permission, has_perm_code,
+    verify_kefu_permission, has_perm_code, has_merchant_order_permission,
 )
 from rank.utils import get_tag_fee, create_shenhe_jilu, validate_shenheguan
 
@@ -303,8 +303,19 @@ class KefuGetShangjiaOrderListView(APIView):
         if kefu is None:
             return permissions
 
-        if not has_perm_code(permissions, '002ac'):
-            return Response({'code': 403, 'msg': '您无权查看商家订单列表'})
+        if not has_merchant_order_permission(permissions):
+            from backend.utils import _AllPermissions
+            if isinstance(permissions, _AllPermissions):
+                codes = ['*']
+            else:
+                codes = list(permissions or [])
+            return Response({
+                'code': 403,
+                'msg': (
+                    f'您无权查看商家订单列表（需要 002ac/002ab/003aa，'
+                    f'当前俱乐部权限码：{",".join(codes) or "无"}）'
+                ),
+            })
 
         # 4. 获取分页和筛选参数
         page = int(request.data.get('page', 1))