feat: 考试集团一览与商品集团权限边界

backend/view.py

@@ -39,6 +39,7 @@ from backend.utils import (
     update_shangjia_daily
 )
 from jituan.services.club_context import filter_club_char_field, filter_queryset_by_club, filter_user_related_by_club, filter_user_qs_by_club, orders_for_request
+from jituan.services.catalog_scope import block_non_group_catalog_scope
 from jituan.services.club_penalty import (
     filter_penalty_qs, resolve_penalty_club_id, filter_gsfenhong_qs,
     forbid_penalty_out_of_scope, resolve_penalty_record_club_id,
@@ -1766,6 +1767,9 @@ class GetProductBaseDataView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 获取所有商品类型（按 paixu 升序）
         type_qs = ShangpinLeixing.query.all().order_by('paixu')
@@ -1854,6 +1858,9 @@ class GetProductListView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 获取参数
         leixing_id = request.data.get('leixing_id')
@@ -1981,6 +1988,9 @@ class GetProductListView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 获取所有商品类型（按 paixu 升序）
         type_qs = ShangpinLeixing.query.all().order_by('paixu')
@@ -2059,6 +2069,9 @@ class GetProductListView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 获取参数
         leixing_id = request.data.get('leixing_id')
@@ -2180,6 +2193,9 @@ class SaveProductOrderView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         sort_type = request.data.get('type', '').strip().lower()
         if sort_type not in ('leixing', 'zhuanqu'):
@@ -2242,6 +2258,9 @@ class AddProductView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 获取表单字段
         biaoqian = request.data.get('biaoqian', '').strip()
@@ -2439,6 +2458,9 @@ class DeleteProductView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 查询商品是否存在
         try:
@@ -2501,6 +2523,9 @@ class GetProductDetailView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 查询商品
         try:
@@ -2582,6 +2607,9 @@ class UpdateProductView(APIView):
             return permissions
         if '2200a' not in permissions:
             return Response({'code': 403, 'msg': '无权限管理商品'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 使用事务，将 select_for_update 放在事务内
         with transaction.atomic():
@@ -4515,6 +4543,9 @@ class GetProductTypeZoneView(APIView):
             return permissions
         if '7007a' not in permissions:
             return Response({'code': 403, 'msg': '您无权访问此页面'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         # 查询所有商品类型（含专区数量）
         types = ShangpinLeixing.query.all().order_by('-paixu')  # paixu 越大越靠前
@@ -4592,6 +4623,9 @@ class ModifyProductTypeZoneView(APIView):
             return permissions
         if '7007a' not in permissions:
             return Response({'code': 403, 'msg': '您无权进行此操作'})
+        scope_err = block_non_group_catalog_scope(request)
+        if scope_err:
+            return Response({'code': 400, 'msg': scope_err})
 
         if obj_type == 'leixing':
             return self.handle_leixing(request, action)