fix: kefu permissions use legacy permission table instead of gvsdsdk

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/utils.py

@@ -77,14 +77,19 @@ class _AllPermissions(list):
         return True
 
 
-def _legacy_backend_role_permissions(phone):
+def _legacy_backend_role_permissions(phone, yonghuid=None):
     """
     读取旧权限表（backend.models）：
-    user_role.account_id = 手机号 → role → role_permission → permission.perm_code
-    与 gvsdsdk 表并行，未改 SDK 结构。
+    user_role.account_id = 手机号或 UserUID → role → role_permission → permission.perm_code
     """
-    phone = (phone or '').strip()
-    if not phone:
+    account_ids = []
+    ph = (phone or '').strip()
+    uid = (yonghuid or '').strip()
+    if ph:
+        account_ids.append(ph)
+    if uid and uid not in account_ids:
+        account_ids.append(uid)
+    if not account_ids:
         return [], []
     try:
         from backend.models import (
@@ -93,7 +98,7 @@ def _legacy_backend_role_permissions(phone):
             Permission as BackendPermission,
         )
         role_ids = list(
-            LegacyUserRole.objects.filter(account_id=phone).values_list('role_id', flat=True)
+            LegacyUserRole.objects.filter(account_id__in=account_ids).values_list('role_id', flat=True)
         )
         if not role_ids:
             return [], []
@@ -107,10 +112,22 @@ def _legacy_backend_role_permissions(phone):
         )
         return perm_codes, role_names
     except Exception as e:
-        logger.warning('legacy_backend_role_permissions phone=%s err=%s', phone, e)
+        logger.warning('legacy_backend_role_permissions ids=%s err=%s', account_ids, e)
         return [], []
 
 
+def has_legacy_backend_binding(user):
+    """旧表 user_role 或 role 下已有 perm_code。"""
+    from backend.models import UserRole as LegacyUserRole
+    ph = getattr(user, 'Phone', '') or ''
+    uid = getattr(user, 'UserUID', '') or ''
+    ids = [x for x in [ph, uid] if x]
+    if ids and LegacyUserRole.objects.filter(account_id__in=ids).exists():
+        return True
+    codes, _ = _legacy_backend_role_permissions(ph, uid)
+    return bool(codes)
+
+
 def verify_kefu_permission(request, username_from_frontend=None):
     """
     验证客服/管理员身份，并返回该用户的所有权限列表（基于新RBAC表）
@@ -128,9 +145,10 @@ def verify_kefu_permission(request, username_from_frontend=None):
 
     # ---------- 1. 必须是客服或管理员 ----------
     from jituan.constants import SUPER_ADMIN_PHONES
+    from jituan.services.admin_context import is_kefu_backend_account
     is_super_phone = getattr(current_user, 'Phone', '') in SUPER_ADMIN_PHONES
     is_admin = current_user.UserType == 'admin' or current_user.IsSuperuser or is_super_phone
-    if current_user.UserType != 'kefu' and not is_admin:
+    if not is_kefu_backend_account(current_user):
         return None, Response({'code': 403, 'msg': '身份错误，非客服账号'}, status=403)
 
     # ---------- 2. 客服扩展表存在且状态正常（管理员跳过） ----------
@@ -156,42 +174,12 @@ def verify_kefu_permission(request, username_from_frontend=None):
             'msg': '身份错误，无权操作其他账号，相关操作已记录'
         }, status=403)
 
-    # ---------- 4. 获取用户的所有权限 ----------
-    # 使用 gvsdsdk RBAC 表（UserRole → RolePermission → Permission）
-    try:
-        user_uuid = current_user.UserUUID
-        role_uuids = list(SdkUserRole.objects.filter(
-            UserUUID=user_uuid
-        ).values_list('RoleUUID', flat=True))
-
-        if role_uuids:
-            perm_uuids = list(SdkRolePermission.objects.filter(
-                RoleUUID__in=role_uuids
-            ).values_list('PermUUID', flat=True))
-
-            permissions = list(SdkPermission.objects.filter(
-                PermUUID__in=perm_uuids,
-                PermStatus=1
-            ).values_list('PermCode', flat=True).distinct())
-        else:
-            permissions = []
-    except Exception as e:
-        logger.warning(
-            'verify_kefu_permission failed: UserUUID=%s Phone=%s err=%s',
-            getattr(current_user, 'UserUUID', None),
-            getattr(current_user, 'Phone', None),
-            e,
-            exc_info=True,
-        )
-        permissions = []
-
-    # 旧权限表（user_role 按手机号），与 gvsdsdk 合并
-    legacy_codes, _ = _legacy_backend_role_permissions(current_user.Phone)
-    if legacy_codes:
-        if isinstance(permissions, _AllPermissions):
-            pass
-        else:
-            permissions = list(set(list(permissions) + legacy_codes))
+    # ---------- 4. 权限码：只读旧表 permission（user_role → role → role_permission）----------
+    legacy_codes, _ = _legacy_backend_role_permissions(
+        current_user.Phone,
+        getattr(current_user, 'UserUID', None),
+    )
+    permissions = list(legacy_codes) if legacy_codes else []
 
     # 管理员/超级用户自动拥有所有权限
     if is_admin and '000001' not in permissions: