fix: kefu permissions use legacy permission table instead of gvsdsdk

Co-authored-by: Cursor <cursoragent@cursor.com>

jituan/services/admin_context.py

@@ -101,6 +101,22 @@ def is_system_super_admin(user):
     )
 
 
+def is_kefu_backend_account(user):
+    """可登录客服后台：超管 / UserType=kefu / KefuProfile / 旧表 user_role 有绑定。"""
+    if is_system_super_admin(user):
+        return True
+    if getattr(user, 'UserType', '') == 'kefu':
+        return True
+    try:
+        kefu = user.KefuProfile
+        if kefu.zhuangtai == 1:
+            return True
+    except Exception:
+        pass
+    from backend.utils import has_legacy_backend_binding
+    return has_legacy_backend_binding(user)
+
+
 def can_manage_admin_assignments(user, permissions=None):
     """是否可维护数据范围任职、俱乐部密钥等集团级配置（不含俱乐部 000001）。"""
     if is_system_super_admin(user):

jituan/services/club_rbac.py

@@ -79,16 +79,11 @@ def resolve_role_by_name(role_name, club_id=None):
 def user_bound_role_names(user):
     from backend.utils import _legacy_backend_role_permissions
 
-    uuids = list(
-        UserRole.objects.filter(UserUUID=user.UserUUID).values_list('RoleUUID', flat=True)
+    _, legacy_names = _legacy_backend_role_permissions(
+        getattr(user, 'Phone', ''),
+        getattr(user, 'UserUID', None),
     )
-    names = []
-    if uuids:
-        names = list(
-            Role.objects.filter(RoleUUID__in=uuids, RoleStatus=1).values_list('RoleName', flat=True)
-        )
-    _, legacy_names = _legacy_backend_role_permissions(getattr(user, 'Phone', ''))
-    return sorted(set(names + legacy_names))
+    return sorted(set(legacy_names))
 
 
 def resolve_kefu_admin_user(yonghuid=None, phone=None):

jituan/views.py

@@ -12,7 +12,7 @@ from rest_framework_simplejwt.tokens import RefreshToken
 
 from jituan.constants import SUPER_ADMIN_PHONES, ADMIN_ROLE_LABELS, CLUB_ID_DEFAULT, DATA_SCOPE_ALL, DATA_SCOPE_SINGLE
 from jituan.models import Club, AdminAssignment
-from jituan.services.admin_context import build_admin_club_context, can_manage_admin_assignments
+from jituan.services.admin_context import build_admin_club_context, is_kefu_backend_account, can_manage_admin_assignments
 from jituan.services.kefu_menu import build_menu_access_payload
 from jituan.services.wechat_login import login_or_register_by_club
 from jituan.services.caiwu_stats import build_caiwu_payload
@@ -204,7 +204,7 @@ class ClubMeContextView(APIView):
 
     def get(self, request):
         user = request.user
-        if user.UserType not in ('kefu', 'admin') and not user.IsSuperuser:
+        if not is_kefu_backend_account(user):
             return Response({'code': 403, 'msg': '非后台账号', 'data': None}, status=403)
         return Response({
             'code': 0,
@@ -219,7 +219,7 @@ class ClubKefuMenuAccessView(APIView):
 
     def get(self, request):
         user = request.user
-        if user.UserType not in ('kefu', 'admin') and not user.IsSuperuser:
+        if not is_kefu_backend_account(user):
             return Response({'code': 403, 'msg': '非后台账号', 'data': None}, status=403)
         payload, err = build_menu_access_payload(request)
         if err is not None: