XingQue/Django
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 切换俱乐部仅算本俱乐部角色权限，统一权限解析

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
XingQue
2026-07-06 19:00:18 +08:00
parent 553d2d5707
commit 45a4dde034
4 changed files with 57 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
backend/utils.py
View File

@@ -170,11 +170,10 @@ def verify_kefu_permission(request, username_from_frontend=None):
'msg': '身份错误，无权操作其他账号，相关操作已记录'
}, status=403)
# ---------- 4. 获取用户的所有权限 ----------
# 使用 gvsdsdk RBAC 表（UserRole → RolePermission → Permission）
# ---------- 4. 获取用户的所有权限（与菜单 menu-access 同一套算法） ----------
from jituan.constants import CLUB_ID_DEFAULT, DATA_SCOPE_SINGLE
from jituan.services.admin_context import resolve_admin_effective_club, get_allowed_club_ids, is_system_super_admin
from jituan.services.club_rbac import filter_role_uuids_for_club_scope
from jituan.services.club_rbac import resolve_effective_permission_codes
eff_club = getattr(request, 'club_id', None) or CLUB_ID_DEFAULT
eff_scope = getattr(request, 'club_scope', None) or DATA_SCOPE_SINGLE
@@ -188,27 +187,27 @@ def verify_kefu_permission(request, username_from_frontend=None):
allowed_club_ids = list(get_allowed_club_ids(current_user))
try:
user_uuid = current_user.UserUUID
role_uuids = list(SdkUserRole.objects.filter(
UserUUID=user_uuid
).values_list('RoleUUID', flat=True))
if role_uuids and not is_system_super_admin(current_user):
role_uuids = filter_role_uuids_for_club_scope(
role_uuids, eff_club, eff_scope, allowed_club_ids,
)
if role_uuids:
perm_uuids = list(SdkRolePermission.objects.filter(
RoleUUID__in=role_uuids
).values_list('PermUUID', flat=True))
permissions = list(SdkPermission.objects.filter(
PermUUID__in=perm_uuids,
PermStatus=1
).values_list('PermCode', flat=True).distinct())
if is_system_super_admin(current_user):
user_uuid = current_user.UserUUID
role_uuids = list(SdkUserRole.objects.filter(
UserUUID=user_uuid
).values_list('RoleUUID', flat=True))
if role_uuids:
perm_uuids = list(SdkRolePermission.objects.filter(
RoleUUID__in=role_uuids
).values_list('PermUUID', flat=True))
permissions = list(SdkPermission.objects.filter(
PermUUID__in=perm_uuids, PermStatus=1
).values_list('PermCode', flat=True).distinct())
else:
permissions = []
legacy_codes, _ = _legacy_backend_role_permissions(current_user.Phone)
if legacy_codes:
permissions = list(set(list(permissions) + legacy_codes))
else:
permissions = []
permissions = resolve_effective_permission_codes(
current_user, eff_club, eff_scope, allowed_club_ids,
)
except Exception as e:
logger.warning(
'verify_kefu_permission failed: UserUUID=%s Phone=%s err=%s',
@@ -219,11 +218,6 @@ def verify_kefu_permission(request, username_from_frontend=None):
)
permissions = []
# 旧权限表（user_role 按手机号）：仅在没有 gvsdsdk 角色绑定时兜底，避免污染多俱乐部权限
legacy_codes, _ = _legacy_backend_role_permissions(current_user.Phone)
if legacy_codes and not role_uuids:
permissions = list(set(list(permissions) + legacy_codes))
# 仅系统级超管自动拥有全部功能权限；俱乐部 000001 只解锁超管页，不展开全部菜单
if is_system_super_admin(current_user):
if '000001' not in permissions: