fix: 订单时间字段别名与子客服鉴权/读权限统一

Co-authored-by: Cursor <cursoragent@cursor.com>

merchant_ops/services/authz.py

@@ -2,7 +2,8 @@
 from rest_framework.exceptions import PermissionDenied, NotFound
 
 from merchant_ops.constants import (
-    MEMBER_STATUS_ACTIVE, MEMBER_STATUS_REMOVED, OWNER_ALL_PERMISSIONS,
+    MEMBER_STATUS_ACTIVE, MEMBER_STATUS_DISABLED, MEMBER_STATUS_REMOVED,
+    OWNER_ALL_PERMISSIONS,
 )
 from merchant_ops.models import MerchantStaffMember, MerchantStaffMemberPermission
 from merchant_ops.services.bootstrap import ensure_merchant_roles
@@ -31,6 +32,24 @@ def get_active_staff_member(user):
     ).select_related('role').first()
 
 
+def require_active_staff_member(user):
+    """子客服接口鉴权：区分老板误入、未绑定、禁用、移除等场景。"""
+    if is_merchant_owner(user):
+        raise StaffAuthError(403, '您是商家老板，请使用商家端原接口')
+    member = MerchantStaffMember.query.filter(
+        staff_user_id=user.UserUID,
+    ).select_related('role').order_by('-id').first()
+    if not member:
+        raise StaffAuthError(403, '未绑定子客服，请使用商家邀请码绑定')
+    if member.status == MEMBER_STATUS_DISABLED:
+        raise StaffAuthError(403, '子客服账号已被禁用，请联系商家老板')
+    if member.status == MEMBER_STATUS_REMOVED:
+        raise StaffAuthError(403, '子客服已被移除，请联系商家老板重新邀请')
+    if member.status != MEMBER_STATUS_ACTIVE:
+        raise StaffAuthError(403, '非有效子客服')
+    return member
+
+
 def get_member_permissions(member):
     """角色权限 + 成员覆盖。"""
     perms = set(
@@ -48,6 +67,14 @@ def member_has_perm(member, perm_code):
     return perm_code in get_member_permissions(member)
 
 
+def staff_order_read_perm(member):
+    """子客服读订单/商品类型/模板时，任一看单或派单权限即可。"""
+    for code in ('order_dispatch', 'order_view_all', 'order_view_self', 'order_detail'):
+        if member_has_perm(member, code):
+            return code
+    return None
+
+
 def assert_staff_perm(member, perm_code):
     if not member_has_perm(member, perm_code):
         raise StaffAuthError(403, f'无权限: {perm_code}')

merchant_ops/services/order_query.py

@@ -1,7 +1,7 @@
 """子客服订单查询：按权限隔离，不返回商家全量（除非 order_view_all）。"""
 from django.db.models import Q
 
-from backend.utils import pick_leixing_id
+from backend.utils import fmt_datetime, pick_leixing_id
 from merchant_ops.models import MerchantOrderDispatch
 from merchant_ops.services.authz import member_has_perm
 from orders.models import MerchantOrderExt
@@ -43,7 +43,7 @@ def staff_apply_order_filters(qs, data):
 
 def staff_order_to_dict(ext):
     o = ext.Order
-    ct = o.CreateTime.strftime('%Y-%m-%d %H:%M:%S') if o.CreateTime else ''
+    ct = fmt_datetime(o.CreateTime)
     return {
         'dingdan_id': o.OrderID,
         'zhuangtai': o.Status,

merchant_ops/views_orders.py

@@ -8,7 +8,9 @@ from rest_framework.views import APIView
 
 from backend.utils import pick_order_id
 from merchant_ops.helpers import proxy_merchant_order_view
-from merchant_ops.services.authz import StaffAuthError, get_active_staff_member, member_has_perm
+from merchant_ops.services.authz import (
+    StaffAuthError, require_active_staff_member, member_has_perm, staff_order_read_perm,
+)
 from merchant_ops.services.order_query import (
     staff_apply_order_filters,
     staff_can_view_all_orders,
@@ -29,10 +31,7 @@ logger = logging.getLogger(__name__)
 
 
 def _require_staff(request):
-    member = get_active_staff_member(request.user)
-    if not member:
-        raise StaffAuthError(403, '非有效子客服')
-    return member
+    return require_active_staff_member(request.user)
 
 
 def _err(e):
@@ -138,9 +137,10 @@ class StaffProductTypesView(APIView):
     def post(self, request):
         try:
             member = _require_staff(request)
-            if not member_has_perm(member, 'order_dispatch'):
-                raise StaffAuthError(403, '无权限')
-            return proxy_merchant_order_view(request, member, ShangpinLeixingView, 'order_dispatch')
+            perm = staff_order_read_perm(member)
+            if not perm:
+                raise StaffAuthError(403, '无权限查看商品类型')
+            return proxy_merchant_order_view(request, member, ShangpinLeixingView, perm)
         except Exception as e:
             return _err(e)
 

merchant_ops/views_templates.py

@@ -10,7 +10,9 @@ from config.views import (
     ShangjiaShanchuMobanView,
 )
 from merchant_ops.helpers import proxy_as_merchant_user
-from merchant_ops.services.authz import StaffAuthError, get_active_staff_member, member_has_perm
+from merchant_ops.services.authz import (
+    StaffAuthError, require_active_staff_member, member_has_perm, staff_order_read_perm,
+)
 from merchant_ops.services.template_query import list_merchant_templates
 from merchant_ops.services.link import staff_generate_link, staff_list_links
 from merchant_ops.services.audit import audit_staff
@@ -18,15 +20,12 @@ from merchant_ops.views_manage import _err
 
 
 def _require_staff(request):
-    member = get_active_staff_member(request.user)
-    if not member:
-        raise StaffAuthError(403, '非有效子客服')
-    return member
+    return require_active_staff_member(request.user)
 
 
 def _can_read_templates(member):
-    """派单发常规单需读模板；改模板需 template_manage。"""
-    return member_has_perm(member, 'order_dispatch') or member_has_perm(member, 'template_manage')
+    """派单/看单/管模板任一权限即可读模板列表。"""
+    return staff_order_read_perm(member) or member_has_perm(member, 'template_manage')
 
 
 class StaffTemplateListView(APIView):