fix: 订单时间字段别名与子客服鉴权/读权限统一

Co-authored-by: Cursor <cursoragent@cursor.com>

merchant_ops/services/authz.py

@@ -2,7 +2,8 @@
 from rest_framework.exceptions import PermissionDenied, NotFound
 
 from merchant_ops.constants import (
-    MEMBER_STATUS_ACTIVE, MEMBER_STATUS_REMOVED, OWNER_ALL_PERMISSIONS,
+    MEMBER_STATUS_ACTIVE, MEMBER_STATUS_DISABLED, MEMBER_STATUS_REMOVED,
+    OWNER_ALL_PERMISSIONS,
 )
 from merchant_ops.models import MerchantStaffMember, MerchantStaffMemberPermission
 from merchant_ops.services.bootstrap import ensure_merchant_roles
@@ -31,6 +32,24 @@ def get_active_staff_member(user):
     ).select_related('role').first()
 
 
+def require_active_staff_member(user):
+    """子客服接口鉴权：区分老板误入、未绑定、禁用、移除等场景。"""
+    if is_merchant_owner(user):
+        raise StaffAuthError(403, '您是商家老板，请使用商家端原接口')
+    member = MerchantStaffMember.query.filter(
+        staff_user_id=user.UserUID,
+    ).select_related('role').order_by('-id').first()
+    if not member:
+        raise StaffAuthError(403, '未绑定子客服，请使用商家邀请码绑定')
+    if member.status == MEMBER_STATUS_DISABLED:
+        raise StaffAuthError(403, '子客服账号已被禁用，请联系商家老板')
+    if member.status == MEMBER_STATUS_REMOVED:
+        raise StaffAuthError(403, '子客服已被移除，请联系商家老板重新邀请')
+    if member.status != MEMBER_STATUS_ACTIVE:
+        raise StaffAuthError(403, '非有效子客服')
+    return member
+
+
 def get_member_permissions(member):
     """角色权限 + 成员覆盖。"""
     perms = set(
@@ -48,6 +67,14 @@ def member_has_perm(member, perm_code):
     return perm_code in get_member_permissions(member)
 
 
+def staff_order_read_perm(member):
+    """子客服读订单/商品类型/模板时，任一看单或派单权限即可。"""
+    for code in ('order_dispatch', 'order_view_all', 'order_view_self', 'order_detail'):
+        if member_has_perm(member, code):
+            return code
+    return None
+
+
 def assert_staff_perm(member, perm_code):
     if not member_has_perm(member, perm_code):
         raise StaffAuthError(403, f'无权限: {perm_code}')

merchant_ops/services/order_query.py

@@ -1,7 +1,7 @@
 """子客服订单查询：按权限隔离，不返回商家全量（除非 order_view_all）。"""
 from django.db.models import Q
 
-from backend.utils import pick_leixing_id
+from backend.utils import fmt_datetime, pick_leixing_id
 from merchant_ops.models import MerchantOrderDispatch
 from merchant_ops.services.authz import member_has_perm
 from orders.models import MerchantOrderExt
@@ -43,7 +43,7 @@ def staff_apply_order_filters(qs, data):
 
 def staff_order_to_dict(ext):
     o = ext.Order
-    ct = o.CreateTime.strftime('%Y-%m-%d %H:%M:%S') if o.CreateTime else ''
+    ct = fmt_datetime(o.CreateTime)
     return {
         'dingdan_id': o.OrderID,
         'zhuangtai': o.Status,