fix: 俱乐部+全局角色权限并集，修复002ac校验

Co-authored-by: Cursor <cursoragent@cursor.com>

jituan/services/club_rbac.py

@@ -149,11 +149,8 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id
             )
         return list(qs.filter(ClubID='').values_list('RoleUUID', flat=True))
     cid = (club_id or CLUB_ID_DEFAULT).strip()
-    # 优先本俱乐部专属角色，避免全局角色权限串到其他俱乐部
-    club_specific = qs.filter(ClubID=cid)
-    if club_specific.exists():
-        return list(club_specific.values_list('RoleUUID', flat=True))
-    return list(qs.filter(ClubID='').values_list('RoleUUID', flat=True))
+    # 本俱乐部专属角色 + 全局角色（权限取并集；002ac 等常在全局角色上）
+    return list(qs.filter(Q(ClubID=cid) | Q(ClubID='')).values_list('RoleUUID', flat=True))
 
 
 def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None):

users/views/kefu_orders.py

@@ -304,8 +304,15 @@ class KefuGetShangjiaOrderListView(APIView):
         if kefu is None:
             return permissions
 
-        # 3. 检查商家订单管理权限（002ac）
-        if not has_perm_code(permissions, '002ac'):
+        from jituan.constants import CLUB_ID_DEFAULT
+        from jituan.services.admin_context import get_allowed_club_ids
+        from jituan.services.club_rbac import resolve_permission_codes_for_club
+
+        club_id = getattr(request, 'club_id', None) or CLUB_ID_DEFAULT
+        eff_codes = resolve_permission_codes_for_club(
+            request.user, club_id, list(get_allowed_club_ids(request.user)),
+        )
+        if not has_perm_code(permissions, '002ac') and '002ac' not in eff_codes:
             return Response({'code': 403, 'msg': '您无权查看商家订单列表'})
 
         # 4. 获取分页和筛选参数