From 553d2d5707ccd68ad4283926da82c45fcc741716 Mon Sep 17 00:00:00 2001 From: XingQue Date: Mon, 6 Jul 2026 18:44:11 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=B1=E4=B9=90=E9=83=A8+=E5=85=A8?= =?UTF-8?q?=E5=B1=80=E8=A7=92=E8=89=B2=E6=9D=83=E9=99=90=E5=B9=B6=E9=9B=86?= =?UTF-8?q?=EF=BC=8C=E4=BF=AE=E5=A4=8D002ac=E6=A0=A1=E9=AA=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Cursor --- jituan/services/club_rbac.py | 7 ++----- users/views/kefu_orders.py | 11 +++++++++-- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/jituan/services/club_rbac.py b/jituan/services/club_rbac.py index 179608c..70dacff 100644 --- a/jituan/services/club_rbac.py +++ b/jituan/services/club_rbac.py @@ -149,11 +149,8 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id ) return list(qs.filter(ClubID='').values_list('RoleUUID', flat=True)) cid = (club_id or CLUB_ID_DEFAULT).strip() - # 优先本俱乐部专属角色，避免全局角色权限串到其他俱乐部 - club_specific = qs.filter(ClubID=cid) - if club_specific.exists(): - return list(club_specific.values_list('RoleUUID', flat=True)) - return list(qs.filter(ClubID='').values_list('RoleUUID', flat=True)) + # 本俱乐部专属角色 + 全局角色（权限取并集；002ac 等常在全局角色上） + return list(qs.filter(Q(ClubID=cid) | Q(ClubID='')).values_list('RoleUUID', flat=True)) def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None): diff --git a/users/views/kefu_orders.py b/users/views/kefu_orders.py index 1a40675..315045a 100644 --- a/users/views/kefu_orders.py +++ b/users/views/kefu_orders.py @@ -304,8 +304,15 @@ class KefuGetShangjiaOrderListView(APIView): if kefu is None: return permissions - # 3. 检查商家订单管理权限（002ac） - if not has_perm_code(permissions, '002ac'): + from jituan.constants import CLUB_ID_DEFAULT + from jituan.services.admin_context import get_allowed_club_ids + from jituan.services.club_rbac import resolve_permission_codes_for_club + + club_id = getattr(request, 'club_id', None) or CLUB_ID_DEFAULT + eff_codes = resolve_permission_codes_for_club( + request.user, club_id, list(get_allowed_club_ids(request.user)), + ) + if not has_perm_code(permissions, '002ac') and '002ac' not in eff_codes: return Response({'code': 403, 'msg': '您无权查看商家订单列表'}) # 4. 获取分页和筛选参数