From 593ed1ab091fd02c5c44f5cee12c8cf2ccf1c4cd Mon Sep 17 00:00:00 2001
From: XingQue <kongxing634@gmail.com>
Date: Thu, 2 Jul 2026 14:05:38 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=85=AC=E5=91=8A=E8=BD=AE=E6=92=ADpage?=
 =?UTF-8?q?=5Fkey=E9=80=BB=E8=BE=91=E4=B8=8E=E5=95=86=E5=AE=B6=E5=85=85?=
 =?UTF-8?q?=E5=80=BC=E8=BD=AE=E8=AF=A2yonghuid=E5=AD=97=E6=AE=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 jituan/services/display_config.py | 15 ++++++++++-----
 products/views.py                 |  4 ++--
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/jituan/services/display_config.py b/jituan/services/display_config.py
index 3317489..a9099b7 100644
--- a/jituan/services/display_config.py
+++ b/jituan/services/display_config.py
@@ -70,14 +70,19 @@ def allowed_lunbo_page_keys_for_user(user):
 
 def resolve_lunbo_page_key_for_request(request, page_key=None, image_type=1):
     """
-    按身份限制 page_key：
-    - 无特殊身份：仅 order_pool / accept_order
-    - 商家：+ merchant_home
-    - 打手：+ dashou_center
-    无权访问所请求的 page_key 时返回 None（接口应返回空公告/轮播）。
+    按身份限制 page_key（与小程序 display-config.js 对齐）：
+    - order_pool / accept_order：任何人（含未登录）均可访问
+    - merchant_home / dashou_center：未登录时按前端传入的 page_key 返回（接口 AllowAny、前端不传 JWT）
+    - 已登录时：无对应扩展表身份则拒绝该 page_key（返回 None）
     """
     requested = normalize_page_key(page_key, image_type=image_type)
+    if requested in PUBLIC_LUNBO_PAGE_KEYS:
+        return requested
+
     user = getattr(request, 'user', None)
+    if not user or not getattr(user, 'is_authenticated', False):
+        return requested
+
     allowed = allowed_lunbo_page_keys_for_user(user)
     if requested in allowed:
         return requested
diff --git a/products/views.py b/products/views.py
index 7140900..f49255c 100644
--- a/products/views.py
+++ b/products/views.py
@@ -2443,7 +2443,7 @@ class ShangjiaShibai(APIView):
             try:
                 order = Czjilu.query.get(
                     dingdan_id=dingdanid,
-                    UserUID=request.user.UserUID,
+                    yonghuid=request.user.UserUID,
                     leixing=4  # 确保是商家充值订单
                 )
             except Czjilu.DoesNotExist:
@@ -2509,7 +2509,7 @@ class ShangjiaChenggong(APIView):
             try:
                 order = Czjilu.query.get(
                     dingdan_id=dingdanid,
-                    UserUID=request.user.UserUID,
+                    yonghuid=request.user.UserUID,
                     leixing=4  # 商家充值类型
                 )
             except Czjilu.DoesNotExist: