XingQue/Django
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 俱乐部超级管理000001可添加/管理本店后台用户，无需集团权限

Browse Source 
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
XingQue
2026-07-26 02:14:33 +08:00
parent 98b4526efa
commit 6443336bd9
2 changed files with 43 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
backend/views/roles.py
View File

@@ -553,10 +553,15 @@ class GetAdminUserListView(APIView):
})
from jituan.services.admin_context import can_manage_admin_assignments, get_manageable_club_ids
manageable = sorted(get_manageable_club_ids(request.user, permissions))
manageable = sorted(get_manageable_club_ids(
request.user, permissions, current_club_id=curr_club,
))
if scope != DATA_SCOPE_ALL:
# 顶栏在具体俱乐部时，可管理集合收敛到当前店（含超级管理 000001）
manageable = [c for c in manageable if c == curr_club]
# 兜底：本店超级管理一定能管本店用户（不依赖集团任职）
if not manageable and curr_club and permissions and '000001' in permissions:
manageable = [curr_club]
return Response({
'code': 0,
'data': {
@@ -565,6 +570,9 @@ class GetAdminUserListView(APIView):
'page': page,
'pageSize': page_size,
'can_manage_club_assignments': can_manage_admin_assignments(request.user, permissions),
'can_manage_club_users': bool(manageable) or (
bool(permissions) and '000001' in permissions and scope != DATA_SCOPE_ALL
),
'manageable_club_ids': manageable,
'current_club_id': curr_club,
'scope': scope,
@@ -722,9 +730,11 @@ class ModifyAdminUserView(APIView):
club_assign_actions = {'add_club_assignment', 'remove_club_assignment'}
role_manage_actions = {'add_user_roles', 'remove_user_role'}
if action in club_assign_actions:
# 跨店任职仍需集团权限；本店超级管理只管功能角色与账号，不分配其他俱乐部任职
if not can_manage_admin_assignments(request.user, permissions):
return Response({'code': 403, 'msg': '无权分配俱乐部任职'})
return Response({'code': 403, 'msg': '无权分配俱乐部任职（需集团权限）'})
elif action in role_manage_actions:
# 本店超级管理 000001 可给本俱乐部用户增删功能角色
if not can_access_admin_user_management(request.user, permissions):
return Response({'code': 403, 'msg': '您无权管理角色分配'})
elif not can_manage_admin_assignments(request.user, permissions) and '000001' not in permissions:
@@ -778,7 +788,10 @@ class ModifyAdminUserView(APIView):
)
if not bind_club_id:
return Response({'code': 400, 'msg': '请先切换到具体俱乐部再分配角色'})
if not can_manage_roles_for_club(request.user, permissions, bind_club_id):
if not (
can_manage_roles_for_club(request.user, permissions, bind_club_id)
or ('000001' in permissions)
):
return Response({'code': 403, 'msg': '您无权管理该俱乐部的角色分配'})
added, missing = [], []
for rc in role_codes:
@@ -824,7 +837,10 @@ class ModifyAdminUserView(APIView):
)
if not bind_club_id:
return Response({'code': 400, 'msg': '请先切换到具体俱乐部再操作角色'})
if not can_manage_roles_for_club(request.user, permissions, bind_club_id):
if not (
can_manage_roles_for_club(request.user, permissions, bind_club_id)
or ('000001' in permissions)
):
return Response({'code': 403, 'msg': '您无权管理该俱乐部的角色分配'})
role = resolve_role_by_name(role_code, bind_club_id)
if not role:
@@ -892,12 +908,17 @@ class AddAdminUserView(APIView):
can_manage_admin_assignments,
can_manage_roles_for_club,
)
from jituan.services.club_context import resolve_club_id_from_request
from jituan.services.club_context import resolve_club_id_from_request, resolve_club_scope
from jituan.constants import DATA_SCOPE_ALL
target_club_id = resolve_club_id_from_request(request)
if resolve_club_scope(request) == DATA_SCOPE_ALL or not target_club_id:
return Response({'code': 400, 'msg': '请先切换到具体俱乐部再添加用户'})
# 俱乐部超级管理 000001 即可添加本店后台用户，无需集团权限
if not (
can_manage_admin_assignments(request.user, permissions)
or can_manage_roles_for_club(request.user, permissions, target_club_id)
or ('000001' in permissions)
):
return Response({'code': 403, 'msg': '您无权在该俱乐部添加用户'})

25
jituan/services/admin_context.py
View File

@@ -190,27 +190,36 @@ def get_switchable_club_ids(user):
def can_manage_roles_for_club(user, permissions, club_id):
"""
是否可为指定俱乐部分配/移除功能角色。
集团高层：全部俱乐部；否则须在该俱乐部拥有 000001 超级管理权限。
是否可为指定俱乐部分配/移除功能角色、添加本店后台用户。
集团高层：全部俱乐部；否则须在该俱乐部拥有 000001 超级管理（不必有集团权限）。
"""
if can_manage_admin_assignments(user, permissions):
return True
cid = (club_id or '').strip()
if not cid:
return False
from jituan.services.club_rbac import resolve_permission_codes_for_club
codes = resolve_permission_codes_for_club(user, cid)
return '000001' in codes
from jituan.constants import DATA_SCOPE_SINGLE
from jituan.services.club_rbac import resolve_effective_permission_codes
# 与菜单/verify_kefu 同一套：含 legacy，避免「页面能进但添加按钮出不来」
codes = resolve_effective_permission_codes(user, cid, DATA_SCOPE_SINGLE)
return '000001' in (codes or [])
def get_manageable_club_ids(user, permissions=None):
"""当前操作者可管理角色分配的俱乐部集合。"""
def get_manageable_club_ids(user, permissions=None, current_club_id=None):
"""
当前操作者可管理角色/后台用户的俱乐部集合。
current_club_id：若请求上下文已带 000001，务必把当前顶栏俱乐部算进去。
"""
if can_manage_admin_assignments(user, permissions):
return {c.club_id for c in Club.query.filter(status=1)}
return {
ids = {
c.club_id for c in Club.query.filter(status=1)
if can_manage_roles_for_club(user, permissions, c.club_id)
}
cid = (current_club_id or '').strip()
if cid and permissions and '000001' in permissions:
ids.add(cid)
return ids
def can_access_admin_user_management(user, permissions=None):