fix: 俱乐部000001不再展开全部菜单权限

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/utils.py

@@ -213,21 +213,15 @@ def verify_kefu_permission(request, username_from_frontend=None):
         )
         permissions = []
 
-    # 旧权限表（user_role 按手机号），与 gvsdsdk 合并
+    # 旧权限表（user_role 按手机号）：仅在没有 gvsdsdk 角色绑定时兜底，避免污染多俱乐部权限
     legacy_codes, _ = _legacy_backend_role_permissions(current_user.Phone)
-    if legacy_codes:
-        if isinstance(permissions, _AllPermissions):
-            pass
-        else:
-            permissions = list(set(list(permissions) + legacy_codes))
+    if legacy_codes and not role_uuids:
+        permissions = list(set(list(permissions) + legacy_codes))
 
-    # 管理员/超级用户自动拥有所有权限
-    if is_admin and '000001' not in permissions:
-        permissions.insert(0, '000001')
-
-    # 拥有 000001（超级管理权限）的用户自动获得所有功能权限
-    # 使用 _AllPermissions 包装，使任何权限码检查都自动通过
-    if '000001' in permissions:
+    # 仅系统级超管自动拥有全部功能权限；俱乐部 000001 只解锁超管页，不展开全部菜单
+    if is_system_super_admin(current_user):
+        if '000001' not in permissions:
+            permissions.insert(0, '000001')
         permissions = _AllPermissions(permissions)
 
     if not permissions:

jituan/services/club_rbac.py

@@ -149,7 +149,7 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id
             )
         return list(qs.filter(ClubID='').values_list('RoleUUID', flat=True))
     cid = (club_id or CLUB_ID_DEFAULT).strip()
-    return list(qs.filter(Q(ClubID=cid) | Q(ClubID='')).values_list('RoleUUID', flat=True))
+    return list(qs.filter(ClubID=cid).values_list('RoleUUID', flat=True))
 
 
 def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None):

jituan/services/kefu_menu.py

@@ -35,7 +35,8 @@ def _page_visible(page, permissions, user):
     if page.require_super:
         return _has_super_perm(permissions) or is_system_super_admin(user)
 
-    if _is_super_permissions(permissions):
+    # 仅系统级超管可见全部菜单；俱乐部 000001 不展开业务菜单
+    if is_system_super_admin(user):
         return True
 
     codes = page.perm_codes or []