From 64ddb7d0b8e40c32331864e889f4fcddca7ded22 Mon Sep 17 00:00:00 2001 From: XingQue Date: Mon, 6 Jul 2026 18:32:01 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=B1=E4=B9=90=E9=83=A8000001?= =?UTF-8?q?=E4=B8=8D=E5=86=8D=E5=B1=95=E5=BC=80=E5=85=A8=E9=83=A8=E8=8F=9C?= =?UTF-8?q?=E5=8D=95=E6=9D=83=E9=99=90?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Cursor --- backend/utils.py | 20 +++++++------------- jituan/services/club_rbac.py | 2 +- jituan/services/kefu_menu.py | 3 ++- 3 files changed, 10 insertions(+), 15 deletions(-) diff --git a/backend/utils.py b/backend/utils.py index 852d5ec..2811949 100644 --- a/backend/utils.py +++ b/backend/utils.py @@ -213,21 +213,15 @@ def verify_kefu_permission(request, username_from_frontend=None): ) permissions = [] - # 旧权限表（user_role 按手机号），与 gvsdsdk 合并 + # 旧权限表（user_role 按手机号）：仅在没有 gvsdsdk 角色绑定时兜底，避免污染多俱乐部权限 legacy_codes, _ = _legacy_backend_role_permissions(current_user.Phone) - if legacy_codes: - if isinstance(permissions, _AllPermissions): - pass - else: - permissions = list(set(list(permissions) + legacy_codes)) + if legacy_codes and not role_uuids: + permissions = list(set(list(permissions) + legacy_codes)) - # 管理员/超级用户自动拥有所有权限 - if is_admin and '000001' not in permissions: - permissions.insert(0, '000001') - - # 拥有 000001（超级管理权限）的用户自动获得所有功能权限 - # 使用 _AllPermissions 包装，使任何权限码检查都自动通过 - if '000001' in permissions: + # 仅系统级超管自动拥有全部功能权限；俱乐部 000001 只解锁超管页，不展开全部菜单 + if is_system_super_admin(current_user): + if '000001' not in permissions: + permissions.insert(0, '000001') permissions = _AllPermissions(permissions) if not permissions: diff --git a/jituan/services/club_rbac.py b/jituan/services/club_rbac.py index 744a525..887e647 100644 --- a/jituan/services/club_rbac.py +++ b/jituan/services/club_rbac.py @@ -149,7 +149,7 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id ) return list(qs.filter(ClubID='').values_list('RoleUUID', flat=True)) cid = (club_id or CLUB_ID_DEFAULT).strip() - return list(qs.filter(Q(ClubID=cid) | Q(ClubID='')).values_list('RoleUUID', flat=True)) + return list(qs.filter(ClubID=cid).values_list('RoleUUID', flat=True)) def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None): diff --git a/jituan/services/kefu_menu.py b/jituan/services/kefu_menu.py index a048cc7..aa40d12 100644 --- a/jituan/services/kefu_menu.py +++ b/jituan/services/kefu_menu.py @@ -35,7 +35,8 @@ def _page_visible(page, permissions, user): if page.require_super: return _has_super_perm(permissions) or is_system_super_admin(user) - if _is_super_permissions(permissions): + # 仅系统级超管可见全部菜单；俱乐部 000001 不展开业务菜单 + if is_system_super_admin(user): return True codes = page.perm_codes or []