From 6e2e1944b6f3222e60f728db06b01d3419844314 Mon Sep 17 00:00:00 2001
From: XingQue <kongxing634@gmail.com>
Date: Mon, 6 Jul 2026 19:28:35 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E8=A7=92=E8=89=B2UUID=20bytes=E6=AF=94?=
 =?UTF-8?q?=E5=AF=B9=E4=BF=AE=E5=A4=8D=E6=9D=83=E9=99=90=E5=85=A8=E7=A9=BA?=
 =?UTF-8?q?=EF=BC=8Clegacy=E6=9D=83=E9=99=90=E5=90=88=E5=B9=B6=E5=85=9C?=
 =?UTF-8?q?=E5=BA=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 jituan/services/club_rbac.py | 52 ++++++++++++++++--------------------
 1 file changed, 23 insertions(+), 29 deletions(-)

diff --git a/jituan/services/club_rbac.py b/jituan/services/club_rbac.py
index b47aadd..4e93594 100644
--- a/jituan/services/club_rbac.py
+++ b/jituan/services/club_rbac.py
@@ -142,20 +142,26 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id
     按当前俱乐部上下文过滤 UserRole 绑定的 RoleUUID。
     SINGLE_CLUB：本俱乐部角色 + 全局角色（ClubID 空/NULL）。
     ALL_CLUBS：已授权各俱乐部角色 + 全局角色。
+    使用 bytes 比对（兼容 UUIDObj），避免 ORM __in 在 BINARY(16) 上匹配失败。
     """
     if not role_uuids:
         return []
-    qs = Role.objects.filter(RoleUUID__in=role_uuids, RoleStatus=1)
-    if scope == DATA_SCOPE_ALL:
-        club_ids = [c for c in (allowed_club_ids or []) if c]
-        q = _global_role_q()
-        if club_ids:
-            q |= Q(ClubID__in=club_ids)
-        qs = qs.filter(q)
-    else:
-        cid = (club_id or CLUB_ID_DEFAULT).strip()
-        qs = qs.filter(Q(ClubID=cid) | _global_role_q())
-    return list(qs.values_list('RoleUUID', flat=True))
+    wanted = {role_uuid_bytes(u) for u in role_uuids}
+
+    matched = []
+    for ruuid, rcid_raw in Role.objects.filter(RoleStatus=1).values_list('RoleUUID', 'ClubID'):
+        if role_uuid_bytes(ruuid) not in wanted:
+            continue
+        rcid = (rcid_raw or '').strip()
+        if scope == DATA_SCOPE_ALL:
+            club_ids = {c for c in (allowed_club_ids or []) if c}
+            if rcid == '' or rcid in club_ids:
+                matched.append(ruuid)
+        else:
+            cid = (club_id or CLUB_ID_DEFAULT).strip()
+            if rcid == cid or rcid == '':
+                matched.append(ruuid)
+    return matched
 
 
 def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None, scope=None):
@@ -184,29 +190,17 @@ def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None, scop
 
 def resolve_effective_permission_codes(user, club_id, scope, allowed_club_ids=None):
     """
-    菜单与各业务接口统一权限码：当前俱乐部 gvsdsdk 角色 + 过渡期 legacy 兜底。
+    菜单与各业务接口统一权限码：当前俱乐部 gvsdsdk 角色 + legacy 合并。
     """
     from backend.utils import _legacy_backend_role_permissions
-    from gvsdsdk.models import UserRole as SdkUserRole
 
-    codes = resolve_permission_codes_for_club(
+    codes = list(resolve_permission_codes_for_club(
         user, club_id, allowed_club_ids, scope=scope,
-    )
-    if codes:
-        return codes
-
+    ))
     legacy_codes, _ = _legacy_backend_role_permissions(getattr(user, 'Phone', ''))
-    if not legacy_codes:
-        return []
-
-    if not SdkUserRole.objects.filter(UserUUID=user.UserUUID).exists():
-        return list(legacy_codes)
-
-    # gvsdsdk 有绑定但当前俱乐部视图下无权限码：单俱乐部账号仍走 legacy（未迁移完）
-    allowed = {c for c in (allowed_club_ids or []) if c}
-    if len(allowed) <= 1:
-        return list(legacy_codes)
-    return []
+    if legacy_codes:
+        codes = list(dict.fromkeys(codes + list(legacy_codes)))
+    return codes
 
 
 def describe_roles_in_scope(user, club_id, scope, allowed_club_ids=None):