fix: 模板创建变量名; 客服模板/角色/权限 API

merchant_ops/views_manage.py

@@ -252,6 +252,72 @@ class StaffRoleSetPermsView(APIView):
             return _err(e)
 
 
+class StaffRoleCreateView(APIView):
+    """商家自定义角色（自由勾选权限）。"""
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request):
+        try:
+            mid = request.user.UserUID
+            ensure_owner_merchant(mid, request.user)
+            ensure_merchant_roles(mid)
+            role_name = (request.data.get('role_name') or '').strip()
+            if not role_name:
+                return Response({'code': 400, 'msg': '角色名称不能为空', 'data': None})
+            role_code = (request.data.get('role_code') or '').strip()
+            if not role_code:
+                role_code = 'CUSTOM_' + secrets.token_hex(3).upper()
+            if MerchantStaffRole.query.filter(merchant_id=mid, role_code=role_code).exists():
+                return Response({'code': 400, 'msg': '角色码已存在', 'data': None})
+            permissions = request.data.get('permissions', [])
+            role = MerchantStaffRole.objects.create(
+                club_id='xq',
+                merchant_id=mid,
+                role_code=role_code,
+                role_name=role_name,
+                is_system=False,
+                sort_order=50,
+                status=1,
+            )
+            valid = set(MerchantStaffPermission.query.filter(status=1).values_list('perm_code', flat=True))
+            for p in permissions:
+                if p in valid:
+                    MerchantStaffRolePermission.objects.create(role=role, perm_code=p)
+            audit_owner(mid, mid, 'ROLE_CREATE', request, resource_id=role.id)
+            return Response({'code': 0, 'msg': '创建成功', 'data': {'id': role.id, 'role_code': role.role_code}})
+        except Exception as e:
+            return _err(e)
+
+
+class StaffMemberUpdatePermsView(APIView):
+    """成员级权限加减（覆盖角色默认权限）。"""
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request):
+        try:
+            mid = request.user.UserUID
+            ensure_owner_merchant(mid, request.user)
+            member_id = request.data.get('member_id')
+            overrides = request.data.get('overrides', [])
+            m = MerchantStaffMember.query.get(id=member_id, merchant_id=mid, status=MEMBER_STATUS_ACTIVE)
+            MerchantStaffMemberPermission.query.filter(member=m).delete()
+            valid = set(MerchantStaffPermission.query.filter(status=1).values_list('perm_code', flat=True))
+            for item in overrides:
+                if isinstance(item, dict):
+                    code = item.get('perm_code')
+                    granted = bool(item.get('granted', True))
+                else:
+                    code = item
+                    granted = True
+                if code not in valid:
+                    continue
+                MerchantStaffMemberPermission.objects.create(member=m, perm_code=code, granted=granted)
+            audit_owner(mid, mid, 'MEMBER_SET_PERMS', request, resource_id=member_id)
+            return Response({'code': 0, 'msg': '成员权限已更新', 'data': {'permissions': list(get_member_permissions(m))}})
+        except Exception as e:
+            return _err(e)
+
+
 class StaffWalletAllocateView(APIView):
     permission_classes = [IsAuthenticated]