diff --git a/config/views.py b/config/views.py index c2a6093..462cc97 100644 --- a/config/views.py +++ b/config/views.py @@ -151,7 +151,8 @@ class ShangpinGonggaoView(APIView): """ throttle_classes = [AnonRateThrottle] permission_classes = [AllowAny] - authentication_classes = [] # 不校验 JWT,避免前端带过期 token 时 401 + authentication_classes = [] + def post(self, request): """ 处理POST请求,返回公告和轮播图数据 diff --git a/jituan/services/display_config.py b/jituan/services/display_config.py index a9099b7..45de591 100644 --- a/jituan/services/display_config.py +++ b/jituan/services/display_config.py @@ -21,12 +21,6 @@ LUNBO_PAGE_OPTIONS = [ (LUNBO_PAGE_DASHOU_CENTER, '打手个人中心背景'), ] -# 无商家/打手/管事/组长身份时,仅允许点单相关 page_key -PUBLIC_LUNBO_PAGE_KEYS = frozenset({ - LUNBO_PAGE_ACCEPT_ORDER, - LUNBO_PAGE_ORDER_POOL, -}) - def normalize_page_key(page_key, image_type=1): key = (page_key or '').strip() @@ -37,58 +31,6 @@ def normalize_page_key(page_key, image_type=1): return LUNBO_PAGE_ORDER_POOL -def _user_role_profile_flags(user): - """根据扩展表判断用户是否具备对应身份(比 UserType 更准)。""" - if not user or not getattr(user, 'is_authenticated', False): - return frozenset() - found = set() - for attr, name in ( - ('ShopProfile', 'shop'), - ('DashouProfile', 'dashou'), - ('GuanshiProfile', 'guanshi'), - ('ZuzhangProfile', 'zuzhang'), - ): - try: - getattr(user, attr) - found.add(name) - except Exception: - pass - return frozenset(found) - - -def allowed_lunbo_page_keys_for_user(user): - """当前用户可访问的轮播/公告 page_key。""" - allowed = set(PUBLIC_LUNBO_PAGE_KEYS) - roles = _user_role_profile_flags(user) - if 'shop' in roles: - allowed.add(LUNBO_PAGE_MERCHANT_HOME) - if 'dashou' in roles: - allowed.add(LUNBO_PAGE_DASHOU_CENTER) - # 管事/组长与点单页共用 order_pool、accept_order,已在 PUBLIC 中 - return frozenset(allowed) - - -def resolve_lunbo_page_key_for_request(request, page_key=None, image_type=1): - """ - 按身份限制 page_key(与小程序 display-config.js 对齐): - - order_pool / accept_order:任何人(含未登录)均可访问 - - merchant_home / dashou_center:未登录时按前端传入的 page_key 返回(接口 AllowAny、前端不传 JWT) - - 已登录时:无对应扩展表身份则拒绝该 page_key(返回 None) - """ - requested = normalize_page_key(page_key, image_type=image_type) - if requested in PUBLIC_LUNBO_PAGE_KEYS: - return requested - - user = getattr(request, 'user', None) - if not user or not getattr(user, 'is_authenticated', False): - return requested - - allowed = allowed_lunbo_page_keys_for_user(user) - if requested in allowed: - return requested - return None - - def forbid_display_write_in_all_scope(request): if resolve_club_scope(request) == DATA_SCOPE_ALL: return Response({'code': 403, 'msg': '请在子公司视图下修改展示配置'})