From 725a1386c3efa69d9b010929496ed71c134b4f0d Mon Sep 17 00:00:00 2001 From: XingQue Date: Thu, 2 Jul 2026 14:17:26 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E5=AE=8C=E5=85=A8=E5=9B=9E=E6=BB=9A?= =?UTF-8?q?=E5=85=AC=E5=91=8A=E8=BD=AE=E6=92=AD=E8=BA=AB=E4=BB=BD=E6=A0=A1?= =?UTF-8?q?=E9=AA=8C=E4=BB=A3=E7=A0=81=EF=BC=8C=E6=81=A2=E5=A4=8D=E6=94=B9?= =?UTF-8?q?=E5=89=8D=E8=A1=8C=E4=B8=BA?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Cursor --- config/views.py | 3 +- jituan/services/display_config.py | 58 ------------------------------- 2 files changed, 2 insertions(+), 59 deletions(-) diff --git a/config/views.py b/config/views.py index c2a6093..462cc97 100644 --- a/config/views.py +++ b/config/views.py @@ -151,7 +151,8 @@ class ShangpinGonggaoView(APIView): """ throttle_classes = [AnonRateThrottle] permission_classes = [AllowAny] - authentication_classes = [] # 不校验 JWT，避免前端带过期 token 时 401 + authentication_classes = [] + def post(self, request): """ 处理POST请求，返回公告和轮播图数据 diff --git a/jituan/services/display_config.py b/jituan/services/display_config.py index a9099b7..45de591 100644 --- a/jituan/services/display_config.py +++ b/jituan/services/display_config.py @@ -21,12 +21,6 @@ LUNBO_PAGE_OPTIONS = [ (LUNBO_PAGE_DASHOU_CENTER, '打手个人中心背景'), ] -# 无商家/打手/管事/组长身份时，仅允许点单相关 page_key -PUBLIC_LUNBO_PAGE_KEYS = frozenset({ - LUNBO_PAGE_ACCEPT_ORDER, - LUNBO_PAGE_ORDER_POOL, -}) - def normalize_page_key(page_key, image_type=1): key = (page_key or '').strip() @@ -37,58 +31,6 @@ def normalize_page_key(page_key, image_type=1): return LUNBO_PAGE_ORDER_POOL -def _user_role_profile_flags(user): - """根据扩展表判断用户是否具备对应身份（比 UserType 更准）。""" - if not user or not getattr(user, 'is_authenticated', False): - return frozenset() - found = set() - for attr, name in ( - ('ShopProfile', 'shop'), - ('DashouProfile', 'dashou'), - ('GuanshiProfile', 'guanshi'), - ('ZuzhangProfile', 'zuzhang'), - ): - try: - getattr(user, attr) - found.add(name) - except Exception: - pass - return frozenset(found) - - -def allowed_lunbo_page_keys_for_user(user): - """当前用户可访问的轮播/公告 page_key。""" - allowed = set(PUBLIC_LUNBO_PAGE_KEYS) - roles = _user_role_profile_flags(user) - if 'shop' in roles: - allowed.add(LUNBO_PAGE_MERCHANT_HOME) - if 'dashou' in roles: - allowed.add(LUNBO_PAGE_DASHOU_CENTER) - # 管事/组长与点单页共用 order_pool、accept_order，已在 PUBLIC 中 - return frozenset(allowed) - - -def resolve_lunbo_page_key_for_request(request, page_key=None, image_type=1): - """ - 按身份限制 page_key（与小程序 display-config.js 对齐）： - - order_pool / accept_order：任何人（含未登录）均可访问 - - merchant_home / dashou_center：未登录时按前端传入的 page_key 返回（接口 AllowAny、前端不传 JWT） - - 已登录时：无对应扩展表身份则拒绝该 page_key（返回 None） - """ - requested = normalize_page_key(page_key, image_type=image_type) - if requested in PUBLIC_LUNBO_PAGE_KEYS: - return requested - - user = getattr(request, 'user', None) - if not user or not getattr(user, 'is_authenticated', False): - return requested - - allowed = allowed_lunbo_page_keys_for_user(user) - if requested in allowed: - return requested - return None - - def forbid_display_write_in_all_scope(request): if resolve_club_scope(request) == DATA_SCOPE_ALL: return Response({'code': 403, 'msg': '请在子公司视图下修改展示配置'})