fix: 完全回滚公告轮播身份校验代码,恢复改前行为

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
XingQue
2026-07-02 14:17:26 +08:00
parent 0fc9c85503
commit 725a1386c3
2 changed files with 2 additions and 59 deletions

View File

@@ -21,12 +21,6 @@ LUNBO_PAGE_OPTIONS = [
(LUNBO_PAGE_DASHOU_CENTER, '打手个人中心背景'),
]
# 无商家/打手/管事/组长身份时,仅允许点单相关 page_key
PUBLIC_LUNBO_PAGE_KEYS = frozenset({
LUNBO_PAGE_ACCEPT_ORDER,
LUNBO_PAGE_ORDER_POOL,
})
def normalize_page_key(page_key, image_type=1):
key = (page_key or '').strip()
@@ -37,58 +31,6 @@ def normalize_page_key(page_key, image_type=1):
return LUNBO_PAGE_ORDER_POOL
def _user_role_profile_flags(user):
"""根据扩展表判断用户是否具备对应身份(比 UserType 更准)。"""
if not user or not getattr(user, 'is_authenticated', False):
return frozenset()
found = set()
for attr, name in (
('ShopProfile', 'shop'),
('DashouProfile', 'dashou'),
('GuanshiProfile', 'guanshi'),
('ZuzhangProfile', 'zuzhang'),
):
try:
getattr(user, attr)
found.add(name)
except Exception:
pass
return frozenset(found)
def allowed_lunbo_page_keys_for_user(user):
"""当前用户可访问的轮播/公告 page_key。"""
allowed = set(PUBLIC_LUNBO_PAGE_KEYS)
roles = _user_role_profile_flags(user)
if 'shop' in roles:
allowed.add(LUNBO_PAGE_MERCHANT_HOME)
if 'dashou' in roles:
allowed.add(LUNBO_PAGE_DASHOU_CENTER)
# 管事/组长与点单页共用 order_pool、accept_order已在 PUBLIC 中
return frozenset(allowed)
def resolve_lunbo_page_key_for_request(request, page_key=None, image_type=1):
"""
按身份限制 page_key与小程序 display-config.js 对齐):
- order_pool / accept_order任何人含未登录均可访问
- merchant_home / dashou_center未登录时按前端传入的 page_key 返回(接口 AllowAny、前端不传 JWT
- 已登录时:无对应扩展表身份则拒绝该 page_key返回 None
"""
requested = normalize_page_key(page_key, image_type=image_type)
if requested in PUBLIC_LUNBO_PAGE_KEYS:
return requested
user = getattr(request, 'user', None)
if not user or not getattr(user, 'is_authenticated', False):
return requested
allowed = allowed_lunbo_page_keys_for_user(user)
if requested in allowed:
return requested
return None
def forbid_display_write_in_all_scope(request):
if resolve_club_scope(request) == DATA_SCOPE_ALL:
return Response({'code': 403, 'msg': '请在子公司视图下修改展示配置'})