From 97e9093aa5a5cc27e37b56478ed3492d5078e565 Mon Sep 17 00:00:00 2001
From: XingQue <kongxing634@gmail.com>
Date: Thu, 23 Jul 2026 01:11:18 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=99=BB=E5=BD=95=E6=8E=A5=E5=8F=A3?=
 =?UTF-8?q?=E5=BD=BB=E5=BA=95=E8=B7=B3=E8=BF=87=E9=89=B4=E6=9D=83=EF=BC=8C?=
 =?UTF-8?q?=E6=B6=88=E9=99=A4=20403=20=E6=9D=83=E9=99=90=E4=B8=8D=E8=B6=B3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ClubWechatLoginView / WechatMiniProgramLoginView 覆盖 initial，不做 JWT/权限/限流；动态配置接口也不再解析坏 Token。

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 config/views/miniapp_config.py |  1 +
 jituan/views.py                | 14 +++++++++++---
 users/views/auth.py            |  9 +++++++--
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/config/views/miniapp_config.py b/config/views/miniapp_config.py
index e31a194..e1b7a92 100644
--- a/config/views/miniapp_config.py
+++ b/config/views/miniapp_config.py
@@ -61,6 +61,7 @@ import logging
 logger = logging.getLogger(__name__)
 
 class GetDynamicConfigView(APIView):
+    authentication_classes = ()
     permission_classes = [AllowAny]
     parser_classes = [JSONParser]
 
diff --git a/jituan/views.py b/jituan/views.py
index 86779bb..60f87c1 100644
--- a/jituan/views.py
+++ b/jituan/views.py
@@ -48,10 +48,18 @@ class ClubWechatLoginView(APIView):
     多俱乐部微信小程序登录（新接口，旧 /yonghu/wechatlogin 不变）。
     POST /jituan/auth/wechat-login
     body: { code, club_id?, app_id? }
+
+    注意：必须完全跳过 JWT/权限/限流。
+    DRF 在 authentication_classes=[] 时若仍抛 AuthenticationFailed，
+    会因无 WWW-Authenticate 头被改写成 HTTP 403（前端显示「权限不足」）。
     """
-    authentication_classes = []  # 登录不走 JWT，避免旧 Token 触发 403
-    throttle_classes = [AnonRateThrottle]
-    permission_classes = [AllowAny]
+    authentication_classes = ()
+    permission_classes = ()
+    throttle_classes = ()
+
+    def initial(self, request, *args, **kwargs):
+        # 登录接口不做任何鉴权/权限/限流，避免 403「权限不足」
+        return
 
     def post(self, request):
         code = (request.data.get('code') or '').strip()
diff --git a/users/views/auth.py b/users/views/auth.py
index 1adf3b9..37566a8 100644
--- a/users/views/auth.py
+++ b/users/views/auth.py
@@ -103,8 +103,13 @@ class WechatMiniProgramLoginView(APIView):
     """
     微信小程序登录接口
     """
-    throttle_classes = [AnonRateThrottle]
-    permission_classes = [AllowAny]
+    authentication_classes = ()
+    permission_classes = ()
+    throttle_classes = ()
+
+    def initial(self, request, *args, **kwargs):
+        # 与 /jituan/auth/wechat-login 一致：登录绝不走 JWT，避免 403「权限不足」
+        return
 
     def post(self, request):
         try: