fix: 集团可给各俱乐部分配不同功能角色，按俱乐部隔离权限校验

backend/views/roles.py

@@ -144,8 +144,8 @@ class GetRolePermissionView(APIView):
         if kefu is None:
             return permissions  # 直接返回错误响应
 
-        # 2. 检查是否有 000001 权限
-        if '000001' not in permissions:
+        from jituan.services.admin_context import can_access_admin_user_management
+        if not can_access_admin_user_management(request.user, permissions):
             return Response({'code': 403, 'msg': '您无权访问此页面'})
 
         # 3. 获取所有权限
@@ -410,7 +410,8 @@ class GetAdminUserListView(APIView):
             kefu, permissions = verify_kefu_permission(request, username)
             if kefu is None:
                 return permissions
-            if '000001' not in permissions:
+            from jituan.services.admin_context import can_access_admin_user_management
+            if not can_access_admin_user_management(request.user, permissions):
                 return Response({'code': 403, 'msg': '您无权访问此页面'})
 
             phone = request.data.get('phone', '').strip()
@@ -541,7 +542,8 @@ class GetAdminRolesView(APIView):
         kefu, permissions = verify_kefu_permission(request, username)
         if kefu is None:
             return permissions
-        if '000001' not in permissions:
+        from jituan.services.admin_context import can_access_admin_user_management
+        if not can_access_admin_user_management(request.user, permissions):
             return Response({'code': 403, 'msg': '您无权访问此页面'})
 
         from jituan.services.admin_context import can_manage_admin_assignments, get_manageable_club_ids
@@ -588,7 +590,8 @@ class GetAdminRolesView(APIView):
         kefu, permissions = verify_kefu_permission(request, username)
         if kefu is None:
             return permissions
-        if '000001' not in permissions:
+        from jituan.services.admin_context import can_access_admin_user_management
+        if not can_access_admin_user_management(request.user, permissions):
             return Response({'code': 403, 'msg': '您无权访问此页面'})
 
         # 筛选条件
@@ -659,7 +662,11 @@ class ModifyAdminUserView(APIView):
         if kefu is None:
             return permissions
 
-        from jituan.services.admin_context import can_manage_admin_assignments, can_manage_roles_for_club
+        from jituan.services.admin_context import (
+            can_manage_admin_assignments,
+            can_manage_roles_for_club,
+            can_access_admin_user_management,
+        )
 
         club_assign_actions = {'add_club_assignment', 'remove_club_assignment'}
         role_manage_actions = {'add_user_roles', 'remove_user_role'}
@@ -667,8 +674,9 @@ class ModifyAdminUserView(APIView):
             if not can_manage_admin_assignments(request.user, permissions):
                 return Response({'code': 403, 'msg': '无权分配俱乐部任职'})
         elif action in role_manage_actions:
-            pass
-        elif '000001' not in permissions:
+            if not can_access_admin_user_management(request.user, permissions):
+                return Response({'code': 403, 'msg': '您无权管理角色分配'})
+        elif not can_manage_admin_assignments(request.user, permissions) and '000001' not in permissions:
             return Response({'code': 403, 'msg': '您无权进行此操作'})
 
         target_yonghuid = request.data.get('yonghuid', '').strip()
@@ -726,6 +734,10 @@ class ModifyAdminUserView(APIView):
                     if not role:
                         missing.append(rc)
                         continue
+                    role_club = (getattr(role, 'ClubID', None) or '').strip()
+                    if role_club and role_club != bind_club_id:
+                        missing.append(rc)
+                        continue
                     _, created = UserRole.objects.get_or_create(
                         UserUUID=target_user.UserUUID,
                         RoleUUID=role.RoleUUID,
@@ -822,8 +834,19 @@ class AddAdminUserView(APIView):
         kefu, permissions = verify_kefu_permission(request, username)
         if kefu is None:
             return permissions
-        if '000001' not in permissions:
-            return Response({'code': 403, 'msg': '您无权进行此操作'})
+
+        from jituan.services.admin_context import (
+            can_manage_admin_assignments,
+            can_manage_roles_for_club,
+        )
+        from jituan.services.club_context import resolve_club_id_from_request
+
+        target_club_id = resolve_club_id_from_request(request)
+        if not (
+            can_manage_admin_assignments(request.user, permissions)
+            or can_manage_roles_for_club(request.user, permissions, target_club_id)
+        ):
+            return Response({'code': 403, 'msg': '您无权在该俱乐部添加用户'})
 
         phone = request.data.get('phone', '').strip()
         password = request.data.get('password', '').strip()
@@ -836,11 +859,8 @@ class AddAdminUserView(APIView):
         if len(password) < 6 or len(erjimima) < 6:
             return Response({'code': 400, 'msg': '密码和二级密码至少6位'})
 
-        from jituan.services.club_context import resolve_club_id_from_request
         from jituan.services.club_rbac import resolve_roles_for_binding
 
-        target_club_id = resolve_club_id_from_request(request)
-
         # 校验手机号是否已被后台客服占用（同俱乐部优先）
         existing_kefu = User.query.filter(
             Phone=phone, KefuProfile__isnull=False