fix: 集团可给各俱乐部分配不同功能角色，按俱乐部隔离权限校验

jituan/services/admin_context.py

@@ -213,6 +213,20 @@ def get_manageable_club_ids(user, permissions=None):
     }
 
 
+def can_access_admin_user_management(user, permissions=None):
+    """
+    是否可访问「后台用户」页（列表、按俱乐部分配功能角色）。
+    系统超管 / 000001 / 集团高管 / 任一俱乐部超管均可。
+    """
+    if is_system_super_admin(user):
+        return True
+    if permissions and '000001' in permissions:
+        return True
+    if can_manage_admin_assignments(user, permissions):
+        return True
+    return bool(get_manageable_club_ids(user, permissions))
+
+
 def _pack(scope, club_id, is_group_admin, assignments, clubs, can_switch_club,
           role_code, role_name):
     allowed_club_ids = sorted({

jituan/services/club_rbac.py

@@ -94,10 +94,8 @@ def resolve_role_by_name(role_name, club_id=None):
     qs = Role.objects.filter(RoleName=name, RoleStatus=1)
     cid = (club_id or '').strip()
     if cid:
-        hit = qs.filter(ClubID=cid).first()
-        if hit:
-            return hit
-    return qs.filter(ClubID='').first() or qs.first()
+        return qs.filter(ClubID=cid).first()
+    return qs.filter(ClubID='').first()
 
 
 def role_uuid_bytes(role_uuid):
@@ -192,10 +190,23 @@ def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None, scop
 
 
 def resolve_effective_permission_codes(user, club_id, scope, allowed_club_ids=None):
-    """菜单与各业务接口统一权限码：仅当前俱乐部 gvsdsdk 角色，不串其他俱乐部。"""
-    return resolve_permission_codes_for_club(
+    """
+    菜单与各业务接口统一权限码：当前俱乐部 gvsdsdk 角色。
+    单俱乐部任职且 gvsdsdk 为空时，兜底合并旧 user_role 表（兼容未迁移账号）。
+    """
+    from backend.utils import _legacy_backend_role_permissions
+
+    codes = resolve_permission_codes_for_club(
         user, club_id, allowed_club_ids, scope=scope,
     )
+    if codes:
+        return codes
+    allowed = {c for c in (allowed_club_ids or []) if c}
+    if len(allowed) <= 1:
+        legacy_codes, _ = _legacy_backend_role_permissions(getattr(user, 'Phone', ''))
+        if legacy_codes:
+            return list(legacy_codes)
+    return []
 
 
 def user_bound_role_names(user, club_id=None, scope=None, allowed_club_ids=None):

jituan/services/kefu_menu.py

@@ -6,6 +6,7 @@ from backend.utils import _AllPermissions, verify_kefu_permission
 from jituan.models import KefuMenuPage
 from jituan.services.admin_context import (
     build_admin_club_context,
+    can_access_admin_user_management,
     can_manage_admin_assignments,
     get_allowed_club_ids,
     is_system_super_admin,
@@ -32,6 +33,9 @@ def _page_visible(page, permissions, user):
     if page.require_group_manage:
         return can_manage_admin_assignments(user)
 
+    if getattr(page, 'require_admin_user_manage', False):
+        return can_access_admin_user_management(user, permissions)
+
     if page.require_super:
         return _has_super_perm(permissions) or is_system_super_admin(user)
 
@@ -46,8 +50,8 @@ def _page_visible(page, permissions, user):
 
 
 def _permission_codes_list(permissions):
-    if _is_super_permissions(permissions):
-        return ['000001']
+    if isinstance(permissions, _AllPermissions):
+        return list(dict.fromkeys(permissions)) if len(permissions) else ['000001']
     return list(permissions) if permissions else []
 
 
@@ -64,6 +68,7 @@ def _builtin_menu_pages():
             perm_codes=row.get('perm_codes', []),
             require_super=row.get('require_super', False),
             require_group_manage=row.get('require_group_manage', False),
+            require_admin_user_manage=row.get('require_admin_user_manage', False),
         ))
     return pages
 
@@ -145,6 +150,7 @@ def build_menu_access_payload(request, username=None):
         'yonghuid': getattr(request.user, 'UserUID', '') or '',
         'club_id': club_id,
         'club_scope': scope,
+        'effective_club_id': club_id,
         'can_switch_club': bool(club_ctx.get('can_switch_club')),
         'is_group_admin': bool(club_ctx.get('is_group_admin')),
         'menu_ready': True,

jituan/services/kefu_menu_definitions.py

@@ -55,7 +55,7 @@ KEFU_MENU_ROW_DEFS = [
     {'page_id': 'admin.club-config', 'name': '俱乐部密钥配置', 'path': '/admin/club-config', 'parent_id': 'admin', 'sort_order': 73,
      'require_group_manage': True},
     {'page_id': 'admin.user', 'name': '后台用户', 'path': '/admin/user', 'parent_id': 'admin', 'sort_order': 74,
-     'require_super': True},
+     'require_admin_user_manage': True},
     {'page_id': 'admin.operation-log', 'name': '操作日志', 'path': '/admin/operation-log', 'parent_id': 'admin', 'sort_order': 75,
      'perm_codes': ['czrz666']},
     {'page_id': 'punishment', 'name': '处罚管理', 'path': '/punishment', 'parent_id': '', 'sort_order': 80,