XingQue/Django
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 订单类型接口与 menu-access 对齐鉴权，去掉业务 401

Browse Source 
kfhqptddlx 不再校验 phone/UserType，仅 JWT + is_kefu_backend_account，避免菜单能进但类型接口 401 踢登录。

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
XingQue
2026-07-06 19:35:23 +08:00
parent 6e2e1944b6
commit bfd5a63cb4
1 changed files with 6 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
users/views/kefu_base.py
View File

@@ -56,8 +56,8 @@ from orders.utils import (
from backend.utils import (
update_dashou_daily_by_action, update_guanshi_daily_by_action,
update_shangjia_daily, update_zuzhang_daily_by_action,
verify_kefu_permission
)
from jituan.services.admin_context import is_kefu_backend_account
from rank.utils import get_tag_fee, create_shenhe_jilu, validate_shenheguan
from ..models import (
@@ -324,54 +324,24 @@ class KefuStatsView(APIView):
class KefuGetOrderTypesView(APIView):
"""
客服获取订单类型列表接口（平台订单用）
客服获取订单类型列表（平台/商家/跨平台订单页共用）
请求：POST /yonghu/kfhqptddlx
参数：{"phone": "13800138000"}
认证：JWT
认证：JWT + 与 menu-access 相同的 is_kefu_backend_account
返回：code=0 + 类型列表
"""
permission_classes = [IsAuthenticated]
parser_classes = [JSONParser]
def post(self, request):
# 1. 获取参数
phone = request.data.get('phone', '').strip()
if not phone:
return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED)
if not is_kefu_backend_account(request.user):
return Response({'code': 403, 'msg': '非后台账号'}, status=403)
current_user = request.user
# 2. 验证手机号一致性
if getattr(current_user, 'Phone', '') != phone:
logger.warning(f"手机号不匹配: 请求phone={phone}, 用户phone={current_user.Phone}")
return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED)
# 3. 验证用户类型及客服状态
if current_user.UserType not in ('kefu', 'admin'):
logger.warning(f"用户类型非客服: {current_user.UserUID}")
return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED)
# 管理员跳过客服扩展表检查
is_admin = current_user.UserType == 'admin' or current_user.IsSuperuser
if not is_admin:
try:
kefu_profile = current_user.KefuProfile
except ObjectDoesNotExist:
logger.warning(f"客服扩展表不存在: {current_user.UserUID}")
return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED)
if kefu_profile.zhuangtai != 1:
logger.warning(f"客服账号已被禁用: {current_user.UserUID}")
return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED)
# 4. 查询订单类型（商品类型）
try:
# 只查询需要的字段，减少数据传输
types_qs = ShangpinLeixing.query.all().only('id', 'jieshao', 'tupian_url')
type_list = [
{
'id': t.id,
'biaoti': t.jieshao or '', # 假设商品类型的标题字段为 jieshao
'biaoti': t.jieshao or '',
'tupian_url': t.tupian_url or ''
}
for t in types_qs
@@ -379,5 +349,4 @@ class KefuGetOrderTypesView(APIView):
return Response({'code': 0, 'data': type_list})
except Exception as e:
logger.error(f"查询商品类型表失败: {str(e)}")
# 表不存在或查询失败，返回空列表
return Response({'code': 0, 'data': []})