From bfd5a63cb4782daaf1b3b1ad5f746bd8c57041a8 Mon Sep 17 00:00:00 2001 From: XingQue Date: Mon, 6 Jul 2026 19:35:23 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E8=AE=A2=E5=8D=95=E7=B1=BB=E5=9E=8B?= =?UTF-8?q?=E6=8E=A5=E5=8F=A3=E4=B8=8E=20menu-access=20=E5=AF=B9=E9=BD=90?= =?UTF-8?q?=E9=89=B4=E6=9D=83=EF=BC=8C=E5=8E=BB=E6=8E=89=E4=B8=9A=E5=8A=A1?= =?UTF-8?q?=20401?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit kfhqptddlx 不再校验 phone/UserType，仅 JWT + is_kefu_backend_account，避免菜单能进但类型接口 401 踢登录。 Co-authored-by: Cursor --- users/views/kefu_base.py | 43 ++++++---------------------------------- 1 file changed, 6 insertions(+), 37 deletions(-) diff --git a/users/views/kefu_base.py b/users/views/kefu_base.py index c3f1f45..445d77d 100644 --- a/users/views/kefu_base.py +++ b/users/views/kefu_base.py @@ -56,8 +56,8 @@ from orders.utils import ( from backend.utils import ( update_dashou_daily_by_action, update_guanshi_daily_by_action, update_shangjia_daily, update_zuzhang_daily_by_action, - verify_kefu_permission ) +from jituan.services.admin_context import is_kefu_backend_account from rank.utils import get_tag_fee, create_shenhe_jilu, validate_shenheguan from ..models import ( @@ -324,54 +324,24 @@ class KefuStatsView(APIView): class KefuGetOrderTypesView(APIView): """ - 客服获取订单类型列表接口（平台订单用） + 客服获取订单类型列表（平台/商家/跨平台订单页共用） 请求：POST /yonghu/kfhqptddlx - 参数：{"phone": "13800138000"} - 认证：JWT + 认证：JWT + 与 menu-access 相同的 is_kefu_backend_account 返回：code=0 + 类型列表 """ permission_classes = [IsAuthenticated] parser_classes = [JSONParser] def post(self, request): - # 1. 获取参数 - phone = request.data.get('phone', '').strip() - if not phone: - return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED) + if not is_kefu_backend_account(request.user): + return Response({'code': 403, 'msg': '非后台账号'}, status=403) - current_user = request.user - - # 2. 验证手机号一致性 - if getattr(current_user, 'Phone', '') != phone: - logger.warning(f"手机号不匹配: 请求phone={phone}, 用户phone={current_user.Phone}") - return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED) - - # 3. 验证用户类型及客服状态 - if current_user.UserType not in ('kefu', 'admin'): - logger.warning(f"用户类型非客服: {current_user.UserUID}") - return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED) - - # 管理员跳过客服扩展表检查 - is_admin = current_user.UserType == 'admin' or current_user.IsSuperuser - if not is_admin: - try: - kefu_profile = current_user.KefuProfile - except ObjectDoesNotExist: - logger.warning(f"客服扩展表不存在: {current_user.UserUID}") - return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED) - - if kefu_profile.zhuangtai != 1: - logger.warning(f"客服账号已被禁用: {current_user.UserUID}") - return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED) - - # 4. 查询订单类型（商品类型） try: - # 只查询需要的字段，减少数据传输 types_qs = ShangpinLeixing.query.all().only('id', 'jieshao', 'tupian_url') type_list = [ { 'id': t.id, - 'biaoti': t.jieshao or '', # 假设商品类型的标题字段为 jieshao + 'biaoti': t.jieshao or '', 'tupian_url': t.tupian_url or '' } for t in types_qs @@ -379,5 +349,4 @@ class KefuGetOrderTypesView(APIView): return Response({'code': 0, 'data': type_list}) except Exception as e: logger.error(f"查询商品类型表失败: {str(e)}") - # 表不存在或查询失败，返回空列表 return Response({'code': 0, 'data': []})