fix: merge legacy user_role permissions with gvsdsdk for kefu login

backend/utils.py

@@ -77,6 +77,40 @@ class _AllPermissions(list):
         return True
 
 
+def _legacy_backend_role_permissions(phone):
+    """
+    读取旧权限表（backend.models）：
+    user_role.account_id = 手机号 → role → role_permission → permission.perm_code
+    与 gvsdsdk 表并行，未改 SDK 结构。
+    """
+    phone = (phone or '').strip()
+    if not phone:
+        return [], []
+    try:
+        from backend.models import (
+            UserRole as LegacyUserRole,
+            Role as BackendRole,
+            Permission as BackendPermission,
+        )
+        role_ids = list(
+            LegacyUserRole.objects.filter(account_id=phone).values_list('role_id', flat=True)
+        )
+        if not role_ids:
+            return [], []
+        perm_codes = list(
+            BackendPermission.objects.filter(
+                rolepermission__role_id__in=role_ids
+            ).values_list('perm_code', flat=True).distinct()
+        )
+        role_names = list(
+            BackendRole.objects.filter(role_id__in=role_ids).values_list('role_name', flat=True)
+        )
+        return perm_codes, role_names
+    except Exception as e:
+        logger.warning('legacy_backend_role_permissions phone=%s err=%s', phone, e)
+        return [], []
+
+
 def verify_kefu_permission(request, username_from_frontend=None):
     """
     验证客服/管理员身份，并返回该用户的所有权限列表（基于新RBAC表）
@@ -151,6 +185,14 @@ def verify_kefu_permission(request, username_from_frontend=None):
         )
         permissions = []
 
+    # 旧权限表（user_role 按手机号），与 gvsdsdk 合并
+    legacy_codes, _ = _legacy_backend_role_permissions(current_user.Phone)
+    if legacy_codes:
+        if isinstance(permissions, _AllPermissions):
+            pass
+        else:
+            permissions = list(set(list(permissions) + legacy_codes))
+
     # 管理员/超级用户自动拥有所有权限
     if is_admin and '000001' not in permissions:
         permissions.insert(0, '000001')