fix: 修复添加后台用户 RoleUUID 转换错误并严格校验角色绑定

backend/view.py

@@ -717,7 +717,7 @@ class AddAdminUserView(APIView):
             return Response({'code': 400, 'msg': '密码和二级密码至少6位'})
 
         from jituan.services.club_context import resolve_club_id_from_request
-        from jituan.services.club_rbac import resolve_role_by_name
+        from jituan.services.club_rbac import resolve_roles_for_binding
 
         target_club_id = resolve_club_id_from_request(request)
 
@@ -728,6 +728,27 @@ class AddAdminUserView(APIView):
         if existing_kefu:
             return Response({'code': 400, 'msg': '该账号已存在'})
 
+        if not isinstance(role_codes, list):
+            return Response({'code': 400, 'msg': 'role_codes 格式错误'})
+
+        # 分配角色（默认客服 + 所选角色，去重；任一角色找不到则整单拒绝）
+        role_names_to_bind = []
+        seen_names = set()
+        for name in (['客服'] if '客服' not in role_codes else []) + list(role_codes):
+            n = (name or '').strip()
+            if n and n not in seen_names:
+                seen_names.add(n)
+                role_names_to_bind.append(n)
+
+        roles_to_bind, missing_roles = resolve_roles_for_binding(role_names_to_bind, target_club_id)
+        if missing_roles:
+            return Response({
+                'code': 400,
+                'msg': f'角色不存在或与当前俱乐部不匹配：{", ".join(missing_roles)}',
+            })
+        if not roles_to_bind:
+            return Response({'code': 400, 'msg': '请至少选择一个有效角色'})
+
         with transaction.atomic():
             # 事务内二次校验，防止并发重复创建
             if User.query.filter(Phone=phone, KefuProfile__isnull=False).exists():
@@ -765,20 +786,7 @@ class AddAdminUserView(APIView):
                 erjimima=erjimima_hashed,
                 zhuangtai=1
             )
-            # 分配角色（默认客服 + 所选角色，按俱乐部解析，去重）
-            role_names_to_bind = []
-            if '客服' not in role_codes:
-                role_names_to_bind.append('客服')
-            role_names_to_bind.extend(role_codes)
-            bound_role_uuids = set()
-            for rc in role_names_to_bind:
-                role = resolve_role_by_name(rc, target_club_id)
-                if not role:
-                    continue
-                role_uuid = bytes(role.RoleUUID) if not isinstance(role.RoleUUID, bytes) else role.RoleUUID
-                if role_uuid in bound_role_uuids:
-                    continue
-                bound_role_uuids.add(role_uuid)
+            for role in roles_to_bind:
                 UserRole.objects.get_or_create(
                     UserUUID=user_main.UserUUID,
                     RoleUUID=role.RoleUUID,