diff --git a/orders/views.py b/orders/views.py
index 9b45bb6..c4595f7 100644
--- a/orders/views.py
+++ b/orders/views.py
@@ -1753,8 +1753,24 @@ class ShangpinLeixingView(APIView):
     """
     permission_classes = [IsAuthenticated]
 
+    @staticmethod
+    def _can_access(request):
+        """商家老板、有效子客服（含代理调用）方可获取"""
+        if getattr(request, '_staff_member', None) is not None:
+            return True
+        from merchant_ops.services.authz import (
+            get_active_staff_member, is_merchant_owner, member_has_perm,
+        )
+        if is_merchant_owner(request.user):
+            return True
+        member = get_active_staff_member(request.user)
+        return bool(member and member_has_perm(member, 'order_dispatch'))
+
     def post(self, request):
-        
+
+        if not self._can_access(request):
+            return Response({'code': 403, 'msg': '非商家或有效客服，无权获取订单类型', 'data': []})
+
         try:
             # 1. 查询审核通过且抢单要求类型为1的商品类型，按排序权重升序
             shangpin_queryset = ShangpinLeixing.query.filter(