From d19bcb844a0374d5e25dfaea4654ffff71e8838a Mon Sep 17 00:00:00 2001
From: XingQue <kongxing634@gmail.com>
Date: Sun, 21 Jun 2026 05:26:17 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=95=86=E5=AE=B6=E8=AE=A2=E5=8D=95?=
 =?UTF-8?q?=E7=B1=BB=E5=9E=8B=E6=8E=A5=E5=8F=A3=E5=A2=9E=E5=8A=A0=E5=95=86?=
 =?UTF-8?q?=E5=AE=B6/=E5=AE=A2=E6=9C=8D=E8=BA=AB=E4=BB=BD=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 orders/views.py | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/orders/views.py b/orders/views.py
index 9b45bb6..c4595f7 100644
--- a/orders/views.py
+++ b/orders/views.py
@@ -1753,8 +1753,24 @@ class ShangpinLeixingView(APIView):
     """
     permission_classes = [IsAuthenticated]
 
+    @staticmethod
+    def _can_access(request):
+        """商家老板、有效子客服（含代理调用）方可获取"""
+        if getattr(request, '_staff_member', None) is not None:
+            return True
+        from merchant_ops.services.authz import (
+            get_active_staff_member, is_merchant_owner, member_has_perm,
+        )
+        if is_merchant_owner(request.user):
+            return True
+        member = get_active_staff_member(request.user)
+        return bool(member and member_has_perm(member, 'order_dispatch'))
+
     def post(self, request):
-        
+
+        if not self._can_access(request):
+            return Response({'code': 403, 'msg': '非商家或有效客服，无权获取订单类型', 'data': []})
+
         try:
             # 1. 查询审核通过且抢单要求类型为1的商品类型，按排序权重升序
             shangpin_queryset = ShangpinLeixing.query.filter(