公告轮播按用户身份限制 page_key，无身份仅可访问点单相关

config/views.py

@@ -165,9 +165,27 @@ class ShangpinGonggaoView(APIView):
         """
         try:
             logger.info("收到商品公告和轮播图请求")
-            from jituan.services.display_config import get_gonggao_content, get_lunbo_urls, normalize_page_key
+            from jituan.services.display_config import (
+                get_gonggao_content,
+                get_lunbo_urls,
+                normalize_page_key,
+                resolve_lunbo_page_key_for_request,
+            )
+
+            requested_key = normalize_page_key(request.data.get('page_key'), image_type=1)
+            page_key = resolve_lunbo_page_key_for_request(request, request.data.get('page_key'), image_type=1)
+            if page_key is None:
+                logger.info(
+                    "公告轮播 page_key 被拒绝 user=%s requested=%s",
+                    getattr(getattr(request, 'user', None), 'UserUID', 'anon'),
+                    requested_key,
+                )
+                return Response({
+                    "shangpingonggao": "",
+                    "shangpinlunbo": [],
+                    "page_key": requested_key,
+                }, status=status.HTTP_200_OK)
 
-            page_key = normalize_page_key(request.data.get('page_key'), image_type=1)
             gonggao_content = get_gonggao_content(request, notice_type=1, page_key=page_key)
             lunbo_urls = get_lunbo_urls(request, page_key=page_key, image_type=1)
             response_data = {

jituan/services/display_config.py

@@ -21,6 +21,12 @@ LUNBO_PAGE_OPTIONS = [
     (LUNBO_PAGE_DASHOU_CENTER, '打手个人中心背景'),
 ]
 
+# 无商家/打手/管事/组长身份时，仅允许点单相关 page_key
+PUBLIC_LUNBO_PAGE_KEYS = frozenset({
+    LUNBO_PAGE_ACCEPT_ORDER,
+    LUNBO_PAGE_ORDER_POOL,
+})
+
 
 def normalize_page_key(page_key, image_type=1):
     key = (page_key or '').strip()
@@ -31,6 +37,53 @@ def normalize_page_key(page_key, image_type=1):
     return LUNBO_PAGE_ORDER_POOL
 
 
+def _user_role_profile_flags(user):
+    """根据扩展表判断用户是否具备对应身份（比 UserType 更准）。"""
+    if not user or not getattr(user, 'is_authenticated', False):
+        return frozenset()
+    found = set()
+    for attr, name in (
+        ('ShopProfile', 'shop'),
+        ('DashouProfile', 'dashou'),
+        ('GuanshiProfile', 'guanshi'),
+        ('ZuzhangProfile', 'zuzhang'),
+    ):
+        try:
+            getattr(user, attr)
+            found.add(name)
+        except Exception:
+            pass
+    return frozenset(found)
+
+
+def allowed_lunbo_page_keys_for_user(user):
+    """当前用户可访问的轮播/公告 page_key。"""
+    allowed = set(PUBLIC_LUNBO_PAGE_KEYS)
+    roles = _user_role_profile_flags(user)
+    if 'shop' in roles:
+        allowed.add(LUNBO_PAGE_MERCHANT_HOME)
+    if 'dashou' in roles:
+        allowed.add(LUNBO_PAGE_DASHOU_CENTER)
+    # 管事/组长与点单页共用 order_pool、accept_order，已在 PUBLIC 中
+    return frozenset(allowed)
+
+
+def resolve_lunbo_page_key_for_request(request, page_key=None, image_type=1):
+    """
+    按身份限制 page_key：
+    - 无特殊身份：仅 order_pool / accept_order
+    - 商家：+ merchant_home
+    - 打手：+ dashou_center
+    无权访问所请求的 page_key 时返回 None（接口应返回空公告/轮播）。
+    """
+    requested = normalize_page_key(page_key, image_type=image_type)
+    user = getattr(request, 'user', None)
+    allowed = allowed_lunbo_page_keys_for_user(user)
+    if requested in allowed:
+        return requested
+    return None
+
+
 def forbid_display_write_in_all_scope(request):
     if resolve_club_scope(request) == DATA_SCOPE_ALL:
         return Response({'code': 403, 'msg': '请在子公司视图下修改展示配置'})