公告轮播按用户身份限制 page_key，无身份仅可访问点单相关

config/views.py

@@ -165,9 +165,27 @@ class ShangpinGonggaoView(APIView):
         """
         try:
             logger.info("收到商品公告和轮播图请求")
-            from jituan.services.display_config import get_gonggao_content, get_lunbo_urls, normalize_page_key
+            from jituan.services.display_config import (
+                get_gonggao_content,
+                get_lunbo_urls,
+                normalize_page_key,
+                resolve_lunbo_page_key_for_request,
+            )
+
+            requested_key = normalize_page_key(request.data.get('page_key'), image_type=1)
+            page_key = resolve_lunbo_page_key_for_request(request, request.data.get('page_key'), image_type=1)
+            if page_key is None:
+                logger.info(
+                    "公告轮播 page_key 被拒绝 user=%s requested=%s",
+                    getattr(getattr(request, 'user', None), 'UserUID', 'anon'),
+                    requested_key,
+                )
+                return Response({
+                    "shangpingonggao": "",
+                    "shangpinlunbo": [],
+                    "page_key": requested_key,
+                }, status=status.HTTP_200_OK)
 
-            page_key = normalize_page_key(request.data.get('page_key'), image_type=1)
             gonggao_content = get_gonggao_content(request, notice_type=1, page_key=page_key)
             lunbo_urls = get_lunbo_urls(request, page_key=page_key, image_type=1)
             response_data = {