feat: gate withdraw audit and add-balance to group executives only

Co-authored-by: Cursor <cursoragent@cursor.com>

users/views.py

@@ -8793,6 +8793,10 @@ class KefuUpdateDashouView(APIView):
                 elif caozuo == 'jia_yue':
                     if '001bb' not in permissions:
                         return Response({'code': 403, 'msg': '无权限加打手余额'})
+                    from jituan.services.group_finance_gate import deny_group_finance_exec
+                    deny = deny_group_finance_exec(request.user, request)
+                    if deny:
+                        return deny
                     amount = Decimal(str(value))
                     dashou_profile.yue += amount
                     dashou_profile.save()
@@ -9776,6 +9780,8 @@ class KefuWithdrawListView(APIView):
         return 1
 
     def post(self, request):
+        from jituan.services.group_finance_gate import require_withdraw_audit_access
+
         dakuan_mode_filter = request.data.get('dakuan_mode')
         req_params = self._safe_request_params(request)
         kefu_txsh_list_logger.info('kefu_txsh_list 请求开始 params=%s', req_params)
@@ -9804,11 +9810,9 @@ class KefuWithdrawListView(APIView):
             if not phone:
                 return Response({'code': 401, 'msg': '缺少客服手机号'}, status=status.HTTP_401_UNAUTHORIZED)
 
-            kefu, permissions = verify_kefu_permission(request, phone)
-            if kefu is None:
-                return permissions
-            if '005bb' not in permissions:
-                return Response({'code': 403, 'msg': '您无权查看提现审核列表'})
+            kefu, err_resp = require_withdraw_audit_access(request, phone)
+            if err_resp:
+                return err_resp
 
             q = Q()
 
@@ -10029,6 +10033,11 @@ class KefuWithdrawDetailView(APIView):
                 logger.warning(f"客服账号已禁用: {current_user.UserUID}")
                 return Response({'code': 401, 'msg': '认证失败'}, status=status.HTTP_401_UNAUTHORIZED)
 
+        from jituan.services.group_finance_gate import require_withdraw_audit_access
+        _, err_resp = require_withdraw_audit_access(request, phone)
+        if err_resp:
+            return err_resp
+
         # 查询提现记录
         try:
             record = Tixianjilu.query.get(id=tixian_id)
@@ -10327,6 +10336,11 @@ class KefuWithdrawActionView(APIView):
         if err_resp:
             return err_resp
 
+        from jituan.services.group_finance_gate import require_withdraw_audit_access
+        _, audit_err = require_withdraw_audit_access(request, phone)
+        if audit_err:
+            return audit_err
+
         items, err_resp = self._parse_items(request)
         if err_resp:
             return err_resp