revert: restore gvsdsdk role/permission APIs; keep KefuProfile login fix

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/utils.py

@@ -77,19 +77,14 @@ class _AllPermissions(list):
         return True
 
 
-def _legacy_backend_role_permissions(phone, yonghuid=None):
+def _legacy_backend_role_permissions(phone):
     """
     读取旧权限表（backend.models）：
-    user_role.account_id = 手机号或 UserUID → role → role_permission → permission.perm_code
+    user_role.account_id = 手机号 → role → role_permission → permission.perm_code
+    与 gvsdsdk 表并行，未改 SDK 结构。
     """
-    account_ids = []
-    ph = (phone or '').strip()
-    uid = (yonghuid or '').strip()
-    if ph:
-        account_ids.append(ph)
-    if uid and uid not in account_ids:
-        account_ids.append(uid)
-    if not account_ids:
+    phone = (phone or '').strip()
+    if not phone:
         return [], []
     try:
         from backend.models import (
@@ -98,7 +93,7 @@ def _legacy_backend_role_permissions(phone, yonghuid=None):
             Permission as BackendPermission,
         )
         role_ids = list(
-            LegacyUserRole.objects.filter(account_id__in=account_ids).values_list('role_id', flat=True)
+            LegacyUserRole.objects.filter(account_id=phone).values_list('role_id', flat=True)
         )
         if not role_ids:
             return [], []
@@ -112,22 +107,10 @@ def _legacy_backend_role_permissions(phone, yonghuid=None):
         )
         return perm_codes, role_names
     except Exception as e:
-        logger.warning('legacy_backend_role_permissions ids=%s err=%s', account_ids, e)
+        logger.warning('legacy_backend_role_permissions phone=%s err=%s', phone, e)
         return [], []
 
 
-def has_legacy_backend_binding(user):
-    """旧表 user_role 或 role 下已有 perm_code。"""
-    from backend.models import UserRole as LegacyUserRole
-    ph = getattr(user, 'Phone', '') or ''
-    uid = getattr(user, 'UserUID', '') or ''
-    ids = [x for x in [ph, uid] if x]
-    if ids and LegacyUserRole.objects.filter(account_id__in=ids).exists():
-        return True
-    codes, _ = _legacy_backend_role_permissions(ph, uid)
-    return bool(codes)
-
-
 def verify_kefu_permission(request, username_from_frontend=None):
     """
     验证客服/管理员身份，并返回该用户的所有权限列表（基于新RBAC表）
@@ -174,12 +157,42 @@ def verify_kefu_permission(request, username_from_frontend=None):
             'msg': '身份错误，无权操作其他账号，相关操作已记录'
         }, status=403)
 
-    # ---------- 4. 权限码：只读旧表 permission（user_role → role → role_permission）----------
-    legacy_codes, _ = _legacy_backend_role_permissions(
-        current_user.Phone,
-        getattr(current_user, 'UserUID', None),
-    )
-    permissions = list(legacy_codes) if legacy_codes else []
+    # ---------- 4. 获取用户的所有权限 ----------
+    # 使用 gvsdsdk RBAC 表（UserRole → RolePermission → Permission）
+    try:
+        user_uuid = current_user.UserUUID
+        role_uuids = list(SdkUserRole.objects.filter(
+            UserUUID=user_uuid
+        ).values_list('RoleUUID', flat=True))
+
+        if role_uuids:
+            perm_uuids = list(SdkRolePermission.objects.filter(
+                RoleUUID__in=role_uuids
+            ).values_list('PermUUID', flat=True))
+
+            permissions = list(SdkPermission.objects.filter(
+                PermUUID__in=perm_uuids,
+                PermStatus=1
+            ).values_list('PermCode', flat=True).distinct())
+        else:
+            permissions = []
+    except Exception as e:
+        logger.warning(
+            'verify_kefu_permission failed: UserUUID=%s Phone=%s err=%s',
+            getattr(current_user, 'UserUUID', None),
+            getattr(current_user, 'Phone', None),
+            e,
+            exc_info=True,
+        )
+        permissions = []
+
+    # 旧权限表（user_role 按手机号），与 gvsdsdk 合并
+    legacy_codes, _ = _legacy_backend_role_permissions(current_user.Phone)
+    if legacy_codes:
+        if isinstance(permissions, _AllPermissions):
+            pass
+        else:
+            permissions = list(set(list(permissions) + legacy_codes))
 
     # 管理员/超级用户自动拥有所有权限
     if is_admin and '000001' not in permissions: