fix: 恢复全局角色权限校验，修复商家订单403

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/utils.py

@@ -77,11 +77,17 @@ class _AllPermissions(list):
         return True
 
 
-def has_merchant_order_permission(permissions):
-    """商家/链接订单处理权限：002ac 商家订单、002ab 平台订单、003aa 跨平台。"""
+def has_perm_code(permissions, *codes):
+    """权限码 in 检查；系统超管 _AllPermissions 视为全部通过。"""
     if isinstance(permissions, _AllPermissions):
         return True
-    return any(p in permissions for p in ('002ac', '002ab', '003aa'))
+    perms = permissions or []
+    return any(c in perms for c in codes)
+
+
+def has_merchant_order_permission(permissions):
+    """商家/链接订单处理权限：002ac 商家订单、002ab 平台订单、003aa 跨平台。"""
+    return has_perm_code(permissions, '002ac', '002ab', '003aa')
 
 
 def _legacy_backend_role_permissions(phone):

jituan/services/club_rbac.py

@@ -149,7 +149,8 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id
             )
         return list(qs.filter(ClubID='').values_list('RoleUUID', flat=True))
     cid = (club_id or CLUB_ID_DEFAULT).strip()
-    return list(qs.filter(ClubID=cid).values_list('RoleUUID', flat=True))
+    # 本俱乐部角色 + 历史全局角色（club_id 为空）；否则旧角色绑定的 002ac 等会菜单/API 不一致
+    return list(qs.filter(Q(ClubID=cid) | Q(ClubID='')).values_list('RoleUUID', flat=True))
 
 
 def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None):

users/views/kefu_orders.py

@@ -56,7 +56,7 @@ from orders.utils import (
 from backend.utils import (
     update_dashou_daily_by_action, update_guanshi_daily_by_action,
     update_shangjia_daily, update_zuzhang_daily_by_action,
-    verify_kefu_permission
+    verify_kefu_permission, has_perm_code,
 )
 from rank.utils import get_tag_fee, create_shenhe_jilu, validate_shenheguan
 
@@ -136,7 +136,7 @@ class KefuGetOrderListView(APIView):
             return permissions
 
         # 3. 检查平台订单管理权限（002ab）
-        if '002ab' not in permissions:
+        if not has_perm_code(permissions, '002ab'):
             return Response({'code': 403, 'msg': '您无权查看平台订单列表'})
 
         # 4. 获取分页和筛选参数
@@ -304,8 +304,8 @@ class KefuGetShangjiaOrderListView(APIView):
         if kefu is None:
             return permissions
 
-        # 3. 检查商家订单管理权限（使用 002ac，如果没有可改用 002ab）
-        if '002ac' not in permissions:
+        # 3. 检查商家订单管理权限（002ac）
+        if not has_perm_code(permissions, '002ac'):
             return Response({'code': 403, 'msg': '您无权查看商家订单列表'})
 
         # 4. 获取分页和筛选参数