From df6c6912d9f16b08b81880da4d3abcb2a867c956 Mon Sep 17 00:00:00 2001 From: XingQue Date: Mon, 6 Jul 2026 18:36:39 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E6=81=A2=E5=A4=8D=E5=85=A8=E5=B1=80?= =?UTF-8?q?=E8=A7=92=E8=89=B2=E6=9D=83=E9=99=90=E6=A0=A1=E9=AA=8C=EF=BC=8C?= =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E5=95=86=E5=AE=B6=E8=AE=A2=E5=8D=95403?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Cursor --- backend/utils.py | 12 +++++++++--- jituan/services/club_rbac.py | 3 ++- users/views/kefu_orders.py | 8 ++++---- 3 files changed, 15 insertions(+), 8 deletions(-) diff --git a/backend/utils.py b/backend/utils.py index 2811949..5a76d26 100644 --- a/backend/utils.py +++ b/backend/utils.py @@ -77,11 +77,17 @@ class _AllPermissions(list): return True -def has_merchant_order_permission(permissions): - """商家/链接订单处理权限：002ac 商家订单、002ab 平台订单、003aa 跨平台。""" +def has_perm_code(permissions, *codes): + """权限码 in 检查；系统超管 _AllPermissions 视为全部通过。""" if isinstance(permissions, _AllPermissions): return True - return any(p in permissions for p in ('002ac', '002ab', '003aa')) + perms = permissions or [] + return any(c in perms for c in codes) + + +def has_merchant_order_permission(permissions): + """商家/链接订单处理权限：002ac 商家订单、002ab 平台订单、003aa 跨平台。""" + return has_perm_code(permissions, '002ac', '002ab', '003aa') def _legacy_backend_role_permissions(phone): diff --git a/jituan/services/club_rbac.py b/jituan/services/club_rbac.py index 887e647..68a66c7 100644 --- a/jituan/services/club_rbac.py +++ b/jituan/services/club_rbac.py @@ -149,7 +149,8 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id ) return list(qs.filter(ClubID='').values_list('RoleUUID', flat=True)) cid = (club_id or CLUB_ID_DEFAULT).strip() - return list(qs.filter(ClubID=cid).values_list('RoleUUID', flat=True)) + # 本俱乐部角色 + 历史全局角色（club_id 为空）；否则旧角色绑定的 002ac 等会菜单/API 不一致 + return list(qs.filter(Q(ClubID=cid) | Q(ClubID='')).values_list('RoleUUID', flat=True)) def resolve_permission_codes_for_club(user, club_id, allowed_club_ids=None): diff --git a/users/views/kefu_orders.py b/users/views/kefu_orders.py index 5116ee0..1a40675 100644 --- a/users/views/kefu_orders.py +++ b/users/views/kefu_orders.py @@ -56,7 +56,7 @@ from orders.utils import ( from backend.utils import ( update_dashou_daily_by_action, update_guanshi_daily_by_action, update_shangjia_daily, update_zuzhang_daily_by_action, - verify_kefu_permission + verify_kefu_permission, has_perm_code, ) from rank.utils import get_tag_fee, create_shenhe_jilu, validate_shenheguan @@ -136,7 +136,7 @@ class KefuGetOrderListView(APIView): return permissions # 3. 检查平台订单管理权限（002ab） - if '002ab' not in permissions: + if not has_perm_code(permissions, '002ab'): return Response({'code': 403, 'msg': '您无权查看平台订单列表'}) # 4. 获取分页和筛选参数 @@ -304,8 +304,8 @@ class KefuGetShangjiaOrderListView(APIView): if kefu is None: return permissions - # 3. 检查商家订单管理权限（使用 002ac，如果没有可改用 002ab） - if '002ac' not in permissions: + # 3. 检查商家订单管理权限（002ac） + if not has_perm_code(permissions, '002ac'): return Response({'code': 403, 'msg': '您无权查看商家订单列表'}) # 4. 获取分页和筛选参数