From e6e8e718d3824fa2e5c3b6fc2743582fb35163b4 Mon Sep 17 00:00:00 2001 From: XingQue Date: Mon, 13 Jul 2026 16:00:06 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E5=AD=90=E5=AE=A2=E6=9C=8D(=E6=80=BB?= =?UTF-8?q?=E7=AE=A1)=E7=94=B3=E8=AF=B7=E7=BD=9A=E6=AC=BE=E8=AF=81?= =?UTF-8?q?=E6=8D=AE=E4=B8=8A=E4=BC=A0=E6=9D=83=E9=99=90=EF=BC=8C=E6=94=AF?= =?UTF-8?q?=E6=8C=81=E5=95=86=E5=AE=B6=E5=AE=A2=E6=9C=8D=E4=BB=A3=E5=95=86?= =?UTF-8?q?=E5=AE=B6=E6=93=8D=E4=BD=9C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit COS 上传接口 fakuan_evidence / fakuan_evidence_draft 现允许具 penalty_apply 或 penalty_manage 且能查看该订单的子客服。 Co-authored-by: Cursor --- merchant_ops/helpers.py | 53 +++++++++++++++++++++++++++++++++++++++-- orders/views/dashou.py | 43 ++++++++++----------------------- 2 files changed, 64 insertions(+), 32 deletions(-) diff --git a/merchant_ops/helpers.py b/merchant_ops/helpers.py index 00f427d..5261349 100644 --- a/merchant_ops/helpers.py +++ b/merchant_ops/helpers.py @@ -2,14 +2,63 @@ import logging from backend.utils import pick_order_id -from merchant_ops.services.authz import StaffAuthError, member_has_perm +from merchant_ops.services.authz import StaffAuthError, get_active_staff_member, member_has_perm from merchant_ops.models import MerchantOrderDispatch -from orders.models import MerchantOrderExt +from orders.models import MerchantOrderExt, Penalty from users.business_models import User +from users.models import UserShangjia logger = logging.getLogger(__name__) +class PenaltyEvidenceAuthError(Exception): + def __init__(self, code, msg): + self.code = code + self.msg = msg + super().__init__(msg) + + +def resolve_penalty_evidence_upload_auth(request, dingdan_id, fadan_id=None): + """ + 商家老板或具 penalty_apply / penalty_manage 且能查看该订单的子客服。 + 返回所属 merchant_id（ApplicantID）。 + """ + user = request.user + try: + shangjia_profile = user.ShopProfile + if shangjia_profile.zhuangtai != 1: + raise PenaltyEvidenceAuthError(403, '商家状态异常') + try: + MerchantOrderExt.query.get(Order__OrderID=dingdan_id, MerchantID=user.UserUID) + except MerchantOrderExt.DoesNotExist: + raise PenaltyEvidenceAuthError(403, '订单不存在或无权操作') + if fadan_id and not Penalty.query.filter( + id=fadan_id, + RelatedOrderID=dingdan_id, + ApplicantID=user.UserUID, + ).exists(): + raise PenaltyEvidenceAuthError(403, '罚单不存在或无权操作') + return user.UserUID + except UserShangjia.DoesNotExist: + pass + + member = get_active_staff_member(user) + if not member: + raise PenaltyEvidenceAuthError(403, '非商家或子客服无权上传') + if not (member_has_perm(member, 'penalty_apply') or member_has_perm(member, 'penalty_manage')): + raise PenaltyEvidenceAuthError(403, '无罚单权限') + ok, _ = staff_can_access_order(member, dingdan_id) + if not ok: + raise PenaltyEvidenceAuthError(403, '无权操作该订单') + if fadan_id and not Penalty.query.filter( + id=fadan_id, + RelatedOrderID=dingdan_id, + ApplicantID=member.merchant_id, + ).exists(): + raise PenaltyEvidenceAuthError(403, '罚单不存在或无权操作') + return member.merchant_id + + def get_merchant_user(merchant_id): return User.query.get(UserUID=merchant_id) diff --git a/orders/views/dashou.py b/orders/views/dashou.py index e17a31f..4b70b38 100644 --- a/orders/views/dashou.py +++ b/orders/views/dashou.py @@ -748,41 +748,24 @@ class DashouCOSZhengshuView(APIView): elif yongtu == 'fakuan': # 罚款申诉不需要订单验证 pass - elif yongtu == 'fakuan_evidence': - # 商家上传罚单证据图（Purpose=1） - fadan_id = request.data.get('fadan_id') - if not dingdan_id or not fadan_id: + elif yongtu in ('fakuan_evidence', 'fakuan_evidence_draft'): + # 商家或子客服（总管等）上传/补传罚单证据图 + from merchant_ops.helpers import ( + PenaltyEvidenceAuthError, + resolve_penalty_evidence_upload_auth, + ) + if not dingdan_id: + return Response({'code': 400, 'msg': '缺少订单ID'}, status=400) + fadan_id = request.data.get('fadan_id') if yongtu == 'fakuan_evidence' else None + if yongtu == 'fakuan_evidence' and not fadan_id: return Response( {'code': 400, 'msg': '缺少订单ID或罚单ID'}, status=status.HTTP_400_BAD_REQUEST, ) try: - shangjia_profile = request.user.ShopProfile - if shangjia_profile.zhuangtai != 1: - return Response({'code': 403, 'msg': '商家状态异常'}, status=403) - except Exception: - return Response({'code': 403, 'msg': '非商家无权上传'}, status=403) - fadan = Penalty.query.filter( - id=fadan_id, - RelatedOrderID=dingdan_id, - ApplicantID=request.user.UserUID, - ).first() - if not fadan: - return Response({'code': 403, 'msg': '罚单不存在或无权操作'}, status=403) - elif yongtu == 'fakuan_evidence_draft': - # 商家申请罚款前上传证据图（仅需订单归属校验） - if not dingdan_id: - return Response({'code': 400, 'msg': '缺少订单ID'}, status=400) - try: - shangjia_profile = request.user.ShopProfile - if shangjia_profile.zhuangtai != 1: - return Response({'code': 403, 'msg': '商家状态异常'}, status=403) - except Exception: - return Response({'code': 403, 'msg': '非商家无权上传'}, status=403) - try: - MerchantOrderExt.query.get(Order__OrderID=dingdan_id, MerchantID=request.user.UserUID) - except MerchantOrderExt.DoesNotExist: - return Response({'code': 403, 'msg': '订单不存在或无权操作'}, status=403) + resolve_penalty_evidence_upload_auth(request, dingdan_id, fadan_id=fadan_id) + except PenaltyEvidenceAuthError as e: + return Response({'code': e.code, 'msg': e.msg}, status=403) else: # 默认为订单相关，需要验证订单且打手必须接单 try: