fix: 商家订单权限与菜单一致，含本俱乐部+全局角色

Co-authored-by: Cursor <cursoragent@cursor.com>

jituan/services/club_rbac.py

@@ -156,8 +156,13 @@ def filter_role_uuids_for_club_scope(role_uuids, club_id, scope, allowed_club_id
 
     cid = (club_id or CLUB_ID_DEFAULT).strip()
     matched = []
-    for role in Role.objects.filter(RoleStatus=1, ClubID=cid):
+    for role in Role.objects.filter(RoleStatus=1):
-        if role_uuid_bytes(role.RoleUUID) in wanted:
+        key = role_uuid_bytes(role.RoleUUID)
+        if key not in wanted:
+            continue
+        rcid = (getattr(role, 'ClubID', None) or '').strip()
+        # 本俱乐部角色 + 全局角色；不含其他俱乐部角色
+        if rcid == cid or rcid == '':
             matched.append(role.RoleUUID)
     return matched
 

users/views/kefu_orders.py

@@ -56,7 +56,7 @@ from orders.utils import (
 from backend.utils import (
     update_dashou_daily_by_action, update_guanshi_daily_by_action,
     update_shangjia_daily, update_zuzhang_daily_by_action,
-    verify_kefu_permission, has_merchant_order_permission, has_perm_code,
+    verify_kefu_permission, has_perm_code,
 )
 from rank.utils import get_tag_fee, create_shenhe_jilu, validate_shenheguan
 
@@ -299,12 +299,14 @@ class KefuGetShangjiaOrderListView(APIView):
         if not username:
             return Response({'code': 400, 'msg': '缺少username'})
 
-        # 2. 公共权限校验
+        # 2. 权限校验（与 menu-access 完全一致：须 002ac）
-        kefu, permissions = verify_kefu_permission(request, username)
+        kefu, permissions = verify_kefu_permission(
+            request, getattr(request.user, 'Phone', '') or None,
+        )
         if kefu is None:
             return permissions
 
-        if not has_merchant_order_permission(permissions):
+        if not has_perm_code(permissions, '002ac'):
             return Response({'code': 403, 'msg': '您无权查看商家订单列表'})
 
         # 4. 获取分页和筛选参数