diff --git a/backend/views/system.py b/backend/views/system.py index 1407dd0..6f4a255 100644 --- a/backend/views/system.py +++ b/backend/views/system.py @@ -236,14 +236,12 @@ class GetProductTypeZoneView(APIView): return permissions if '7007a' not in permissions: return Response({'code': 403, 'msg': '您无权访问此页面'}) - scope_err = block_non_group_catalog_scope(request) - if scope_err: - return Response({'code': 400, 'msg': scope_err}) - # 查询所有商品类型(含专区数量) - # 一次性分组聚合所有类型的专区数量,避免循环内 N+1 count - # 注:ShangpinZhuanqu.leixing_id 是 PositiveIntegerField(非 FK),无法用反向 annotate - zone_count_rows = ShangpinZhuanqu.query.values('leixing_id').annotate(cnt=Count('id')) + # 查询专区数量(按俱乐部隔离;集团汇总看全部) + zone_qs_for_count = filter_club_char_field( + ShangpinZhuanqu.query.all(), request, field='club_id' + ) + zone_count_rows = zone_qs_for_count.values('leixing_id').annotate(cnt=Count('id')) zone_count_map = {row['leixing_id']: row['cnt'] for row in zone_count_rows} types = ShangpinLeixing.query.all().order_by('-paixu') # paixu 越大越靠前 @@ -263,8 +261,10 @@ class GetProductTypeZoneView(APIView): 'product_count': zone_count, }) - # 查询所有专区 - zones = ShangpinZhuanqu.query.all().order_by('-paixu') + # 查询专区(按俱乐部隔离) + zones = filter_club_char_field( + ShangpinZhuanqu.query.all().order_by('-paixu'), request, field='club_id' + ) zone_list = [ { 'id': z.id, @@ -272,6 +272,7 @@ class GetProductTypeZoneView(APIView): 'leixing_id': z.leixing_id, 'shenhezhuangtai': z.shenhezhuangtai, 'paixu': z.paixu, + 'club_id': getattr(z, 'club_id', '') or '', } for z in zones ] @@ -287,12 +288,16 @@ class GetProductTypeZoneView(APIView): for m in members ] + from jituan.constants import DATA_SCOPE_ALL + from jituan.services.club_context import resolve_club_scope + return Response({ 'code': 0, 'data': { 'type_list': type_list, 'zone_list': zone_list, 'member_list': member_list, + 'club_scoped': resolve_club_scope(request) != DATA_SCOPE_ALL, } }) @@ -321,11 +326,12 @@ class ModifyProductTypeZoneView(APIView): return permissions if '7007a' not in permissions: return Response({'code': 403, 'msg': '您无权进行此操作'}) - scope_err = block_non_group_catalog_scope(request) - if scope_err: - return Response({'code': 400, 'msg': scope_err}) + # 类型仍须集团汇总;专区允许在具体俱乐部操作 if obj_type == 'leixing': + scope_err = block_non_group_catalog_scope(request) + if scope_err: + return Response({'code': 400, 'msg': scope_err}) return self.handle_leixing(request, action) elif obj_type == 'zhuanqu': return self.handle_zhuanqu(request, action) @@ -590,13 +596,16 @@ class ModifyProductTypeZoneView(APIView): try: with transaction.atomic(): + from jituan.services.club_write import resolve_club_id_for_write + club_id = resolve_club_id_for_write(request) zhuanqu = ShangpinZhuanqu.query.create( mingzi=mingzi, leixing_id=leixing_id, shenhezhuangtai=shenhezhuangtai, - paixu=0 + paixu=0, + club_id=club_id, ) - return Response({'code': 0, 'msg': '添加成功', 'data': {'id': zhuanqu.id}}) + return Response({'code': 0, 'msg': '添加成功', 'data': {'id': zhuanqu.id, 'club_id': club_id}}) except Exception as e: logger.error(f"添加专区失败: {e}", exc_info=True) return Response({'code': 500, 'msg': '数据库错误'}) @@ -610,6 +619,15 @@ class ModifyProductTypeZoneView(APIView): except ShangpinZhuanqu.DoesNotExist: return Response({'code': 404, 'msg': '专区不存在'}) + from jituan.constants import DATA_SCOPE_ALL + from jituan.services.club_context import resolve_club_scope + from jituan.services.club_write import resolve_club_id_for_write + if resolve_club_scope(request) != DATA_SCOPE_ALL: + write_club = resolve_club_id_for_write(request) + zone_club = getattr(zhuanqu, 'club_id', None) or 'xq' + if zone_club != write_club: + return Response({'code': 403, 'msg': '专区不属于当前俱乐部'}) + changes = {} mingzi = request.data.get('mingzi') if mingzi is not None and mingzi.strip() != zhuanqu.mingzi: @@ -661,6 +679,15 @@ class ModifyProductTypeZoneView(APIView): except ShangpinZhuanqu.DoesNotExist: return Response({'code': 404, 'msg': '专区不存在'}) + from jituan.constants import DATA_SCOPE_ALL + from jituan.services.club_context import resolve_club_scope + from jituan.services.club_write import resolve_club_id_for_write + if resolve_club_scope(request) != DATA_SCOPE_ALL: + write_club = resolve_club_id_for_write(request) + zone_club = getattr(zhuanqu, 'club_id', None) or 'xq' + if zone_club != write_club: + return Response({'code': 403, 'msg': '专区不属于当前俱乐部'}) + with transaction.atomic(): if delete_products: Shangpin.query.filter(zhuanqu_id=zone_id).delete()