From f1db185d0381612a97efbf53ca5b54927b0416eb Mon Sep 17 00:00:00 2001 From: XingQue Date: Tue, 21 Jul 2026 03:24:41 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E4=B8=93=E5=8C=BA=E7=AE=A1=E7=90=86?= =?UTF-8?q?=E5=85=81=E8=AE=B8=E5=9C=A8=E5=85=B7=E4=BD=93=E4=BF=B1=E4=B9=90?= =?UTF-8?q?=E9=83=A8=E6=93=8D=E4=BD=9C=EF=BC=8C=E7=B1=BB=E5=9E=8B=E4=BB=8D?= =?UTF-8?q?=E9=99=90=E9=9B=86=E5=9B=A2=E6=B1=87=E6=80=BB?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Cursor --- backend/views/system.py | 55 ++++++++++++++++++++++++++++++----------- 1 file changed, 41 insertions(+), 14 deletions(-) diff --git a/backend/views/system.py b/backend/views/system.py index 1407dd0..6f4a255 100644 --- a/backend/views/system.py +++ b/backend/views/system.py @@ -236,14 +236,12 @@ class GetProductTypeZoneView(APIView): return permissions if '7007a' not in permissions: return Response({'code': 403, 'msg': '您无权访问此页面'}) - scope_err = block_non_group_catalog_scope(request) - if scope_err: - return Response({'code': 400, 'msg': scope_err}) - # 查询所有商品类型（含专区数量） - # 一次性分组聚合所有类型的专区数量，避免循环内 N+1 count - # 注：ShangpinZhuanqu.leixing_id 是 PositiveIntegerField（非 FK），无法用反向 annotate - zone_count_rows = ShangpinZhuanqu.query.values('leixing_id').annotate(cnt=Count('id')) + # 查询专区数量（按俱乐部隔离；集团汇总看全部） + zone_qs_for_count = filter_club_char_field( + ShangpinZhuanqu.query.all(), request, field='club_id' + ) + zone_count_rows = zone_qs_for_count.values('leixing_id').annotate(cnt=Count('id')) zone_count_map = {row['leixing_id']: row['cnt'] for row in zone_count_rows} types = ShangpinLeixing.query.all().order_by('-paixu') # paixu 越大越靠前 @@ -263,8 +261,10 @@ class GetProductTypeZoneView(APIView): 'product_count': zone_count, }) - # 查询所有专区 - zones = ShangpinZhuanqu.query.all().order_by('-paixu') + # 查询专区（按俱乐部隔离） + zones = filter_club_char_field( + ShangpinZhuanqu.query.all().order_by('-paixu'), request, field='club_id' + ) zone_list = [ { 'id': z.id, @@ -272,6 +272,7 @@ class GetProductTypeZoneView(APIView): 'leixing_id': z.leixing_id, 'shenhezhuangtai': z.shenhezhuangtai, 'paixu': z.paixu, + 'club_id': getattr(z, 'club_id', '') or '', } for z in zones ] @@ -287,12 +288,16 @@ class GetProductTypeZoneView(APIView): for m in members ] + from jituan.constants import DATA_SCOPE_ALL + from jituan.services.club_context import resolve_club_scope + return Response({ 'code': 0, 'data': { 'type_list': type_list, 'zone_list': zone_list, 'member_list': member_list, + 'club_scoped': resolve_club_scope(request) != DATA_SCOPE_ALL, } }) @@ -321,11 +326,12 @@ class ModifyProductTypeZoneView(APIView): return permissions if '7007a' not in permissions: return Response({'code': 403, 'msg': '您无权进行此操作'}) - scope_err = block_non_group_catalog_scope(request) - if scope_err: - return Response({'code': 400, 'msg': scope_err}) + # 类型仍须集团汇总；专区允许在具体俱乐部操作 if obj_type == 'leixing': + scope_err = block_non_group_catalog_scope(request) + if scope_err: + return Response({'code': 400, 'msg': scope_err}) return self.handle_leixing(request, action) elif obj_type == 'zhuanqu': return self.handle_zhuanqu(request, action) @@ -590,13 +596,16 @@ class ModifyProductTypeZoneView(APIView): try: with transaction.atomic(): + from jituan.services.club_write import resolve_club_id_for_write + club_id = resolve_club_id_for_write(request) zhuanqu = ShangpinZhuanqu.query.create( mingzi=mingzi, leixing_id=leixing_id, shenhezhuangtai=shenhezhuangtai, - paixu=0 + paixu=0, + club_id=club_id, ) - return Response({'code': 0, 'msg': '添加成功', 'data': {'id': zhuanqu.id}}) + return Response({'code': 0, 'msg': '添加成功', 'data': {'id': zhuanqu.id, 'club_id': club_id}}) except Exception as e: logger.error(f"添加专区失败: {e}", exc_info=True) return Response({'code': 500, 'msg': '数据库错误'}) @@ -610,6 +619,15 @@ class ModifyProductTypeZoneView(APIView): except ShangpinZhuanqu.DoesNotExist: return Response({'code': 404, 'msg': '专区不存在'}) + from jituan.constants import DATA_SCOPE_ALL + from jituan.services.club_context import resolve_club_scope + from jituan.services.club_write import resolve_club_id_for_write + if resolve_club_scope(request) != DATA_SCOPE_ALL: + write_club = resolve_club_id_for_write(request) + zone_club = getattr(zhuanqu, 'club_id', None) or 'xq' + if zone_club != write_club: + return Response({'code': 403, 'msg': '专区不属于当前俱乐部'}) + changes = {} mingzi = request.data.get('mingzi') if mingzi is not None and mingzi.strip() != zhuanqu.mingzi: @@ -661,6 +679,15 @@ class ModifyProductTypeZoneView(APIView): except ShangpinZhuanqu.DoesNotExist: return Response({'code': 404, 'msg': '专区不存在'}) + from jituan.constants import DATA_SCOPE_ALL + from jituan.services.club_context import resolve_club_scope + from jituan.services.club_write import resolve_club_id_for_write + if resolve_club_scope(request) != DATA_SCOPE_ALL: + write_club = resolve_club_id_for_write(request) + zone_club = getattr(zhuanqu, 'club_id', None) or 'xq' + if zone_club != write_club: + return Response({'code': 403, 'msg': '专区不属于当前俱乐部'}) + with transaction.atomic(): if delete_products: Shangpin.query.filter(zhuanqu_id=zone_id).delete()