fix: 专区管理允许在具体俱乐部操作，类型仍限集团汇总

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/views/system.py

@@ -236,14 +236,12 @@ class GetProductTypeZoneView(APIView):
             return permissions
         if '7007a' not in permissions:
             return Response({'code': 403, 'msg': '您无权访问此页面'})
-        scope_err = block_non_group_catalog_scope(request)
-        if scope_err:
-            return Response({'code': 400, 'msg': scope_err})
 
-        # 查询所有商品类型（含专区数量）
+        # 查询专区数量（按俱乐部隔离；集团汇总看全部）
-        # 一次性分组聚合所有类型的专区数量，避免循环内 N+1 count
+        zone_qs_for_count = filter_club_char_field(
-        # 注：ShangpinZhuanqu.leixing_id 是 PositiveIntegerField（非 FK），无法用反向 annotate
+            ShangpinZhuanqu.query.all(), request, field='club_id'
-        zone_count_rows = ShangpinZhuanqu.query.values('leixing_id').annotate(cnt=Count('id'))
+        )
+        zone_count_rows = zone_qs_for_count.values('leixing_id').annotate(cnt=Count('id'))
         zone_count_map = {row['leixing_id']: row['cnt'] for row in zone_count_rows}
 
         types = ShangpinLeixing.query.all().order_by('-paixu')  # paixu 越大越靠前
@@ -263,8 +261,10 @@ class GetProductTypeZoneView(APIView):
                 'product_count': zone_count,
             })
 
-        # 查询所有专区
+        # 查询专区（按俱乐部隔离）
-        zones = ShangpinZhuanqu.query.all().order_by('-paixu')
+        zones = filter_club_char_field(
+            ShangpinZhuanqu.query.all().order_by('-paixu'), request, field='club_id'
+        )
         zone_list = [
             {
                 'id': z.id,
@@ -272,6 +272,7 @@ class GetProductTypeZoneView(APIView):
                 'leixing_id': z.leixing_id,
                 'shenhezhuangtai': z.shenhezhuangtai,
                 'paixu': z.paixu,
+                'club_id': getattr(z, 'club_id', '') or '',
             }
             for z in zones
         ]
@@ -287,12 +288,16 @@ class GetProductTypeZoneView(APIView):
             for m in members
         ]
 
+        from jituan.constants import DATA_SCOPE_ALL
+        from jituan.services.club_context import resolve_club_scope
+
         return Response({
             'code': 0,
             'data': {
                 'type_list': type_list,
                 'zone_list': zone_list,
                 'member_list': member_list,
+                'club_scoped': resolve_club_scope(request) != DATA_SCOPE_ALL,
             }
         })
 
@@ -321,11 +326,12 @@ class ModifyProductTypeZoneView(APIView):
             return permissions
         if '7007a' not in permissions:
             return Response({'code': 403, 'msg': '您无权进行此操作'})
-        scope_err = block_non_group_catalog_scope(request)
-        if scope_err:
-            return Response({'code': 400, 'msg': scope_err})
 
+        # 类型仍须集团汇总；专区允许在具体俱乐部操作
         if obj_type == 'leixing':
+            scope_err = block_non_group_catalog_scope(request)
+            if scope_err:
+                return Response({'code': 400, 'msg': scope_err})
             return self.handle_leixing(request, action)
         elif obj_type == 'zhuanqu':
             return self.handle_zhuanqu(request, action)
@@ -590,13 +596,16 @@ class ModifyProductTypeZoneView(APIView):
 
         try:
             with transaction.atomic():
+                from jituan.services.club_write import resolve_club_id_for_write
+                club_id = resolve_club_id_for_write(request)
                 zhuanqu = ShangpinZhuanqu.query.create(
                     mingzi=mingzi,
                     leixing_id=leixing_id,
                     shenhezhuangtai=shenhezhuangtai,
-                    paixu=0
+                    paixu=0,
+                    club_id=club_id,
                 )
-            return Response({'code': 0, 'msg': '添加成功', 'data': {'id': zhuanqu.id}})
+            return Response({'code': 0, 'msg': '添加成功', 'data': {'id': zhuanqu.id, 'club_id': club_id}})
         except Exception as e:
             logger.error(f"添加专区失败: {e}", exc_info=True)
             return Response({'code': 500, 'msg': '数据库错误'})
@@ -610,6 +619,15 @@ class ModifyProductTypeZoneView(APIView):
         except ShangpinZhuanqu.DoesNotExist:
             return Response({'code': 404, 'msg': '专区不存在'})
 
+        from jituan.constants import DATA_SCOPE_ALL
+        from jituan.services.club_context import resolve_club_scope
+        from jituan.services.club_write import resolve_club_id_for_write
+        if resolve_club_scope(request) != DATA_SCOPE_ALL:
+            write_club = resolve_club_id_for_write(request)
+            zone_club = getattr(zhuanqu, 'club_id', None) or 'xq'
+            if zone_club != write_club:
+                return Response({'code': 403, 'msg': '专区不属于当前俱乐部'})
+
         changes = {}
         mingzi = request.data.get('mingzi')
         if mingzi is not None and mingzi.strip() != zhuanqu.mingzi:
@@ -661,6 +679,15 @@ class ModifyProductTypeZoneView(APIView):
         except ShangpinZhuanqu.DoesNotExist:
             return Response({'code': 404, 'msg': '专区不存在'})
 
+        from jituan.constants import DATA_SCOPE_ALL
+        from jituan.services.club_context import resolve_club_scope
+        from jituan.services.club_write import resolve_club_id_for_write
+        if resolve_club_scope(request) != DATA_SCOPE_ALL:
+            write_club = resolve_club_id_for_write(request)
+            zone_club = getattr(zhuanqu, 'club_id', None) or 'xq'
+            if zone_club != write_club:
+                return Response({'code': 403, 'msg': '专区不属于当前俱乐部'})
+
         with transaction.atomic():
             if delete_products:
                 Shangpin.query.filter(zhuanqu_id=zone_id).delete()