点单商品接口多途径解析token识别用户；有邀请人/扫码只返回隐藏式，不再误回正常商品。

Co-authored-by: Cursor <cursoragent@cursor.com>

shangpin/views.py

@@ -6,7 +6,7 @@ from rest_framework.throttling import AnonRateThrottle
 from django.db import models
 from shangpin.models import ShangpinLeixing, ShangpinZhuanqu, Shangpin
 from utils.xcx_sys_config import get_shangpin_shenhe_zhuangtai
-from utils.jwt_auth import OptionalYonghuidJWTAuthentication
+from utils.jwt_auth import OptionalYonghuidJWTAuthentication, YonghuidJWTAuthentication
 from yonghu.models import UserMain, UserDashou
 import logging
 from rest_framework.permissions import AllowAny  # 新增这行
@@ -33,10 +33,49 @@ class ShangpinHuoquView(APIView):
     authentication_classes = [OptionalYonghuidJWTAuthentication]
     permission_classes = [AllowAny]
 
-    def _resolve_shenhe_filter(self, request):
-        """扫码标记或打手有邀请人 → 强制隐藏式4；否则走体验开关。"""
+    def _extract_raw_token(self, request):
+        """Authorization / token 头 / body.token / query.token，兼容网关剥 Authorization。"""
+        auth = (
+            request.META.get('HTTP_AUTHORIZATION')
+            or request.META.get('HTTP_TOKEN')
+            or request.META.get('HTTP_X_TOKEN')
+            or ''
+        ).strip()
+        if auth:
+            parts = auth.split()
+            return parts[-1] if parts else auth
+        body_token = ''
+        try:
+            body_token = (request.data.get('token') or '').strip()
+        except Exception:
+            body_token = ''
+        if body_token:
+            return body_token
+        return (request.query_params.get('token') or '').strip()
+
+    def _resolve_request_user(self, request):
+        """优先用 DRF 已认证用户；否则手动解析 token。"""
         user = request.user
         if getattr(user, 'is_authenticated', False):
+            return user
+        raw = self._extract_raw_token(request)
+        if not raw:
+            logger.info('点单商品：请求未带token，无法识别用户')
+            return None
+        try:
+            from rest_framework_simplejwt.tokens import AccessToken
+            validated = AccessToken(raw)
+            user = YonghuidJWTAuthentication().get_user(validated)
+            logger.info('点单商品：手动解析token成功 yonghuid=%s', getattr(user, 'yonghuid', ''))
+            return user
+        except Exception as exc:
+            logger.warning('点单商品：token无效 %s', exc)
+            return None
+
+    def _resolve_shenhe_filter(self, request):
+        """扫码标记或打手有邀请人 → 强制隐藏式4；否则走体验开关。"""
+        user = self._resolve_request_user(request)
+        if user is not None:
             yonghuid = getattr(user, 'yonghuid', '')
             saoma = UserMain.objects.filter(pk=user.pk).values_list('guanshi_saoma', flat=True).first()
             if saoma == 1:
@@ -57,12 +96,11 @@ class ShangpinHuoquView(APIView):
                 )
                 return 4
             logger.info(
-                '点单商品：未扫码且无打手邀请人 guanshi_saoma=%s yonghuid=%s',
+                '点单商品：已识别用户但未扫码且无打手邀请人 guanshi_saoma=%s yonghuid=%s dashou=%s',
                 saoma,
                 yonghuid,
+                bool(dashou),
             )
-        else:
-            logger.info('点单商品：未登录/无token，按体验开关筛选')
         shenhe = get_shangpin_shenhe_zhuangtai()
         logger.info('点单商品：按体验开关 shenhezhuangtai=%s', shenhe)
         return shenhe
@@ -136,9 +174,13 @@ class ShangpinHuoquView(APIView):
                 "shangpinliebiao": shangpinliebiao_data
             }
 
-            logger.info(f"返回数据：类型{len(shangpinleixing_data)}个，"
-                        f"专区{len(shangpinzhuanqu_data)}个，"
-                        f"商品{len(shangpinliebiao_data)}个")
+            logger.info(
+                '返回商品数据 filter=%s 类型=%s 专区=%s 商品=%s',
+                shenhe_filter,
+                len(shangpinleixing_data),
+                len(shangpinzhuanqu_data),
+                len(shangpinliebiao_data),
+            )
 
             # 5. 返回响应
             return Response(response_data, status=status.HTTP_200_OK)