yumoqing/discount
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: owner (org=0) can see all customers and sales across orgs

Browse Source
This commit is contained in:
yumoqing 2026-07-14 10:50:59 +08:00
parent 1e0081862d
commit 429cee6e9d
1 changed files with 60 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

93
discount/init.py
View File

@ -1033,20 +1033,28 @@ async def get_free_customers(request):
"""
env = request._run_ns
userorgid = await env.get_userorgid()
if not userorgid or userorgid == '0':
if not userorgid:
return []
is_owner = userorgid == '0'
dbname = env.get_module_dbname('discount')
async with DBPools().sqlorContext(dbname) as sor:
# Find customers of this reseller that are unbound (no sale_id)
rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id
FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid
WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NULL
ORDER BY o.orgname""",
{'rid': userorgid}
)
if is_owner:
rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id
FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid
WHERE dcb.sale_id IS NULL OR dcb.sale_id = ''
ORDER BY o.orgname""", {})
else:
rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id
FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid
WHERE dcb.resellerid = ${rid}$ AND (dcb.sale_id IS NULL OR dcb.sale_id = '')
ORDER BY o.orgname""",
{'rid': userorgid})
return rows or []
@ -1056,21 +1064,32 @@ async def get_bound_customers(request):
"""
env = request._run_ns
userorgid = await env.get_userorgid()
if not userorgid or userorgid == '0':
if not userorgid:
return []
is_owner = userorgid == '0'
dbname = env.get_module_dbname('discount')
async with DBPools().sqlorContext(dbname) as sor:
rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id,
u.nick_name as sale_name
FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid
LEFT JOIN users u ON u.id = dcb.sale_id
WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NOT NULL
ORDER BY o.orgname""",
{'rid': userorgid}
)
if is_owner:
rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id,
u.nick_name as sale_name
FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid
LEFT JOIN users u ON u.id = dcb.sale_id
WHERE dcb.sale_id IS NOT NULL AND dcb.sale_id != ''
ORDER BY o.orgname""", {})
else:
rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id,
u.nick_name as sale_name
FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid
LEFT JOIN users u ON u.id = dcb.sale_id
WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NOT NULL AND dcb.sale_id != ''
ORDER BY o.orgname""",
{'rid': userorgid})
return rows or []
@ -1117,17 +1136,25 @@ async def get_reseller_sales(request):
"""
env = request._run_ns
userorgid = await env.get_userorgid()
if not userorgid or userorgid == '0':
if not userorgid:
return []
async with DBPools().sqlorContext('sage') as sor:
rows = await sor.sqlExe(
"""SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name
FROM users u
JOIN userrole ur ON ur.userid = u.id
JOIN role r ON r.id = ur.roleid
WHERE r.name = 'sale' AND u.orgid = ${oid}$
ORDER BY u.nick_name""",
{'oid': userorgid}
)
if userorgid == '0':
rows = await sor.sqlExe(
"""SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name
FROM users u
JOIN userrole ur ON ur.userid = u.id
JOIN role r ON r.id = ur.roleid
WHERE r.name = 'sale'
ORDER BY u.nick_name""", {})
else:
rows = await sor.sqlExe(
"""SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name
FROM users u
JOIN userrole ur ON ur.userid = u.id
JOIN role r ON r.id = ur.roleid
WHERE r.name = 'sale' AND u.orgid = ${oid}$
ORDER BY u.nick_name""",
{'oid': userorgid})
return [{'value': r.sale_id, 'text': r.sale_name} for r in rows]