From 429cee6e9d4ac320490aac9df97c25c10a587adc Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Tue, 14 Jul 2026 10:50:59 +0800
Subject: [PATCH] fix: owner (org=0) can see all customers and sales across
 orgs

---
 discount/init.py | 93 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 60 insertions(+), 33 deletions(-)

diff --git a/discount/init.py b/discount/init.py
index 1ef9399..1befdc1 100644
--- a/discount/init.py
+++ b/discount/init.py
@@ -1033,20 +1033,28 @@ async def get_free_customers(request):
     """
     env = request._run_ns
     userorgid = await env.get_userorgid()
-    if not userorgid or userorgid == '0':
+    if not userorgid:
         return []
+    is_owner = userorgid == '0'
     dbname = env.get_module_dbname('discount')
     async with DBPools().sqlorContext(dbname) as sor:
-        # Find customers of this reseller that are unbound (no sale_id)
-        rows = await sor.sqlExe(
-            """SELECT dcb.id as bind_id, dcb.customerid,
-               o.orgname as customer_name, dcb.sale_id
-            FROM discount_customer_bind dcb
-            JOIN organization o ON o.id = dcb.customerid
-            WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NULL
-            ORDER BY o.orgname""",
-            {'rid': userorgid}
-        )
+        if is_owner:
+            rows = await sor.sqlExe(
+                """SELECT dcb.id as bind_id, dcb.customerid,
+                   o.orgname as customer_name, dcb.sale_id
+                FROM discount_customer_bind dcb
+                JOIN organization o ON o.id = dcb.customerid
+                WHERE dcb.sale_id IS NULL OR dcb.sale_id = ''
+                ORDER BY o.orgname""", {})
+        else:
+            rows = await sor.sqlExe(
+                """SELECT dcb.id as bind_id, dcb.customerid,
+                   o.orgname as customer_name, dcb.sale_id
+                FROM discount_customer_bind dcb
+                JOIN organization o ON o.id = dcb.customerid
+                WHERE dcb.resellerid = ${rid}$ AND (dcb.sale_id IS NULL OR dcb.sale_id = '')
+                ORDER BY o.orgname""",
+                {'rid': userorgid})
         return rows or []
 
 
@@ -1056,21 +1064,32 @@ async def get_bound_customers(request):
     """
     env = request._run_ns
     userorgid = await env.get_userorgid()
-    if not userorgid or userorgid == '0':
+    if not userorgid:
         return []
+    is_owner = userorgid == '0'
     dbname = env.get_module_dbname('discount')
     async with DBPools().sqlorContext(dbname) as sor:
-        rows = await sor.sqlExe(
-            """SELECT dcb.id as bind_id, dcb.customerid,
-               o.orgname as customer_name, dcb.sale_id,
-               u.nick_name as sale_name
-            FROM discount_customer_bind dcb
-            JOIN organization o ON o.id = dcb.customerid
-            LEFT JOIN users u ON u.id = dcb.sale_id
-            WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NOT NULL
-            ORDER BY o.orgname""",
-            {'rid': userorgid}
-        )
+        if is_owner:
+            rows = await sor.sqlExe(
+                """SELECT dcb.id as bind_id, dcb.customerid,
+                   o.orgname as customer_name, dcb.sale_id,
+                   u.nick_name as sale_name
+                FROM discount_customer_bind dcb
+                JOIN organization o ON o.id = dcb.customerid
+                LEFT JOIN users u ON u.id = dcb.sale_id
+                WHERE dcb.sale_id IS NOT NULL AND dcb.sale_id != ''
+                ORDER BY o.orgname""", {})
+        else:
+            rows = await sor.sqlExe(
+                """SELECT dcb.id as bind_id, dcb.customerid,
+                   o.orgname as customer_name, dcb.sale_id,
+                   u.nick_name as sale_name
+                FROM discount_customer_bind dcb
+                JOIN organization o ON o.id = dcb.customerid
+                LEFT JOIN users u ON u.id = dcb.sale_id
+                WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NOT NULL AND dcb.sale_id != ''
+                ORDER BY o.orgname""",
+                {'rid': userorgid})
         return rows or []
 
 
@@ -1117,17 +1136,25 @@ async def get_reseller_sales(request):
     """
     env = request._run_ns
     userorgid = await env.get_userorgid()
-    if not userorgid or userorgid == '0':
+    if not userorgid:
         return []
     async with DBPools().sqlorContext('sage') as sor:
-        rows = await sor.sqlExe(
-            """SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name
-            FROM users u
-            JOIN userrole ur ON ur.userid = u.id
-            JOIN role r ON r.id = ur.roleid
-            WHERE r.name = 'sale' AND u.orgid = ${oid}$
-            ORDER BY u.nick_name""",
-            {'oid': userorgid}
-        )
+        if userorgid == '0':
+            rows = await sor.sqlExe(
+                """SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name
+                FROM users u
+                JOIN userrole ur ON ur.userid = u.id
+                JOIN role r ON r.id = ur.roleid
+                WHERE r.name = 'sale'
+                ORDER BY u.nick_name""", {})
+        else:
+            rows = await sor.sqlExe(
+                """SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name
+                FROM users u
+                JOIN userrole ur ON ur.userid = u.id
+                JOIN role r ON r.id = ur.roleid
+                WHERE r.name = 'sale' AND u.orgid = ${oid}$
+                ORDER BY u.nick_name""",
+                {'oid': userorgid})
         return [{'value': r.sale_id, 'text': r.sale_name} for r in rows]