yumoqing/discount
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: owner (org=0) can see all customers and sales across orgs

Browse Source
This commit is contained in:
yumoqing 2026-07-14 10:50:59 +08:00
parent 1e0081862d
commit 429cee6e9d
1 changed files with 60 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

93
discount/init.py
View File

@ -1033,20 +1033,28 @@ async def get_free_customers(request):
""" """
env = request._run_ns env = request._run_ns
userorgid = await env.get_userorgid() userorgid = await env.get_userorgid()
if not userorgid or userorgid == '0': if not userorgid:
return [] return []
is_owner = userorgid == '0'
dbname = env.get_module_dbname('discount') dbname = env.get_module_dbname('discount')
async with DBPools().sqlorContext(dbname) as sor: async with DBPools().sqlorContext(dbname) as sor:
# Find customers of this reseller that are unbound (no sale_id) if is_owner:
rows = await sor.sqlExe( rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid, """SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id o.orgname as customer_name, dcb.sale_id
FROM discount_customer_bind dcb FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid JOIN organization o ON o.id = dcb.customerid
WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NULL WHERE dcb.sale_id IS NULL OR dcb.sale_id = ''
ORDER BY o.orgname""", ORDER BY o.orgname""", {})
{'rid': userorgid} else:
) rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id
FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid
WHERE dcb.resellerid = ${rid}$ AND (dcb.sale_id IS NULL OR dcb.sale_id = '')
ORDER BY o.orgname""",
{'rid': userorgid})
return rows or [] return rows or []
@ -1056,21 +1064,32 @@ async def get_bound_customers(request):
""" """
env = request._run_ns env = request._run_ns
userorgid = await env.get_userorgid() userorgid = await env.get_userorgid()
if not userorgid or userorgid == '0': if not userorgid:
return [] return []
is_owner = userorgid == '0'
dbname = env.get_module_dbname('discount') dbname = env.get_module_dbname('discount')
async with DBPools().sqlorContext(dbname) as sor: async with DBPools().sqlorContext(dbname) as sor:
rows = await sor.sqlExe( if is_owner:
"""SELECT dcb.id as bind_id, dcb.customerid, rows = await sor.sqlExe(
o.orgname as customer_name, dcb.sale_id, """SELECT dcb.id as bind_id, dcb.customerid,
u.nick_name as sale_name o.orgname as customer_name, dcb.sale_id,
FROM discount_customer_bind dcb u.nick_name as sale_name
JOIN organization o ON o.id = dcb.customerid FROM discount_customer_bind dcb
LEFT JOIN users u ON u.id = dcb.sale_id JOIN organization o ON o.id = dcb.customerid
WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NOT NULL LEFT JOIN users u ON u.id = dcb.sale_id
ORDER BY o.orgname""", WHERE dcb.sale_id IS NOT NULL AND dcb.sale_id != ''
{'rid': userorgid} ORDER BY o.orgname""", {})
) else:
rows = await sor.sqlExe(
"""SELECT dcb.id as bind_id, dcb.customerid,
o.orgname as customer_name, dcb.sale_id,
u.nick_name as sale_name
FROM discount_customer_bind dcb
JOIN organization o ON o.id = dcb.customerid
LEFT JOIN users u ON u.id = dcb.sale_id
WHERE dcb.resellerid = ${rid}$ AND dcb.sale_id IS NOT NULL AND dcb.sale_id != ''
ORDER BY o.orgname""",
{'rid': userorgid})
return rows or [] return rows or []
@ -1117,17 +1136,25 @@ async def get_reseller_sales(request):
""" """
env = request._run_ns env = request._run_ns
userorgid = await env.get_userorgid() userorgid = await env.get_userorgid()
if not userorgid or userorgid == '0': if not userorgid:
return [] return []
async with DBPools().sqlorContext('sage') as sor: async with DBPools().sqlorContext('sage') as sor:
rows = await sor.sqlExe( if userorgid == '0':
"""SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name rows = await sor.sqlExe(
FROM users u """SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name
JOIN userrole ur ON ur.userid = u.id FROM users u
JOIN role r ON r.id = ur.roleid JOIN userrole ur ON ur.userid = u.id
WHERE r.name = 'sale' AND u.orgid = ${oid}$ JOIN role r ON r.id = ur.roleid
ORDER BY u.nick_name""", WHERE r.name = 'sale'
{'oid': userorgid} ORDER BY u.nick_name""", {})
) else:
rows = await sor.sqlExe(
"""SELECT DISTINCT u.id as sale_id, u.nick_name as sale_name
FROM users u
JOIN userrole ur ON ur.userid = u.id
JOIN role r ON r.id = ur.roleid
WHERE r.name = 'sale' AND u.orgid = ${oid}$
ORDER BY u.nick_name""",
{'oid': userorgid})
return [{'value': r.sale_id, 'text': r.sale_name} for r in rows] return [{'value': r.sale_id, 'text': r.sale_name} for r in rows]