From 4ba7d405962ae8b02f60838060a6cab3ce4e64e4 Mon Sep 17 00:00:00 2001 From: wxg0103 <727495428@qq.com> Date: Thu, 12 Nov 2026 11:20:30 +0800 Subject: [PATCH] refactor: simplify role visibility logic for non-admin users MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 【【用户管理】用户包含角色为继承系统管理员时，角色列可以看见继承系统管理员的角色，用户详情中的角色设置仍可见继承系统管理员】 https://www.tapd.cn/tapd_fe/45245355/bug/detail/1145245355001079300 --- apps/users/serializers/user.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/users/serializers/user.py b/apps/users/serializers/user.py index d6ebb741f04..2eb0f0a0909 100644 --- a/apps/users/serializers/user.py +++ b/apps/users/serializers/user.py @@ -465,9 +465,8 @@ def _get_user_roles(user_ids, is_admin=True): user_id = str(relation.user_id) role_id = relation.role_id workspace_id = relation.workspace_id - # 非内置系统管理员只能看到除内置系统管理员之外的角色 - is_builtin_admin_role = relation.role.internal and relation.role.type == RoleConstants.ADMIN.name - if not is_admin and is_builtin_admin_role: + # 非内置系统管理员只能看到系统角色类型（ADMIN）之外的角色 + if not is_admin and relation.role.type == RoleConstants.ADMIN.name: continue user_role_mapping[user_id].add(relation.role.role_name) if relation.role.type == RoleConstants.ADMIN.name: @@ -827,7 +826,7 @@ def update_user_role(instance, user, user_id=None): return is_admin = workspace_user_role_mapping_model.objects.filter( - user_id=user_id, role_id=RoleConstants.ADMIN.name + user_id=user_id, role_id=RoleConstants.ADMIN.name, role__internal=True ).exists() if str(user.id) == "f0dd8f71-e4ee-11ee-8c84-a8a1595801ab": @@ -858,6 +857,7 @@ def update_user_role(instance, user, user_id=None): if is_admin: workspace_user_role_mapping_model.objects.filter(user_id=user.id).delete() else: + # 非内置系统管理员看不到系统角色类型（ADMIN）的角色，保存时保留这些关系，避免被覆盖 workspace_user_role_mapping_model.objects.filter(user_id=user.id).exclude( role__type=RoleConstants.ADMIN.name ).delete()