fin

api_core/permissions.py

@@ -0,0 +1,26 @@
+from rest_framework.permissions import BasePermission
+
+
+class IsCoreSuperAdmin(BasePermission):
+    """
+    Core APIs are reserved for Django superusers with a bound Employee merchant.
+    """
+
+    message = "需要 superadmin 权限并绑定有效员工商户"
+
+    def has_permission(self, request, view):
+        user = request.user
+        if not user or not user.is_authenticated:
+            return False
+        if not user.is_superuser:
+            return False
+
+        employee = getattr(user, "employee", None)
+        if employee is None:
+            return False
+        if getattr(employee, "merchant_id", None) is None:
+            return False
+
+        request.core_merchant = employee.merchant
+        return True
+