Merge branch 'main' into online

2026-07-13 17:34:26 +08:00
parent adfc2aa4f4 dc2e527977
commit b2b322bcfb
4 changed files with 12 additions and 5 deletions
@@ -98,10 +98,16 @@ async def get_optional_current_user(
 async def get_admin_user(
    current_user: User = Depends(get_current_user_allow_password_pending),
 ) -> User:
-    if not current_user.is_admin or current_user.user_type != "admin":
+    """验证后台用户权限。
+
+    - user_type="admin" 的后台用户即可通过（含非管理员子账号）
+    - 前端通过 allowed_menus 控制非管理员子账号的菜单可见性
+    - 非后台用户: 403 拒绝
+    """
+    if current_user.user_type != "admin":
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
-            detail="需要管理员权限",
+            detail="需要后台用户权限",
        )
    return current_user

@@ -109,6 +115,7 @@ async def get_admin_user(
 async def get_backend_user(
    current_user: User = Depends(get_current_user_allow_password_pending),
 ) -> User:
+    """与 get_admin_user 等价: 验证 user_type="admin" 的后台用户。"""
    if current_user.user_type != "admin":
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
@@ -28,7 +28,7 @@
        }
      })();
    </script>
-    <script type="module" crossorigin src="/assets/index-a7nRC5ui.js"></script>
+    <script type="module" crossorigin src="/assets/index-CEhV1cDD.js"></script>
    <link rel="stylesheet" crossorigin href="/assets/index-JhRVnnL-.css">
  </head>
  <body>
@@ -1137,7 +1137,7 @@ function RemoveInfo() {
                                {productImage ? (
                                    <>
                                        <img
-                                            src={productImage}
+                                            src={buildAssetUrl(productImage)}
                                            alt="产品图"
                                            style={{ width: '100%', height: '100%', objectFit: 'cover' }}
                                        />