接入客户登录和订单会话权限隔离

tests/test_order_data.py

@@ -22,8 +22,6 @@ class OrderDataTests(unittest.TestCase):
         self.client.post('/api/visitor/session', json={'key':'1'*64})
         self.context = self.app.app_context()
         self.context.push()
-        from flask import g
-        g.customer_tenant_id = 'tenant-a'
         self.addCleanup(self.context.pop)
         self.record = {'source_order_id':'999999999999999999', 'tenant_id':'tenant-a',
             'order_no':'FL202610290001', 'inbound_code':'INB20261029001-01', 'shipment_id':'shipment00208',
@@ -32,6 +30,8 @@ class OrderDataTests(unittest.TestCase):
             'history_json':[{'time':'2026-10-28 10:00', 'status':'SUBMITTED'},
                             {'time':'2026-10-29 10:00', 'status':'PROCESSING'}]}
         self.import_rows([self.record])
+        self.assertTrue(self.client.post('/api/customer/login',json={'username':'admin','password':'123456'}).json['ok'])
+        self.client.get('/api/customer/session')
 
     def import_rows(self, rows, replace=False):
         connection = db.connect()