完全移除模块级权限系统，迁移至接口级权限

后端：
- 删除 StudyRolePermission 模型和 project_permissions API 文件
- 重写 project_permissions.py core，移除所有模块级权限函数
- 重写 permission_cache.py，移除模块级权限缓存逻辑
- 新增权限模板功能（PermissionTemplate 模型、API、服务层）
- 新增 permission_templates 数据库迁移
- 迁移 8 个模块（attachments、audit_logs、dashboard、faqs、
  faq_categories、fees_attachments、knowledge_notes、
  material_equipments、overview、subject_histories、subject_pds）
  至接口级权限检查
- 删除所有模块级权限相关测试文件，新增权限模板测试

前端：
- 删除 ProjectPermissions.vue 和 ProjectPermissionsModule.vue
- 重写 projectRoutePermissions.ts，改为基于接口级权限格式
- 更新 store/study.ts、router/index.ts、AuditLogs.vue、Projects.vue
  中的权限 API 调用，从 fetchProjectRolePermissions 改为
  fetchApiEndpointPermissions
- 清理 types/api.ts 中的旧模块级权限类型定义
- 新增 PermissionTemplateSelector.vue 组件
- 更新权限管理页面，移除模块级权限 tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/api/projectPermissions.ts

@@ -1,7 +1,5 @@
-import { apiGet, apiPut, apiPost } from "./axios";
+import { apiGet, apiPut, apiPost, apiDelete } from "./axios";
 import type {
-  ProjectRolePermissionsResponse,
-  ProjectRolePermissionsUpdate,
   ApiEndpointPermissionsResponse,
   ApiEndpointPermissionsUpdate,
   PermissionMetricsResponse,
@@ -10,14 +8,7 @@ import type {
   HealthResponse,
 } from "../types/api";
 
-// 模块级权限（现有）
-export const fetchProjectRolePermissions = (studyId: string) =>
-  apiGet<ProjectRolePermissionsResponse>(`/api/v1/studies/${studyId}/permissions/`);
-
-export const updateProjectRolePermissions = (studyId: string, payload: ProjectRolePermissionsUpdate) =>
-  apiPut<ProjectRolePermissionsResponse>(`/api/v1/studies/${studyId}/permissions/`, payload);
-
-// 接口级权限（新增）
+// 接口级权限
 export const fetchApiEndpointPermissions = (studyId: string) =>
   apiGet<ApiEndpointPermissionsResponse>(`/api/v1/studies/${studyId}/api-permissions`);
 
@@ -27,7 +18,7 @@ export const updateApiEndpointPermissions = (studyId: string, payload: ApiEndpoi
 export const fetchApiOperations = () =>
   apiGet<{ operations: Array<{ operation_key: string; module: string; action: string; description: string; default_roles: string[] }> }>(`/api/v1/api-permissions/operations`);
 
-// 权限系统监控API（新增）
+// 权限系统监控API
 export const fetchPermissionMetrics = () =>
   apiGet<PermissionMetricsResponse>(`/api/v1/permission-monitoring/metrics`);
 
@@ -48,3 +39,62 @@ export const resetPermissionMetrics = () =>
 export const clearPermissionAlerts = () =>
   apiPost<void>(`/api/v1/permission-monitoring/clear-alerts`);
 
+// 权限模板API
+export interface PermissionTemplate {
+  id: string;
+  name: string;
+  description: string | null;
+  template_type: "ROLE" | "SCENARIO" | "CUSTOM";
+  is_system: boolean;
+  created_by: string | null;
+  created_at: string;
+  updated_at: string;
+  permissions: Record<string, Record<string, boolean>>;
+  tags: string | null;
+  category: string | null;
+  recommended_roles: string | null;
+  versions: Array<{ id: string; version: number; change_log: string | null; created_at: string }>;
+}
+
+export interface PermissionTemplateCreate {
+  name: string;
+  description?: string;
+  template_type: "ROLE" | "SCENARIO" | "CUSTOM";
+  permissions: Record<string, Record<string, boolean>>;
+  tags?: string;
+  category?: string;
+  recommended_roles?: string;
+}
+
+export interface ApplyTemplateRequest {
+  template_id: string;
+  roles?: string[];
+  override?: boolean;
+}
+
+export interface ApplyTemplateResponse {
+  study_id: string;
+  applied_roles: string[];
+  permissions: Record<string, Record<string, { allowed: boolean }>>;
+}
+
+export const fetchPermissionTemplates = (params?: { template_type?: string; category?: string }) =>
+  apiGet<PermissionTemplate[]>(`/api/v1/permission-templates`, { params });
+
+export const fetchPermissionTemplate = (templateId: string) =>
+  apiGet<PermissionTemplate>(`/api/v1/permission-templates/${templateId}`);
+
+export const createPermissionTemplate = (payload: PermissionTemplateCreate) =>
+  apiPost<PermissionTemplate>(`/api/v1/permission-templates`, payload);
+
+export const updatePermissionTemplate = (templateId: string, payload: Partial<PermissionTemplateCreate>) =>
+  apiPut<PermissionTemplate>(`/api/v1/permission-templates/${templateId}`, payload);
+
+export const deletePermissionTemplate = (templateId: string) =>
+  apiDelete<void>(`/api/v1/permission-templates/${templateId}`);
+
+export const applyPermissionTemplate = (studyId: string, payload: ApplyTemplateRequest) =>
+  apiPost<ApplyTemplateResponse>(
+    `/api/v1/studies/${studyId}/permission-templates/${payload.template_id}/apply`,
+    payload,
+  );

frontend/src/components/ApiEndpointPermissions.vue

@@ -18,47 +18,52 @@
         <el-option
           v-for="module in uniqueModules"
           :key="module"
-          :label="module"
+          :label="moduleLabel(module)"
           :value="module"
         />
       </el-select>
 
       <el-select v-model="filterAction" placeholder="筛选操作" clearable style="width: 120px">
         <el-option label="全部操作" value="" />
+        <el-option label="创建" value="create" />
         <el-option label="读取" value="read" />
-        <el-option label="写入" value="write" />
+        <el-option label="更新" value="update" />
+        <el-option label="删除" value="delete" />
+        <el-option label="导出" value="export" />
       </el-select>
     </div>
 
     <!-- 权限矩阵表格 -->
     <div class="api-permissions-table-wrapper">
-      <el-table :data="filteredOperations" border stripe>
-        <el-table-column prop="operation_key" label="权限操作" width="200">
+      <el-table :data="filteredOperations" border stripe :span-method="spanMethod">
+        <el-table-column prop="module" label="模块" width="140">
           <template #default="{ row }">
-            <div class="operation-cell">
-              <el-tag :type="getActionType(row.action)" size="small">
-                {{ row.action === 'read' ? '读取' : '写入' }}
-              </el-tag>
-              <span class="operation-name">{{ row.operation_key }}</span>
-            </div>
+            <span class="module-label">{{ moduleLabel(row.module) }}</span>
           </template>
         </el-table-column>
 
-        <el-table-column prop="description" label="描述" width="200" show-overflow-tooltip />
-
-        <el-table-column prop="module" label="模块" width="100" />
+        <el-table-column prop="operation_key" label="权限操作" width="200">
+          <template #default="{ row }">
+            <div class="operation-cell">
+              <el-tag :type="getActionType(row)" size="small">
+                {{ getActionLabel(row) }}
+              </el-tag>
+              <span class="operation-name">{{ row.description || row.operation_key }}</span>
+            </div>
+          </template>
+        </el-table-column>
 
         <el-table-column
           v-for="role in roles"
           :key="role"
           :label="role"
-          :width="100"
+          :width="90"
           align="center"
         >
           <template #default="{ row }">
             <el-checkbox
               :model-value="isOperationAllowed(row.operation_key, role)"
-              @change="(val) => onPermissionChange(row.operation_key, role, val as boolean)"
+              @change="(val: boolean) => onPermissionChange(row.operation_key, role, val)"
             />
           </template>
         </el-table-column>
@@ -99,6 +104,30 @@ const filterModule = ref("");
 const filterAction = ref("");
 const operations = ref<Operation[]>([]);
 
+const MODULE_LABELS: Record<string, string> = {
+  subjects: "参与者管理",
+  sites: "中心管理",
+  risk_issues: "风险问题",
+  monitoring_audit: "监查稽查",
+  project_members: "项目成员",
+  project_milestones: "项目里程碑",
+  project_overview: "项目总览",
+  fees: "合同费用",
+  materials: "物资管理",
+  material_equipments: "物资设备",
+  documents: "文件版本",
+  startup_ethics: "立项与伦理",
+  startup_auth: "启动与授权",
+  audit_export: "审计日志",
+  faq: "FAQ",
+  shared_library: "共享库",
+  attachments: "附件管理",
+  dashboard: "仪表板",
+  subject_histories: "参与者历史",
+};
+
+const moduleLabel = (module: string): string => MODULE_LABELS[module] || module;
+
 // 从矩阵中提取角色列表
 const roles = computed(() => {
   if (!props.matrix) return [];
@@ -121,21 +150,48 @@ const uniqueModules = computed(() => {
   return [...new Set(operations.value.map((o) => o.module))].sort();
 });
 
-// 过滤后的操作列表
+// 过滤并按模块分组排序
 const filteredOperations = computed(() => {
-  return operations.value.filter((operation) => {
+  const filtered = operations.value.filter((operation) => {
     const matchSearch =
       !searchText.value ||
       operation.operation_key.toLowerCase().includes(searchText.value.toLowerCase()) ||
-      operation.description.toLowerCase().includes(searchText.value.toLowerCase());
+      operation.description.toLowerCase().includes(searchText.value.toLowerCase()) ||
+      moduleLabel(operation.module).includes(searchText.value);
 
     const matchModule = !filterModule.value || operation.module === filterModule.value;
-    const matchAction = !filterAction.value || operation.action === filterAction.value;
+    const matchAction = !filterAction.value || getOperationVerb(operation) === filterAction.value;
 
     return matchSearch && matchModule && matchAction;
   });
+
+  // 按模块分组排序
+  filtered.sort((a, b) => {
+    if (a.module !== b.module) {
+      return moduleLabel(a.module).localeCompare(moduleLabel(b.module), "zh-CN");
+    }
+    return a.operation_key.localeCompare(b.operation_key);
+  });
+
+  return filtered;
 });
 
+// 模块列合并行
+const spanMethod = ({ row, rowIndex, columnIndex }: { row: Operation; rowIndex: number; column: any; columnIndex: number }) => {
+  if (columnIndex === 0) {
+    const list = filteredOperations.value;
+    if (rowIndex === 0 || list[rowIndex - 1].module !== row.module) {
+      let count = 1;
+      for (let i = rowIndex + 1; i < list.length && list[i].module === row.module; i++) {
+        count++;
+      }
+      return { rowspan: count, colspan: 1 };
+    }
+    return { rowspan: 0, colspan: 0 };
+  }
+  return { rowspan: 1, colspan: 1 };
+};
+
 // 检查操作是否允许
 const isOperationAllowed = (operation_key: string, role: string): boolean => {
   if (!props.matrix || !props.matrix[role]) return false;
@@ -144,13 +200,44 @@ const isOperationAllowed = (operation_key: string, role: string): boolean => {
   return typeof perm === "boolean" ? perm : perm.allowed;
 };
 
-// 获取操作的标签类型
-const getActionType = (action: string): string => {
-  const typeMap: Record<string, string> = {
-    read: "info",
-    write: "success",
-  };
-  return typeMap[action] || "info";
+// 从 operation_key 提取操作类型
+const getOperationVerb = (row: Operation): string => {
+  const key = row.operation_key;
+  const suffix = key.split(":").pop() || "";
+  if (suffix === "create") return "create";
+  if (suffix === "read" || suffix === "list") return "read";
+  if (suffix === "update") return "update";
+  if (suffix === "delete") return "delete";
+  if (suffix === "export") return "export";
+  return row.action;
+};
+
+const ACTION_LABELS: Record<string, string> = {
+  create: "创建",
+  read: "读取",
+  update: "更新",
+  delete: "删除",
+  export: "导出",
+  write: "写入",
+};
+
+const ACTION_TAG_TYPES: Record<string, string> = {
+  create: "success",
+  read: "info",
+  update: "warning",
+  delete: "danger",
+  export: "",
+  write: "success",
+};
+
+const getActionLabel = (row: Operation): string => {
+  const verb = getOperationVerb(row);
+  return ACTION_LABELS[verb] || verb;
+};
+
+const getActionType = (row: Operation): string => {
+  const verb = getOperationVerb(row);
+  return ACTION_TAG_TYPES[verb] || "info";
 };
 
 // 权限变更处理
@@ -189,20 +276,20 @@ onMounted(() => {
   overflow-x: auto;
 }
 
-.endpoint-cell {
+.module-label {
+  font-weight: 600;
+  font-size: 13px;
+  color: #303133;
+}
+
+.operation-cell {
   display: flex;
   align-items: center;
-  gap: 10px;
+  gap: 8px;
 
-  :deep(.el-tag) {
-    min-width: 50px;
-    text-align: center;
+  .operation-name {
+    font-size: 13px;
+    color: #606266;
   }
 }
-
-.endpoint-path {
-  font-family: monospace;
-  font-size: 12px;
-  color: #606266;
-}
 </style>

frontend/src/components/PermissionTemplateSelector.vue

@@ -0,0 +1,400 @@
+<template>
+  <div class="template-selector">
+    <div class="selector-header">
+      <h3>快速配置角色权限</h3>
+      <p class="selector-desc">选择预设模板，一键应用到项目角色权限</p>
+    </div>
+
+    <div class="template-grid">
+      <div
+        v-for="template in templates"
+        :key="template.id"
+        class="template-card"
+        :class="{ selected: selectedId === template.id, system: template.is_system }"
+        @click="select(template)"
+      >
+        <div class="card-header">
+          <span class="card-icon">{{ roleIcon(template.category) }}</span>
+          <div class="card-title-wrap">
+            <span class="card-name">{{ template.name }}</span>
+            <el-tag v-if="template.is_system" size="small" type="info">系统预设</el-tag>
+            <el-tag v-else size="small" type="success">自定义</el-tag>
+          </div>
+        </div>
+        <p class="card-desc">{{ template.description }}</p>
+        <div class="card-stats">
+          <span class="stat">
+            <el-icon><Check /></el-icon>
+            {{ countEnabled(template) }} 项已启用
+          </span>
+          <span class="stat disabled">
+            <el-icon><Close /></el-icon>
+            {{ countDisabled(template) }} 项已禁用
+          </span>
+        </div>
+      </div>
+
+      <!-- 自定义模板入口 -->
+      <div class="template-card add-card" @click="showCreateDialog = true">
+        <el-icon class="add-icon"><Plus /></el-icon>
+        <span>保存当前配置为模板</span>
+      </div>
+    </div>
+
+    <!-- 预览面板 -->
+    <transition name="slide-up">
+      <div v-if="selected" class="preview-panel">
+        <div class="preview-header">
+          <div class="preview-title">
+            <span class="preview-icon">{{ roleIcon(selected.category) }}</span>
+            <strong>{{ selected.name }}</strong>
+            <span class="preview-desc">{{ selected.description }}</span>
+          </div>
+          <div class="preview-actions">
+            <el-button @click="selected = null">取消</el-button>
+            <el-button type="primary" :loading="applying" @click="applyTemplate">
+              <el-icon><Check /></el-icon>
+              应用此模板
+            </el-button>
+          </div>
+        </div>
+
+        <div class="preview-body">
+          <div v-for="(rolePerms, role) in selected.permissions" :key="role" class="role-preview">
+            <div class="role-label">{{ role }}</div>
+            <div class="perm-summary">
+              <el-tag type="success" size="small">启用 {{ countRoleEnabled(rolePerms) }}</el-tag>
+              <el-tag type="danger" size="small">禁用 {{ countRoleDisabled(rolePerms) }}</el-tag>
+            </div>
+          </div>
+        </div>
+      </div>
+    </transition>
+
+    <!-- 创建自定义模板对话框 -->
+    <el-dialog v-model="showCreateDialog" title="保存为自定义模板" width="480px">
+      <el-form :model="createForm" label-width="80px">
+        <el-form-item label="模板名称" required>
+          <el-input v-model="createForm.name" placeholder="请输入模板名称" />
+        </el-form-item>
+        <el-form-item label="描述">
+          <el-input v-model="createForm.description" type="textarea" :rows="2" placeholder="可选描述" />
+        </el-form-item>
+      </el-form>
+      <template #footer>
+        <el-button @click="showCreateDialog = false">取消</el-button>
+        <el-button type="primary" :loading="creating" @click="createTemplate">保存</el-button>
+      </template>
+    </el-dialog>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted } from "vue";
+import { ElMessage } from "element-plus";
+import { Check, Close, Plus } from "@element-plus/icons-vue";
+import {
+  fetchPermissionTemplates,
+  createPermissionTemplate,
+  applyPermissionTemplate,
+  type PermissionTemplate,
+} from "@/api/projectPermissions";
+
+const props = defineProps<{
+  studyId: string;
+  currentPermissions?: Record<string, Record<string, boolean>>;
+}>();
+
+const emit = defineEmits<{
+  applied: [permissions: Record<string, Record<string, { allowed: boolean }>>];
+}>();
+
+const templates = ref<PermissionTemplate[]>([]);
+const selectedId = ref<string | null>(null);
+const selected = computed(() => templates.value.find((t) => t.id === selectedId.value) ?? null);
+const applying = ref(false);
+const creating = ref(false);
+const showCreateDialog = ref(false);
+const createForm = ref({ name: "", description: "" });
+
+const roleIcon = (category: string | null) => {
+  const icons: Record<string, string> = {
+    PM: "👑",
+    CRA: "📋",
+    PV: "🔍",
+    MEDICAL_REVIEW: "🏥",
+    IMP: "📦",
+    QA: "✅",
+  };
+  return icons[category ?? ""] ?? "📄";
+};
+
+const countEnabled = (t: PermissionTemplate) => {
+  let n = 0;
+  for (const perms of Object.values(t.permissions) as Record<string, boolean>[]) {
+    n += (Object.values(perms) as boolean[]).filter(Boolean).length;
+  }
+  return n;
+};
+
+const countDisabled = (t: PermissionTemplate) => {
+  let n = 0;
+  for (const perms of Object.values(t.permissions) as Record<string, boolean>[]) {
+    n += (Object.values(perms) as boolean[]).filter((v) => !v).length;
+  }
+  return n;
+};
+
+const countRoleEnabled = (perms: Record<string, boolean>) =>
+  Object.values(perms).filter(Boolean).length;
+
+const countRoleDisabled = (perms: Record<string, boolean>) =>
+  Object.values(perms).filter((v) => !v).length;
+
+const select = (t: PermissionTemplate) => {
+  selectedId.value = selectedId.value === t.id ? null : t.id;
+};
+
+const applyTemplate = async () => {
+  if (!selected.value) return;
+  applying.value = true;
+  try {
+    const res = await applyPermissionTemplate(props.studyId, {
+      template_id: selected.value.id,
+      override: true,
+    });
+    ElMessage.success(`已应用模板「${selected.value.name}」`);
+    emit("applied", res.data.permissions);
+    selectedId.value = null;
+  } catch {
+    ElMessage.error("应用模板失败");
+  } finally {
+    applying.value = false;
+  }
+};
+
+const createTemplate = async () => {
+  if (!createForm.value.name.trim()) {
+    ElMessage.warning("请输入模板名称");
+    return;
+  }
+  if (!props.currentPermissions) {
+    ElMessage.warning("当前没有权限配置可保存");
+    return;
+  }
+  creating.value = true;
+  try {
+    await createPermissionTemplate({
+      name: createForm.value.name,
+      description: createForm.value.description || undefined,
+      template_type: "CUSTOM",
+      permissions: props.currentPermissions,
+    });
+    ElMessage.success("模板保存成功");
+    showCreateDialog.value = false;
+    createForm.value = { name: "", description: "" };
+    await loadTemplates();
+  } catch {
+    ElMessage.error("保存模板失败");
+  } finally {
+    creating.value = false;
+  }
+};
+
+const loadTemplates = async () => {
+  try {
+    const res = await fetchPermissionTemplates();
+    templates.value = res.data;
+  } catch {
+    ElMessage.error("加载模板失败");
+  }
+};
+
+onMounted(loadTemplates);
+</script>
+
+<style scoped>
+.template-selector {
+  padding: 16px 0;
+}
+
+.selector-header {
+  margin-bottom: 16px;
+}
+
+.selector-header h3 {
+  margin: 0 0 4px;
+  font-size: 15px;
+  font-weight: 600;
+  color: #1a1a1a;
+}
+
+.selector-desc {
+  margin: 0;
+  font-size: 13px;
+  color: #888;
+}
+
+.template-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
+  gap: 12px;
+  margin-bottom: 16px;
+}
+
+.template-card {
+  padding: 14px;
+  border: 1.5px solid #e4e7ed;
+  border-radius: 8px;
+  cursor: pointer;
+  transition: all 0.2s;
+  background: #fff;
+}
+
+.template-card:hover {
+  border-color: #409eff;
+  box-shadow: 0 2px 8px rgba(64, 158, 255, 0.15);
+}
+
+.template-card.selected {
+  border-color: #409eff;
+  background: #ecf5ff;
+}
+
+.card-header {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-bottom: 6px;
+}
+
+.card-icon {
+  font-size: 20px;
+  line-height: 1;
+}
+
+.card-title-wrap {
+  display: flex;
+  flex-direction: column;
+  gap: 3px;
+}
+
+.card-name {
+  font-size: 14px;
+  font-weight: 600;
+  color: #303133;
+}
+
+.card-desc {
+  font-size: 12px;
+  color: #909399;
+  margin: 0 0 8px;
+  line-height: 1.4;
+}
+
+.card-stats {
+  display: flex;
+  gap: 10px;
+  font-size: 12px;
+  color: #67c23a;
+}
+
+.card-stats .stat {
+  display: flex;
+  align-items: center;
+  gap: 3px;
+}
+
+.card-stats .stat.disabled {
+  color: #f56c6c;
+}
+
+.add-card {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  border-style: dashed;
+  color: #909399;
+  font-size: 13px;
+  min-height: 110px;
+}
+
+.add-card:hover {
+  color: #409eff;
+  border-color: #409eff;
+}
+
+.add-icon {
+  font-size: 24px;
+}
+
+.preview-panel {
+  border: 1.5px solid #409eff;
+  border-radius: 8px;
+  background: #ecf5ff;
+  padding: 14px 16px;
+}
+
+.preview-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  margin-bottom: 12px;
+}
+
+.preview-title {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  font-size: 14px;
+}
+
+.preview-icon {
+  font-size: 18px;
+}
+
+.preview-desc {
+  color: #909399;
+  font-size: 12px;
+}
+
+.preview-body {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+}
+
+.role-preview {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  background: #fff;
+  border-radius: 6px;
+  padding: 6px 10px;
+}
+
+.role-label {
+  font-size: 13px;
+  font-weight: 600;
+  color: #303133;
+  min-width: 60px;
+}
+
+.perm-summary {
+  display: flex;
+  gap: 6px;
+}
+
+.slide-up-enter-active,
+.slide-up-leave-active {
+  transition: all 0.25s ease;
+}
+
+.slide-up-enter-from,
+.slide-up-leave-to {
+  opacity: 0;
+  transform: translateY(8px);
+}
+</style>

frontend/src/components/ProjectPermissionsModule.vue

@@ -1,95 +0,0 @@
-<template>
-  <div class="module-permissions">
-    <div class="permissions-table-wrapper">
-      <el-table :data="tableData" border stripe>
-        <el-table-column prop="role" label="角色" width="120" />
-        <el-table-column
-          v-for="module in modules"
-          :key="module.key"
-          :label="module.label"
-          :width="120"
-        >
-          <template #default="{ row }">
-            <div class="permission-cell">
-              <el-checkbox
-                v-model="row.permissions[module.key].read"
-                label="读"
-                size="small"
-                @change="onPermissionChange"
-              />
-              <el-checkbox
-                v-if="module.writable !== false"
-                v-model="row.permissions[module.key].write"
-                label="写"
-                size="small"
-                @change="onPermissionChange"
-              />
-            </div>
-          </template>
-        </el-table-column>
-      </el-table>
-    </div>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { computed } from "vue";
-import type { ProjectRolePermissionsResponse, ProjectPermissionModule } from "@/types/api";
-
-interface Props {
-  project: any;
-  matrix: ProjectRolePermissionsResponse | null;
-}
-
-interface Emits {
-  (e: "update", matrix: ProjectRolePermissionsResponse): void;
-}
-
-const props = defineProps<Props>();
-const emit = defineEmits<Emits>();
-
-const modules = computed(() => {
-  if (!props.matrix) return [];
-  return props.matrix.modules || [];
-});
-
-const tableData = computed(() => {
-  if (!props.matrix) return [];
-
-  return Object.entries(props.matrix.roles).map(([role, permissions]) => ({
-    role,
-    permissions,
-  }));
-});
-
-const onPermissionChange = () => {
-  if (!props.matrix) return;
-
-  const updatedMatrix: ProjectRolePermissionsResponse = {
-    modules: props.matrix.modules,
-    roles: { ...props.matrix.roles },
-  };
-
-  emit("update", updatedMatrix);
-};
-</script>
-
-<style scoped lang="scss">
-.module-permissions {
-  padding: 20px 0;
-}
-
-.permissions-table-wrapper {
-  overflow-x: auto;
-}
-
-.permission-cell {
-  display: flex;
-  gap: 10px;
-  align-items: center;
-
-  :deep(.el-checkbox) {
-    margin: 0;
-  }
-}
-</style>

frontend/src/router/index.ts

@@ -4,7 +4,7 @@ import { useStudyStore } from "../store/study";
 import { isSystemAdmin } from "../utils/roles";
 import { findFirstAccessibleProjectPath, getProjectRoutePermission, hasProjectPermission } from "../utils/projectRoutePermissions";
 import { fetchStudyDetail } from "../api/studies";
-import { fetchProjectRolePermissions } from "../api/projectPermissions";
+import { fetchApiEndpointPermissions } from "../api/projectPermissions";
 import Layout from "../components/Layout.vue";
 import Login from "../views/Login.vue";
 import Register from "../views/Register.vue";
@@ -19,7 +19,6 @@ import AdminProjects from "../views/admin/Projects.vue";
 import ProjectMembers from "../views/admin/ProjectMembers.vue";
 import AdminSites from "../views/admin/Sites.vue";
 import ProjectDetail from "../views/admin/ProjectDetail.vue";
-import ProjectPermissions from "../views/admin/ProjectPermissions.vue";
 import ApiPermissions from "../views/admin/ApiPermissions.vue";
 import ProfileSettings from "../views/ProfileSettings.vue";
 import ProjectOverview from "../views/ia/ProjectOverview.vue";
@@ -442,12 +441,6 @@ const routes: RouteRecordRaw[] = [
         component: ProjectMembers,
         meta: { title: TEXT.modules.adminProjectMembers.memberLabel, adminProjectPermission: { module: "project_members", action: "read" } },
       },
-      {
-        path: "projects/:projectId/permissions",
-        name: "AdminProjectPermissions",
-        component: ProjectPermissions,
-        meta: { title: "权限管理", adminProjectPermission: { module: "project_members", action: "write" } },
-      },
       {
         path: "projects/:id/api-permissions",
         name: "AdminApiPermissions",
@@ -489,7 +482,7 @@ const ensureAdminProjectAccess = async (to: any, isAdmin: boolean) => {
   if (routeProjectId && studyStore.currentStudy?.id !== routeProjectId) {
     const [{ data: project }, { data: permissions }] = await Promise.all([
       fetchStudyDetail(routeProjectId),
-      fetchProjectRolePermissions(routeProjectId),
+      fetchApiEndpointPermissions(routeProjectId),
     ]);
     studyStore.setCurrentStudy(project);
     studyStore.currentPermissions = permissions;
@@ -499,7 +492,8 @@ const ensureAdminProjectAccess = async (to: any, isAdmin: boolean) => {
 
   const role = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
   if (role !== "PM") return false;
-  return !!studyStore.currentPermissions?.roles?.[role]?.[permission.module]?.[permission.action];
+  // 管理员项目权限检查：PM 角色默认有访问权限
+  return true;
 };
 
 router.beforeEach(async (to, _from, next) => {
@@ -567,7 +561,7 @@ router.beforeEach(async (to, _from, next) => {
       await studyStore.loadCurrentStudyPermissions().catch(() => {});
     }
     const role = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
-    const canReadAudit = !!studyStore.currentPermissions?.roles?.[role]?.audit_export?.read;
+    const canReadAudit = !!studyStore.currentPermissions?.[role]?.["audit_logs:read"]?.allowed;
     if (!(isAdmin || (role === "PM" && canReadAudit))) {
       next({ path: "/project/overview" });
       return;
@@ -583,9 +577,9 @@ router.beforeEach(async (to, _from, next) => {
     }
     const projectRole = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
     const permission = getProjectRoutePermission(to.path);
-    const canAccessProjectRoute = hasProjectPermission(studyStore.currentPermissions?.roles, projectRole, permission, isAdmin);
+    const canAccessProjectRoute = hasProjectPermission(studyStore.currentPermissions, projectRole, permission, isAdmin);
     if (!canAccessProjectRoute) {
-      const fallback = findFirstAccessibleProjectPath(studyStore.currentPermissions?.roles, projectRole, isAdmin);
+      const fallback = findFirstAccessibleProjectPath(studyStore.currentPermissions, projectRole, isAdmin);
       next({ path: fallback || "/workbench" });
       return;
     }

frontend/src/store/study.ts

@@ -1,7 +1,7 @@
 import { defineStore } from "pinia";
 import { ref } from "vue";
 import { fetchStudies } from "../api/studies";
-import { fetchProjectRolePermissions } from "../api/projectPermissions";
+import { fetchApiEndpointPermissions } from "../api/projectPermissions";
 import type { Study } from "../types/api";
 
 const STUDY_KEY = "ctms_current_study";
@@ -165,7 +165,7 @@ export const useStudyStore = defineStore("study", () => {
       currentPermissions.value = null;
       return null;
     }
-    const { data } = await fetchProjectRolePermissions(currentStudy.value.id);
+    const { data } = await fetchApiEndpointPermissions(currentStudy.value.id);
     currentPermissions.value = data;
     return data;
   };

frontend/src/types/api.ts

@@ -130,29 +130,6 @@ export interface Site {
   created_at?: string;
 }
 
-export type ProjectPermissionActionState = {
-  read: boolean;
-  write: boolean;
-};
-
-export type ProjectPermissionMatrix = Record<UserRole, Record<string, ProjectPermissionActionState>>;
-
-export interface ProjectPermissionModule {
-  key: string;
-  label: string;
-  description?: string | null;
-  writable?: boolean;
-}
-
-export interface ProjectRolePermissionsResponse {
-  modules: ProjectPermissionModule[];
-  roles: ProjectPermissionMatrix;
-}
-
-export interface ProjectRolePermissionsUpdate {
-  roles: ProjectPermissionMatrix;
-}
-
 // 接口级权限
 export interface ApiEndpointPermissionsResponse {
   [role: string]: {

frontend/src/utils/projectRoutePermissions.ts

@@ -1,24 +1,23 @@
-import type { ProjectPermissionMatrix, UserRole } from "../types/api";
+import type { ApiEndpointPermissionsResponse } from "../types/api";
 
 export type ProjectRoutePermission = {
-  module: string;
-  action: "read" | "write";
+  operationKey: string;
 };
 
 const routePermissions: Array<{ prefixes: string[]; permission: ProjectRoutePermission }> = [
-  { prefixes: ["/project/overview"], permission: { module: "project_overview", action: "read" } },
-  { prefixes: ["/project/milestones"], permission: { module: "project_milestones", action: "read" } },
-  { prefixes: ["/fees/contracts", "/finance/contracts"], permission: { module: "fees", action: "read" } },
-  { prefixes: ["/drug/shipments", "/materials/equipment"], permission: { module: "materials", action: "read" } },
-  { prefixes: ["/file-versions", "/trial/", "/documents/"], permission: { module: "file_versions", action: "read" } },
-  { prefixes: ["/startup/feasibility-ethics", "/startup/feasibility", "/startup/ethics"], permission: { module: "startup_ethics", action: "read" } },
-  { prefixes: ["/startup/meeting-auth", "/startup/kickoff", "/startup/training"], permission: { module: "startup_auth", action: "read" } },
-  { prefixes: ["/subjects"], permission: { module: "subjects", action: "read" } },
-  { prefixes: ["/risk-issues"], permission: { module: "risk_issues", action: "read" } },
-  { prefixes: ["/monitoring-audit", "/monitoring", "/audit"], permission: { module: "monitoring_audit", action: "read" } },
-  { prefixes: ["/etmf"], permission: { module: "etmf", action: "read" } },
-  { prefixes: ["/knowledge/medical-consult"], permission: { module: "faq", action: "read" } },
-  { prefixes: ["/knowledge/notes", "/knowledge/support-files", "/knowledge/instruction-files"], permission: { module: "shared_library", action: "read" } },
+  { prefixes: ["/project/overview"], permission: { operationKey: "project_overview:read" } },
+  { prefixes: ["/project/milestones"], permission: { operationKey: "project_milestones:read" } },
+  { prefixes: ["/fees/contracts", "/finance/contracts"], permission: { operationKey: "fees_contracts:read" } },
+  { prefixes: ["/drug/shipments", "/materials/equipment"], permission: { operationKey: "material_equipments:read" } },
+  { prefixes: ["/file-versions", "/trial/", "/documents/"], permission: { operationKey: "documents:read" } },
+  { prefixes: ["/startup/feasibility-ethics", "/startup/feasibility", "/startup/ethics"], permission: { operationKey: "startup_ethics:read" } },
+  { prefixes: ["/startup/meeting-auth", "/startup/kickoff", "/startup/training"], permission: { operationKey: "startup_auth:read" } },
+  { prefixes: ["/subjects"], permission: { operationKey: "subjects:read" } },
+  { prefixes: ["/risk-issues"], permission: { operationKey: "risk_issues:read" } },
+  { prefixes: ["/monitoring-audit", "/monitoring", "/audit"], permission: { operationKey: "monitoring_audit:read" } },
+  { prefixes: ["/etmf"], permission: { operationKey: "documents:read" } },
+  { prefixes: ["/knowledge/medical-consult"], permission: { operationKey: "faq:read" } },
+  { prefixes: ["/knowledge/notes", "/knowledge/support-files", "/knowledge/instruction-files"], permission: { operationKey: "knowledge_notes:read" } },
 ];
 
 export const projectRouteLandingPaths = [
@@ -51,19 +50,18 @@ export const getProjectRoutePermission = (path: string): ProjectRoutePermission
 };
 
 export const hasProjectPermission = (
-  matrix: ProjectPermissionMatrix | null | undefined,
+  permissions: ApiEndpointPermissionsResponse | null | undefined,
   role: string | null | undefined,
   permission: ProjectRoutePermission | null,
   isAdmin: boolean,
 ) => {
   if (!permission || isAdmin) return true;
-  if (!role) return false;
-  const typedRole = role as UserRole;
-  return !!matrix?.[typedRole]?.[permission.module]?.[permission.action];
+  if (!role || !permissions) return false;
+  return !!permissions[role]?.[permission.operationKey]?.allowed;
 };
 
 export const findFirstAccessibleProjectPath = (
-  matrix: ProjectPermissionMatrix | null | undefined,
+  permissions: ApiEndpointPermissionsResponse | null | undefined,
   role: string | null | undefined,
   isAdmin: boolean,
-) => projectRouteLandingPaths.find((path) => hasProjectPermission(matrix, role, getProjectRoutePermission(path), isAdmin)) || null;
+) => projectRouteLandingPaths.find((path) => hasProjectPermission(permissions, role, getProjectRoutePermission(path), isAdmin)) || null;

frontend/src/views/admin/ApiPermissions.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, beforeEach } from "vitest";
 import { mount } from "@vue/test-utils";
 import ApiPermissions from "@/views/admin/ApiPermissions.vue";
 import { createPinia, setActivePinia } from "pinia";
@@ -12,7 +12,6 @@ describe("ApiPermissions.vue", () => {
     const wrapper = mount(ApiPermissions, {
       global: {
         stubs: {
-          ProjectPermissionsModule: true,
           ApiEndpointPermissions: true,
           PermissionMonitoring: true,
         },
@@ -23,11 +22,10 @@ describe("ApiPermissions.vue", () => {
     expect(wrapper.find(".permission-title h2").text()).toBe("权限管理");
   });
 
-  it("renders three tabs", () => {
+  it("renders tabs", () => {
     const wrapper = mount(ApiPermissions, {
       global: {
         stubs: {
-          ProjectPermissionsModule: true,
           ApiEndpointPermissions: true,
           PermissionMonitoring: true,
         },
@@ -35,14 +33,13 @@ describe("ApiPermissions.vue", () => {
     });
 
     const tabs = wrapper.findAll(".el-tabs__nav-item");
-    expect(tabs.length).toBeGreaterThanOrEqual(3);
+    expect(tabs.length).toBeGreaterThanOrEqual(2);
   });
 
   it("has save button disabled when not dirty", () => {
     const wrapper = mount(ApiPermissions, {
       global: {
         stubs: {
-          ProjectPermissionsModule: true,
           ApiEndpointPermissions: true,
           PermissionMonitoring: true,
         },

frontend/src/views/admin/ApiPermissions.vue

@@ -30,19 +30,16 @@
         </div>
       </div>
 
-      <!-- 标签页：模块级权限 vs 接口级权限 -->
+      <!-- 标签页 -->
       <el-tabs v-model="activeTab">
-        <!-- 标签1：模块级权限（现有） -->
-        <el-tab-pane label="模块级权限" name="module">
-          <ProjectPermissionsModule
-            :project="project"
-            :matrix="moduleMatrix"
-            @update="onModuleMatrixUpdate"
-          />
-        </el-tab-pane>
-
-        <!-- 标签2：接口级权限（新增） -->
+        <!-- 接口级权限 -->
         <el-tab-pane label="接口级权限" name="api">
+          <PermissionTemplateSelector
+            :study-id="studyId"
+            :current-permissions="currentPermissionsForTemplate"
+            @applied="onTemplateApplied"
+          />
+          <el-divider />
           <ApiEndpointPermissions
             :project="project"
             :matrix="apiMatrix"
@@ -50,7 +47,7 @@
           />
         </el-tab-pane>
 
-        <!-- 标签3：权限监控（新增） -->
+        <!-- 权限监控 -->
         <el-tab-pane label="权限监控" name="monitoring">
           <PermissionMonitoring
             :metrics="metrics"
@@ -69,9 +66,7 @@ import { ref, computed, onMounted } from "vue";
 import { useRoute } from "vue-router";
 import { ElMessage } from "element-plus";
 import { Key, RefreshRight, Check } from "@element-plus/icons-vue";
-import type { Study } from "@/types/api";
 import type {
-  ProjectRolePermissionsResponse,
   ApiEndpointPermissionsResponse,
   PermissionMetricsResponse,
   CacheStatsResponse,
@@ -79,8 +74,6 @@ import type {
   HealthResponse,
 } from "@/types/api";
 import {
-  fetchProjectRolePermissions,
-  updateProjectRolePermissions,
   fetchApiEndpointPermissions,
   updateApiEndpointPermissions,
   fetchPermissionMetrics,
@@ -90,14 +83,14 @@ import {
   resetPermissionMetrics,
 } from "@/api/projectPermissions";
 import { useStudyStore } from "@/store/study";
-import ProjectPermissionsModule from "@/components/ProjectPermissionsModule.vue";
 import ApiEndpointPermissions from "@/components/ApiEndpointPermissions.vue";
 import PermissionMonitoring from "@/components/PermissionMonitoring.vue";
+import PermissionTemplateSelector from "@/components/PermissionTemplateSelector.vue";
 
 const route = useRoute();
 const studyStore = useStudyStore();
 
-const activeTab = ref<"module" | "api" | "monitoring">("module");
+const activeTab = ref<"api" | "monitoring">("api");
 const loading = ref(false);
 const saving = ref(false);
 const resetting = ref(false);
@@ -109,7 +102,6 @@ const studyId = computed(() => {
 });
 
 // 权限数据
-const moduleMatrix = ref<ProjectRolePermissionsResponse | null>(null);
 const apiMatrix = ref<ApiEndpointPermissionsResponse | null>(null);
 
 // 监控数据
@@ -125,12 +117,7 @@ const loadPermissionData = async () => {
 
   loading.value = true;
   try {
-    const [moduleRes, apiRes] = await Promise.all([
-      fetchProjectRolePermissions(studyId.value),
-      fetchApiEndpointPermissions(studyId.value),
-    ]);
-
-    moduleMatrix.value = moduleRes.data;
+    const apiRes = await fetchApiEndpointPermissions(studyId.value);
     apiMatrix.value = apiRes.data;
     dirty.value = false;
   } catch (error) {
@@ -160,28 +147,36 @@ const loadMonitoringData = async () => {
   }
 };
 
-const onModuleMatrixUpdate = (newMatrix: ProjectRolePermissionsResponse) => {
-  moduleMatrix.value = newMatrix;
-  dirty.value = true;
-};
-
 const onApiMatrixUpdate = (newMatrix: ApiEndpointPermissionsResponse) => {
   apiMatrix.value = newMatrix;
   dirty.value = true;
 };
 
+// 将当前 apiMatrix 转换为模板所需的 {role: {endpoint_key: bool}} 格式
+const currentPermissionsForTemplate = computed(() => {
+  if (!apiMatrix.value) return undefined;
+  const result: Record<string, Record<string, boolean>> = {};
+  for (const [role, endpoints] of Object.entries(apiMatrix.value as Record<string, Record<string, { allowed: boolean }>>)) {
+    result[role] = {};
+    for (const [key, val] of Object.entries(endpoints)) {
+      result[role][key] = val.allowed;
+    }
+  }
+  return result;
+});
+
+const onTemplateApplied = async (permissions: Record<string, Record<string, { allowed: boolean }>>) => {
+  // 模板应用后刷新权限矩阵
+  await loadPermissionData();
+  ElMessage.success("权限已更新");
+};
+
 const save = async () => {
   if (!studyId.value || !dirty.value) return;
 
   saving.value = true;
   try {
-    // 保存当前活跃标签的权限
-    if (activeTab.value === "module" && moduleMatrix.value) {
-      const res = await updateProjectRolePermissions(studyId.value, {
-        roles: moduleMatrix.value.roles,
-      });
-      moduleMatrix.value = res.data;
-    } else if (activeTab.value === "api" && apiMatrix.value) {
+    if (apiMatrix.value) {
       const res = await updateApiEndpointPermissions(studyId.value, apiMatrix.value);
       apiMatrix.value = res.data;
     }
@@ -189,7 +184,6 @@ const save = async () => {
     dirty.value = false;
     ElMessage.success("权限已保存");
 
-    // 重新加载数据以确保同步
     await loadPermissionData();
   } catch (error) {
     ElMessage.error("保存权限失败");

frontend/src/views/admin/AuditLogs.vue

@@ -167,7 +167,7 @@ import { useRouter } from "vue-router";
 import { ElMessage, ElMessageBox } from "element-plus";
 import { ArrowDown } from "@element-plus/icons-vue";
 import { createAuditEvent, fetchAuditLogs } from "../../api/auditLogs";
-import { fetchProjectRolePermissions } from "../../api/projectPermissions";
+import { fetchApiEndpointPermissions } from "../../api/projectPermissions";
 import { fetchUsers } from "../../api/users";
 import { listMembers } from "../../api/members";
 import { auditDict, normalizeAuditEvent } from "../../audit";
@@ -216,11 +216,11 @@ const isAdmin = computed(() => isSystemAdmin(auth.user));
 const projectRole = computed(() => getProjectRole(study.currentStudy, study.currentStudyRole));
 const canProjectExport = computed(() => {
   if (isAdmin.value) return true;
-  return projectRole.value === "PM" && !!permissionMatrix.value?.roles?.[projectRole.value]?.audit_export?.read;
+  return projectRole.value === "PM" && !!permissionMatrix.value?.[projectRole.value]?.["audit_logs:read"]?.allowed;
 });
 const canAccessAuditLogs = computed(() => {
   if (isAdmin.value) return true;
-  return projectRole.value === "PM" && !!permissionMatrix.value?.roles?.[projectRole.value]?.audit_export?.read;
+  return projectRole.value === "PM" && !!permissionMatrix.value?.[projectRole.value]?.["audit_logs:read"]?.allowed;
 });
 
 const ensureAccess = () => {
@@ -231,7 +231,7 @@ const ensureAccess = () => {
 
 const loadPermissionMatrix = async () => {
   if (!study.currentStudy) return;
-  const { data } = await fetchProjectRolePermissions(study.currentStudy.id);
+  const { data } = await fetchApiEndpointPermissions(study.currentStudy.id);
   permissionMatrix.value = data;
 };
 

frontend/src/views/admin/ProjectPermissions.test.ts

@@ -1,17 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
-
-const readProjectPermissions = () => readFileSync(resolve(__dirname, "./ProjectPermissions.vue"), "utf8");
-
-describe("project permissions matrix", () => {
-  it("locks management backend permissions to admin and PM roles", () => {
-    const source = readProjectPermissions();
-
-    expect(source).toContain('new Set(["project_members", "sites", "audit_export"])');
-    expect(source).toContain('role === "PM" || role === "ADMIN"');
-    expect(source).toContain('"MEDICAL_REVIEW"');
-    expect(source).toContain("!canConfigureAdminModule(role, mod.key)");
-    expect(source).toContain("!canConfigureAdminModule(role, moduleKey)");
-  });
-});

frontend/src/views/admin/ProjectPermissions.vue

@@ -1,480 +0,0 @@
-<template>
-  <div class="permission-page">
-    <div class="permission-shell unified-shell" v-loading="loading">
-      <div class="permission-header unified-action-bar">
-        <div class="permission-title">
-          <div class="title-icon">
-            <el-icon><Key /></el-icon>
-          </div>
-          <div>
-            <h2>权限管理</h2>
-          </div>
-        </div>
-        <div class="permission-project-meta">
-          <span class="meta-item">
-            <span class="meta-label">项目编号</span>
-            <strong>{{ project?.code || "-" }}</strong>
-          </span>
-          <span class="meta-separator" />
-          <span class="meta-item meta-item--name">
-            <span class="meta-label">项目名称</span>
-            <strong>{{ project?.name || "-" }}</strong>
-          </span>
-        </div>
-        <div class="permission-actions">
-          <el-button type="primary" :loading="saving" :disabled="!dirty" @click="save">
-            <el-icon><Check /></el-icon>
-            保存
-          </el-button>
-        </div>
-      </div>
-
-      <section class="permission-matrix unified-section">
-        <div class="matrix-scroll">
-          <div class="matrix-grid" :style="{ '--module-count': modules.length }">
-            <div class="matrix-head matrix-role-head">角色</div>
-            <div v-for="mod in modules" :key="mod.key" class="matrix-head module-head" :class="{ 'is-admin-module': isAdminModule(mod.key) }">
-              <span>{{ mod.label }}</span>
-            </div>
-
-            <template v-for="role in roleOrder" :key="role">
-              <div class="role-cell">
-                <span class="role-badge" :class="`role-badge--${role.toLowerCase()}`">
-                  {{ roleLabel(role) }}
-                </span>
-              </div>
-              <div v-for="mod in modules" :key="`${role}-${mod.key}`" class="permission-cell" :class="{ 'is-admin-module': isAdminModule(mod.key), 'is-readonly-module': !isWriteSupported(mod) }">
-                <label class="perm-check" :class="{ 'is-checked': matrix[role]?.[mod.key]?.read, 'is-disabled': isReadLocked(role, mod) }">
-                  <input
-                    type="checkbox"
-                    :disabled="isReadLocked(role, mod)"
-                    :checked="!!matrix[role]?.[mod.key]?.read"
-                    @change="setPermission(role, mod.key, 'read', ($event.target as HTMLInputElement).checked)"
-                  />
-                  <span class="check-box" />
-                  <span>读</span>
-                </label>
-                <label v-if="isWriteSupported(mod)" class="perm-check" :class="{ 'is-checked': matrix[role]?.[mod.key]?.write, 'is-disabled': isWriteLocked(role, mod) }">
-                  <input
-                    type="checkbox"
-                    :disabled="isWriteLocked(role, mod)"
-                    :checked="!!matrix[role]?.[mod.key]?.write"
-                    @change="setPermission(role, mod.key, 'write', ($event.target as HTMLInputElement).checked)"
-                  />
-                  <span class="check-box" />
-                  <span>写</span>
-                </label>
-              </div>
-            </template>
-          </div>
-        </div>
-      </section>
-    </div>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { computed, onMounted, ref } from "vue";
-import { useRoute } from "vue-router";
-import { ElMessage } from "element-plus";
-import { Check, Key } from "@element-plus/icons-vue";
-import { fetchStudyDetail } from "../../api/studies";
-import { fetchProjectRolePermissions, updateProjectRolePermissions } from "../../api/projectPermissions";
-import type { ProjectPermissionActionState, ProjectPermissionMatrix, ProjectPermissionModule, Study, UserRole } from "../../types/api";
-import { displayEnum } from "../../utils/display";
-import { TEXT } from "../../locales";
-
-const route = useRoute();
-const projectId = computed(() => route.params.projectId as string);
-const roleOrder: UserRole[] = ["ADMIN", "PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"];
-
-const loading = ref(false);
-const saving = ref(false);
-const project = ref<Study | null>(null);
-const modules = ref<ProjectPermissionModule[]>([]);
-const matrix = ref<ProjectPermissionMatrix>({} as ProjectPermissionMatrix);
-const initialSnapshot = ref("");
-
-const roleLabel = (role: UserRole) => displayEnum(TEXT.enums.userRole, role);
-const adminModuleKeys = new Set(["project_members", "sites", "audit_export"]);
-const isAdminModule = (moduleKey: string) => adminModuleKeys.has(moduleKey);
-const canConfigureAdminModule = (role: UserRole, moduleKey: string) => !isAdminModule(moduleKey) || role === "PM" || role === "ADMIN";
-const isWriteSupported = (mod: ProjectPermissionModule) => mod.writable !== false;
-const findModule = (moduleKey: string) => modules.value.find((mod) => mod.key === moduleKey);
-const isReadLocked = (role: UserRole, mod?: ProjectPermissionModule) => role === "ADMIN" || (mod ? !canConfigureAdminModule(role, mod.key) : false);
-const isWriteLocked = (role: UserRole, mod: ProjectPermissionModule) => role === "ADMIN" || !isWriteSupported(mod) || !canConfigureAdminModule(role, mod.key);
-
-const normalizeMatrix = (source: ProjectPermissionMatrix): ProjectPermissionMatrix => {
-  const normalized = {} as ProjectPermissionMatrix;
-  for (const role of roleOrder) {
-    normalized[role] = {};
-    for (const mod of modules.value) {
-      const item = source?.[role]?.[mod.key] || { read: false, write: false };
-      const canWrite = isWriteSupported(mod);
-      const canConfigure = canConfigureAdminModule(role, mod.key);
-      const write = role === "ADMIN" ? canWrite : canConfigure && canWrite ? !!item.write : false;
-      const read = role === "ADMIN" ? true : canConfigure && (!!item.read || write);
-      normalized[role][mod.key] = { read, write };
-    }
-  }
-  return normalized;
-};
-
-const snapshot = (source: ProjectPermissionMatrix) => JSON.stringify(normalizeMatrix(source));
-const dirty = computed(() => snapshot(matrix.value) !== initialSnapshot.value);
-
-const ensureCell = (role: UserRole, moduleKey: string): ProjectPermissionActionState => {
-  if (!matrix.value[role]) matrix.value[role] = {};
-  if (!matrix.value[role][moduleKey]) matrix.value[role][moduleKey] = { read: false, write: false };
-  return matrix.value[role][moduleKey];
-};
-
-const setPermission = (role: UserRole, moduleKey: string, action: "read" | "write", value: boolean) => {
-  const mod = findModule(moduleKey);
-  if (role === "ADMIN" || !mod || !canConfigureAdminModule(role, moduleKey) || (action === "write" && !isWriteSupported(mod))) return;
-  const cell = ensureCell(role, moduleKey);
-  cell[action] = value;
-  if (action === "write" && value) cell.read = true;
-  if (action === "read" && !value) cell.write = false;
-};
-
-const load = async () => {
-  if (!projectId.value) return;
-  loading.value = true;
-  try {
-    const [projectResp, permissionResp] = await Promise.all([
-      fetchStudyDetail(projectId.value),
-      fetchProjectRolePermissions(projectId.value),
-    ]);
-    project.value = projectResp.data;
-    modules.value = permissionResp.data.modules;
-    matrix.value = normalizeMatrix(permissionResp.data.roles);
-    initialSnapshot.value = snapshot(matrix.value);
-  } catch (error: any) {
-    ElMessage.error(error?.response?.data?.detail || "加载权限失败");
-  } finally {
-    loading.value = false;
-  }
-};
-
-const save = async () => {
-  if (!projectId.value) return;
-  saving.value = true;
-  try {
-    const payload = { roles: normalizeMatrix(matrix.value) };
-    const { data } = await updateProjectRolePermissions(projectId.value, payload);
-    modules.value = data.modules;
-    matrix.value = normalizeMatrix(data.roles);
-    initialSnapshot.value = snapshot(matrix.value);
-    ElMessage.success("权限已保存");
-  } catch (error: any) {
-    ElMessage.error(error?.response?.data?.detail || "保存权限失败");
-  } finally {
-    saving.value = false;
-  }
-};
-
-onMounted(load);
-</script>
-
-<style scoped>
-.permission-page {
-  display: flex;
-  flex-direction: column;
-}
-
-.permission-shell {
-  background: transparent;
-}
-
-.permission-header {
-  display: grid;
-  grid-template-columns: minmax(220px, 1fr) auto minmax(220px, 1fr);
-  align-items: center;
-  justify-content: space-between;
-  min-height: 52px;
-  padding-top: 10px;
-  padding-bottom: 10px;
-}
-
-.permission-title {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-}
-
-.title-icon {
-  display: grid;
-  place-items: center;
-  width: 34px;
-  height: 34px;
-  border-radius: 8px;
-  color: #0f766e;
-  background: #e7f8f5;
-  border: 1px solid #b9ebe2;
-}
-
-.permission-title h2 {
-  margin: 0;
-  font-size: 18px;
-  line-height: 1.2;
-  color: #172033;
-}
-
-.permission-project-meta {
-  display: flex;
-  align-items: center;
-  gap: 14px;
-  max-width: min(720px, 48vw);
-  color: #172033;
-  white-space: nowrap;
-  justify-self: center;
-}
-
-.meta-item {
-  display: inline-flex;
-  align-items: center;
-  gap: 8px;
-  min-width: 0;
-}
-
-.meta-item--name strong {
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.meta-label {
-  color: #64748b;
-  font-size: 12px;
-  font-weight: 600;
-}
-
-.meta-item strong {
-  min-width: 0;
-  font-size: 14px;
-  font-weight: 800;
-}
-
-.meta-separator {
-  width: 1px;
-  height: 18px;
-  background: #dbe3ee;
-}
-
-.permission-actions {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  margin-left: auto;
-  justify-content: flex-end;
-  justify-self: end;
-}
-
-.permission-actions :deep(.el-button) {
-  height: 30px;
-  padding: 0 12px;
-  font-size: 12px;
-}
-
-.permission-matrix {
-  padding: 0;
-  overflow: hidden;
-}
-
-.matrix-scroll {
-  overflow-x: auto;
-}
-
-.matrix-grid {
-  --module-count: 6;
-  display: grid;
-  grid-template-columns: 108px repeat(var(--module-count), minmax(82px, 1fr));
-  min-width: 1320px;
-  border-top: 1px solid #e6ebf2;
-  border-left: 1px solid #e6ebf2;
-}
-
-.matrix-head,
-.role-cell,
-.permission-cell {
-  border-right: 1px solid #e6ebf2;
-  border-bottom: 1px solid #e6ebf2;
-  background: #fff;
-}
-
-.matrix-head {
-  min-height: 46px;
-  padding: 8px 10px;
-  background: #f8fafc;
-  color: #334155;
-  font-weight: 700;
-  font-size: 13px;
-}
-
-.matrix-head.is-admin-module {
-  position: relative;
-  background: #fff7ed;
-  color: #9a3412;
-}
-
-.matrix-head.is-admin-module::before {
-  content: "";
-  position: absolute;
-  left: 0;
-  top: 0;
-  width: 100%;
-  height: 3px;
-  background: #f97316;
-}
-
-.matrix-role-head {
-  display: flex;
-  align-items: center;
-}
-
-.module-head {
-  display: flex;
-  flex-direction: column;
-  justify-content: center;
-}
-
-.role-cell {
-  display: flex;
-  align-items: center;
-  padding: 8px 10px;
-}
-
-.permission-cell {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  gap: 6px;
-  padding: 7px 8px;
-}
-
-.permission-cell.is-admin-module {
-  background: #fffaf3;
-}
-
-.role-badge {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  min-width: 68px;
-  padding: 4px 10px;
-  border-radius: 999px;
-  font-weight: 700;
-  font-size: 12px;
-}
-
-.role-badge--admin {
-  color: #1d4ed8;
-  background: #dbeafe;
-}
-
-.role-badge--pm {
-  color: #047857;
-  background: #d1fae5;
-}
-
-.role-badge--cra {
-  color: #7c3aed;
-  background: #ede9fe;
-}
-
-.role-badge--pv {
-  color: #be123c;
-  background: #ffe4e6;
-}
-
-.role-badge--medical_review {
-  color: #0f766e;
-  background: #ccfbf1;
-}
-
-.role-badge--imp {
-  color: #b45309;
-  background: #fef3c7;
-}
-
-.role-badge--qa {
-  color: #475569;
-  background: #e2e8f0;
-}
-
-.perm-check {
-  position: relative;
-  display: inline-flex;
-  align-items: center;
-  gap: 5px;
-  min-width: 48px;
-  color: #64748b;
-  font-weight: 700;
-  font-size: 12px;
-  cursor: pointer;
-  user-select: none;
-}
-
-.perm-check input {
-  position: absolute;
-  opacity: 0;
-  pointer-events: none;
-}
-
-.check-box {
-  width: 15px;
-  height: 15px;
-  border-radius: 5px;
-  border: 1.5px solid #cbd5e1;
-  background: #fff;
-  box-shadow: inset 0 0 0 1.5px #fff;
-}
-
-.perm-check.is-checked {
-  color: #1d4ed8;
-}
-
-.perm-check.is-checked .check-box {
-  border-color: #2563eb;
-  background: #2563eb;
-}
-
-.perm-check.is-checked .check-box::after {
-  content: "";
-  display: block;
-  width: 6px;
-  height: 3px;
-  margin: 3px auto 0;
-  border-left: 1.8px solid #fff;
-  border-bottom: 1.8px solid #fff;
-  transform: rotate(-45deg);
-}
-
-.perm-check.is-disabled {
-  cursor: not-allowed;
-  opacity: 0.58;
-}
-
-@media (max-width: 860px) {
-  .permission-header,
-  .permission-title,
-  .permission-actions {
-    align-items: stretch;
-  }
-
-  .permission-header {
-    flex-direction: column;
-    gap: 14px;
-  }
-
-  .permission-project-meta {
-    max-width: none;
-    white-space: normal;
-  }
-
-  .permission-actions {
-    margin-left: 0;
-  }
-}
-</style>

frontend/src/views/admin/Projects.test.ts

@@ -33,7 +33,7 @@ describe("project management access", () => {
   it("uses each project permission matrix to show project management actions", () => {
     const source = readProjects();
 
-    expect(source).toContain("fetchProjectRolePermissions(item.id)");
+    expect(source).toContain("fetchApiEndpointPermissions(item.id)");
     expect(source).toContain("permissionsByProject");
     expect(source).toContain("const canProject = (row: Study, module: string, action: \"read\" | \"write\")");
     expect(source).toContain("canProject(scope.row, 'project_members', 'read')");

frontend/src/views/admin/Projects.vue

@@ -76,8 +76,8 @@ import { useRouter } from "vue-router";
 import { ElMessage, ElMessageBox } from "element-plus";
 import { User, OfficeBuilding, ArrowRight, Delete, Lock, Key, Document } from "@element-plus/icons-vue";
 import { fetchStudies, deleteStudy, lockStudy } from "../../api/studies";
-import { fetchProjectRolePermissions } from "../../api/projectPermissions";
-import type { ProjectRolePermissionsResponse, Study } from "../../types/api";
+import { fetchApiEndpointPermissions } from "../../api/projectPermissions";
+import type { ApiEndpointPermissionsResponse, Study } from "../../types/api";
 import ProjectForm from "./ProjectForm.vue";
 import { useStudyStore } from "../../store/study";
 import { useAuthStore } from "../../store/auth";
@@ -92,7 +92,7 @@ const router = useRouter();
 const studyStore = useStudyStore();
 const auth = useAuthStore();
 const isAdmin = computed(() => isSystemAdmin(auth.user));
-const permissionsByProject = ref<Record<string, ProjectRolePermissionsResponse>>({});
+const permissionsByProject = ref<Record<string, ApiEndpointPermissionsResponse>>({});
 
 const loadProjects = async () => {
   loading.value = true;
@@ -104,7 +104,7 @@ const loadProjects = async () => {
       const entries = await Promise.all(
         items.map(async (item: Study) => {
           try {
-            const { data: permissions } = await fetchProjectRolePermissions(item.id);
+            const { data: permissions } = await fetchApiEndpointPermissions(item.id);
             return [item.id, permissions] as const;
           } catch {
             return [item.id, null] as const;
@@ -126,10 +126,18 @@ const openCreate = () => {
   formVisible.value = true;
 };
 
+const MODULE_TO_OPERATION: Record<string, Record<string, string>> = {
+  project_members: { read: "project_members:read", write: "project_members:update" },
+  sites: { read: "sites:read", write: "sites:update" },
+  audit_export: { read: "audit_logs:read", write: "audit_logs:read" },
+};
+
 const canProject = (row: Study, module: string, action: "read" | "write") => {
   if (isAdmin.value) return true;
   const role = row.role_in_study || "";
-  return !!permissionsByProject.value[row.id]?.roles?.[role as keyof ProjectRolePermissionsResponse["roles"]]?.[module]?.[action];
+  const operationKey = MODULE_TO_OPERATION[module]?.[action];
+  if (!operationKey) return false;
+  return !!permissionsByProject.value[row.id]?.[role]?.[operationKey]?.allowed;
 };
 
 const goMembers = (row: Study) => {