完全移除模块级权限系统，迁移至接口级权限

后端：
- 删除 StudyRolePermission 模型和 project_permissions API 文件
- 重写 project_permissions.py core，移除所有模块级权限函数
- 重写 permission_cache.py，移除模块级权限缓存逻辑
- 新增权限模板功能（PermissionTemplate 模型、API、服务层）
- 新增 permission_templates 数据库迁移
- 迁移 8 个模块（attachments、audit_logs、dashboard、faqs、
  faq_categories、fees_attachments、knowledge_notes、
  material_equipments、overview、subject_histories、subject_pds）
  至接口级权限检查
- 删除所有模块级权限相关测试文件，新增权限模板测试

前端：
- 删除 ProjectPermissions.vue 和 ProjectPermissionsModule.vue
- 重写 projectRoutePermissions.ts，改为基于接口级权限格式
- 更新 store/study.ts、router/index.ts、AuditLogs.vue、Projects.vue
  中的权限 API 调用，从 fetchProjectRolePermissions 改为
  fetchApiEndpointPermissions
- 清理 types/api.ts 中的旧模块级权限类型定义
- 新增 PermissionTemplateSelector.vue 组件
- 更新权限管理页面，移除模块级权限 tab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/views/admin/ApiPermissions.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, beforeEach } from "vitest";
 import { mount } from "@vue/test-utils";
 import ApiPermissions from "@/views/admin/ApiPermissions.vue";
 import { createPinia, setActivePinia } from "pinia";
@@ -12,7 +12,6 @@ describe("ApiPermissions.vue", () => {
     const wrapper = mount(ApiPermissions, {
       global: {
         stubs: {
-          ProjectPermissionsModule: true,
           ApiEndpointPermissions: true,
           PermissionMonitoring: true,
         },
@@ -23,11 +22,10 @@ describe("ApiPermissions.vue", () => {
     expect(wrapper.find(".permission-title h2").text()).toBe("权限管理");
   });
 
-  it("renders three tabs", () => {
+  it("renders tabs", () => {
     const wrapper = mount(ApiPermissions, {
       global: {
         stubs: {
-          ProjectPermissionsModule: true,
           ApiEndpointPermissions: true,
           PermissionMonitoring: true,
         },
@@ -35,14 +33,13 @@ describe("ApiPermissions.vue", () => {
     });
 
     const tabs = wrapper.findAll(".el-tabs__nav-item");
-    expect(tabs.length).toBeGreaterThanOrEqual(3);
+    expect(tabs.length).toBeGreaterThanOrEqual(2);
   });
 
   it("has save button disabled when not dirty", () => {
     const wrapper = mount(ApiPermissions, {
       global: {
         stubs: {
-          ProjectPermissionsModule: true,
           ApiEndpointPermissions: true,
           PermissionMonitoring: true,
         },

frontend/src/views/admin/ApiPermissions.vue

@@ -30,19 +30,16 @@
         </div>
       </div>
 
-      <!-- 标签页：模块级权限 vs 接口级权限 -->
+      <!-- 标签页 -->
       <el-tabs v-model="activeTab">
-        <!-- 标签1：模块级权限（现有） -->
-        <el-tab-pane label="模块级权限" name="module">
-          <ProjectPermissionsModule
-            :project="project"
-            :matrix="moduleMatrix"
-            @update="onModuleMatrixUpdate"
-          />
-        </el-tab-pane>
-
-        <!-- 标签2：接口级权限（新增） -->
+        <!-- 接口级权限 -->
         <el-tab-pane label="接口级权限" name="api">
+          <PermissionTemplateSelector
+            :study-id="studyId"
+            :current-permissions="currentPermissionsForTemplate"
+            @applied="onTemplateApplied"
+          />
+          <el-divider />
           <ApiEndpointPermissions
             :project="project"
             :matrix="apiMatrix"
@@ -50,7 +47,7 @@
           />
         </el-tab-pane>
 
-        <!-- 标签3：权限监控（新增） -->
+        <!-- 权限监控 -->
         <el-tab-pane label="权限监控" name="monitoring">
           <PermissionMonitoring
             :metrics="metrics"
@@ -69,9 +66,7 @@ import { ref, computed, onMounted } from "vue";
 import { useRoute } from "vue-router";
 import { ElMessage } from "element-plus";
 import { Key, RefreshRight, Check } from "@element-plus/icons-vue";
-import type { Study } from "@/types/api";
 import type {
-  ProjectRolePermissionsResponse,
   ApiEndpointPermissionsResponse,
   PermissionMetricsResponse,
   CacheStatsResponse,
@@ -79,8 +74,6 @@ import type {
   HealthResponse,
 } from "@/types/api";
 import {
-  fetchProjectRolePermissions,
-  updateProjectRolePermissions,
   fetchApiEndpointPermissions,
   updateApiEndpointPermissions,
   fetchPermissionMetrics,
@@ -90,14 +83,14 @@ import {
   resetPermissionMetrics,
 } from "@/api/projectPermissions";
 import { useStudyStore } from "@/store/study";
-import ProjectPermissionsModule from "@/components/ProjectPermissionsModule.vue";
 import ApiEndpointPermissions from "@/components/ApiEndpointPermissions.vue";
 import PermissionMonitoring from "@/components/PermissionMonitoring.vue";
+import PermissionTemplateSelector from "@/components/PermissionTemplateSelector.vue";
 
 const route = useRoute();
 const studyStore = useStudyStore();
 
-const activeTab = ref<"module" | "api" | "monitoring">("module");
+const activeTab = ref<"api" | "monitoring">("api");
 const loading = ref(false);
 const saving = ref(false);
 const resetting = ref(false);
@@ -109,7 +102,6 @@ const studyId = computed(() => {
 });
 
 // 权限数据
-const moduleMatrix = ref<ProjectRolePermissionsResponse | null>(null);
 const apiMatrix = ref<ApiEndpointPermissionsResponse | null>(null);
 
 // 监控数据
@@ -125,12 +117,7 @@ const loadPermissionData = async () => {
 
   loading.value = true;
   try {
-    const [moduleRes, apiRes] = await Promise.all([
-      fetchProjectRolePermissions(studyId.value),
-      fetchApiEndpointPermissions(studyId.value),
-    ]);
-
-    moduleMatrix.value = moduleRes.data;
+    const apiRes = await fetchApiEndpointPermissions(studyId.value);
     apiMatrix.value = apiRes.data;
     dirty.value = false;
   } catch (error) {
@@ -160,28 +147,36 @@ const loadMonitoringData = async () => {
   }
 };
 
-const onModuleMatrixUpdate = (newMatrix: ProjectRolePermissionsResponse) => {
-  moduleMatrix.value = newMatrix;
-  dirty.value = true;
-};
-
 const onApiMatrixUpdate = (newMatrix: ApiEndpointPermissionsResponse) => {
   apiMatrix.value = newMatrix;
   dirty.value = true;
 };
 
+// 将当前 apiMatrix 转换为模板所需的 {role: {endpoint_key: bool}} 格式
+const currentPermissionsForTemplate = computed(() => {
+  if (!apiMatrix.value) return undefined;
+  const result: Record<string, Record<string, boolean>> = {};
+  for (const [role, endpoints] of Object.entries(apiMatrix.value as Record<string, Record<string, { allowed: boolean }>>)) {
+    result[role] = {};
+    for (const [key, val] of Object.entries(endpoints)) {
+      result[role][key] = val.allowed;
+    }
+  }
+  return result;
+});
+
+const onTemplateApplied = async (permissions: Record<string, Record<string, { allowed: boolean }>>) => {
+  // 模板应用后刷新权限矩阵
+  await loadPermissionData();
+  ElMessage.success("权限已更新");
+};
+
 const save = async () => {
   if (!studyId.value || !dirty.value) return;
 
   saving.value = true;
   try {
-    // 保存当前活跃标签的权限
-    if (activeTab.value === "module" && moduleMatrix.value) {
-      const res = await updateProjectRolePermissions(studyId.value, {
-        roles: moduleMatrix.value.roles,
-      });
-      moduleMatrix.value = res.data;
-    } else if (activeTab.value === "api" && apiMatrix.value) {
+    if (apiMatrix.value) {
       const res = await updateApiEndpointPermissions(studyId.value, apiMatrix.value);
       apiMatrix.value = res.data;
     }
@@ -189,7 +184,6 @@ const save = async () => {
     dirty.value = false;
     ElMessage.success("权限已保存");
 
-    // 重新加载数据以确保同步
     await loadPermissionData();
   } catch (error) {
     ElMessage.error("保存权限失败");

frontend/src/views/admin/AuditLogs.vue

@@ -167,7 +167,7 @@ import { useRouter } from "vue-router";
 import { ElMessage, ElMessageBox } from "element-plus";
 import { ArrowDown } from "@element-plus/icons-vue";
 import { createAuditEvent, fetchAuditLogs } from "../../api/auditLogs";
-import { fetchProjectRolePermissions } from "../../api/projectPermissions";
+import { fetchApiEndpointPermissions } from "../../api/projectPermissions";
 import { fetchUsers } from "../../api/users";
 import { listMembers } from "../../api/members";
 import { auditDict, normalizeAuditEvent } from "../../audit";
@@ -216,11 +216,11 @@ const isAdmin = computed(() => isSystemAdmin(auth.user));
 const projectRole = computed(() => getProjectRole(study.currentStudy, study.currentStudyRole));
 const canProjectExport = computed(() => {
   if (isAdmin.value) return true;
-  return projectRole.value === "PM" && !!permissionMatrix.value?.roles?.[projectRole.value]?.audit_export?.read;
+  return projectRole.value === "PM" && !!permissionMatrix.value?.[projectRole.value]?.["audit_logs:read"]?.allowed;
 });
 const canAccessAuditLogs = computed(() => {
   if (isAdmin.value) return true;
-  return projectRole.value === "PM" && !!permissionMatrix.value?.roles?.[projectRole.value]?.audit_export?.read;
+  return projectRole.value === "PM" && !!permissionMatrix.value?.[projectRole.value]?.["audit_logs:read"]?.allowed;
 });
 
 const ensureAccess = () => {
@@ -231,7 +231,7 @@ const ensureAccess = () => {
 
 const loadPermissionMatrix = async () => {
   if (!study.currentStudy) return;
-  const { data } = await fetchProjectRolePermissions(study.currentStudy.id);
+  const { data } = await fetchApiEndpointPermissions(study.currentStudy.id);
   permissionMatrix.value = data;
 };
 

frontend/src/views/admin/ProjectPermissions.test.ts

@@ -1,17 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
-
-const readProjectPermissions = () => readFileSync(resolve(__dirname, "./ProjectPermissions.vue"), "utf8");
-
-describe("project permissions matrix", () => {
-  it("locks management backend permissions to admin and PM roles", () => {
-    const source = readProjectPermissions();
-
-    expect(source).toContain('new Set(["project_members", "sites", "audit_export"])');
-    expect(source).toContain('role === "PM" || role === "ADMIN"');
-    expect(source).toContain('"MEDICAL_REVIEW"');
-    expect(source).toContain("!canConfigureAdminModule(role, mod.key)");
-    expect(source).toContain("!canConfigureAdminModule(role, moduleKey)");
-  });
-});

frontend/src/views/admin/ProjectPermissions.vue

@@ -1,480 +0,0 @@
-<template>
-  <div class="permission-page">
-    <div class="permission-shell unified-shell" v-loading="loading">
-      <div class="permission-header unified-action-bar">
-        <div class="permission-title">
-          <div class="title-icon">
-            <el-icon><Key /></el-icon>
-          </div>
-          <div>
-            <h2>权限管理</h2>
-          </div>
-        </div>
-        <div class="permission-project-meta">
-          <span class="meta-item">
-            <span class="meta-label">项目编号</span>
-            <strong>{{ project?.code || "-" }}</strong>
-          </span>
-          <span class="meta-separator" />
-          <span class="meta-item meta-item--name">
-            <span class="meta-label">项目名称</span>
-            <strong>{{ project?.name || "-" }}</strong>
-          </span>
-        </div>
-        <div class="permission-actions">
-          <el-button type="primary" :loading="saving" :disabled="!dirty" @click="save">
-            <el-icon><Check /></el-icon>
-            保存
-          </el-button>
-        </div>
-      </div>
-
-      <section class="permission-matrix unified-section">
-        <div class="matrix-scroll">
-          <div class="matrix-grid" :style="{ '--module-count': modules.length }">
-            <div class="matrix-head matrix-role-head">角色</div>
-            <div v-for="mod in modules" :key="mod.key" class="matrix-head module-head" :class="{ 'is-admin-module': isAdminModule(mod.key) }">
-              <span>{{ mod.label }}</span>
-            </div>
-
-            <template v-for="role in roleOrder" :key="role">
-              <div class="role-cell">
-                <span class="role-badge" :class="`role-badge--${role.toLowerCase()}`">
-                  {{ roleLabel(role) }}
-                </span>
-              </div>
-              <div v-for="mod in modules" :key="`${role}-${mod.key}`" class="permission-cell" :class="{ 'is-admin-module': isAdminModule(mod.key), 'is-readonly-module': !isWriteSupported(mod) }">
-                <label class="perm-check" :class="{ 'is-checked': matrix[role]?.[mod.key]?.read, 'is-disabled': isReadLocked(role, mod) }">
-                  <input
-                    type="checkbox"
-                    :disabled="isReadLocked(role, mod)"
-                    :checked="!!matrix[role]?.[mod.key]?.read"
-                    @change="setPermission(role, mod.key, 'read', ($event.target as HTMLInputElement).checked)"
-                  />
-                  <span class="check-box" />
-                  <span>读</span>
-                </label>
-                <label v-if="isWriteSupported(mod)" class="perm-check" :class="{ 'is-checked': matrix[role]?.[mod.key]?.write, 'is-disabled': isWriteLocked(role, mod) }">
-                  <input
-                    type="checkbox"
-                    :disabled="isWriteLocked(role, mod)"
-                    :checked="!!matrix[role]?.[mod.key]?.write"
-                    @change="setPermission(role, mod.key, 'write', ($event.target as HTMLInputElement).checked)"
-                  />
-                  <span class="check-box" />
-                  <span>写</span>
-                </label>
-              </div>
-            </template>
-          </div>
-        </div>
-      </section>
-    </div>
-  </div>
-</template>
-
-<script setup lang="ts">
-import { computed, onMounted, ref } from "vue";
-import { useRoute } from "vue-router";
-import { ElMessage } from "element-plus";
-import { Check, Key } from "@element-plus/icons-vue";
-import { fetchStudyDetail } from "../../api/studies";
-import { fetchProjectRolePermissions, updateProjectRolePermissions } from "../../api/projectPermissions";
-import type { ProjectPermissionActionState, ProjectPermissionMatrix, ProjectPermissionModule, Study, UserRole } from "../../types/api";
-import { displayEnum } from "../../utils/display";
-import { TEXT } from "../../locales";
-
-const route = useRoute();
-const projectId = computed(() => route.params.projectId as string);
-const roleOrder: UserRole[] = ["ADMIN", "PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"];
-
-const loading = ref(false);
-const saving = ref(false);
-const project = ref<Study | null>(null);
-const modules = ref<ProjectPermissionModule[]>([]);
-const matrix = ref<ProjectPermissionMatrix>({} as ProjectPermissionMatrix);
-const initialSnapshot = ref("");
-
-const roleLabel = (role: UserRole) => displayEnum(TEXT.enums.userRole, role);
-const adminModuleKeys = new Set(["project_members", "sites", "audit_export"]);
-const isAdminModule = (moduleKey: string) => adminModuleKeys.has(moduleKey);
-const canConfigureAdminModule = (role: UserRole, moduleKey: string) => !isAdminModule(moduleKey) || role === "PM" || role === "ADMIN";
-const isWriteSupported = (mod: ProjectPermissionModule) => mod.writable !== false;
-const findModule = (moduleKey: string) => modules.value.find((mod) => mod.key === moduleKey);
-const isReadLocked = (role: UserRole, mod?: ProjectPermissionModule) => role === "ADMIN" || (mod ? !canConfigureAdminModule(role, mod.key) : false);
-const isWriteLocked = (role: UserRole, mod: ProjectPermissionModule) => role === "ADMIN" || !isWriteSupported(mod) || !canConfigureAdminModule(role, mod.key);
-
-const normalizeMatrix = (source: ProjectPermissionMatrix): ProjectPermissionMatrix => {
-  const normalized = {} as ProjectPermissionMatrix;
-  for (const role of roleOrder) {
-    normalized[role] = {};
-    for (const mod of modules.value) {
-      const item = source?.[role]?.[mod.key] || { read: false, write: false };
-      const canWrite = isWriteSupported(mod);
-      const canConfigure = canConfigureAdminModule(role, mod.key);
-      const write = role === "ADMIN" ? canWrite : canConfigure && canWrite ? !!item.write : false;
-      const read = role === "ADMIN" ? true : canConfigure && (!!item.read || write);
-      normalized[role][mod.key] = { read, write };
-    }
-  }
-  return normalized;
-};
-
-const snapshot = (source: ProjectPermissionMatrix) => JSON.stringify(normalizeMatrix(source));
-const dirty = computed(() => snapshot(matrix.value) !== initialSnapshot.value);
-
-const ensureCell = (role: UserRole, moduleKey: string): ProjectPermissionActionState => {
-  if (!matrix.value[role]) matrix.value[role] = {};
-  if (!matrix.value[role][moduleKey]) matrix.value[role][moduleKey] = { read: false, write: false };
-  return matrix.value[role][moduleKey];
-};
-
-const setPermission = (role: UserRole, moduleKey: string, action: "read" | "write", value: boolean) => {
-  const mod = findModule(moduleKey);
-  if (role === "ADMIN" || !mod || !canConfigureAdminModule(role, moduleKey) || (action === "write" && !isWriteSupported(mod))) return;
-  const cell = ensureCell(role, moduleKey);
-  cell[action] = value;
-  if (action === "write" && value) cell.read = true;
-  if (action === "read" && !value) cell.write = false;
-};
-
-const load = async () => {
-  if (!projectId.value) return;
-  loading.value = true;
-  try {
-    const [projectResp, permissionResp] = await Promise.all([
-      fetchStudyDetail(projectId.value),
-      fetchProjectRolePermissions(projectId.value),
-    ]);
-    project.value = projectResp.data;
-    modules.value = permissionResp.data.modules;
-    matrix.value = normalizeMatrix(permissionResp.data.roles);
-    initialSnapshot.value = snapshot(matrix.value);
-  } catch (error: any) {
-    ElMessage.error(error?.response?.data?.detail || "加载权限失败");
-  } finally {
-    loading.value = false;
-  }
-};
-
-const save = async () => {
-  if (!projectId.value) return;
-  saving.value = true;
-  try {
-    const payload = { roles: normalizeMatrix(matrix.value) };
-    const { data } = await updateProjectRolePermissions(projectId.value, payload);
-    modules.value = data.modules;
-    matrix.value = normalizeMatrix(data.roles);
-    initialSnapshot.value = snapshot(matrix.value);
-    ElMessage.success("权限已保存");
-  } catch (error: any) {
-    ElMessage.error(error?.response?.data?.detail || "保存权限失败");
-  } finally {
-    saving.value = false;
-  }
-};
-
-onMounted(load);
-</script>
-
-<style scoped>
-.permission-page {
-  display: flex;
-  flex-direction: column;
-}
-
-.permission-shell {
-  background: transparent;
-}
-
-.permission-header {
-  display: grid;
-  grid-template-columns: minmax(220px, 1fr) auto minmax(220px, 1fr);
-  align-items: center;
-  justify-content: space-between;
-  min-height: 52px;
-  padding-top: 10px;
-  padding-bottom: 10px;
-}
-
-.permission-title {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-}
-
-.title-icon {
-  display: grid;
-  place-items: center;
-  width: 34px;
-  height: 34px;
-  border-radius: 8px;
-  color: #0f766e;
-  background: #e7f8f5;
-  border: 1px solid #b9ebe2;
-}
-
-.permission-title h2 {
-  margin: 0;
-  font-size: 18px;
-  line-height: 1.2;
-  color: #172033;
-}
-
-.permission-project-meta {
-  display: flex;
-  align-items: center;
-  gap: 14px;
-  max-width: min(720px, 48vw);
-  color: #172033;
-  white-space: nowrap;
-  justify-self: center;
-}
-
-.meta-item {
-  display: inline-flex;
-  align-items: center;
-  gap: 8px;
-  min-width: 0;
-}
-
-.meta-item--name strong {
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.meta-label {
-  color: #64748b;
-  font-size: 12px;
-  font-weight: 600;
-}
-
-.meta-item strong {
-  min-width: 0;
-  font-size: 14px;
-  font-weight: 800;
-}
-
-.meta-separator {
-  width: 1px;
-  height: 18px;
-  background: #dbe3ee;
-}
-
-.permission-actions {
-  display: flex;
-  align-items: center;
-  gap: 8px;
-  margin-left: auto;
-  justify-content: flex-end;
-  justify-self: end;
-}
-
-.permission-actions :deep(.el-button) {
-  height: 30px;
-  padding: 0 12px;
-  font-size: 12px;
-}
-
-.permission-matrix {
-  padding: 0;
-  overflow: hidden;
-}
-
-.matrix-scroll {
-  overflow-x: auto;
-}
-
-.matrix-grid {
-  --module-count: 6;
-  display: grid;
-  grid-template-columns: 108px repeat(var(--module-count), minmax(82px, 1fr));
-  min-width: 1320px;
-  border-top: 1px solid #e6ebf2;
-  border-left: 1px solid #e6ebf2;
-}
-
-.matrix-head,
-.role-cell,
-.permission-cell {
-  border-right: 1px solid #e6ebf2;
-  border-bottom: 1px solid #e6ebf2;
-  background: #fff;
-}
-
-.matrix-head {
-  min-height: 46px;
-  padding: 8px 10px;
-  background: #f8fafc;
-  color: #334155;
-  font-weight: 700;
-  font-size: 13px;
-}
-
-.matrix-head.is-admin-module {
-  position: relative;
-  background: #fff7ed;
-  color: #9a3412;
-}
-
-.matrix-head.is-admin-module::before {
-  content: "";
-  position: absolute;
-  left: 0;
-  top: 0;
-  width: 100%;
-  height: 3px;
-  background: #f97316;
-}
-
-.matrix-role-head {
-  display: flex;
-  align-items: center;
-}
-
-.module-head {
-  display: flex;
-  flex-direction: column;
-  justify-content: center;
-}
-
-.role-cell {
-  display: flex;
-  align-items: center;
-  padding: 8px 10px;
-}
-
-.permission-cell {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  gap: 6px;
-  padding: 7px 8px;
-}
-
-.permission-cell.is-admin-module {
-  background: #fffaf3;
-}
-
-.role-badge {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  min-width: 68px;
-  padding: 4px 10px;
-  border-radius: 999px;
-  font-weight: 700;
-  font-size: 12px;
-}
-
-.role-badge--admin {
-  color: #1d4ed8;
-  background: #dbeafe;
-}
-
-.role-badge--pm {
-  color: #047857;
-  background: #d1fae5;
-}
-
-.role-badge--cra {
-  color: #7c3aed;
-  background: #ede9fe;
-}
-
-.role-badge--pv {
-  color: #be123c;
-  background: #ffe4e6;
-}
-
-.role-badge--medical_review {
-  color: #0f766e;
-  background: #ccfbf1;
-}
-
-.role-badge--imp {
-  color: #b45309;
-  background: #fef3c7;
-}
-
-.role-badge--qa {
-  color: #475569;
-  background: #e2e8f0;
-}
-
-.perm-check {
-  position: relative;
-  display: inline-flex;
-  align-items: center;
-  gap: 5px;
-  min-width: 48px;
-  color: #64748b;
-  font-weight: 700;
-  font-size: 12px;
-  cursor: pointer;
-  user-select: none;
-}
-
-.perm-check input {
-  position: absolute;
-  opacity: 0;
-  pointer-events: none;
-}
-
-.check-box {
-  width: 15px;
-  height: 15px;
-  border-radius: 5px;
-  border: 1.5px solid #cbd5e1;
-  background: #fff;
-  box-shadow: inset 0 0 0 1.5px #fff;
-}
-
-.perm-check.is-checked {
-  color: #1d4ed8;
-}
-
-.perm-check.is-checked .check-box {
-  border-color: #2563eb;
-  background: #2563eb;
-}
-
-.perm-check.is-checked .check-box::after {
-  content: "";
-  display: block;
-  width: 6px;
-  height: 3px;
-  margin: 3px auto 0;
-  border-left: 1.8px solid #fff;
-  border-bottom: 1.8px solid #fff;
-  transform: rotate(-45deg);
-}
-
-.perm-check.is-disabled {
-  cursor: not-allowed;
-  opacity: 0.58;
-}
-
-@media (max-width: 860px) {
-  .permission-header,
-  .permission-title,
-  .permission-actions {
-    align-items: stretch;
-  }
-
-  .permission-header {
-    flex-direction: column;
-    gap: 14px;
-  }
-
-  .permission-project-meta {
-    max-width: none;
-    white-space: normal;
-  }
-
-  .permission-actions {
-    margin-left: 0;
-  }
-}
-</style>

frontend/src/views/admin/Projects.test.ts

@@ -33,7 +33,7 @@ describe("project management access", () => {
   it("uses each project permission matrix to show project management actions", () => {
     const source = readProjects();
 
-    expect(source).toContain("fetchProjectRolePermissions(item.id)");
+    expect(source).toContain("fetchApiEndpointPermissions(item.id)");
     expect(source).toContain("permissionsByProject");
     expect(source).toContain("const canProject = (row: Study, module: string, action: \"read\" | \"write\")");
     expect(source).toContain("canProject(scope.row, 'project_members', 'read')");

frontend/src/views/admin/Projects.vue

@@ -76,8 +76,8 @@ import { useRouter } from "vue-router";
 import { ElMessage, ElMessageBox } from "element-plus";
 import { User, OfficeBuilding, ArrowRight, Delete, Lock, Key, Document } from "@element-plus/icons-vue";
 import { fetchStudies, deleteStudy, lockStudy } from "../../api/studies";
-import { fetchProjectRolePermissions } from "../../api/projectPermissions";
-import type { ProjectRolePermissionsResponse, Study } from "../../types/api";
+import { fetchApiEndpointPermissions } from "../../api/projectPermissions";
+import type { ApiEndpointPermissionsResponse, Study } from "../../types/api";
 import ProjectForm from "./ProjectForm.vue";
 import { useStudyStore } from "../../store/study";
 import { useAuthStore } from "../../store/auth";
@@ -92,7 +92,7 @@ const router = useRouter();
 const studyStore = useStudyStore();
 const auth = useAuthStore();
 const isAdmin = computed(() => isSystemAdmin(auth.user));
-const permissionsByProject = ref<Record<string, ProjectRolePermissionsResponse>>({});
+const permissionsByProject = ref<Record<string, ApiEndpointPermissionsResponse>>({});
 
 const loadProjects = async () => {
   loading.value = true;
@@ -104,7 +104,7 @@ const loadProjects = async () => {
       const entries = await Promise.all(
         items.map(async (item: Study) => {
           try {
-            const { data: permissions } = await fetchProjectRolePermissions(item.id);
+            const { data: permissions } = await fetchApiEndpointPermissions(item.id);
             return [item.id, permissions] as const;
           } catch {
             return [item.id, null] as const;
@@ -126,10 +126,18 @@ const openCreate = () => {
   formVisible.value = true;
 };
 
+const MODULE_TO_OPERATION: Record<string, Record<string, string>> = {
+  project_members: { read: "project_members:read", write: "project_members:update" },
+  sites: { read: "sites:read", write: "sites:update" },
+  audit_export: { read: "audit_logs:read", write: "audit_logs:read" },
+};
+
 const canProject = (row: Study, module: string, action: "read" | "write") => {
   if (isAdmin.value) return true;
   const role = row.role_in_study || "";
-  return !!permissionsByProject.value[row.id]?.roles?.[role as keyof ProjectRolePermissionsResponse["roles"]]?.[module]?.[action];
+  const operationKey = MODULE_TO_OPERATION[module]?.[action];
+  if (!operationKey) return false;
+  return !!permissionsByProject.value[row.id]?.[role]?.[operationKey]?.allowed;
 };
 
 const goMembers = (row: Study) => {