统一项目角色与接口权限配置

backend/alembic/versions/20260514_01_add_permission_templates.py

@@ -92,7 +92,7 @@ def _insert_system_templates() -> None:
             "项目负责人，统筹项目全局，协调进度、资源与关键决策。",
             "PM",
             "PM",
-            '{"PM": {"subjects:create": true, "subjects:list": true, "subjects:read": true, "subjects:update": true, "subjects:delete": true, "visits:create": true, "visits:list": true, "visits:read": true, "visits:update": true, "visits:delete": true, "risk_issues:create": true, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": true, "risk_issues:delete": true, "finance_contracts:create": true, "finance_contracts:list": true, "finance_contracts:read": true, "finance_contracts:update": true, "finance_contracts:delete": true, "fees_contracts:create": true, "fees_contracts:list": true, "fees_contracts:read": true, "fees_contracts:update": true, "fees_contracts:delete": true, "fees_payments:create": true, "fees_payments:update": true, "fees_payments:delete": true, "project_members:create": true, "project_members:list": true, "project_members:candidates": true, "project_members:update": true, "project_members:delete": true, "sites:create": true, "sites:list": true, "sites:read": true, "sites:update": true, "sites:delete": true, "ethics:create": true, "ethics:list": true, "ethics:read": true, "ethics:update": true, "ethics:delete": true, "feasibility:create": true, "feasibility:list": true, "feasibility:read": true, "feasibility:update": true, "feasibility:delete": true, "budget:create": true, "budget:list": true, "budget:read": true, "budget:update": true, "budget:delete": true, "timeline:create": true, "timeline:list": true, "timeline:read": true, "timeline:update": true, "timeline:delete": true, "permissions:read": true, "permissions:update": true, "overview:read": true, "monitoring_issues:create": true, "monitoring_issues:list": true, "monitoring_issues:read": true, "monitoring_issues:update": true, "monitoring_issues:delete": true, "monitoring_issues:close": true, "monitoring_issues:history": true, "monitoring_audit:create": true, "monitoring_audit:read": true, "monitoring_audit:update": true, "monitoring_audit:delete": true, "drug_shipments:create": true, "drug_shipments:list": true, "drug_shipments:read": true, "drug_shipments:update": true, "drug_shipments:delete": true, "materials:create": true, "materials:list": true, "materials:read": true, "materials:update": true, "materials:delete": true, "subject_pds:create": true, "subject_pds:list": true, "subject_pds:read": true, "subject_pds:update": true, "audit_logs:list": true, "audit_logs:read": true, "audit_logs:export": true, "knowledge_notes:create": true, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": true, "knowledge_notes:delete": true, "subject_history:list": true, "subject_history:read": true, "subject_history:timeline": true, "subject_history:export": true, "subject_history:search": true, "milestones:list": true, "milestones:update": true, "attachments:create": true, "attachments:read": true, "attachments:update": true, "attachments:delete": true, "fees_attachments:create": true, "fees_attachments:read": true, "fees_attachments:delete": true, "faq:create": true, "faq:read": true, "faq:update": true, "faq:delete": true, "faq_category:create": true, "faq_category:read": true, "faq_category:update": true, "faq_category:delete": true, "faq_reply:create": true, "faq_reply:delete": true, "dashboard:read": true, "subject_histories:create": true, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": true, "subject_histories:delete": true, "material_equipments:create": true, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": true, "material_equipments:delete": true, "documents:create": true, "documents:read": true, "documents:update": true, "documents:delete": true}}',
+            '{"PM": {"subjects:create": true, "subjects:list": true, "subjects:read": true, "subjects:update": true, "subjects:delete": true, "visits:create": true, "visits:list": true, "visits:read": true, "visits:update": true, "visits:delete": true, "risk_issues:create": true, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": true, "risk_issues:delete": true, "finance_contracts:create": true, "finance_contracts:list": true, "finance_contracts:read": true, "finance_contracts:update": true, "finance_contracts:delete": true, "fees_contracts:create": true, "fees_contracts:list": true, "fees_contracts:read": true, "fees_contracts:update": true, "fees_contracts:delete": true, "fees_payments:create": true, "fees_payments:update": true, "fees_payments:delete": true, "project_members:create": true, "project_members:list": true, "project_members:candidates": true, "project_members:update": true, "project_members:delete": true, "sites:create": true, "sites:list": true, "sites:read": true, "sites:update": true, "sites:delete": true, "ethics:create": true, "ethics:list": true, "ethics:read": true, "ethics:update": true, "ethics:delete": true, "feasibility:create": true, "feasibility:list": true, "feasibility:read": true, "feasibility:update": true, "feasibility:delete": true, "permissions:read": true, "permissions:update": true, "overview:read": true, "monitoring_issues:create": true, "monitoring_issues:list": true, "monitoring_issues:read": true, "monitoring_issues:update": true, "monitoring_issues:delete": true, "drug_shipments:create": true, "drug_shipments:list": true, "drug_shipments:read": true, "drug_shipments:update": true, "drug_shipments:delete": true, "materials:create": true, "materials:list": true, "materials:read": true, "materials:update": true, "materials:delete": true, "subject_pds:create": true, "subject_pds:list": true, "subject_pds:read": true, "subject_pds:update": true, "audit_logs:list": true, "audit_logs:read": true, "audit_logs:export": true, "knowledge_notes:create": true, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": true, "knowledge_notes:delete": true, "subject_history:list": true, "subject_history:read": true, "subject_history:timeline": true, "subject_history:export": true, "subject_history:search": true, "milestones:list": true, "milestones:update": true, "attachments:create": true, "attachments:read": true, "attachments:update": true, "attachments:delete": true, "fees_attachments:create": true, "fees_attachments:read": true, "fees_attachments:delete": true, "faq:create": true, "faq:read": true, "faq:update": true, "faq:delete": true, "faq_category:create": true, "faq_category:read": true, "faq_category:update": true, "faq_category:delete": true, "faq_reply:create": true, "faq_reply:delete": true, "subject_histories:create": true, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": true, "subject_histories:delete": true, "material_equipments:create": true, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": true, "material_equipments:delete": true, "documents:create": true, "documents:read": true, "documents:update": true, "documents:delete": true}}',
         ),
         (
             "a17e6fd5-f0c6-4723-b166-6c25a595e28d",
@@ -100,7 +100,7 @@ def _insert_system_templates() -> None:
             "负责各中心临床监查执行，跟进现场质量、数据和问题闭环。",
             "CRA",
             "CRA",
-            '{"CRA": {"subjects:create": true, "subjects:list": true, "subjects:read": true, "subjects:update": true, "subjects:delete": false, "visits:create": true, "visits:list": true, "visits:read": true, "visits:update": true, "visits:delete": false, "risk_issues:create": true, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": true, "risk_issues:delete": false, "finance_contracts:create": false, "finance_contracts:list": true, "finance_contracts:read": true, "finance_contracts:update": false, "finance_contracts:delete": false, "fees_contracts:create": false, "fees_contracts:list": true, "fees_contracts:read": true, "fees_contracts:update": false, "fees_contracts:delete": false, "fees_payments:create": false, "fees_payments:update": false, "fees_payments:delete": false, "project_members:create": false, "project_members:list": false, "project_members:candidates": false, "project_members:update": false, "project_members:delete": false, "sites:create": false, "sites:list": true, "sites:read": true, "sites:update": false, "sites:delete": false, "ethics:create": false, "ethics:list": true, "ethics:read": true, "ethics:update": false, "ethics:delete": false, "feasibility:create": false, "feasibility:list": true, "feasibility:read": true, "feasibility:update": false, "feasibility:delete": false, "budget:create": false, "budget:list": true, "budget:read": true, "budget:update": false, "budget:delete": false, "timeline:create": false, "timeline:list": true, "timeline:read": true, "timeline:update": false, "timeline:delete": false, "permissions:read": false, "permissions:update": false, "overview:read": true, "monitoring_issues:create": true, "monitoring_issues:list": true, "monitoring_issues:read": true, "monitoring_issues:update": true, "monitoring_issues:delete": false, "monitoring_issues:close": true, "monitoring_issues:history": true, "monitoring_audit:create": true, "monitoring_audit:read": true, "monitoring_audit:update": true, "monitoring_audit:delete": false, "drug_shipments:create": false, "drug_shipments:list": true, "drug_shipments:read": true, "drug_shipments:update": false, "drug_shipments:delete": false, "materials:create": false, "materials:list": true, "materials:read": true, "materials:update": false, "materials:delete": false, "subject_pds:create": true, "subject_pds:list": true, "subject_pds:read": true, "subject_pds:update": true, "audit_logs:list": false, "audit_logs:read": false, "audit_logs:export": false, "knowledge_notes:create": true, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": true, "knowledge_notes:delete": false, "subject_history:list": true, "subject_history:read": true, "subject_history:timeline": true, "subject_history:export": true, "subject_history:search": true, "milestones:list": true, "milestones:update": false, "attachments:create": true, "attachments:read": true, "attachments:update": true, "attachments:delete": true, "fees_attachments:create": true, "fees_attachments:read": true, "fees_attachments:delete": true, "faq:create": false, "faq:read": true, "faq:update": false, "faq:delete": false, "faq_category:create": false, "faq_category:read": true, "faq_category:update": false, "faq_category:delete": false, "faq_reply:create": true, "faq_reply:delete": false, "dashboard:read": true, "subject_histories:create": true, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": true, "subject_histories:delete": false, "material_equipments:create": true, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": true, "material_equipments:delete": false, "documents:create": true, "documents:read": true, "documents:update": true, "documents:delete": false}}',
+            '{"CRA": {"subjects:create": true, "subjects:list": true, "subjects:read": true, "subjects:update": true, "subjects:delete": false, "visits:create": true, "visits:list": true, "visits:read": true, "visits:update": true, "visits:delete": false, "risk_issues:create": true, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": true, "risk_issues:delete": false, "finance_contracts:create": false, "finance_contracts:list": true, "finance_contracts:read": true, "finance_contracts:update": false, "finance_contracts:delete": false, "fees_contracts:create": false, "fees_contracts:list": true, "fees_contracts:read": true, "fees_contracts:update": false, "fees_contracts:delete": false, "fees_payments:create": false, "fees_payments:update": false, "fees_payments:delete": false, "project_members:create": false, "project_members:list": false, "project_members:candidates": false, "project_members:update": false, "project_members:delete": false, "sites:create": false, "sites:list": true, "sites:read": true, "sites:update": false, "sites:delete": false, "ethics:create": false, "ethics:list": true, "ethics:read": true, "ethics:update": false, "ethics:delete": false, "feasibility:create": false, "feasibility:list": true, "feasibility:read": true, "feasibility:update": false, "feasibility:delete": false, "permissions:read": false, "permissions:update": false, "overview:read": true, "monitoring_issues:create": true, "monitoring_issues:list": true, "monitoring_issues:read": true, "monitoring_issues:update": true, "monitoring_issues:delete": false, "drug_shipments:create": false, "drug_shipments:list": true, "drug_shipments:read": true, "drug_shipments:update": false, "drug_shipments:delete": false, "materials:create": false, "materials:list": true, "materials:read": true, "materials:update": false, "materials:delete": false, "subject_pds:create": true, "subject_pds:list": true, "subject_pds:read": true, "subject_pds:update": true, "audit_logs:list": false, "audit_logs:read": false, "audit_logs:export": false, "knowledge_notes:create": true, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": true, "knowledge_notes:delete": false, "subject_history:list": true, "subject_history:read": true, "subject_history:timeline": true, "subject_history:export": true, "subject_history:search": true, "milestones:list": true, "milestones:update": false, "attachments:create": true, "attachments:read": true, "attachments:update": true, "attachments:delete": true, "fees_attachments:create": true, "fees_attachments:read": true, "fees_attachments:delete": true, "faq:create": false, "faq:read": true, "faq:update": false, "faq:delete": false, "faq_category:create": false, "faq_category:read": true, "faq_category:update": false, "faq_category:delete": false, "faq_reply:create": true, "faq_reply:delete": false, "subject_histories:create": true, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": true, "subject_histories:delete": false, "material_equipments:create": true, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": true, "material_equipments:delete": false, "documents:create": true, "documents:read": true, "documents:update": true, "documents:delete": false}}',
         ),
         (
             "f45fbfda-faed-4b83-b4a8-24ca4011894b",
@@ -108,7 +108,7 @@ def _insert_system_templates() -> None:
             "负责药物警戒相关工作，跟踪安全性事件并支持风险评估。",
             "PV",
             "PV",
-            '{"PV": {"subjects:create": false, "subjects:list": true, "subjects:read": true, "subjects:update": false, "subjects:delete": false, "visits:create": false, "visits:list": true, "visits:read": true, "visits:update": false, "visits:delete": false, "risk_issues:create": true, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": true, "risk_issues:delete": false, "finance_contracts:create": false, "finance_contracts:list": false, "finance_contracts:read": false, "finance_contracts:update": false, "finance_contracts:delete": false, "fees_contracts:create": false, "fees_contracts:list": false, "fees_contracts:read": false, "fees_contracts:update": false, "fees_contracts:delete": false, "fees_payments:create": false, "fees_payments:update": false, "fees_payments:delete": false, "project_members:create": false, "project_members:list": false, "project_members:candidates": false, "project_members:update": false, "project_members:delete": false, "sites:create": false, "sites:list": true, "sites:read": true, "sites:update": false, "sites:delete": false, "ethics:create": false, "ethics:list": true, "ethics:read": true, "ethics:update": false, "ethics:delete": false, "feasibility:create": false, "feasibility:list": true, "feasibility:read": true, "feasibility:update": false, "feasibility:delete": false, "budget:create": false, "budget:list": false, "budget:read": false, "budget:update": false, "budget:delete": false, "timeline:create": false, "timeline:list": true, "timeline:read": true, "timeline:update": false, "timeline:delete": false, "permissions:read": false, "permissions:update": false, "overview:read": true, "monitoring_issues:create": false, "monitoring_issues:list": true, "monitoring_issues:read": true, "monitoring_issues:update": false, "monitoring_issues:delete": false, "monitoring_issues:close": false, "monitoring_issues:history": true, "monitoring_audit:create": true, "monitoring_audit:read": true, "monitoring_audit:update": true, "monitoring_audit:delete": false, "drug_shipments:create": false, "drug_shipments:list": false, "drug_shipments:read": false, "drug_shipments:update": false, "drug_shipments:delete": false, "materials:create": false, "materials:list": false, "materials:read": false, "materials:update": false, "materials:delete": false, "subject_pds:create": false, "subject_pds:list": true, "subject_pds:read": true, "subject_pds:update": false, "audit_logs:list": false, "audit_logs:read": false, "audit_logs:export": false, "knowledge_notes:create": true, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": true, "knowledge_notes:delete": false, "subject_history:list": true, "subject_history:read": true, "subject_history:timeline": true, "subject_history:export": false, "subject_history:search": true, "milestones:list": true, "milestones:update": false, "attachments:create": true, "attachments:read": true, "attachments:update": false, "attachments:delete": false, "fees_attachments:create": false, "fees_attachments:read": true, "fees_attachments:delete": false, "faq:create": false, "faq:read": true, "faq:update": false, "faq:delete": false, "faq_category:create": false, "faq_category:read": true, "faq_category:update": false, "faq_category:delete": false, "faq_reply:create": true, "faq_reply:delete": false, "dashboard:read": true, "subject_histories:create": false, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": false, "subject_histories:delete": false, "material_equipments:create": false, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": false, "material_equipments:delete": false, "documents:create": false, "documents:read": true, "documents:update": false, "documents:delete": false}}',
+            '{"PV": {"subjects:create": false, "subjects:list": true, "subjects:read": true, "subjects:update": false, "subjects:delete": false, "visits:create": false, "visits:list": true, "visits:read": true, "visits:update": false, "visits:delete": false, "risk_issues:create": true, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": true, "risk_issues:delete": false, "finance_contracts:create": false, "finance_contracts:list": false, "finance_contracts:read": false, "finance_contracts:update": false, "finance_contracts:delete": false, "fees_contracts:create": false, "fees_contracts:list": false, "fees_contracts:read": false, "fees_contracts:update": false, "fees_contracts:delete": false, "fees_payments:create": false, "fees_payments:update": false, "fees_payments:delete": false, "project_members:create": false, "project_members:list": false, "project_members:candidates": false, "project_members:update": false, "project_members:delete": false, "sites:create": false, "sites:list": true, "sites:read": true, "sites:update": false, "sites:delete": false, "ethics:create": false, "ethics:list": true, "ethics:read": true, "ethics:update": false, "ethics:delete": false, "feasibility:create": false, "feasibility:list": true, "feasibility:read": true, "feasibility:update": false, "feasibility:delete": false, "permissions:read": false, "permissions:update": false, "overview:read": true, "monitoring_issues:create": false, "monitoring_issues:list": true, "monitoring_issues:read": true, "monitoring_issues:update": false, "monitoring_issues:delete": false, "drug_shipments:create": false, "drug_shipments:list": false, "drug_shipments:read": false, "drug_shipments:update": false, "drug_shipments:delete": false, "materials:create": false, "materials:list": false, "materials:read": false, "materials:update": false, "materials:delete": false, "subject_pds:create": false, "subject_pds:list": true, "subject_pds:read": true, "subject_pds:update": false, "audit_logs:list": false, "audit_logs:read": false, "audit_logs:export": false, "knowledge_notes:create": true, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": true, "knowledge_notes:delete": false, "subject_history:list": true, "subject_history:read": true, "subject_history:timeline": true, "subject_history:export": false, "subject_history:search": true, "milestones:list": true, "milestones:update": false, "attachments:create": true, "attachments:read": true, "attachments:update": false, "attachments:delete": false, "fees_attachments:create": false, "fees_attachments:read": true, "fees_attachments:delete": false, "faq:create": false, "faq:read": true, "faq:update": false, "faq:delete": false, "faq_category:create": false, "faq_category:read": true, "faq_category:update": false, "faq_category:delete": false, "faq_reply:create": true, "faq_reply:delete": false, "subject_histories:create": false, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": false, "subject_histories:delete": false, "material_equipments:create": false, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": false, "material_equipments:delete": false, "documents:create": false, "documents:read": true, "documents:update": false, "documents:delete": false}}',
         ),
         (
             "b43d06e4-2ee2-4e80-b733-85964d738f40",
@@ -116,7 +116,7 @@ def _insert_system_templates() -> None:
             "负责医学审核与稽查，关注质量风险、合规性和医学一致性。",
             "MEDICAL_REVIEW",
             "MEDICAL_REVIEW",
-            '{"MEDICAL_REVIEW": {"subjects:create": false, "subjects:list": true, "subjects:read": true, "subjects:update": false, "subjects:delete": false, "visits:create": false, "visits:list": true, "visits:read": true, "visits:update": false, "visits:delete": false, "risk_issues:create": true, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": true, "risk_issues:delete": false, "finance_contracts:create": false, "finance_contracts:list": false, "finance_contracts:read": false, "finance_contracts:update": false, "finance_contracts:delete": false, "fees_contracts:create": false, "fees_contracts:list": false, "fees_contracts:read": false, "fees_contracts:update": false, "fees_contracts:delete": false, "fees_payments:create": false, "fees_payments:update": false, "fees_payments:delete": false, "project_members:create": false, "project_members:list": false, "project_members:candidates": false, "project_members:update": false, "project_members:delete": false, "sites:create": false, "sites:list": true, "sites:read": true, "sites:update": false, "sites:delete": false, "ethics:create": false, "ethics:list": true, "ethics:read": true, "ethics:update": false, "ethics:delete": false, "feasibility:create": false, "feasibility:list": true, "feasibility:read": true, "feasibility:update": false, "feasibility:delete": false, "budget:create": false, "budget:list": false, "budget:read": false, "budget:update": false, "budget:delete": false, "timeline:create": false, "timeline:list": false, "timeline:read": false, "timeline:update": false, "timeline:delete": false, "permissions:read": false, "permissions:update": false, "overview:read": true, "monitoring_issues:create": false, "monitoring_issues:list": true, "monitoring_issues:read": true, "monitoring_issues:update": false, "monitoring_issues:delete": false, "monitoring_issues:close": false, "monitoring_issues:history": true, "monitoring_audit:create": true, "monitoring_audit:read": true, "monitoring_audit:update": true, "monitoring_audit:delete": false, "drug_shipments:create": false, "drug_shipments:list": false, "drug_shipments:read": false, "drug_shipments:update": false, "drug_shipments:delete": false, "materials:create": false, "materials:list": false, "materials:read": false, "materials:update": false, "materials:delete": false, "subject_pds:create": false, "subject_pds:list": true, "subject_pds:read": true, "subject_pds:update": false, "audit_logs:list": false, "audit_logs:read": false, "audit_logs:export": false, "knowledge_notes:create": true, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": true, "knowledge_notes:delete": false, "subject_history:list": true, "subject_history:read": true, "subject_history:timeline": true, "subject_history:export": false, "subject_history:search": true, "milestones:list": true, "milestones:update": false, "attachments:create": false, "attachments:read": true, "attachments:update": false, "attachments:delete": false, "fees_attachments:create": false, "fees_attachments:read": false, "fees_attachments:delete": false, "faq:create": false, "faq:read": true, "faq:update": false, "faq:delete": false, "faq_category:create": false, "faq_category:read": true, "faq_category:update": false, "faq_category:delete": false, "faq_reply:create": true, "faq_reply:delete": false, "dashboard:read": true, "subject_histories:create": false, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": false, "subject_histories:delete": false, "material_equipments:create": false, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": false, "material_equipments:delete": false, "documents:create": false, "documents:read": true, "documents:update": false, "documents:delete": false}}',
+            '{"MEDICAL_REVIEW": {"subjects:create": false, "subjects:list": true, "subjects:read": true, "subjects:update": false, "subjects:delete": false, "visits:create": false, "visits:list": true, "visits:read": true, "visits:update": false, "visits:delete": false, "risk_issues:create": true, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": true, "risk_issues:delete": false, "finance_contracts:create": false, "finance_contracts:list": false, "finance_contracts:read": false, "finance_contracts:update": false, "finance_contracts:delete": false, "fees_contracts:create": false, "fees_contracts:list": false, "fees_contracts:read": false, "fees_contracts:update": false, "fees_contracts:delete": false, "fees_payments:create": false, "fees_payments:update": false, "fees_payments:delete": false, "project_members:create": false, "project_members:list": false, "project_members:candidates": false, "project_members:update": false, "project_members:delete": false, "sites:create": false, "sites:list": true, "sites:read": true, "sites:update": false, "sites:delete": false, "ethics:create": false, "ethics:list": true, "ethics:read": true, "ethics:update": false, "ethics:delete": false, "feasibility:create": false, "feasibility:list": true, "feasibility:read": true, "feasibility:update": false, "feasibility:delete": false, "permissions:read": false, "permissions:update": false, "overview:read": true, "monitoring_issues:create": false, "monitoring_issues:list": true, "monitoring_issues:read": true, "monitoring_issues:update": false, "monitoring_issues:delete": false, "drug_shipments:create": false, "drug_shipments:list": false, "drug_shipments:read": false, "drug_shipments:update": false, "drug_shipments:delete": false, "materials:create": false, "materials:list": false, "materials:read": false, "materials:update": false, "materials:delete": false, "subject_pds:create": false, "subject_pds:list": true, "subject_pds:read": true, "subject_pds:update": false, "audit_logs:list": false, "audit_logs:read": false, "audit_logs:export": false, "knowledge_notes:create": true, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": true, "knowledge_notes:delete": false, "subject_history:list": true, "subject_history:read": true, "subject_history:timeline": true, "subject_history:export": false, "subject_history:search": true, "milestones:list": true, "milestones:update": false, "attachments:create": false, "attachments:read": true, "attachments:update": false, "attachments:delete": false, "fees_attachments:create": false, "fees_attachments:read": false, "fees_attachments:delete": false, "faq:create": false, "faq:read": true, "faq:update": false, "faq:delete": false, "faq_category:create": false, "faq_category:read": true, "faq_category:update": false, "faq_category:delete": false, "faq_reply:create": true, "faq_reply:delete": false, "subject_histories:create": false, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": false, "subject_histories:delete": false, "material_equipments:create": false, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": false, "material_equipments:delete": false, "documents:create": false, "documents:read": true, "documents:update": false, "documents:delete": false}}',
         ),
         (
             "1e38cffb-a7f2-4243-a31c-1a4f8ce66a05",
@@ -124,7 +124,7 @@ def _insert_system_templates() -> None:
             "负责合同、药品及相关项目事务管理，保障执行支持与物资协同。",
             "IMP",
             "IMP",
-            '{"IMP": {"subjects:create": false, "subjects:list": true, "subjects:read": true, "subjects:update": false, "subjects:delete": false, "visits:create": false, "visits:list": true, "visits:read": true, "visits:update": false, "visits:delete": false, "risk_issues:create": false, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": false, "risk_issues:delete": false, "finance_contracts:create": false, "finance_contracts:list": true, "finance_contracts:read": true, "finance_contracts:update": false, "finance_contracts:delete": false, "fees_contracts:create": false, "fees_contracts:list": true, "fees_contracts:read": true, "fees_contracts:update": false, "fees_contracts:delete": false, "fees_payments:create": false, "fees_payments:update": false, "fees_payments:delete": false, "project_members:create": false, "project_members:list": false, "project_members:candidates": false, "project_members:update": false, "project_members:delete": false, "sites:create": false, "sites:list": true, "sites:read": true, "sites:update": false, "sites:delete": false, "ethics:create": false, "ethics:list": false, "ethics:read": false, "ethics:update": false, "ethics:delete": false, "feasibility:create": false, "feasibility:list": false, "feasibility:read": false, "feasibility:update": false, "feasibility:delete": false, "budget:create": false, "budget:list": true, "budget:read": true, "budget:update": false, "budget:delete": false, "timeline:create": false, "timeline:list": false, "timeline:read": false, "timeline:update": false, "timeline:delete": false, "permissions:read": false, "permissions:update": false, "overview:read": true, "monitoring_issues:create": false, "monitoring_issues:list": false, "monitoring_issues:read": false, "monitoring_issues:update": false, "monitoring_issues:delete": false, "monitoring_issues:close": false, "monitoring_issues:history": false, "monitoring_audit:create": false, "monitoring_audit:read": false, "monitoring_audit:update": false, "monitoring_audit:delete": false, "drug_shipments:create": true, "drug_shipments:list": true, "drug_shipments:read": true, "drug_shipments:update": true, "drug_shipments:delete": false, "materials:create": true, "materials:list": true, "materials:read": true, "materials:update": true, "materials:delete": false, "subject_pds:create": false, "subject_pds:list": false, "subject_pds:read": false, "subject_pds:update": false, "audit_logs:list": false, "audit_logs:read": false, "audit_logs:export": false, "knowledge_notes:create": false, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": false, "knowledge_notes:delete": false, "subject_history:list": false, "subject_history:read": false, "subject_history:timeline": false, "subject_history:export": false, "subject_history:search": false, "milestones:list": true, "milestones:update": false, "attachments:create": false, "attachments:read": true, "attachments:update": false, "attachments:delete": false, "fees_attachments:create": false, "fees_attachments:read": false, "fees_attachments:delete": false, "faq:create": false, "faq:read": true, "faq:update": false, "faq:delete": false, "faq_category:create": false, "faq_category:read": true, "faq_category:update": false, "faq_category:delete": false, "faq_reply:create": false, "faq_reply:delete": false, "dashboard:read": true, "subject_histories:create": false, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": false, "subject_histories:delete": false, "material_equipments:create": false, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": false, "material_equipments:delete": false, "documents:create": false, "documents:read": true, "documents:update": false, "documents:delete": false}}',
+            '{"IMP": {"subjects:create": false, "subjects:list": true, "subjects:read": true, "subjects:update": false, "subjects:delete": false, "visits:create": false, "visits:list": true, "visits:read": true, "visits:update": false, "visits:delete": false, "risk_issues:create": false, "risk_issues:list": true, "risk_issues:read": true, "risk_issues:update": false, "risk_issues:delete": false, "finance_contracts:create": false, "finance_contracts:list": true, "finance_contracts:read": true, "finance_contracts:update": false, "finance_contracts:delete": false, "fees_contracts:create": false, "fees_contracts:list": true, "fees_contracts:read": true, "fees_contracts:update": false, "fees_contracts:delete": false, "fees_payments:create": false, "fees_payments:update": false, "fees_payments:delete": false, "project_members:create": false, "project_members:list": false, "project_members:candidates": false, "project_members:update": false, "project_members:delete": false, "sites:create": false, "sites:list": true, "sites:read": true, "sites:update": false, "sites:delete": false, "ethics:create": false, "ethics:list": false, "ethics:read": false, "ethics:update": false, "ethics:delete": false, "feasibility:create": false, "feasibility:list": false, "feasibility:read": false, "feasibility:update": false, "feasibility:delete": false, "permissions:read": false, "permissions:update": false, "overview:read": true, "monitoring_issues:create": false, "monitoring_issues:list": false, "monitoring_issues:read": false, "monitoring_issues:update": false, "monitoring_issues:delete": false, "drug_shipments:create": true, "drug_shipments:list": true, "drug_shipments:read": true, "drug_shipments:update": true, "drug_shipments:delete": false, "materials:create": true, "materials:list": true, "materials:read": true, "materials:update": true, "materials:delete": false, "subject_pds:create": false, "subject_pds:list": false, "subject_pds:read": false, "subject_pds:update": false, "audit_logs:list": false, "audit_logs:read": false, "audit_logs:export": false, "knowledge_notes:create": false, "knowledge_notes:list": true, "knowledge_notes:read": true, "knowledge_notes:update": false, "knowledge_notes:delete": false, "subject_history:list": false, "subject_history:read": false, "subject_history:timeline": false, "subject_history:export": false, "subject_history:search": false, "milestones:list": true, "milestones:update": false, "attachments:create": false, "attachments:read": true, "attachments:update": false, "attachments:delete": false, "fees_attachments:create": false, "fees_attachments:read": false, "fees_attachments:delete": false, "faq:create": false, "faq:read": true, "faq:update": false, "faq:delete": false, "faq_category:create": false, "faq_category:read": true, "faq_category:update": false, "faq_category:delete": false, "faq_reply:create": false, "faq_reply:delete": false, "subject_histories:create": false, "subject_histories:list": true, "subject_histories:read": true, "subject_histories:update": false, "subject_histories:delete": false, "material_equipments:create": false, "material_equipments:list": true, "material_equipments:read": true, "material_equipments:update": false, "material_equipments:delete": false, "documents:create": false, "documents:read": true, "documents:update": false, "documents:delete": false}}',
         ),
     ]
 

backend/alembic/versions/20260521_01_remove_qa_role.py

@@ -1,4 +1,4 @@
-"""remove qa role
+"""remove legacy qa role
 
 Revision ID: 20260521_01
 Revises: 20260520_01
@@ -110,7 +110,7 @@ def upgrade() -> None:
         """
     )
 
-    # Delete QA users after dependent project-role and audit rows have been removed.
+    # Delete legacy QA users after dependent project-role and audit rows have been removed.
     op.execute("DELETE FROM users WHERE id IN (SELECT id FROM qa_user_ids)")
     op.execute("DROP TABLE qa_user_ids")
 
@@ -134,7 +134,7 @@ def upgrade() -> None:
 
 
 def downgrade() -> None:
-    allowed = ", ".join(f"'{role}'" for role in (*USER_ROLE_VALUES, "QA"))
+    allowed = ", ".join(f"'{role}'" for role in USER_ROLE_VALUES)
     op.execute(
         """
         ALTER TABLE users

backend/alembic/versions/20260526_01_remove_stale_subject_history_permissions.py

@@ -0,0 +1,90 @@
+"""remove stale unused permissions
+
+Revision ID: 20260526_01
+Revises: 20260522_01
+Create Date: 2026-05-26 15:40:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+
+revision: str = "20260526_01"
+down_revision: Union[str, None] = "20260522_01"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+LEGACY_MONITORING_AUDIT_PREFIX = "monitoring" + "_audit"
+MONITORING_ISSUE_PREFIX = "monitoring" + "_issues"
+
+STALE_PERMISSION_KEYS = (
+    "subject_history:list",
+    "subject_history:read",
+    "subject_history:timeline",
+    "subject_history:export",
+    "subject_history:search",
+    "subject_pds:read",
+    "visits:read",
+    "risk_issues:create",
+    "risk_issues:list",
+    "risk_issues:read",
+    "risk_issues:update",
+    "risk_issues:delete",
+    "risk_issue_aes:list",
+    "risk_issue_pds:list",
+    f"{MONITORING_ISSUE_PREFIX}:close",
+    f"{MONITORING_ISSUE_PREFIX}:history",
+    f"{LEGACY_MONITORING_AUDIT_PREFIX}:create",
+    f"{LEGACY_MONITORING_AUDIT_PREFIX}:read",
+    f"{LEGACY_MONITORING_AUDIT_PREFIX}:update",
+    f"{LEGACY_MONITORING_AUDIT_PREFIX}:delete",
+)
+
+
+def _quoted_keys() -> str:
+    return ", ".join(f"'{key}'" for key in STALE_PERMISSION_KEYS)
+
+
+def upgrade() -> None:
+    op.execute(
+        f"""
+        DELETE FROM api_endpoint_permissions
+        WHERE endpoint_key IN ({_quoted_keys()})
+        """
+    )
+    op.execute(
+        f"""
+        UPDATE permission_templates
+        SET permissions = (
+            SELECT jsonb_object_agg(role_key, role_permissions - ARRAY[{_quoted_keys()}])
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+        ),
+            updated_at = NOW()
+        WHERE EXISTS (
+            SELECT 1
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+            WHERE role_permissions ?| ARRAY[{_quoted_keys()}]
+        )
+        """
+    )
+    op.execute(
+        f"""
+        UPDATE permission_template_versions
+        SET permissions = (
+            SELECT jsonb_object_agg(role_key, role_permissions - ARRAY[{_quoted_keys()}])
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+        )
+        WHERE EXISTS (
+            SELECT 1
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+            WHERE role_permissions ?| ARRAY[{_quoted_keys()}]
+        )
+        """
+    )
+
+
+def downgrade() -> None:
+    pass

backend/alembic/versions/20260527_01_rename_project_roles_qa_cta.py

@@ -0,0 +1,149 @@
+"""rename project roles to qa and cta
+
+Revision ID: 20260527_01
+Revises: 20260526_01
+Create Date: 2026-05-27 08:45:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+
+
+revision: str = "20260527_01"
+down_revision: Union[str, None] = "20260526_01"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def _replace_role_values(table: str, column: str) -> None:
+    op.execute(f"UPDATE {table} SET {column} = 'QA' WHERE {column} = 'MEDICAL_REVIEW'")
+    op.execute(f"UPDATE {table} SET {column} = 'CTA' WHERE {column} = 'IMP'")
+
+
+def _restore_role_values(table: str, column: str) -> None:
+    op.execute(f"UPDATE {table} SET {column} = 'MEDICAL_REVIEW' WHERE {column} = 'QA'")
+    op.execute(f"UPDATE {table} SET {column} = 'IMP' WHERE {column} = 'CTA'")
+
+
+def _normalize_role_array(table: str, column: str) -> None:
+    op.execute(
+        f"""
+        UPDATE {table}
+        SET {column} = (
+            SELECT COALESCE(json_agg(DISTINCT mapped_role), '[]'::json)
+            FROM (
+                SELECT CASE role
+                    WHEN 'MEDICAL_REVIEW' THEN 'QA'
+                    WHEN 'IMP' THEN 'CTA'
+                    ELSE role
+                END AS mapped_role
+                FROM json_array_elements_text({column}) AS role
+            ) mapped
+        )
+        WHERE {column}::text LIKE '%MEDICAL_REVIEW%'
+           OR {column}::text LIKE '%IMP%'
+        """
+    )
+
+
+def _normalize_permission_template_roles(table: str) -> None:
+    op.execute(
+        f"""
+        UPDATE {table}
+        SET permissions = (
+            SELECT jsonb_object_agg(
+                CASE role_key
+                    WHEN 'MEDICAL_REVIEW' THEN 'QA'
+                    WHEN 'IMP' THEN 'CTA'
+                    ELSE role_key
+                END,
+                role_permissions
+            )
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+        )
+        WHERE permissions::jsonb ? 'MEDICAL_REVIEW'
+           OR permissions::jsonb ? 'IMP'
+        """
+    )
+
+
+def _normalize_recommended_roles() -> None:
+    op.execute(
+        """
+        UPDATE permission_templates
+        SET recommended_roles = regexp_replace(
+            regexp_replace(recommended_roles, '(^|,)MEDICAL_REVIEW(,|$)', '\\1QA\\2', 'g'),
+            '(^|,)IMP(,|$)', '\\1CTA\\2', 'g'
+        )
+        WHERE recommended_roles ~ '(^|,)(MEDICAL_REVIEW|IMP)(,|$)'
+        """
+    )
+
+
+def _restore_permission_template_roles(table: str) -> None:
+    op.execute(
+        f"""
+        UPDATE {table}
+        SET permissions = (
+            SELECT jsonb_object_agg(
+                CASE role_key
+                    WHEN 'QA' THEN 'MEDICAL_REVIEW'
+                    WHEN 'CTA' THEN 'IMP'
+                    ELSE role_key
+                END,
+                role_permissions
+            )
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+        )
+        WHERE permissions::jsonb ? 'QA'
+           OR permissions::jsonb ? 'CTA'
+        """
+    )
+
+
+def _replace_role_enum_values() -> None:
+    op.execute("ALTER TYPE user_role ADD VALUE IF NOT EXISTS 'QA'")
+    op.execute("ALTER TYPE user_role ADD VALUE IF NOT EXISTS 'CTA'")
+    op.execute(
+        """
+        ALTER TABLE users
+        ALTER COLUMN role TYPE text
+        USING role::text
+        """
+    )
+    _replace_role_values("users", "role")
+    op.execute("DROP TYPE user_role")
+    op.execute("CREATE TYPE user_role AS ENUM ('ADMIN', 'PM', 'CRA', 'PV', 'QA', 'CTA')")
+    op.execute(
+        """
+        ALTER TABLE users
+        ALTER COLUMN role TYPE user_role
+        USING role::user_role
+        """
+    )
+
+
+def upgrade() -> None:
+    _replace_role_enum_values()
+    _replace_role_values("study_members", "role_in_study")
+    _replace_role_values("api_endpoint_permissions", "role")
+    _replace_role_values("permission_access_logs", "role")
+    _replace_role_values("audit_logs", "operator_role")
+    _replace_role_values("permission_templates", "category")
+    _normalize_recommended_roles()
+    _normalize_role_array("studies", "active_roles")
+    _normalize_permission_template_roles("permission_templates")
+    _normalize_permission_template_roles("permission_template_versions")
+
+
+def downgrade() -> None:
+    _restore_role_values("study_members", "role_in_study")
+    _restore_role_values("api_endpoint_permissions", "role")
+    _restore_role_values("permission_access_logs", "role")
+    _restore_role_values("audit_logs", "operator_role")
+    _restore_role_values("permission_templates", "category")
+    _restore_role_values("permission_templates", "recommended_roles")
+    _restore_permission_template_roles("permission_templates")
+    _restore_permission_template_roles("permission_template_versions")

backend/alembic/versions/20260527_04_remove_stale_startup_permissions.py

@@ -0,0 +1,81 @@
+"""remove stale startup permissions
+
+Revision ID: 20260527_04
+Revises: 20260527_03
+Create Date: 2026-05-27 11:05:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "20260527_04"
+down_revision: Union[str, None] = "20260527_03"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+STALE_STARTUP_PERMISSION_KEYS = (
+    "budget:create",
+    "budget:list",
+    "budget:read",
+    "budget:update",
+    "budget:delete",
+    "timeline:create",
+    "timeline:list",
+    "timeline:read",
+    "timeline:update",
+    "timeline:delete",
+)
+
+
+def _quoted_keys() -> str:
+    return ", ".join(f"'{key}'" for key in STALE_STARTUP_PERMISSION_KEYS)
+
+
+def _table_exists(inspector: sa.Inspector, table_name: str) -> bool:
+    return table_name in inspector.get_table_names()
+
+
+def _remove_template_permission_keys(table_name: str, *, touch_updated_at: bool = False) -> None:
+    updated_at_assignment = ", updated_at = NOW()" if touch_updated_at else ""
+    op.execute(
+        f"""
+        UPDATE {table_name}
+        SET permissions = (
+            SELECT jsonb_object_agg(role_key, role_permissions - ARRAY[{_quoted_keys()}])
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+        ){updated_at_assignment}
+        WHERE EXISTS (
+            SELECT 1
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+            WHERE role_permissions ?| ARRAY[{_quoted_keys()}]
+        )
+        """
+    )
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    if _table_exists(inspector, "api_endpoint_permissions"):
+        op.execute(
+            f"""
+            DELETE FROM api_endpoint_permissions
+            WHERE endpoint_key IN ({_quoted_keys()})
+            """
+        )
+
+    if _table_exists(inspector, "permission_templates"):
+        _remove_template_permission_keys("permission_templates", touch_updated_at=True)
+
+    if _table_exists(inspector, "permission_template_versions"):
+        _remove_template_permission_keys("permission_template_versions")
+
+
+def downgrade() -> None:
+    pass

backend/alembic/versions/20260527_05_remove_legacy_startup_ethics_permission_keys.py

@@ -0,0 +1,81 @@
+"""remove legacy startup ethics permission keys
+
+Revision ID: 20260527_05
+Revises: 20260527_04
+Create Date: 2026-05-27 11:20:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "20260527_05"
+down_revision: Union[str, None] = "20260527_04"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+LEGACY_STARTUP_ETHICS_PERMISSION_KEYS = (
+    "feasibility:create",
+    "feasibility:list",
+    "feasibility:read",
+    "feasibility:update",
+    "feasibility:delete",
+    "ethics:create",
+    "ethics:list",
+    "ethics:read",
+    "ethics:update",
+    "ethics:delete",
+)
+
+
+def _quoted_keys() -> str:
+    return ", ".join(f"'{key}'" for key in LEGACY_STARTUP_ETHICS_PERMISSION_KEYS)
+
+
+def _table_exists(inspector: sa.Inspector, table_name: str) -> bool:
+    return table_name in inspector.get_table_names()
+
+
+def _remove_template_permission_keys(table_name: str, *, touch_updated_at: bool = False) -> None:
+    updated_at_assignment = ", updated_at = NOW()" if touch_updated_at else ""
+    op.execute(
+        f"""
+        UPDATE {table_name}
+        SET permissions = (
+            SELECT jsonb_object_agg(role_key, role_permissions - ARRAY[{_quoted_keys()}])
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+        ){updated_at_assignment}
+        WHERE EXISTS (
+            SELECT 1
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+            WHERE role_permissions ?| ARRAY[{_quoted_keys()}]
+        )
+        """
+    )
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    if _table_exists(inspector, "api_endpoint_permissions"):
+        op.execute(
+            f"""
+            DELETE FROM api_endpoint_permissions
+            WHERE endpoint_key IN ({_quoted_keys()})
+            """
+        )
+
+    if _table_exists(inspector, "permission_templates"):
+        _remove_template_permission_keys("permission_templates", touch_updated_at=True)
+
+    if _table_exists(inspector, "permission_template_versions"):
+        _remove_template_permission_keys("permission_template_versions")
+
+
+def downgrade() -> None:
+    pass

backend/alembic/versions/20260527_06_remove_dashboard_permission.py

@@ -0,0 +1,70 @@
+"""remove dashboard permission
+
+Revision ID: 20260527_06
+Revises: 20260527_05
+Create Date: 2026-05-27 16:05:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "20260527_06"
+down_revision: Union[str, None] = "20260527_05"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+LEGACY_DASHBOARD_PERMISSION_KEYS = ("dashboard:read",)
+
+
+def _quoted_keys() -> str:
+    return ", ".join(f"'{key}'" for key in LEGACY_DASHBOARD_PERMISSION_KEYS)
+
+
+def _table_exists(inspector: sa.Inspector, table_name: str) -> bool:
+    return table_name in inspector.get_table_names()
+
+
+def _remove_template_permission_keys(table_name: str, *, touch_updated_at: bool = False) -> None:
+    updated_at_assignment = ", updated_at = NOW()" if touch_updated_at else ""
+    op.execute(
+        f"""
+        UPDATE {table_name}
+        SET permissions = (
+            SELECT jsonb_object_agg(role_key, role_permissions - ARRAY[{_quoted_keys()}])
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+        ){updated_at_assignment}
+        WHERE EXISTS (
+            SELECT 1
+            FROM jsonb_each(permissions::jsonb) AS role_entries(role_key, role_permissions)
+            WHERE role_permissions ?| ARRAY[{_quoted_keys()}]
+        )
+        """
+    )
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+
+    if _table_exists(inspector, "api_endpoint_permissions"):
+        op.execute(
+            f"""
+            DELETE FROM api_endpoint_permissions
+            WHERE endpoint_key IN ({_quoted_keys()})
+            """
+        )
+
+    if _table_exists(inspector, "permission_templates"):
+        _remove_template_permission_keys("permission_templates", touch_updated_at=True)
+
+    if _table_exists(inspector, "permission_template_versions"):
+        _remove_template_permission_keys("permission_template_versions")
+
+
+def downgrade() -> None:
+    pass