统一项目角色与接口权限配置

backend/app/core/project_permissions.py

@@ -48,6 +48,9 @@ async def role_has_api_permission(
     check_prerequisites: bool = True,
 ) -> bool:
     """检查角色是否有权访问特定接口"""
+    if endpoint_key not in API_ENDPOINT_PERMISSIONS:
+        return False
+
     if role == "ADMIN":
         return True
 
@@ -129,6 +132,8 @@ async def get_api_endpoint_permissions(
         if role not in matrix:
             matrix[role] = {}
         for endpoint_key, allowed in endpoints.items():
+            if endpoint_key not in API_ENDPOINT_PERMISSIONS:
+                continue
             matrix[role][endpoint_key] = {"allowed": allowed}
 
     return matrix

backend/app/core/rbac.py

@@ -25,7 +25,7 @@ ROLE_ACTIONS: dict[str, set[str]] = {
     "PM": {"view", "create_document", "create_version", "submit", "approve", "distribute", "ack", "delete_document"},
     "CRA": {"view", "create_version", "submit", "ack"},
     "PV": {"view", "create_version", "submit", "ack"},
-    "IMP": {"view", "create_version", "submit", "ack"},
+    "CTA": {"view", "create_version", "submit", "ack"},
 }
 
 

backend/app/models/user.py

@@ -17,8 +17,8 @@ class UserRole(str, enum.Enum):
     PM = "PM"
     CRA = "CRA"
     PV = "PV"
-    MEDICAL_REVIEW = "MEDICAL_REVIEW"
-    IMP = "IMP"
+    QA = "QA"
+    CTA = "CTA"
 
 
 class UserStatus(str, enum.Enum):

backend/app/schemas/project_permission.py

@@ -5,7 +5,7 @@ from typing import Literal
 from pydantic import BaseModel, Field
 
 
-ProjectPermissionRole = Literal["ADMIN", "PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP"]
+ProjectPermissionRole = Literal["ADMIN", "PM", "CRA", "PV", "QA", "CTA"]
 ProjectPermissionAction = Literal["read", "write"]
 
 

backend/app/schemas/user.py

@@ -5,7 +5,7 @@ from typing import Literal, Optional
 
 from pydantic import BaseModel, ConfigDict, EmailStr, Field, field_validator
 
-UserRole = Literal["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "ADMIN"]
+UserRole = Literal["PM", "CRA", "PV", "QA", "CTA", "ADMIN"]
 UserStatus = Literal["PENDING", "ACTIVE", "REJECTED", "DISABLED"]
 
 PASSWORD_REGEX = re.compile(r"^(?=.*[A-Za-z])(?=.*\d).{8,}$")