fix(router): check system permissions against target project

backend/app/api/v1/sites.py

@@ -12,7 +12,7 @@ from app.crud import startup as startup_crud
 from app.crud import study as study_crud
 from app.crud import user as user_crud
 from app.schemas.site import SiteCreate, SiteRead, SiteUpdate
-from app.schemas.startup import StartupEthicsCreate, StartupFeasibilityCreate
+from app.schemas.startup import KickoffMeetingCreate, StartupEthicsCreate, StartupFeasibilityCreate
 from app.services.site_contact_display import build_contact_display, parse_contact_user_ids
 
 router = APIRouter()
@@ -58,6 +58,12 @@ async def create_site(
         StartupEthicsCreate(site_id=site.id),
         created_by=getattr(current_user, "id", None),
     )
+    await startup_crud.create_kickoff(
+        db,
+        study_id,
+        KickoffMeetingCreate(site_id=site.id),
+        created_by=getattr(current_user, "id", None),
+    )
     await audit_crud.log_action(
         db,
         study_id=study_id,

backend/tests/test_api_permissions.py

@@ -413,6 +413,17 @@ def test_training_authorization_list_can_filter_by_site_name():
     assert "TrainingAuthorization.site_name == site_name" in crud_source
 
 
+def test_site_creation_initializes_all_startup_baseline_records():
+    """创建中心时应生成启动模块默认记录，但后续手动删除不应依赖列表页重建。"""
+    route_path = Path(__file__).resolve().parents[1] / "app" / "api" / "v1" / "sites.py"
+    source = route_path.read_text()
+
+    assert "StartupFeasibilityCreate(site_id=site.id)" in source
+    assert "StartupEthicsCreate(site_id=site.id)" in source
+    assert "KickoffMeetingCreate(site_id=site.id)" in source
+    assert "await startup_crud.create_kickoff(" in source
+
+
 def test_visit_list_permission_matches_wired_visit_endpoints():
     """访视当前没有详情查询接口，列表接口应只使用 visits:list。"""
     visits_path = Path(__file__).resolve().parents[1] / "app" / "api" / "v1" / "visits.py"

frontend/src/components/Layout.vue

@@ -193,10 +193,12 @@
       
       <el-main class="layout-main">
         <div class="content-wrapper">
-          <router-view v-slot="{ Component }">
-            <div class="ctms-route-shell">
-              <component v-if="Component" :is="Component" />
-            </div>
+          <router-view v-slot="{ Component, route: currentRoute }">
+            <transition name="fade-transform" mode="out-in">
+              <div :key="currentRoute.fullPath" class="ctms-route-shell">
+                <component v-if="Component" :is="Component" />
+              </div>
+            </transition>
           </router-view>
         </div>
       </el-main>
@@ -471,15 +473,15 @@ const onCommand = (cmd: string) => {
   background-color: #2c3e50;
   display: flex;
   flex-direction: column;
-  box-shadow: 0 0 12px rgba(0, 0, 0, 0.08);
+  box-shadow: 4px 0 18px rgba(15, 23, 42, 0.12);
   z-index: 10;
   border-right: none;
-  transition: width 0.18s ease;
+  transition: width 220ms cubic-bezier(0.2, 0.8, 0.2, 1), box-shadow 220ms ease;
   overflow: hidden;
 }
 
 .aside-menu {
-  transition: padding 0.18s ease;
+  transition: padding 220ms cubic-bezier(0.2, 0.8, 0.2, 1);
 }
 
 .layout-aside.collapsed .logo-text {
@@ -503,7 +505,7 @@ const onCommand = (cmd: string) => {
   align-items: center;
   padding: 0 14px;
   background-color: transparent;
-  transition: padding 0.18s ease;
+  transition: padding 220ms cubic-bezier(0.2, 0.8, 0.2, 1);
 }
 
 .logo-icon {
@@ -512,7 +514,7 @@ const onCommand = (cmd: string) => {
   background: #ffffff;
   border-radius: 8px;
   margin-right: 12px;
-  box-shadow: 0 4px 10px rgba(0, 0, 0, 0.2);
+  box-shadow: 0 8px 18px rgba(15, 23, 42, 0.26);
 }
 
 .logo-text {
@@ -520,7 +522,7 @@ const onCommand = (cmd: string) => {
   font-size: 18px;
   font-weight: 800;
   letter-spacing: 0.5px;
-  transition: opacity 0.18s ease, transform 0.18s ease;
+  transition: opacity 180ms ease, transform 220ms cubic-bezier(0.2, 0.8, 0.2, 1);
 }
 
 .aside-menu {
@@ -551,18 +553,45 @@ const onCommand = (cmd: string) => {
   margin: 1px 8px;
   border-radius: 7px;
   color: #f1f5f9 !important;
-  transition: var(--ctms-transition);
+  position: relative;
+  overflow: hidden;
+  transform: translateX(0);
+  transition:
+    background-color 180ms ease,
+    color 180ms ease,
+    transform 220ms cubic-bezier(0.2, 0.8, 0.2, 1),
+    box-shadow 180ms ease;
+  will-change: transform;
 }
 
 .layout-aside :deep(.el-menu-item:hover) {
   color: #ffffff !important;
-  background-color: rgba(255, 255, 255, 0.08) !important;
+  background-color: rgba(255, 255, 255, 0.09) !important;
+  transform: translateX(2px);
+}
+
+.layout-aside :deep(.el-menu-item:active) {
+  transform: translateX(1px) scale(0.985);
+}
+
+.layout-aside :deep(.el-menu-item .el-icon),
+.layout-aside :deep(.el-sub-menu__title .el-icon) {
+  transition:
+    color 180ms ease,
+    opacity 180ms ease,
+    transform 220ms cubic-bezier(0.2, 0.8, 0.2, 1);
 }
 
 .layout-aside :deep(.el-menu-item.is-active) {
   color: #ffffff !important;
-  background-color: rgba(255, 255, 255, 0.12) !important;
-  box-shadow: none;
+  background-color: rgba(255, 255, 255, 0.14) !important;
+  box-shadow:
+    inset 0 1px 0 rgba(255, 255, 255, 0.08),
+    0 8px 22px rgba(15, 23, 42, 0.14);
+}
+
+.layout-aside :deep(.el-menu-item.is-active .el-icon) {
+  transform: translateX(1px) scale(1.04);
 }
 
 .layout-aside :deep(.el-menu-item.is-active::before) {
@@ -574,6 +603,22 @@ const onCommand = (cmd: string) => {
   width: 3px;
   background-color: #94b8d1;
   border-radius: 0 4px 4px 0;
+  transform: scaleY(1);
+  transform-origin: center;
+  transition: transform 220ms cubic-bezier(0.2, 0.8, 0.2, 1), opacity 180ms ease;
+}
+
+.layout-aside :deep(.el-menu-item:not(.is-active)::before) {
+  content: "";
+  position: absolute;
+  left: 0;
+  top: 8px;
+  bottom: 8px;
+  width: 3px;
+  background-color: #94b8d1;
+  border-radius: 0 4px 4px 0;
+  opacity: 0;
+  transform: scaleY(0.35);
 }
 
 .layout-aside :deep(.el-sub-menu__title) {
@@ -582,37 +627,69 @@ const onCommand = (cmd: string) => {
   border-radius: 7px;
   height: 34px;
   line-height: 34px;
+  position: relative;
+  overflow: hidden;
+  transform: translateX(0);
+  transition:
+    background-color 180ms ease,
+    color 180ms ease,
+    transform 220ms cubic-bezier(0.2, 0.8, 0.2, 1),
+    box-shadow 180ms ease;
 }
 
 .layout-aside :deep(.el-sub-menu__title:hover) {
   color: #ffffff !important;
-  background-color: rgba(255, 255, 255, 0.08) !important;
+  background-color: rgba(255, 255, 255, 0.09) !important;
+  transform: translateX(2px);
+}
+
+.layout-aside :deep(.el-sub-menu__title:active) {
+  transform: translateX(1px) scale(0.985);
 }
 
 .layout-aside :deep(.el-sub-menu.is-active .el-sub-menu__title) {
   color: #ffffff !important;
 }
 
+.layout-aside :deep(.el-sub-menu.is-active .el-sub-menu__title .el-icon) {
+  transform: translateX(1px) scale(1.04);
+}
+
+.layout-aside :deep(.el-sub-menu__icon-arrow) {
+  transition: transform 220ms cubic-bezier(0.2, 0.8, 0.2, 1);
+}
+
 .layout-aside :deep(.el-menu--inline) {
   background-color: transparent !important;
-  margin: 0 !important;
+  margin: 2px 0 4px !important;
 }
 
 .layout-aside :deep(.el-menu--inline .el-menu-item) {
   padding-left: 40px !important;
-  margin: 0 10px;
+  margin: 1px 10px;
+  color: rgba(241, 245, 249, 0.88) !important;
+}
+
+.layout-aside :deep(.el-menu--inline .el-menu-item:hover) {
+  color: #ffffff !important;
+}
+
+.layout-aside :deep(.el-menu--inline .el-menu-item.is-active) {
+  color: #ffffff !important;
 }
 
 .layout-header {
-  background-color: #ffffff;
+  background: rgba(255, 255, 255, 0.82);
+  backdrop-filter: blur(12px) saturate(160%);
+  -webkit-backdrop-filter: blur(12px) saturate(160%);
   display: flex;
   align-items: center;
   justify-content: space-between;
-  padding: 0 10px;
-  box-shadow: none;
+  padding: 0 16px;
+  box-shadow: 0 1px 0 rgba(0, 0, 0, 0.04), 0 2px 8px rgba(0, 0, 0, 0.03);
   height: 52px !important;
   z-index: 9;
-  border-bottom: 1px solid #f1f5f9;
+  border-bottom: 1px solid rgba(0, 0, 0, 0.05);
 }
 
 .main-container {
@@ -622,10 +699,10 @@ const onCommand = (cmd: string) => {
 .header-breadcrumb {
   display: flex;
   align-items: center;
-  gap: 6px;
+  gap: 4px;
   color: var(--ctms-text-regular);
   font-size: 13px;
-  margin-left: 14px;
+  margin-left: 16px;
   user-select: none;
 }
 
@@ -677,12 +754,37 @@ const onCommand = (cmd: string) => {
 }
 
 .collapse-btn {
-  border: 1px solid var(--ctms-border-color);
-  color: var(--ctms-text-regular);
+  border: 1px solid rgba(0, 0, 0, 0.08);
+  color: var(--ctms-text-secondary);
+  background: rgba(255, 255, 255, 0.6);
+  width: 32px;
+  height: 32px;
+  padding: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 8px;
+  transition: all 0.2s ease;
+}
+
+.collapse-btn:hover {
+  background: rgba(255, 255, 255, 0.9);
+  border-color: rgba(0, 0, 0, 0.14);
+  color: var(--ctms-text-main);
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.06);
+}
+
+.collapse-btn:active {
+  transform: scale(0.95);
+  background: rgba(0, 0, 0, 0.04);
 }
 
 .collapse-icon {
-  font-size: 18px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 16px;
+  height: 16px;
 }
 
 
@@ -695,37 +797,42 @@ const onCommand = (cmd: string) => {
 .dropdown-trigger.compact {
   display: flex;
   align-items: center;
-  padding: 4px 12px;
-  border-radius: 999px;
-  background: #ffffff;
-  border: 1px solid var(--ctms-border-color);
+  padding: 3px 14px 3px 4px;
+  border-radius: 10px;
+  background: rgba(255, 255, 255, 0.6);
+  border: 1px solid rgba(0, 0, 0, 0.07);
   color: var(--ctms-text-regular);
-  transition: var(--ctms-transition);
-  height: 36px;
+  transition: all 0.2s ease;
+  height: 34px;
+  gap: 6px;
 }
 
 .dropdown-trigger.compact:hover {
-  background: var(--ctms-bg-muted);
-  border-color: var(--ctms-border-color-hover);
+  background: rgba(255, 255, 255, 0.9);
+  border-color: rgba(0, 0, 0, 0.14);
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.06);
 }
 
 .user-avatar-comp {
-  color: var(--ctms-primary) !important;
-  background-color: transparent !important;
-  border-radius: 10px !important;
+  color: #ffffff !important;
+  background-color: var(--ctms-primary) !important;
+  border-radius: 7px !important;
   font-weight: 700;
   flex-shrink: 0;
-  font-size: 14px;
+  font-size: 13px;
+  width: 26px !important;
+  height: 26px !important;
 }
 
 .username {
-  font-size: 14px;
-  font-weight: 600;
-  margin: 0 10px 0 8px;
-  max-width: 150px;
+  font-size: 13px;
+  font-weight: 500;
+  margin: 0 2px;
+  max-width: 140px;
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
+  color: var(--ctms-text-main);
 }
 
 .layout-main {
@@ -743,22 +850,52 @@ const onCommand = (cmd: string) => {
 
 .ctms-route-shell {
   min-height: 100%;
+  transform-origin: top center;
 }
 
 /* 过渡动画 */
 .fade-transform-enter-active,
 .fade-transform-leave-active {
-  transition: all 0.3s;
+  transition:
+    opacity 180ms ease,
+    transform 220ms cubic-bezier(0.2, 0.8, 0.2, 1),
+    filter 180ms ease;
 }
 
 .fade-transform-enter-from {
   opacity: 0;
-  transform: translateX(-15px);
+  filter: blur(3px);
+  transform: translateY(8px) scale(0.995);
 }
 
 .fade-transform-leave-to {
   opacity: 0;
-  transform: translateX(15px);
+  filter: blur(2px);
+  transform: translateY(-4px) scale(0.998);
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .layout-aside,
+  .aside-menu,
+  .aside-logo,
+  .logo-text,
+  .layout-aside :deep(.el-menu-item),
+  .layout-aside :deep(.el-sub-menu__title),
+  .layout-aside :deep(.el-menu-item .el-icon),
+  .layout-aside :deep(.el-sub-menu__title .el-icon),
+  .layout-aside :deep(.el-sub-menu__icon-arrow),
+  .fade-transform-enter-active,
+  .fade-transform-leave-active {
+    transition-duration: 1ms !important;
+  }
+
+  .layout-aside :deep(.el-menu-item:hover),
+  .layout-aside :deep(.el-sub-menu__title:hover),
+  .fade-transform-enter-from,
+  .fade-transform-leave-to {
+    filter: none;
+    transform: none;
+  }
 }
 .breadcrumb-dropdown-menu {
   min-width: 200px;

frontend/src/router.test.ts

@@ -39,7 +39,13 @@ describe("admin project route permissions", () => {
     expect(projectPermissionRoute).toContain("systemPermission: SYSTEM_PERMISSION_PROJECT_CONFIG");
     expect(projectPermissionRoute).not.toContain("requiresProjectPm: true");
     expect(source).toContain("to.meta.systemPermission");
-    expect(source).toContain("hasSystemPermissionAccess(to.meta.systemPermission as string, isAdmin)");
+    expect(source).toContain("hasSystemPermissionAccess(to.meta.systemPermission as string, isAdmin, to)");
+    expect(source).toContain("const targetProjectId = getTargetProjectId(to);");
+    expect(source).toContain('const matchedProject = items.find((study: any) => study.id === targetProjectId);');
+    const targetProjectBranchStart = source.indexOf("if (targetProjectId) {");
+    const targetProjectBranchEnd = source.indexOf("const hasPmProject", targetProjectBranchStart);
+    const targetProjectBranch = source.slice(targetProjectBranchStart, targetProjectBranchEnd);
+    expect(targetProjectBranch).not.toContain("ensureDefaultPmStudy");
   });
 
   it("keeps login landing independent from PM management backend access", () => {

frontend/src/router/index.ts

@@ -4,7 +4,7 @@ import { useStudyStore } from "../store/study";
 import { isSystemAdmin } from "../utils/roles";
 import { isApiPermissionAllowed } from "../utils/apiPermissionValue";
 import { findFirstAccessibleProjectPath, getProjectRoutePermission, hasProjectPermission } from "../utils/projectRoutePermissions";
-import { fetchStudyDetail } from "../api/studies";
+import { fetchStudies, fetchStudyDetail } from "../api/studies";
 import { fetchApiEndpointPermissions } from "../api/projectPermissions";
 import Layout from "../components/Layout.vue";
 import Login from "../views/Login.vue";
@@ -419,16 +419,32 @@ const SYSTEM_PERMISSION_ROLES: Record<string, string[]> = {
   [SYSTEM_PERMISSION_MONITORING_METRICS]: ["ADMIN", "PM"],
 };
 
-const hasSystemPermissionAccess = async (permissionKey: string, isAdmin: boolean) => {
+const getTargetProjectId = (to: any) => {
+  const queryProjectId = typeof to.query?.projectId === "string" ? to.query.projectId : "";
+  const paramProjectId = typeof to.params?.projectId === "string" ? to.params.projectId : "";
+  const paramId = typeof to.params?.id === "string" ? to.params.id : "";
+  return queryProjectId || paramProjectId || paramId;
+};
+
+const hasSystemPermissionAccess = async (permissionKey: string, isAdmin: boolean, to: any) => {
   const roles = SYSTEM_PERMISSION_ROLES[permissionKey] || [];
   if (isAdmin) return roles.includes("ADMIN");
   if (!roles.includes("PM")) return false;
 
   const studyStore = useStudyStore();
-  const hasPmProject = studyStore.currentStudyRole === "PM" || (studyStore.currentStudy as any)?.role_in_study === "PM";
-  if (!hasPmProject) {
-    await studyStore.ensureDefaultPmStudy().catch(() => {});
+  const targetProjectId = getTargetProjectId(to);
+  if (targetProjectId) {
+    if (studyStore.currentStudy?.id === targetProjectId) {
+      return studyStore.currentStudyRole === "PM" || (studyStore.currentStudy as any)?.role_in_study === "PM";
+    }
+    const { data } = await fetchStudies();
+    const items = (data as any).items || [];
+    const matchedProject = items.find((study: any) => study.id === targetProjectId);
+    return matchedProject?.role_in_study === "PM";
   }
+
+  const hasPmProject = studyStore.currentStudyRole === "PM" || (studyStore.currentStudy as any)?.role_in_study === "PM";
+  if (!hasPmProject) await studyStore.ensureDefaultPmStudy().catch(() => {});
   return studyStore.currentStudyRole === "PM" || (studyStore.currentStudy as any)?.role_in_study === "PM";
 };
 
@@ -555,7 +571,7 @@ router.beforeEach(async (to, _from, next) => {
     }
   }
   if (to.meta.systemPermission) {
-    const allowed = await hasSystemPermissionAccess(to.meta.systemPermission as string, isAdmin);
+    const allowed = await hasSystemPermissionAccess(to.meta.systemPermission as string, isAdmin, to);
     if (!allowed) {
       next({ path: isAdmin ? "/admin/users" : "/admin/projects" });
       return;

frontend/src/styles/unified-page.css

@@ -2,7 +2,7 @@
   --unified-shell-bg: #ffffff;
   --unified-shell-border: #d8e2ef;
   --unified-shell-divider: #eaf0f8;
-  --unified-shell-radius: 16px;
+  --unified-shell-radius: 8px;
   --unified-shell-padding-x: 16px;
   --unified-shell-padding-y: 10px;
   --unified-title-color: #0f2345;

frontend/src/views/admin/Projects.test.ts

@@ -47,8 +47,8 @@ describe("project management access", () => {
     expect(source).toContain("suppressErrorMessage: true");
     expect(source).toContain("const canProject = (row: Study, module: string, action: \"read\" | \"write\")");
     expect(source).toContain("canProject(scope.row, 'project_members', 'read')");
-    expect(source).toContain("canProject(scope.row, 'project_members', 'write')");
-    expect(source).toContain("canProject(scope.row, 'sites', 'read')");
+    expect(source).toContain("canConfigureProject(scope.row)");
+    expect(source).toContain("canManageProjectBackend(scope.row)");
     expect(source).toContain("canProject(scope.row, 'audit_export', 'read')");
   });
 
@@ -74,13 +74,33 @@ describe("project management access", () => {
     expect(source).not.toContain('fixed="right"');
   });
 
-  it("opens project names in management detail when the user has setup config read permission", () => {
+  it("renders project names as plain text and moves setup configuration to a gear action", () => {
     const source = readProjects();
 
-    expect(source).toContain("v-if=\"canProject(scope.row, 'setup_config', 'read')\"");
-    expect(source).toContain('@click="goProject(scope.row)" class="project-name"');
+    expect(source).not.toContain("<el-link");
+    expect(source).not.toContain('@click="goProject(scope.row)" class="project-name"');
+    expect(source).toContain('<span class="project-name">{{ scope.row.name }}</span>');
+    expect(source).toContain('v-if="canProject(scope.row, \'setup_config\', \'write\')" content="项目配置"');
+    expect(source).toContain(':icon="Setting"');
+    expect(source).toContain('@click="goProject(scope.row)"');
     expect(source).toContain('@click="enterStudy(scope.row)"');
-    expect(source).toContain('if (!canProject(row, "setup_config", "read"))');
+    expect(source).toContain('if (!canProject(row, "setup_config", "write"))');
+  });
+
+  it("shows project permission configuration only for admins and target project PMs", () => {
+    const source = readProjects();
+
+    expect(source).toContain('v-if="canConfigureProject(scope.row)" content="权限管理"');
+    expect(source).toContain("const canConfigureProject = (row: Study) => canManageProjectBackend(row);");
+    expect(source).not.toContain("canProject(scope.row, 'project_members', 'write')");
+  });
+
+  it("shows center management only for admins and target project PMs", () => {
+    const source = readProjects();
+
+    expect(source).toContain('v-if="canManageProjectBackend(scope.row)" :content="TEXT.modules.adminProjects.sites"');
+    expect(source).toContain("const canManageProjectBackend = (row: Study) => isAdmin.value || row.role_in_study === \"PM\";");
+    expect(source).not.toContain("canProject(scope.row, 'sites', 'read')");
   });
 
   it("checks project management actions against the current row role instead of the first permission role", () => {

frontend/src/views/admin/Projects.vue

@@ -74,8 +74,7 @@
                   </svg>
                 </div>
                 <div class="project-info">
-                  <el-link v-if="canProject(scope.row, 'setup_config', 'read')" type="primary" @click="goProject(scope.row)" class="project-name">{{ scope.row.name }}</el-link>
-                  <span v-else class="project-name project-name--disabled">{{ scope.row.name }}</span>
+                  <span class="project-name">{{ scope.row.name }}</span>
                   <span class="project-code">{{ scope.row.code || '-' }}</span>
                 </div>
               </div>
@@ -123,10 +122,13 @@
                 <el-tooltip v-if="canProject(scope.row, 'project_members', 'read')" :content="TEXT.modules.adminProjects.members" placement="top">
                   <el-button link type="primary" :icon="User" class="action-btn" @click="goMembers(scope.row)" />
                 </el-tooltip>
-                <el-tooltip v-if="canProject(scope.row, 'project_members', 'write')" content="权限管理" placement="top">
+                <el-tooltip v-if="canProject(scope.row, 'setup_config', 'write')" content="项目配置" placement="top">
+                  <el-button link type="primary" :icon="Setting" class="action-btn" @click="goProject(scope.row)" />
+                </el-tooltip>
+                <el-tooltip v-if="canConfigureProject(scope.row)" content="权限管理" placement="top">
                   <el-button link type="primary" :icon="Key" class="action-btn" @click="goPermissions(scope.row)" />
                 </el-tooltip>
-                <el-tooltip v-if="canProject(scope.row, 'sites', 'read')" :content="TEXT.modules.adminProjects.sites" placement="top">
+                <el-tooltip v-if="canManageProjectBackend(scope.row)" :content="TEXT.modules.adminProjects.sites" placement="top">
                   <el-button link type="primary" :icon="OfficeBuilding" class="action-btn" @click="goSites(scope.row)" />
                 </el-tooltip>
                 <el-tooltip v-if="canProject(scope.row, 'audit_export', 'read')" :content="TEXT.menu.auditLogs" placement="top">
@@ -155,7 +157,7 @@
 import { computed, onMounted, ref } from "vue";
 import { useRouter } from "vue-router";
 import { ElMessage, ElMessageBox } from "element-plus";
-import { User, OfficeBuilding, ArrowRight, Delete, Lock, Key, Document, Plus } from "@element-plus/icons-vue";
+import { User, OfficeBuilding, ArrowRight, Delete, Lock, Key, Document, Plus, Setting } from "@element-plus/icons-vue";
 import { fetchStudies, deleteStudy, lockStudy } from "../../api/studies";
 import { fetchMyApiEndpointPermissions } from "../../api/projectPermissions";
 import type { ApiEndpointPermissionsResponse, Study } from "../../types/api";
@@ -232,15 +234,26 @@ const canProject = (row: Study, module: string, action: "read" | "write") => {
   return isApiPermissionAllowed(rolePerms[operationKey]);
 };
 
+const canManageProjectBackend = (row: Study) => isAdmin.value || row.role_in_study === "PM";
+const canConfigureProject = (row: Study) => canManageProjectBackend(row);
+
 const goMembers = (row: Study) => {
   router.push(`/admin/permissions/project?projectId=${row.id}&sub=members`);
 };
 
 const goSites = (row: Study) => {
+  if (!canManageProjectBackend(row)) {
+    ElMessage.warning("仅项目 PM 可管理该项目中心");
+    return;
+  }
   router.push(`/admin/projects/${row.id}/sites`);
 };
 
 const goPermissions = (row: Study) => {
+  if (!canConfigureProject(row)) {
+    ElMessage.warning("仅项目 PM 可配置该项目权限");
+    return;
+  }
   router.push(`/admin/permissions/project?projectId=${row.id}`);
 };
 
@@ -342,8 +355,8 @@ const goDetail = (row: Study) => {
 };
 
 const goProject = (row: Study) => {
-  if (!canProject(row, "setup_config", "read")) {
-    ElMessage.warning("当前角色无权访问该项目的立项配置");
+  if (!canProject(row, "setup_config", "write")) {
+    ElMessage.warning("当前角色无权编辑该项目的立项配置");
     return;
   }
   goDetail(row);
@@ -364,7 +377,6 @@ onMounted(() => {
   grid-template-columns: repeat(4, 1fr);
   gap: 12px;
   padding: 16px;
-  border-bottom: 1px solid var(--unified-shell-divider);
 }
 
 .stat-card {
@@ -462,13 +474,6 @@ onMounted(() => {
   font-size: 13px;
 }
 
-.project-name--disabled {
-  font-weight: 600;
-  font-size: 13px;
-  color: var(--ctms-text-secondary);
-  cursor: default;
-}
-
 .project-code {
   font-size: 12px;
   color: var(--ctms-text-secondary);

frontend/src/views/admin/Sites.vue

@@ -9,7 +9,7 @@
       </div>
       <div class="unified-section site-table-section section--flush-x section--flush-top section--flush-bottom">
         <el-table :data="displaySites" v-loading="loading" stripe :row-class-name="siteRowClass" style="width: 100%" class="site-table">
-          <el-table-column prop="name" :label="TEXT.common.fields.siteName" min-width="220">
+          <el-table-column prop="name" :label="TEXT.common.fields.siteName" min-width="140">
             <template #default="scope">
               <div class="site-name-cell">
                 <span>{{ scope.row.name }}</span>
@@ -19,25 +19,25 @@
               </div>
             </template>
           </el-table-column>
-          <el-table-column prop="city" :label="TEXT.common.fields.city" width="100" />
-          <el-table-column prop="pi_name" :label="TEXT.modules.adminSites.piLabel" width="120" />
-          <el-table-column :label="TEXT.common.fields.phone" width="140">
+          <el-table-column prop="city" :label="TEXT.common.fields.city" min-width="80" />
+          <el-table-column prop="pi_name" :label="TEXT.modules.adminSites.piLabel" min-width="100" />
+          <el-table-column :label="TEXT.common.fields.phone" min-width="110">
             <template #default="scope">
               {{ phoneText(scope.row) }}
             </template>
           </el-table-column>
-          <el-table-column prop="contact" :label="TEXT.common.fields.contact" min-width="160">
+          <el-table-column prop="contact" :label="TEXT.common.fields.contact" min-width="120">
             <template #default="scope">
               {{ contactLabel(scope.row) }}
             </template>
           </el-table-column>
-          <el-table-column :label="TEXT.common.fields.status" width="100">
+          <el-table-column :label="TEXT.common.fields.status" min-width="80">
             <template #default="scope">
               <el-tag type="success" v-if="scope.row.is_active">已解锁</el-tag>
               <el-tag type="danger" v-else>已锁定</el-tag>
             </template>
           </el-table-column>
-          <el-table-column :label="TEXT.common.labels.actions" width="200" align="center" class-name="action-column">
+          <el-table-column :label="TEXT.common.labels.actions" min-width="160" align="center" class-name="action-column">
             <template #default="scope">
               <el-button link type="primary" size="small" @click="openEdit(scope.row)">{{ TEXT.common.actions.edit }}</el-button>
               <el-button