按业务模块拆分附件权限

backend/app/api/v1/fees_attachments.py

@@ -69,7 +69,7 @@ async def _authorize_download_user(request: Request, db: AsyncSession):
     response_model=FeeApiResponse[FeeAttachmentRead],
     status_code=status.HTTP_201_CREATED,
     dependencies=[
-        Depends(require_api_permission("fees_attachments:create")),
+        Depends(require_api_permission("fees_contracts:update")),
         Depends(require_study_not_locked())
     ],
 )
@@ -139,7 +139,7 @@ async def upload_fee_attachment(
 @router.get(
     "/attachments",
     response_model=FeeApiResponse[list[FeeAttachmentRead]],
-    dependencies=[Depends(require_api_permission("fees_attachments:read"))],
+    dependencies=[Depends(require_api_permission("fees_contracts:read"))],
 )
 async def list_fee_attachments(
     entity_type: str,
@@ -195,7 +195,7 @@ async def download_fee_attachment(
         if not membership or not membership.is_active:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
         allowed = await role_has_api_permission(
-            db, project_id, membership.role_in_study, "fees_attachments:read", check_prerequisites=False
+            db, project_id, membership.role_in_study, "fees_contracts:read", check_prerequisites=False
         )
         if not allowed:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
@@ -213,7 +213,7 @@ async def download_fee_attachment(
     "/attachments/{attachment_id}",
     status_code=status.HTTP_204_NO_CONTENT,
     dependencies=[
-        Depends(require_api_permission("fees_attachments:delete")),
+        Depends(require_api_permission("fees_contracts:update")),
         Depends(require_study_not_locked())
     ],
 )