移除QA预设角色并收紧角色模板编辑

backend/app/services/permission_template_service.py

@@ -7,7 +7,7 @@ from sqlalchemy.orm import selectinload
 
 from app.models.permission_template import PermissionTemplate, PermissionTemplateVersion, TemplateType
 from app.models.api_endpoint_permission import ApiEndpointPermission
-from app.core.api_permissions import API_ENDPOINT_PERMISSIONS
+from app.core.api_permissions import API_ENDPOINT_PERMISSIONS, PROJECT_PERMISSION_ROLES
 from app.schemas.permission_template import PermissionTemplateCreate, PermissionTemplateUpdate
 
 
@@ -21,6 +21,9 @@ class PermissionTemplateService:
         created_by: UUID,
     ) -> PermissionTemplate:
         """创建权限模板"""
+        if payload.template_type != TemplateType.CUSTOM:
+            raise ValueError("只能新增自定义角色")
+
         # 验证权限配置
         await PermissionTemplateService._validate_permissions(payload.permissions)
 
@@ -78,6 +81,11 @@ class PermissionTemplateService:
             query = query.where(PermissionTemplate.template_type == template_type)
         if category:
             query = query.where(PermissionTemplate.category == category)
+        elif template_type == TemplateType.ROLE:
+            query = query.where(
+                (PermissionTemplate.is_system.is_(False))
+                | (PermissionTemplate.category.in_(PROJECT_PERMISSION_ROLES))
+            )
 
         query = query.offset(skip).limit(limit)
         result = await db.execute(query)
@@ -94,9 +102,11 @@ class PermissionTemplateService:
         if not template:
             raise ValueError(f"模板 {template_id} 不存在")
 
-        # 不允许修改系统预设模板
+        # 系统预设模板只允许更新展示元数据，权限配置和分类等结构字段保持受保护。
         if template.is_system:
-            raise ValueError("不允许修改系统预设模板")
+            protected_fields = {"permissions", "tags", "category", "recommended_roles"}
+            if protected_fields.intersection(payload.model_fields_set):
+                raise ValueError("不允许修改系统预设模板")
 
         # 验证权限配置
         if payload.permissions: