「权限 × 状态 × 审计」联合约束机制

frontend/src/views/admin/Sites.vue

@@ -63,9 +63,13 @@ import { fetchUsers } from "../../api/users";
 import SiteForm from "./SiteForm.vue";
 import SiteCraBinding from "./SiteCraBinding.vue";
 import type { Site, Study, UserInfo } from "../../types/api";
+import { useAuthStore } from "../../store/auth";
+import { evaluateAction } from "../../guards/actionGuard";
+import { logAudit } from "../../audit";
 
 const route = useRoute();
 const projectId = computed(() => route.params.projectId as string);
+const auth = useAuthStore();
 
 const project = ref<Study | null>(null);
 const sites = ref<Site[]>([]);
@@ -127,6 +131,21 @@ const openBind = (row: Site) => {
 
 const toggleSite = async (row: Site) => {
   if (!projectId.value) return;
+  const decision = evaluateAction({
+    actorRole: auth.user?.role || null,
+    requiredPermission: "site.manage",
+    target: { siteId: row.id, studyId: projectId.value },
+  });
+  if (!decision.allowed) {
+    ElMessage.warning(decision.reason || "无权限执行该操作");
+    logAudit(decision.auditType, {
+      targetId: row.id,
+      targetName: row.name,
+      reason: decision.reason,
+      severity: decision.severity,
+    });
+    return;
+  }
   if (row.is_active) {
     const ok = await ElMessageBox.confirm("该操作将影响中心数据，请确认是否继续", "停用中心", {
       type: "warning",
@@ -138,8 +157,23 @@ const toggleSite = async (row: Site) => {
     await updateSite(projectId.value, row.id, { is_active: !row.is_active });
     ElMessage.success(row.is_active ? "已停用" : "已启用");
     loadSites();
+    logAudit("SITE_STATUS_CHANGED", {
+      targetId: row.id,
+      targetName: row.name,
+      before: { is_active: row.is_active },
+      after: { is_active: !row.is_active },
+      severity: "normal",
+    });
   } catch (e: any) {
     ElMessage.error(e?.response?.data?.message || "操作失败");
+    logAudit("SITE_STATUS_CHANGED", {
+      targetId: row.id,
+      targetName: row.name,
+      before: { is_active: row.is_active },
+      after: { is_active: !row.is_active },
+      severity: "warning",
+      reason: e?.response?.data?.message,
+    });
   }
 };