清理全局角色残留并修复项目权限判断

backend/app/api/v1/admin_users.py

@@ -3,9 +3,9 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_db_session, require_roles
+from app.core.deps import get_db_session, is_system_admin, require_roles
 from app.crud import user as user_crud
-from app.models.user import User, UserRole, UserStatus
+from app.models.user import User, UserStatus
 from app.schemas.user import AdminUserListResponse, UserAdminReviewRequest, UserResponse
 
 router = APIRouter(prefix="/users")
@@ -15,7 +15,7 @@ router = APIRouter(prefix="/users")
 async def list_users_for_review(
     status_filter: UserStatus = Query(default=UserStatus.PENDING, alias="status"),
     db: AsyncSession = Depends(get_db_session),
-    current_user=Depends(require_roles([UserRole.ADMIN.value])),
+    current_user=Depends(require_roles(["ADMIN"])),
 ) -> AdminUserListResponse:
     users = await user_crud.list_users_by_status(db, status=status_filter)
     return AdminUserListResponse(items=list(users), total=len(users))
@@ -25,7 +25,7 @@ async def _get_review_user(db: AsyncSession, user_id: uuid.UUID) -> User:
     user = await user_crud.get_by_id(db, user_id)
     if not user:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
-    if user.role == UserRole.ADMIN:
+    if is_system_admin(user):
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="管理员账号不允许审核")
     return user
 
@@ -35,7 +35,7 @@ async def approve_user(
     user_id: uuid.UUID,
     review: UserAdminReviewRequest,
     db: AsyncSession = Depends(get_db_session),
-    current_user=Depends(require_roles([UserRole.ADMIN.value])),
+    current_user=Depends(require_roles(["ADMIN"])),
 ) -> UserResponse:
     if review.action != "approve":
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="非法操作")
@@ -51,7 +51,7 @@ async def reject_user(
     user_id: uuid.UUID,
     review: UserAdminReviewRequest,
     db: AsyncSession = Depends(get_db_session),
-    current_user=Depends(require_roles([UserRole.ADMIN.value])),
+    current_user=Depends(require_roles(["ADMIN"])),
 ) -> UserResponse:
     if review.action not in ("reject", "approve"):
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="非法操作")