清理全局角色残留并修复项目权限判断

backend/app/api/v1/api_permissions.py

@@ -9,7 +9,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles
+from app.core.deps import get_current_user, get_db_session, is_system_admin, require_study_member, require_system_permission
 from app.core.project_permissions import (
     get_api_endpoint_permissions,
     replace_api_endpoint_permissions,
@@ -163,8 +163,7 @@ async def get_my_study_api_permissions(
     db: Annotated[AsyncSession, Depends(get_db_session)] = None,
 ):
     """获取当前用户当前项目角色的有效权限。"""
-    role_value = current_user.role.value if hasattr(current_user.role, "value") else str(current_user.role)
-    if role_value == "ADMIN":
+    if is_system_admin(current_user):
         return {
             "ADMIN": {
                 endpoint_key: {"allowed": True}
@@ -192,7 +191,7 @@ async def get_my_study_api_permissions(
 )
 async def get_study_api_permissions(
     study_id: uuid.UUID,
-    _=Depends(require_study_roles(["PM"])),
+    _=Depends(require_system_permission("system:permissions:project_config")),
     db: Annotated[AsyncSession, Depends(get_db_session)] = None,
 ):
     """获取项目的接口级权限矩阵
@@ -233,7 +232,7 @@ async def get_study_api_permissions(
 async def update_study_api_permissions(
     study_id: uuid.UUID,
     payload: dict[str, dict[str, bool]],
-    _=Depends(require_study_roles(["PM"])),
+    _=Depends(require_system_permission("system:permissions:project_config")),
     current_user=Depends(get_current_user),
     db: Annotated[AsyncSession, Depends(get_db_session)] = None,
 ):
@@ -248,13 +247,12 @@ async def update_study_api_permissions(
     """
     # 验证输入
     configurable_roles = set(await _get_configurable_roles(db, study_id))
-    current_role = current_user.role.value if hasattr(current_user.role, "value") else str(current_user.role)
     for role in payload.keys():
         if role == "ADMIN":
             continue
         if role not in configurable_roles:
             raise ValueError(f"无效的角色: {role}")
-        if role == "PM" and current_role != "ADMIN":
+        if role == "PM" and not is_system_admin(current_user):
             raise HTTPException(
                 status_code=status.HTTP_403_FORBIDDEN,
                 detail="仅系统管理员可修改项目负责人权限",