清理全局角色残留并修复项目权限判断

backend/app/api/v1/attachments.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status,
 from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, get_study_member, require_study_not_locked
+from app.core.deps import get_current_user, get_db_session, get_operator_role_label, get_study_member, is_system_admin, require_study_not_locked
 from app.core.project_permissions import role_has_api_permission
 from app.crud import attachment as attachment_crud
 from app.crud import audit as audit_crud
@@ -71,10 +71,6 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     return study
 
 
-def _role_value(user) -> str:
-    return user.role.value if hasattr(user.role, "value") else user.role
-
-
 def _attachment_operation(action: str) -> str:
     if action in {"create", "read", "delete"}:
         return action
@@ -154,8 +150,7 @@ async def _ensure_attachment_permission(
     membership=None,
 ) -> None:
     parent_permission = await _resolve_attachment_parent_permission(db, study_id, entity_type, entity_id, action)
-    role_value = _role_value(current_user)
-    if role_value == "ADMIN":
+    if is_system_admin(current_user):
         return
 
     if membership is None:
@@ -238,7 +233,7 @@ async def upload_attachment(
         action="UPLOAD_FILE",
         detail=f"文件已上传：{file.filename}",
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await get_operator_role_label(db, study_id, current_user),
     )
     return AttachmentRead(
         id=attachment.id,
@@ -349,7 +344,7 @@ async def _authorize_global(request: Request, db: AsyncSession, study_id: uuid.U
     user = await user_crud.get_by_id(db, uuid.UUID(str(payload.get("sub"))))
     if not user or not user.is_active:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="账号不存在或已停用")
-    if _role_value(user) == "ADMIN":
+    if is_system_admin(user):
         return user, None
     membership = await member_crud.get_member(db, study_id, user.id)
     if not membership or not membership.is_active:
@@ -429,7 +424,7 @@ async def global_delete_attachment(
         db, attachment.study_id, attachment.entity_type, attachment.entity_id, "delete", user, membership
     )
     can_delete = (
-        _role_value(user) == "ADMIN"
+        is_system_admin(user)
         or attachment.uploaded_by == user.id
         or membership is not None
     )
@@ -444,7 +439,7 @@ async def global_delete_attachment(
         action="DELETE_ATTACHMENT",
         detail=f"文件已删除：{attachment.filename}",
         operator_id=user.id,
-        operator_role=user.role,
+        operator_role=await get_operator_role_label(db, attachment.study_id, user),
     )
 
 
@@ -476,11 +471,11 @@ async def delete_attachment(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
 
     membership = None
-    if _role_value(current_user) != "ADMIN":
+    if not is_system_admin(current_user):
         membership = await get_study_member(study_id, current_user=current_user, db=db)
 
     can_delete = (
-        _role_value(current_user) == "ADMIN"
+        is_system_admin(current_user)
         or attachment.uploaded_by == current_user.id
         or membership is not None
     )
@@ -496,5 +491,5 @@ async def delete_attachment(
         action="DELETE_ATTACHMENT",
         detail=f"文件已删除：{attachment.filename}",
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await get_operator_role_label(db, study_id, current_user),
     )