清理全局角色残留并修复项目权限判断

backend/app/api/v1/audit_logs.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member, require_api_permission
+from app.core.deps import get_operator_role_label, get_current_user, get_db_session, require_roles, require_api_permission
 from app.crud import audit as audit_crud
 from app.schemas.audit import AuditEventCreate, AuditLogRead
 
@@ -57,11 +57,11 @@ async def delete_audit_log(
 @router.post(
     "/events",
     status_code=status.HTTP_201_CREATED,
-    dependencies=[Depends(require_study_member())],
 )
 async def create_audit_event(
     study_id: uuid.UUID,
     payload: AuditEventCreate,
+    _export_permission=Depends(require_api_permission("audit_logs:export")),
     db: AsyncSession = Depends(get_db_session),
     current_user=Depends(get_current_user),
 ):
@@ -76,6 +76,6 @@ async def create_audit_event(
         action=payload.action,
         detail=payload.detail,
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await get_operator_role_label(db, study_id, current_user),
     )
     return {"ok": True}