清理全局角色残留并修复项目权限判断

backend/app/api/v1/dashboard.py

@@ -3,7 +3,7 @@ from fastapi import APIRouter, Depends
 from sqlalchemy import func, select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_api_permission
+from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, is_system_admin, require_api_permission
 from app.core.project_permissions import role_has_api_permission
 from app.crud import member as member_crud
 from app.models.milestone import Milestone
@@ -16,13 +16,10 @@ from app.crud import overview as overview_crud
 router = APIRouter()
 
 
-def _role_value(user) -> str:
-    return user.role.value if hasattr(user.role, "value") else str(user.role)
-
-
-@router.get("/progress", response_model=StudyProgressRead, dependencies=[Depends(require_study_member())])
+@router.get("/progress", response_model=StudyProgressRead)
 async def get_progress(
     study_id: uuid.UUID,
+    _=Depends(require_api_permission("project_overview:read")),
     db: AsyncSession = Depends(get_db_session),
 ) -> StudyProgressRead:
     milestone_total_stmt = select(func.count()).select_from(Milestone).where(Milestone.study_id == study_id)
@@ -42,10 +39,11 @@ async def get_progress(
     )
 
 
-@router.get("/lost-visits", response_model=list[VisitLostItem], dependencies=[Depends(require_study_member())])
+@router.get("/lost-visits", response_model=list[VisitLostItem])
 async def list_lost_visits(
     study_id: uuid.UUID,
     limit: int = 20,
+    _=Depends(require_api_permission("project_overview:read")),
     db: AsyncSession = Depends(get_db_session),
     current_user=Depends(get_current_user),
 ) -> list[VisitLostItem]:
@@ -68,18 +66,15 @@ async def list_lost_visits(
     return items
 
 
-@router.get("/center-summary", response_model=list[CenterSummaryItem], dependencies=[
-    Depends(require_study_member()),
-    Depends(require_api_permission("project_overview:read"))
-])
+@router.get("/center-summary", response_model=list[CenterSummaryItem])
 async def get_center_summary(
     study_id: uuid.UUID,
+    _=Depends(require_api_permission("project_overview:read")),
     db: AsyncSession = Depends(get_db_session),
     current_user=Depends(get_current_user),
 ) -> list[CenterSummaryItem]:
-    role_value = _role_value(current_user)
     membership = None
-    if role_value != "ADMIN":
+    if not is_system_admin(current_user):
         membership = await member_crud.get_member(db, study_id, current_user.id)
         if not membership or not membership.is_active:
             return []