清理全局角色残留并修复项目权限判断

backend/app/api/v1/faqs.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_api_permission
+from app.core.deps import get_current_user, get_db_session, get_operator_role_label, is_system_admin, require_study_not_locked, require_api_permission
 from app.core.project_permissions import role_has_api_permission
 from app.crud import audit as audit_crud
 from app.crud import faq_category as category_crud
@@ -27,8 +27,7 @@ router = APIRouter()
 
 
 def _is_system_admin(current_user) -> bool:
-    role = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
-    return role == "ADMIN"
+    return is_system_admin(current_user)
 
 
 @router.post(
@@ -75,7 +74,7 @@ async def create_faq(
         action="CREATE_FAQ_ITEM",
         detail="FAQ 已创建",
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await get_operator_role_label(db, study_id, current_user),
     )
     return FaqRead.model_validate(item)
 
@@ -108,8 +107,7 @@ async def list_faqs(
     if not study_id:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
 
-    role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
-    if role_value != "ADMIN":
+    if not is_system_admin(current_user):
         member = await member_crud.get_member(db, study_id, current_user.id)
         if not member or not member.is_active:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
@@ -158,8 +156,7 @@ async def get_faq(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
     if not item.study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
-    role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
-    if not item.is_active and role_value != "ADMIN":
+    if not item.is_active and not is_system_admin(current_user):
         member = await member_crud.get_member(db, item.study_id, current_user.id)
         if not member or not member.is_active:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
@@ -203,7 +200,7 @@ async def update_faq(
         action=action,
         detail=detail,
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await get_operator_role_label(db, study_id, current_user),
     )
     return FaqRead.model_validate(updated)
 
@@ -359,7 +356,7 @@ async def create_reply(
         action="CREATE_FAQ_REPLY",
         detail="FAQ 已回复",
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await get_operator_role_label(db, study_id, current_user),
     )
     data = FaqReplyRead.model_validate(reply)
     if quote:
@@ -404,7 +401,7 @@ async def delete_faq(
         action="DELETE_FAQ_ITEM",
         detail="FAQ 已删除",
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await get_operator_role_label(db, study_id, current_user),
     )
 
 
@@ -457,5 +454,5 @@ async def delete_reply(
         action="DELETE_FAQ_REPLY",
         detail="FAQ 回复已删除",
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await get_operator_role_label(db, study_id, current_user),
     )