清理全局角色残留并修复项目权限判断

backend/app/api/v1/finance_dashboard.py

@@ -4,7 +4,7 @@ from datetime import date
 from fastapi import APIRouter, Depends
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_db_session, require_study_member
+from app.core.deps import get_db_session, require_api_permission
 from app.crud import finance as finance_crud
 from app.crud import study as study_crud
 from app.schemas.finance import FinanceSummaryRead
@@ -12,11 +12,12 @@ from app.schemas.finance import FinanceSummaryRead
 router = APIRouter()
 
 
-@router.get("/summary", response_model=FinanceSummaryRead, dependencies=[Depends(require_study_member())])
+@router.get("/summary", response_model=FinanceSummaryRead)
 async def finance_summary(
     study_id: uuid.UUID,
     date_from: date | None = None,
     date_to: date | None = None,
+    _=Depends(require_api_permission("fees_contracts:read")),
     db: AsyncSession = Depends(get_db_session),
 ) -> FinanceSummaryRead:
     # ensure study exists