清理全局角色残留并修复项目权限判断

backend/app/api/v1/members.py

@@ -4,7 +4,7 @@ import json
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_member, require_api_permission, require_study_not_locked
+from app.core.deps import get_current_user, get_db_session, is_system_admin, require_api_permission, require_study_not_locked
 from app.core.decorators import register_api_endpoint
 from app.crud import audit as audit_crud
 from app.crud import member as member_crud
@@ -32,8 +32,11 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     return study
 
 
-def _role_value(user) -> str:
-    return user.role.value if hasattr(user.role, "value") else str(user.role)
+async def _operator_project_role(db: AsyncSession, study_id: uuid.UUID, current_user) -> str:
+    if is_system_admin(current_user):
+        return "ADMIN"
+    member = await member_crud.get_member(db, study_id, current_user.id)
+    return member.role_in_study if member and member.is_active else ""
 
 
 def _role_rank(role: str | None) -> int:
@@ -48,7 +51,7 @@ async def _ensure_member_mutation_allowed(
     target_member=None,
     target_role: str | None = None,
 ) -> None:
-    if _role_value(current_user) == "ADMIN":
+    if is_system_admin(current_user):
         return
 
     actor_member = await member_crud.get_member(db, study_id, current_user.id)
@@ -60,7 +63,7 @@ async def _ensure_member_mutation_allowed(
 
     if target_member:
         target_user = await user_crud.get_by_id(db, target_member.user_id)
-        if _role_value(target_user) == "ADMIN":
+        if is_system_admin(target_user):
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能修改系统管理员账号的项目权限")
 
     if target_member and _role_rank(target_member.role_in_study) >= actor_rank:
@@ -118,7 +121,7 @@ async def add_member(
                     "after": {"is_active": updated.is_active, "role_in_study": updated.role_in_study},
                 }, ensure_ascii=False),
                 operator_id=current_user.id,
-                operator_role=current_user.role,
+                operator_role=await _operator_project_role(db, study_id, current_user),
             )
             return updated
         raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="成员已存在")
@@ -131,7 +134,7 @@ async def add_member(
         action="PROJECT_MEMBER_ADDED",
         detail=json.dumps({"targetName": str(member.user_id), "after": {"role_in_study": member.role_in_study, "is_active": member.is_active}}, ensure_ascii=False),
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await _operator_project_role(db, study_id, current_user),
     )
     return member
 
@@ -246,7 +249,7 @@ async def update_member(
         action="PROJECT_MEMBER_UPDATED",
         detail=json.dumps({"targetName": str(updated.user_id), "before": before_data, "after": after_data}, ensure_ascii=False),
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await _operator_project_role(db, study_id, current_user),
     )
     return updated
 
@@ -274,7 +277,7 @@ async def remove_member(
     if not member or member.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="成员不存在")
     target_user = await user_crud.get_by_id(db, member.user_id)
-    if target_user and _role_value(target_user) == "ADMIN":
+    if target_user and is_system_admin(target_user):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="系统管理员不可从项目中移除")
     await _ensure_member_mutation_allowed(db, study_id, current_user, target_member=member)
     before_data = {"role_in_study": member.role_in_study, "is_active": member.is_active}
@@ -287,6 +290,6 @@ async def remove_member(
         action="PROJECT_MEMBER_REMOVED",
         detail=json.dumps({"targetName": str(removed.user_id), "before": before_data, "after": {"is_active": removed.is_active}}, ensure_ascii=False),
         operator_id=current_user.id,
-        operator_role=current_user.role,
+        operator_role=await _operator_project_role(db, study_id, current_user),
     )
     return removed