清理全局角色残留并修复项目权限判断

backend/app/api/v1/users.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_db_session, require_roles
+from app.core.deps import get_db_session, is_system_admin, require_roles
 from app.schemas.common import PaginatedResponse
 from app.crud import user as user_crud
 from app.crud import member as member_crud
@@ -59,7 +59,7 @@ async def update_user(
             requested_status = "ACTIVE" if user_in.is_active else "DISABLED"
         if requested_status is not None and requested_status != "ACTIVE":
             raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员不允许停用")
-    if db_user.role.value == "ADMIN":
+    if is_system_admin(db_user):
         requested_status = user_in.status
         if user_in.is_active is not None:
             requested_status = "ACTIVE" if user_in.is_active else "DISABLED"
@@ -85,7 +85,7 @@ async def delete_user(
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="系统管理员账号不允许删除")
     if db_user.id == current_user.id:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不允许删除自己")
-    if db_user.role.value == "ADMIN" and db_user.status.value == "ACTIVE":
+    if is_system_admin(db_user) and db_user.status.value == "ACTIVE":
         active_admins = await user_crud.count_active_admins(db)
         if active_admins <= 1:
             raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="至少保留一个管理员账号")