清理全局角色残留并修复项目权限判断

frontend/src/router/index.ts

@@ -57,6 +57,10 @@ import SubjectForm from "../views/subjects/SubjectForm.vue";
 import SubjectDetail from "../views/subjects/SubjectDetail.vue";
 import { TEXT } from "../locales";
 
+const SYSTEM_PERMISSION_READ = "system:permissions:read";
+const SYSTEM_PERMISSION_PROJECT_CONFIG = "system:permissions:project_config";
+const SYSTEM_PERMISSION_MONITORING_METRICS = "system:monitoring:metrics";
+
 const routes: RouteRecordRaw[] = [
   {
     path: "/login",
@@ -414,19 +418,19 @@ const routes: RouteRecordRaw[] = [
         path: "permissions/system",
         name: "AdminPermissionsSystem",
         component: PermissionManagement,
-        meta: { title: "系统级权限", requiresProjectPm: true },
+        meta: { title: "系统级权限", systemPermission: SYSTEM_PERMISSION_READ },
       },
       {
         path: "permissions/project",
         name: "AdminPermissionsProject",
         component: PermissionManagement,
-        meta: { title: "项目权限配置", requiresProjectPm: true },
+        meta: { title: "项目权限配置", systemPermission: SYSTEM_PERMISSION_PROJECT_CONFIG },
       },
       {
         path: "permissions/monitoring",
         name: "AdminPermissionsMonitoring",
         component: PermissionManagement,
-        meta: { title: "权限监控", requiresProjectPm: true },
+        meta: { title: "权限监控", systemPermission: SYSTEM_PERMISSION_MONITORING_METRICS },
       },
     ],
   },
@@ -442,11 +446,30 @@ const router = createRouter({
 });
 
 const ADMIN_PROJECT_OPERATION_KEYS: Record<string, Record<"read" | "write", string>> = {
-  audit_export: { read: "audit_logs:read", write: "audit_logs:read" },
+  audit_export: { read: "audit_logs:read", write: "audit_logs:export" },
   project_members: { read: "project_members:list", write: "project_members:update" },
   sites: { read: "sites:read", write: "sites:update" },
 };
 
+const SYSTEM_PERMISSION_ROLES: Record<string, string[]> = {
+  [SYSTEM_PERMISSION_READ]: ["ADMIN", "PM"],
+  [SYSTEM_PERMISSION_PROJECT_CONFIG]: ["ADMIN", "PM"],
+  [SYSTEM_PERMISSION_MONITORING_METRICS]: ["ADMIN", "PM"],
+};
+
+const hasSystemPermissionAccess = async (permissionKey: string, isAdmin: boolean) => {
+  const roles = SYSTEM_PERMISSION_ROLES[permissionKey] || [];
+  if (isAdmin) return roles.includes("ADMIN");
+  if (!roles.includes("PM")) return false;
+
+  const studyStore = useStudyStore();
+  const hasPmProject = studyStore.currentStudyRole === "PM" || (studyStore.currentStudy as any)?.role_in_study === "PM";
+  if (!hasPmProject) {
+    await studyStore.ensureDefaultPmStudy().catch(() => {});
+  }
+  return studyStore.currentStudyRole === "PM" || (studyStore.currentStudy as any)?.role_in_study === "PM";
+};
+
 const ensureAdminProjectAccess = async (to: any, isAdmin: boolean) => {
   if (isAdmin) return true;
   const studyStore = useStudyStore();
@@ -548,6 +571,13 @@ router.beforeEach(async (to, _from, next) => {
       return;
     }
   }
+  if (to.meta.systemPermission) {
+    const allowed = await hasSystemPermissionAccess(to.meta.systemPermission as string, isAdmin);
+    if (!allowed) {
+      next({ path: isAdmin ? "/admin/users" : "/admin/projects" });
+      return;
+    }
+  }
   if (to.meta.requiresProjectPm && !isAdmin) {
     const hasPmProject = studyStore.currentStudyRole === "PM" || (studyStore.currentStudy as any)?.role_in_study === "PM";
     if (!hasPmProject) {