中文：收口权限与中心/立项配置改造

backend/app/core/config.py

@@ -7,7 +7,7 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 PROTECTED_ADMIN_EMAIL = "admin@huapont.cn"
 PROTECTED_ADMIN_DEFAULT_PASSWORD = "admin123"
 PROTECTED_ADMIN_FULL_NAME = "System Admin"
-PROTECTED_ADMIN_DEPARTMENT = "SYSTEM"
+PROTECTED_ADMIN_CLINICAL_DEPARTMENT = "SYSTEM"
 
 
 class Settings(BaseSettings):

backend/app/core/deps.py

@@ -95,7 +95,7 @@ def require_study_member():
     return dependency
 
 
-def require_study_roles(roles: Iterable[str]):
+def require_study_roles(roles: Iterable[str], *, allow_system_admin: bool = True):
     roles_set = set(roles)
 
     async def dependency(
@@ -104,7 +104,7 @@ def require_study_roles(roles: Iterable[str]):
         db: AsyncSession = Depends(get_db_session),
     ):
         role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
-        if role_value == "ADMIN":
+        if allow_system_admin and role_value == "ADMIN":
             return current_user
         membership = await member_crud.get_member(db, study_id, current_user.id)
         if not membership or not membership.is_active or membership.role_in_study not in roles_set:

backend/app/core/rbac.py

@@ -32,9 +32,8 @@ ROLE_ACTIONS: dict[str, set[str]] = {
 
 def is_allowed(action: str, user, membership) -> bool:
     role_value = user.role.value if hasattr(user.role, "value") else str(user.role)
-    allowed = ROLE_ACTIONS.get(role_value, set())
-    if action in allowed:
-        return True
+    if role_value == "ADMIN":
+        return action in ROLE_ACTIONS["ADMIN"]
     member_role = getattr(membership, "role_in_study", None)
     if member_role:
         return action in ROLE_ACTIONS.get(member_role, set())