中文：收口权限与中心/立项配置改造

backend/tests/test_rbac_project_role.py

@@ -0,0 +1,25 @@
+from dataclasses import dataclass
+
+from app.core import rbac
+
+
+@dataclass
+class UserStub:
+    role: str
+
+
+@dataclass
+class MemberStub:
+    role_in_study: str
+
+
+def test_non_admin_global_role_does_not_grant_project_document_permission():
+    assert not rbac.is_allowed("delete_document", UserStub(role="PM"), MemberStub(role_in_study="CRA"))
+
+
+def test_project_role_grants_project_document_permission():
+    assert rbac.is_allowed("delete_document", UserStub(role="CRA"), MemberStub(role_in_study="PM"))
+
+
+def test_global_admin_keeps_system_document_permission_without_membership():
+    assert rbac.is_allowed("delete_document", UserStub(role="ADMIN"), None)