补齐业务路由与页面权限控制

frontend/src/views/FaqDetail.vue

@@ -51,7 +51,7 @@
           :quote-item="quoteReply"
           :member-map="memberMap"
           :user-map="userMap"
-          :allow-attachments="true"
+          :allow-attachments="canUploadReplyAttachment"
           @submit="submitReply"
           @clear-quote="clearQuote"
         />
@@ -107,7 +107,10 @@ import { listMembers } from "../api/members";
 import { fetchAttachments, uploadAttachment } from "../api/attachments";
 import { displayDateTime, displayUser, getMemberDisplayName, getUserDisplayName } from "../utils/display";
 import { useAuthStore } from "../store/auth";
+import { useStudyStore } from "../store/study";
 import { usePermission } from "../utils/permission";
+import { getAttachmentPermissionKey } from "../utils/attachmentPermissions";
+import { isApiPermissionAllowed } from "../utils/apiPermissionValue";
 import FaqItemForm from "../components/FaqItemForm.vue";
 import ThreadComposer from "../components/ThreadComposer.vue";
 import ThreadList from "../components/ThreadList.vue";
@@ -115,6 +118,7 @@ import { TEXT } from "../locales";
 
 const route = useRoute();
 const auth = useAuthStore();
+const study = useStudyStore();
 const item = ref<any>(null);
 const loading = ref(false);
 const categories = ref<any[]>([]);
@@ -136,6 +140,14 @@ const canReply = computed(() => {
   return can("faq.reply");
 });
 
+const canUploadReplyAttachment = computed(() => {
+  if (!item.value?.study_id) return false;
+  if (auth.user?.is_admin) return true;
+  const role = study.currentStudyRole || (study.currentStudy as any)?.role_in_study;
+  const operationKey = getAttachmentPermissionKey("faq_replies", "create");
+  return !!role && !!operationKey && isApiPermissionAllowed(study.currentPermissions?.[role]?.[operationKey]);
+});
+
 const canDeleteReply = (reply: any) => {
   if (reply.is_deleted) return false;
   if (auth.user?.is_admin) return true;
@@ -273,7 +285,7 @@ const submitReply = async () => {
       quote_reply_id: quoteReply.value?.id || null,
     });
     const created = data as any;
-    if (replyFiles.value.length && created?.id) {
+    if (canUploadReplyAttachment.value && replyFiles.value.length && created?.id) {
       try {
         for (const file of replyFiles.value) {
           if (!file.raw) continue;