权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。

backend/app/api/v1/attachments.py

@@ -8,7 +8,8 @@ from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status,
 from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_member, get_study_member, require_study_not_locked
+from app.core.deps import get_current_user, get_db_session, get_study_member, require_study_not_locked
+from app.core.project_permissions import role_has_project_permission
 from app.crud import attachment as attachment_crud
 from app.crud import audit as audit_crud
 from app.crud import study as study_crud
@@ -22,6 +23,9 @@ router = APIRouter()
 global_router = APIRouter()
 
 UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
+ATTACHMENT_PERMISSION_MODULE_BY_ENTITY = {
+    "knowledge_note": "shared_library",
+}
 
 
 def _content_disposition(filename: str, disposition: str = "inline") -> str:
@@ -37,11 +41,39 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     return study
 
 
+def _permission_module_for_entity(entity_type: str) -> str:
+    return ATTACHMENT_PERMISSION_MODULE_BY_ENTITY.get(entity_type, "file_versions")
+
+
+async def _ensure_attachment_permission(
+    db: AsyncSession,
+    study_id: uuid.UUID,
+    current_user,
+    entity_type: str,
+    action: str,
+) -> None:
+    role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
+    if role_value == "ADMIN":
+        return
+    membership = await member_crud.get_member(db, study_id, current_user.id)
+    if not membership or not membership.is_active:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
+    allowed = await role_has_project_permission(
+        db,
+        study_id,
+        membership.role_in_study,
+        _permission_module_for_entity(entity_type),
+        action,
+    )
+    if not allowed:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
+
+
 @router.post(
     "/",
     response_model=AttachmentRead,
     status_code=status.HTTP_201_CREATED,
-    dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_study_not_locked())],
 )
 async def upload_attachment(
     study_id: uuid.UUID,
@@ -52,6 +84,7 @@ async def upload_attachment(
     current_user=Depends(get_current_user),
 ) -> AttachmentRead:
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "write")
     dest_dir = UPLOAD_ROOT / f"study_{study_id}" / f"{entity_type}_{entity_id}"
     dest_dir.mkdir(parents=True, exist_ok=True)
     unique_name = f"{uuid.uuid4()}{Path(file.filename).suffix}"
@@ -96,15 +129,16 @@ async def upload_attachment(
 @router.get(
     "/",
     response_model=list[AttachmentRead],
-    dependencies=[Depends(require_study_member())],
 )
 async def list_attachments(
     study_id: uuid.UUID,
     entity_type: str,
     entity_id: uuid.UUID,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> list[AttachmentRead]:
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
     attachments = await attachment_crud.list_attachments(db, study_id, entity_type, entity_id)
     user_ids = {a.uploaded_by for a in attachments if a.uploaded_by}
     users_map = await user_crud.get_users_by_ids(db, user_ids)
@@ -127,7 +161,6 @@ async def list_attachments(
 
 @router.get(
     "/{attachment_id}/download",
-    dependencies=[Depends(require_study_member())],
 )
 async def download_attachment(
     study_id: uuid.UUID,
@@ -135,8 +168,10 @@ async def download_attachment(
     entity_id: uuid.UUID,
     attachment_id: uuid.UUID,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> FileResponse:
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -152,7 +187,6 @@ async def download_attachment(
 
 @router.get(
     "/{attachment_id}/preview",
-    dependencies=[Depends(require_study_member())],
 )
 async def preview_attachment(
     study_id: uuid.UUID,
@@ -160,8 +194,10 @@ async def preview_attachment(
     entity_id: uuid.UUID,
     attachment_id: uuid.UUID,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> FileResponse:
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -210,6 +246,19 @@ async def global_download_attachment(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
     await _ensure_study_exists(db, attachment.study_id)
     user, _ = await _authorize_global(request, db, attachment.study_id)
+    membership = None
+    if user.role != "ADMIN":
+        membership = await get_study_member(attachment.study_id, current_user=user, db=db)
+    if user.role != "ADMIN":
+        allowed = await role_has_project_permission(
+            db,
+            attachment.study_id,
+            membership.role_in_study if membership else None,
+            _permission_module_for_entity(attachment.entity_type),
+            "read",
+        )
+        if not allowed:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     if not os.path.exists(attachment.file_path):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
     return FileResponse(
@@ -233,7 +282,17 @@ async def global_preview_attachment(
     if not attachment:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
     await _ensure_study_exists(db, attachment.study_id)
-    await _authorize_global(request, db, attachment.study_id)
+    user, membership = await _authorize_global(request, db, attachment.study_id)
+    if user.role != "ADMIN":
+        allowed = await role_has_project_permission(
+            db,
+            attachment.study_id,
+            membership.role_in_study if membership else None,
+            _permission_module_for_entity(attachment.entity_type),
+            "read",
+        )
+        if not allowed:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     if not os.path.exists(attachment.file_path):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
     return FileResponse(
@@ -258,10 +317,20 @@ async def global_delete_attachment(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
     await _ensure_study_exists(db, attachment.study_id)
     user, membership = await _authorize_global(request, db, attachment.study_id)
+    if user.role != "ADMIN":
+        allowed = await role_has_project_permission(
+            db,
+            attachment.study_id,
+            membership.role_in_study if membership else None,
+            _permission_module_for_entity(attachment.entity_type),
+            "write",
+        )
+        if not allowed:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     can_delete = (
         user.role == "ADMIN"
         or attachment.uploaded_by == user.id
-        or (membership and getattr(membership, "role_in_study", None) == "PM")
+        or membership is not None
     )
     if not can_delete:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
@@ -281,7 +350,7 @@ async def global_delete_attachment(
 @router.delete(
     "/{attachment_id}",
     status_code=status.HTTP_204_NO_CONTENT,
-    dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
+    dependencies=[Depends(require_study_not_locked())],
 )
 async def delete_attachment(
     study_id: uuid.UUID,
@@ -292,6 +361,7 @@ async def delete_attachment(
     current_user=Depends(get_current_user),
 ):
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, current_user, entity_type, "write")
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if (
         not attachment
@@ -309,7 +379,7 @@ async def delete_attachment(
     can_delete = (
         current_user.role == "ADMIN"
         or attachment.uploaded_by == current_user.id
-        or (membership and getattr(membership, "role_in_study", None) == "PM")
+        or membership is not None
     )
     if not can_delete:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")