权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。

frontend/src/api/projectPermissions.ts

@@ -0,0 +1,8 @@
+import { apiGet, apiPut } from "./axios";
+import type { ProjectRolePermissionsResponse, ProjectRolePermissionsUpdate } from "../types/api";
+
+export const fetchProjectRolePermissions = (studyId: string) =>
+  apiGet<ProjectRolePermissionsResponse>(`/api/v1/studies/${studyId}/permissions/`);
+
+export const updateProjectRolePermissions = (studyId: string, payload: ProjectRolePermissionsUpdate) =>
+  apiPut<ProjectRolePermissionsResponse>(`/api/v1/studies/${studyId}/permissions/`, payload);

frontend/src/components/Layout.vue

@@ -34,73 +34,91 @@
             <span>{{ TEXT.menu.auditLogs }}</span>
           </el-menu-item>
         </el-menu-item-group>
+
+        <el-menu-item-group v-if="canAccessPmAdminBackend" class="menu-group">
+          <template #title>
+            <span class="menu-divider">{{ TEXT.menu.admin }}</span>
+          </template>
+          <el-menu-item v-if="canAccessPmAdminModule('project_members')" :index="`/admin/projects/${study.currentStudy?.id}/members`">
+            <el-icon><User /></el-icon>
+            <span>{{ TEXT.modules.adminProjectMembers.memberLabel }}</span>
+          </el-menu-item>
+          <el-menu-item v-if="canAccessPmAdminModule('sites')" :index="`/admin/projects/${study.currentStudy?.id}/sites`">
+            <el-icon><Suitcase /></el-icon>
+            <span>{{ TEXT.modules.adminSites.title }}</span>
+          </el-menu-item>
+          <el-menu-item v-if="canAccessPmAdminModule('audit_export')" index="/admin/audit-logs">
+            <el-icon><Document /></el-icon>
+            <span>{{ TEXT.menu.auditLogs }}</span>
+          </el-menu-item>
+        </el-menu-item-group>
         
-        <el-menu-item-group v-if="study.currentStudy" class="menu-group">
+        <el-menu-item-group v-if="study.currentStudy && hasAnyProjectModuleAccess" class="menu-group">
           <template #title>
             <span class="menu-divider">{{ TEXT.menu.currentProject }}</span>
           </template>
-          <el-menu-item index="/project/overview">
+          <el-menu-item v-if="canAccessProjectPath('/project/overview')" index="/project/overview">
             <el-icon><House /></el-icon>
             <span>{{ TEXT.menu.projectOverview }}</span>
           </el-menu-item>
-          <el-menu-item index="/project/milestones">
+          <el-menu-item v-if="canAccessProjectPath('/project/milestones')" index="/project/milestones">
             <el-icon><Calendar /></el-icon>
             <span>{{ TEXT.menu.projectMilestones }}</span>
           </el-menu-item>
-          <el-menu-item index="/fees/contracts">
+          <el-menu-item v-if="canAccessProjectPath('/fees/contracts')" index="/fees/contracts">
             <el-icon><Coin /></el-icon>
             <span>{{ TEXT.menu.feeContracts }}</span>
           </el-menu-item>
-          <el-sub-menu index="materials">
+          <el-sub-menu v-if="canAccessAnyProjectPath(['/drug/shipments', '/materials/equipment'])" index="materials">
             <template #title>
               <el-icon><Box /></el-icon>
               <span>{{ TEXT.menu.materialManagement }}</span>
             </template>
-            <el-menu-item index="/drug/shipments">{{ TEXT.menu.drugShipments }}</el-menu-item>
-            <el-menu-item index="/materials/equipment">{{ TEXT.menu.materialEquipment }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/drug/shipments')" index="/drug/shipments">{{ TEXT.menu.drugShipments }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/materials/equipment')" index="/materials/equipment">{{ TEXT.menu.materialEquipment }}</el-menu-item>
           </el-sub-menu>
-          <el-menu-item index="/file-versions">
+          <el-menu-item v-if="canAccessProjectPath('/file-versions')" index="/file-versions">
             <el-icon><Files /></el-icon>
             <span>{{ TEXT.menu.fileVersionManagement }}</span>
           </el-menu-item>
-          <el-menu-item index="/startup/feasibility-ethics">
+          <el-menu-item v-if="canAccessProjectPath('/startup/feasibility-ethics')" index="/startup/feasibility-ethics">
             <el-icon><Calendar /></el-icon>
             <span>{{ TEXT.menu.startupFeasibilityEthics }}</span>
           </el-menu-item>
-          <el-menu-item index="/startup/meeting-auth">
+          <el-menu-item v-if="canAccessProjectPath('/startup/meeting-auth')" index="/startup/meeting-auth">
             <el-icon><CircleCheck /></el-icon>
             <span>{{ TEXT.menu.startupMeetingAuth }}</span>
           </el-menu-item>
-          <el-menu-item index="/subjects">
+          <el-menu-item v-if="canAccessProjectPath('/subjects')" index="/subjects">
             <el-icon><User /></el-icon>
             <span>{{ TEXT.menu.subjects }}</span>
           </el-menu-item>
-          <el-sub-menu index="risk-issues">
+          <el-sub-menu v-if="canAccessAnyProjectPath(['/risk-issues/sae', '/risk-issues/pd', '/risk-issues/monitoring-visits'])" index="risk-issues">
             <template #title>
               <el-icon><Flag /></el-icon>
               <span>{{ TEXT.menu.riskIssues }}</span>
             </template>
-            <el-menu-item index="/risk-issues/sae">{{ TEXT.menu.riskIssueSae }}</el-menu-item>
-            <el-menu-item index="/risk-issues/pd">{{ TEXT.menu.riskIssuePd }}</el-menu-item>
-            <el-menu-item index="/risk-issues/monitoring-visits">{{ TEXT.menu.riskIssueMonitoringVisits }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/risk-issues/sae')" index="/risk-issues/sae">{{ TEXT.menu.riskIssueSae }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/risk-issues/pd')" index="/risk-issues/pd">{{ TEXT.menu.riskIssuePd }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/risk-issues/monitoring-visits')" index="/risk-issues/monitoring-visits">{{ TEXT.menu.riskIssueMonitoringVisits }}</el-menu-item>
           </el-sub-menu>
-          <el-menu-item index="/monitoring-audit">
+          <el-menu-item v-if="canAccessProjectPath('/monitoring-audit')" index="/monitoring-audit">
             <el-icon><ChatDotRound /></el-icon>
             <span>{{ TEXT.menu.monitoringAudit }}</span>
           </el-menu-item>
-          <el-menu-item index="/etmf">
+          <el-menu-item v-if="canAccessProjectPath('/etmf')" index="/etmf">
             <el-icon><Flag /></el-icon>
             <span>{{ TEXT.menu.etmf }}</span>
           </el-menu-item>
-          <el-sub-menu index="knowledge">
+          <el-sub-menu v-if="canAccessAnyProjectPath(['/knowledge/medical-consult', '/knowledge/notes', '/knowledge/support-files', '/knowledge/instruction-files'])" index="knowledge">
             <template #title>
               <el-icon><Notebook /></el-icon>
               <span>{{ TEXT.menu.sharedLibrary }}</span>
             </template>
-            <el-menu-item index="/knowledge/medical-consult">{{ TEXT.menu.knowledgeMedicalConsult }}</el-menu-item>
-            <el-menu-item index="/knowledge/notes">{{ TEXT.menu.knowledgeNotes }}</el-menu-item>
-            <el-menu-item index="/knowledge/support-files">{{ TEXT.menu.knowledgeSupportFiles }}</el-menu-item>
-            <el-menu-item index="/knowledge/instruction-files">{{ TEXT.menu.knowledgeInstructionFiles }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/knowledge/medical-consult')" index="/knowledge/medical-consult">{{ TEXT.menu.knowledgeMedicalConsult }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/knowledge/notes')" index="/knowledge/notes">{{ TEXT.menu.knowledgeNotes }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/knowledge/support-files')" index="/knowledge/support-files">{{ TEXT.menu.knowledgeSupportFiles }}</el-menu-item>
+            <el-menu-item v-if="canAccessProjectPath('/knowledge/instruction-files')" index="/knowledge/instruction-files">{{ TEXT.menu.knowledgeInstructionFiles }}</el-menu-item>
           </el-sub-menu>
         </el-menu-item-group>
       </el-menu>
@@ -217,6 +235,7 @@ import {
   CircleCheck, Box, Coin, Notebook, Document, ArrowDown, SwitchButton, Files
 } from "@element-plus/icons-vue";
 import { ElMessage } from "element-plus";
+import { getProjectRoutePermission, hasProjectPermission, projectRouteLandingPaths } from "../utils/projectRoutePermissions";
 
 const auth = useAuthStore();
 const study = useStudyStore();
@@ -224,6 +243,16 @@ const router = useRouter();
 const route = useRoute();
 const isAdmin = computed(() => auth.user?.role === "ADMIN");
 const isCollapsed = ref(localStorage.getItem("ctms_sidebar_collapsed") === "1");
+const projectRole = computed(() => study.currentStudyRole || (study.currentStudy as any)?.role_in_study || "");
+const canAccessPmAdminModule = (module: string) =>
+  !isAdmin.value && projectRole.value === "PM" && !!study.currentPermissions?.roles?.PM?.[module]?.read;
+const canAccessPmAdminBackend = computed(() =>
+  !!study.currentStudy && ["project_members", "sites", "audit_export"].some((module) => canAccessPmAdminModule(module))
+);
+const canAccessProjectPath = (path: string) =>
+  hasProjectPermission(study.currentPermissions?.roles, projectRole.value, getProjectRoutePermission(path), isAdmin.value);
+const canAccessAnyProjectPath = (paths: string[]) => paths.some((path) => canAccessProjectPath(path));
+const hasAnyProjectModuleAccess = computed(() => canAccessAnyProjectPath(projectRouteLandingPaths));
 
 /* 动态设置 body 上的侧边栏宽度 CSS 变量，用于全局弹窗定位偏移 */
 const hasSidebar = computed(() => isAdmin.value || !!study.currentStudy);
@@ -375,9 +404,10 @@ const breadcrumbs = computed(() => {
   return items;
 });
 
-const handleBreadcrumbCommand = (cmd: any) => {
+const handleBreadcrumbCommand = async (cmd: any) => {
   if (cmd.type === 'study') {
     study.setCurrentStudy(cmd.value);
+    await study.loadCurrentStudyPermissions().catch(() => {});
     router.push("/project/overview");
   } else if (cmd.type === 'site') {
     study.setCurrentSite(cmd.value);

frontend/src/components/StudySelector.vue

@@ -57,7 +57,7 @@ const loadStudies = async () => {
   }
 };
 
-const onCommand = (cmd: any) => {
+const onCommand = async (cmd: any) => {
   if (cmd === "clear") {
     study.clearCurrentStudy();
     router.push("/workbench");
@@ -65,6 +65,7 @@ const onCommand = (cmd: any) => {
   }
   if (cmd?.type === "switch" && cmd.study) {
     study.setCurrentStudy(cmd.study as Study);
+    await study.loadCurrentStudyPermissions().catch(() => {});
     router.push("/project/overview");
   }
 };

frontend/src/components/attachments/AttachmentList.vue

@@ -67,7 +67,8 @@ import AttachmentUploader from "./AttachmentUploader.vue";
 import { formatFileSize } from "./attachmentUtils";
 import { useAuthStore } from "../../store/auth";
 import { useStudyStore } from "../../store/study";
-import { getProjectRole, isSystemAdmin } from "../../utils/roles";
+import { isSystemAdmin } from "../../utils/roles";
+import { usePermission } from "../../utils/permission";
 import { listMembers } from "../../api/members";
 import { displayDateTime, displayUser, getMemberDisplayName, getUserDisplayName } from "../../utils/display";
 import { TEXT } from "../../locales";
@@ -84,6 +85,7 @@ const attachments = ref<any[]>([]);
 const loading = ref(false);
 const auth = useAuthStore();
 const study = useStudyStore();
+const permission = usePermission();
 const members = ref<any[]>([]);
 const previewVisible = ref(false);
 const previewUrl = ref("");
@@ -203,11 +205,8 @@ const preview = (row: any) => {
 
 const canDelete = (row: any) => {
   if (props.readonly) return false;
-  const userId = auth.user?.id;
-  const projectRole = getProjectRole(study.currentStudy, study.currentStudyRole);
-  const ownerId =
-    row.uploaded_by_id || (row.uploaded_by && typeof row.uploaded_by === "object" ? row.uploaded_by.id : row.uploaded_by);
-  return userId === ownerId || isSystemAdmin(auth.user) || projectRole === "PM";
+  const action = props.entityType === "knowledge_note" ? "shared.library.write" : "file.attachment.delete";
+  return isSystemAdmin(auth.user) || permission.can(action);
 };
 
 const remove = async (row: any) => {

frontend/src/components/fees/FeeAttachmentPanel.vue

@@ -83,7 +83,8 @@ import { fetchAttachments, uploadAttachment, deleteAttachment } from "../../api/
 import { listMembers } from "../../api/members";
 import { useAuthStore } from "../../store/auth";
 import { useStudyStore } from "../../store/study";
-import { getProjectRole, isSystemAdmin } from "../../utils/roles";
+import { isSystemAdmin } from "../../utils/roles";
+import { usePermission } from "../../utils/permission";
 import { formatFileSize } from "../attachments/attachmentUtils";
 import { displayUser, getMemberDisplayName, getUserDisplayName } from "../../utils/display";
 import StateEmpty from "../StateEmpty.vue";
@@ -110,6 +111,7 @@ const grouped = reactive<Record<string, any[]>>({});
 const progressMap = reactive<Record<string, number>>({});
 const auth = useAuthStore();
 const study = useStudyStore();
+const permission = usePermission();
 const members = ref<any[]>([]);
 const previewVisible = ref(false);
 const previewUrl = ref("");
@@ -269,11 +271,7 @@ const download = (row: any) => {
 
 const canDelete = (row: any) => {
   if (props.readonly) return false;
-  const userId = auth.user?.id;
-  const projectRole = getProjectRole(study.currentStudy, study.currentStudyRole);
-  const ownerId =
-    row.uploaded_by_id || (row.uploaded_by && typeof row.uploaded_by === "object" ? row.uploaded_by.id : row.uploaded_by);
-  return userId === ownerId || isSystemAdmin(auth.user) || projectRole === "PM";
+  return isSystemAdmin(auth.user) || permission.can("fees.attachment.delete");
 };
 
 const remove = async (row: any) => {

frontend/src/main.ts

@@ -24,6 +24,7 @@ const studyStore = useStudyStore();
 studyStore.loadCurrentStudy();
 if (getToken()) {
   await studyStore.rehydrateStudyForLastUser();
+  await studyStore.loadCurrentStudyPermissions().catch(() => {});
 }
 
 app.use(router);

frontend/src/router.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const readRouter = () => readFileSync(resolve(__dirname, "./router/index.ts"), "utf8");
+
+describe("admin project route permissions", () => {
+  it("allows project admin pages through matrix-authorized PMs instead of all project roles", () => {
+    const source = readRouter();
+
+    expect(source).toContain('adminProjectPermission: { module: "project_members", action: "read" }');
+    expect(source).toContain('adminProjectPermission: { module: "sites", action: "read" }');
+    expect(source).toContain('adminProjectPermission: { module: "audit_export", action: "read" }');
+    expect(source).toContain('if (role !== "PM") return false;');
+    expect(source).toContain("roles?.PM?.[permission.module]?.[permission.action]");
+  });
+});

frontend/src/router/index.ts

@@ -1,7 +1,10 @@
 import { createRouter, createWebHistory, RouteRecordRaw } from "vue-router";
 import { useAuthStore } from "../store/auth";
 import { useStudyStore } from "../store/study";
-import { getProjectRole, isSystemAdmin } from "../utils/roles";
+import { isSystemAdmin } from "../utils/roles";
+import { findFirstAccessibleProjectPath, getProjectRoutePermission, hasProjectPermission } from "../utils/projectRoutePermissions";
+import { fetchStudyDetail } from "../api/studies";
+import { fetchProjectRolePermissions } from "../api/projectPermissions";
 import Layout from "../components/Layout.vue";
 import Login from "../views/Login.vue";
 import Register from "../views/Register.vue";
@@ -16,6 +19,7 @@ import AdminProjects from "../views/admin/Projects.vue";
 import ProjectMembers from "../views/admin/ProjectMembers.vue";
 import AdminSites from "../views/admin/Sites.vue";
 import ProjectDetail from "../views/admin/ProjectDetail.vue";
+import ProjectPermissions from "../views/admin/ProjectPermissions.vue";
 import ProfileSettings from "../views/ProfileSettings.vue";
 import ProjectOverview from "../views/ia/ProjectOverview.vue";
 import ProjectMilestones from "../views/ia/ProjectMilestones.vue";
@@ -435,19 +439,25 @@ const routes: RouteRecordRaw[] = [
         path: "projects/:projectId/members",
         name: "AdminProjectMembers",
         component: ProjectMembers,
-        meta: { title: TEXT.modules.adminProjectMembers.memberLabel, requiresAdmin: true },
+        meta: { title: TEXT.modules.adminProjectMembers.memberLabel, adminProjectPermission: { module: "project_members", action: "read" } },
+      },
+      {
+        path: "projects/:projectId/permissions",
+        name: "AdminProjectPermissions",
+        component: ProjectPermissions,
+        meta: { title: "权限管理", requiresAdmin: true },
       },
       {
         path: "projects/:projectId/sites",
         name: "AdminSites",
         component: AdminSites,
-        meta: { title: TEXT.modules.adminSites.title, requiresAdmin: true },
+        meta: { title: TEXT.modules.adminSites.title, adminProjectPermission: { module: "sites", action: "read" } },
       },
       {
         path: "audit-logs",
         name: "AdminAuditLogs",
         component: AuditLogs,
-        meta: { title: TEXT.menu.auditLogs, requiresAdmin: true },
+        meta: { title: TEXT.menu.auditLogs, adminProjectPermission: { module: "audit_export", action: "read" } },
       },
     ],
   },
@@ -462,6 +472,29 @@ const router = createRouter({
   routes,
 });
 
+const ensureAdminProjectAccess = async (to: any, isAdmin: boolean) => {
+  if (isAdmin) return true;
+  const studyStore = useStudyStore();
+  const permission = to.meta.adminProjectPermission as { module: string; action: "read" | "write" } | undefined;
+  if (!permission) return true;
+
+  const routeProjectId = typeof to.params.projectId === "string" ? to.params.projectId : "";
+  if (routeProjectId && studyStore.currentStudy?.id !== routeProjectId) {
+    const [{ data: project }, { data: permissions }] = await Promise.all([
+      fetchStudyDetail(routeProjectId),
+      fetchProjectRolePermissions(routeProjectId),
+    ]);
+    studyStore.setCurrentStudy(project);
+    studyStore.currentPermissions = permissions;
+  } else if (!studyStore.currentPermissions) {
+    await studyStore.loadCurrentStudyPermissions();
+  }
+
+  const role = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
+  if (role !== "PM") return false;
+  return !!studyStore.currentPermissions?.roles?.PM?.[permission.module]?.[permission.action];
+};
+
 router.beforeEach(async (to, _from, next) => {
   const auth = useAuthStore();
   const studyStore = useStudyStore();
@@ -511,13 +544,24 @@ router.beforeEach(async (to, _from, next) => {
       return;
     }
   }
+  if (to.meta.adminProjectPermission) {
+    const allowed = await ensureAdminProjectAccess(to, isAdmin).catch(() => false);
+    if (!allowed) {
+      next({ path: isAdmin ? "/admin/users" : "/workbench" });
+      return;
+    }
+  }
   if (to.meta.requiresAdmin && !isAdmin) {
     next({ path: "/workbench" });
     return;
   }
-  if (to.name === "AuditLogs") {
-    const projectRole = getProjectRole(studyStore.currentStudy, studyStore.currentStudyRole);
-    if (!(isAdmin || projectRole === "PM")) {
+  if (to.name === "AdminAuditLogs") {
+    if (studyStore.currentStudy && !studyStore.currentPermissions) {
+      await studyStore.loadCurrentStudyPermissions().catch(() => {});
+    }
+    const role = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
+    const canReadAudit = !!studyStore.currentPermissions?.roles?.[role]?.audit_export?.read;
+    if (!(isAdmin || (role === "PM" && canReadAudit))) {
       next({ path: "/project/overview" });
       return;
     }
@@ -526,6 +570,19 @@ router.beforeEach(async (to, _from, next) => {
     next({ path: isAdmin ? "/admin/users" : "/workbench" });
     return;
   }
+  if (to.meta.requiresStudy && studyStore.currentStudy) {
+    if (!studyStore.currentPermissions) {
+      await studyStore.loadCurrentStudyPermissions().catch(() => {});
+    }
+    const projectRole = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
+    const permission = getProjectRoutePermission(to.path);
+    const canAccessProjectRoute = hasProjectPermission(studyStore.currentPermissions?.roles, projectRole, permission, isAdmin);
+    if (!canAccessProjectRoute) {
+      const fallback = findFirstAccessibleProjectPath(studyStore.currentPermissions?.roles, projectRole, isAdmin);
+      next({ path: fallback || "/workbench" });
+      return;
+    }
+  }
   next();
 });
 

frontend/src/store/auth.ts

@@ -37,6 +37,7 @@ export const useAuthStore = defineStore("auth", () => {
       const studyStore = useStudyStore();
       const userKey = me?.email || email;
       await studyStore.restoreStudyForUser(userKey, { preferActive: me?.role === "ADMIN" });
+      await studyStore.loadCurrentStudyPermissions().catch(() => {});
       forceLogin.value = false;
     } finally {
       loading.value = false;

frontend/src/store/study.ts

@@ -1,6 +1,7 @@
 import { defineStore } from "pinia";
 import { ref } from "vue";
 import { fetchStudies } from "../api/studies";
+import { fetchProjectRolePermissions } from "../api/projectPermissions";
 import type { Study } from "../types/api";
 
 const STUDY_KEY = "ctms_current_study";
@@ -13,6 +14,7 @@ export const useStudyStore = defineStore("study", () => {
   const currentStudyRole = ref<string | null>(null);
   const currentSite = ref<any | null>(null);
   const viewContext = ref<{ siteName?: string } | null>(null);
+  const currentPermissions = ref<any | null>(null);
   const normalizeUserKey = (value: string) => value.trim().toLowerCase();
 
   const readLastStudyMap = (): Record<string, Study> => {
@@ -49,6 +51,7 @@ export const useStudyStore = defineStore("study", () => {
     if (role) {
       localStorage.setItem(STUDY_ROLE_KEY, role);
     }
+    currentPermissions.value = null;
     const loginEmail = localStorage.getItem("ctms_last_login_email") || "";
     if (loginEmail) {
       rememberStudyForUser(loginEmail, study);
@@ -157,6 +160,17 @@ export const useStudyStore = defineStore("study", () => {
     localStorage.removeItem(STUDY_KEY);
     localStorage.removeItem(STUDY_ROLE_KEY);
     localStorage.removeItem(SITE_KEY);
+    currentPermissions.value = null;
+  };
+
+  const loadCurrentStudyPermissions = async () => {
+    if (!currentStudy.value?.id) {
+      currentPermissions.value = null;
+      return null;
+    }
+    const { data } = await fetchProjectRolePermissions(currentStudy.value.id);
+    currentPermissions.value = data;
+    return data;
   };
 
   const rememberCurrentStudyForUser = (userKey: string) => {
@@ -221,6 +235,8 @@ export const useStudyStore = defineStore("study", () => {
     ensureDefaultActiveStudy,
     restoreStudyForUser,
     rehydrateStudyForLastUser,
+    loadCurrentStudyPermissions,
+    currentPermissions,
     clearCurrentStudy,
   };
 });

frontend/src/types/api.ts

@@ -128,3 +128,26 @@ export interface Site {
   is_active: boolean;
   created_at?: string;
 }
+
+export type ProjectPermissionActionState = {
+  read: boolean;
+  write: boolean;
+};
+
+export type ProjectPermissionMatrix = Record<UserRole, Record<string, ProjectPermissionActionState>>;
+
+export interface ProjectPermissionModule {
+  key: string;
+  label: string;
+  description?: string | null;
+  writable?: boolean;
+}
+
+export interface ProjectRolePermissionsResponse {
+  modules: ProjectPermissionModule[];
+  roles: ProjectPermissionMatrix;
+}
+
+export interface ProjectRolePermissionsUpdate {
+  roles: ProjectPermissionMatrix;
+}

frontend/src/utils/permission.test.ts

@@ -5,21 +5,15 @@ import { resolve } from "node:path";
 const readPermissionSource = () => readFileSync(resolve(__dirname, "./permission.ts"), "utf8");
 
 describe("permission project role model", () => {
-  it("does not fall back to non-admin global roles for project permissions", () => {
+  it("does not fall back to project role names for permission decisions", () => {
     const source = readPermissionSource();
 
     expect(source).toContain("isSystemAdmin");
     expect(source).toContain("getProjectRole");
     expect(source).toContain("study.currentStudyRole");
-    expect(source).not.toContain("role_in_study || auth.user?.role");
-    expect(source).not.toContain("role_in_study || userRole.value");
-  });
-
-  it("allows project administrators and PMs to manage project configuration", () => {
-    const source = readPermissionSource();
-
-    expect(source).toContain('"project.members.manage": ["ADMIN", "PM"]');
-    expect(source).toContain('"site.manage": ["ADMIN", "PM"]');
-    expect(source).toContain('"site.cra.bind": ["ADMIN", "PM"]');
+    expect(source).toContain("study.currentPermissions");
+    expect(source).toContain('"faq.edit": { module: "faq", action: "write" }');
+    expect(source).not.toContain('"faq.edit": { module: "etmf"');
+    expect(source).not.toContain('"ADMIN", "PM"');
   });
 });

frontend/src/utils/permission.ts

@@ -5,19 +5,19 @@ import { TEXT } from "../locales";
 import { getProjectRole, isSystemAdmin } from "./roles";
 
 const PERMISSIONS: Record<string, string[]> = {
-  "subject.create": ["ADMIN", "PM", "CRA"],
-  "subject.enroll": ["ADMIN", "PM", "CRA"],
-  "subject.complete": ["ADMIN", "PM", "CRA"],
-  "subject.drop": ["ADMIN", "PM", "CRA"],
-  "ae.create": ["ADMIN", "PM", "CRA", "PV"],
-  "ae.close": ["ADMIN", "PM", "PV", "CRA"],
-  "faq.edit": ["ADMIN", "PM"],
-  "faq.create": ["ADMIN", "PM", "CRA", "PV", "IMP"],
-  "faq.reply": ["ADMIN", "PM", "CRA", "PV", "IMP"],
-  "project.members.manage": ["ADMIN", "PM"],
-  "site.manage": ["ADMIN", "PM"],
-  "site.cra.bind": ["ADMIN", "PM"],
-  "fees.contract.write": ["ADMIN", "PM"],
+  "subject.create": ["ADMIN"],
+  "subject.enroll": ["ADMIN"],
+  "subject.complete": ["ADMIN"],
+  "subject.drop": ["ADMIN"],
+  "ae.create": ["ADMIN"],
+  "ae.close": ["ADMIN"],
+  "faq.edit": ["ADMIN"],
+  "faq.create": ["ADMIN"],
+  "faq.reply": ["ADMIN"],
+  "project.members.manage": ["ADMIN"],
+  "site.manage": ["ADMIN"],
+  "site.cra.bind": ["ADMIN"],
+  "fees.contract.write": ["ADMIN"],
 };
 
 const REASONS: Record<string, string> = {
@@ -40,13 +40,37 @@ export const usePermission = () => {
 
   const systemAdmin = computed(() => isSystemAdmin(auth.user));
   const projectRole = computed(() => getProjectRole(study.currentStudy, study.currentStudyRole));
+  const projectPermissions = computed(() => study.currentPermissions);
 
   const can = (action: string): boolean => {
     if (systemAdmin.value) return true;
-    const allowList = PERMISSIONS[action];
-    if (!allowList) return false;
     if (!projectRole.value) return false;
-    return allowList.includes(projectRole.value);
+    const permissionMap: Record<string, { module: string; action: "read" | "write" }> = {
+      "subject.create": { module: "subjects", action: "write" },
+      "subject.enroll": { module: "subjects", action: "write" },
+      "subject.complete": { module: "subjects", action: "write" },
+      "subject.drop": { module: "subjects", action: "write" },
+      "ae.create": { module: "risk_issues", action: "write" },
+      "ae.close": { module: "risk_issues", action: "write" },
+      "project.overview.read": { module: "project_overview", action: "read" },
+      "faq.edit": { module: "faq", action: "write" },
+      "faq.create": { module: "faq", action: "write" },
+      "faq.reply": { module: "faq", action: "write" },
+      "knowledge.notes.write": { module: "shared_library", action: "write" },
+      "shared.library.read": { module: "shared_library", action: "read" },
+      "shared.library.write": { module: "shared_library", action: "write" },
+      "project.members.manage": { module: "project_members", action: "write" },
+      "site.manage": { module: "sites", action: "write" },
+      "site.cra.bind": { module: "sites", action: "write" },
+      "fees.contract.write": { module: "fees", action: "write" },
+      "fees.attachment.delete": { module: "fees", action: "write" },
+      "file.attachment.delete": { module: "file_versions", action: "write" },
+      "audit.export.read": { module: "audit_export", action: "read" },
+    };
+    const mapped = permissionMap[action];
+    if (!mapped) return false;
+    const allowed = projectPermissions.value?.roles?.[projectRole.value]?.[mapped.module]?.[mapped.action];
+    return !!allowed;
   };
 
   const reason = (action: string): string => {

frontend/src/utils/projectRoutePermissions.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, it } from "vitest";
+import { findFirstAccessibleProjectPath, getProjectRoutePermission, hasProjectPermission } from "./projectRoutePermissions";
+
+describe("project route permissions", () => {
+  it("maps project routes to read permission modules", () => {
+    expect(getProjectRoutePermission("/project/overview")).toEqual({ module: "project_overview", action: "read" });
+    expect(getProjectRoutePermission("/knowledge/medical-consult/abc")).toEqual({ module: "faq", action: "read" });
+    expect(getProjectRoutePermission("/knowledge/notes/new")).toEqual({ module: "shared_library", action: "read" });
+    expect(getProjectRoutePermission("/startup/kickoff/new")).toEqual({ module: "startup_auth", action: "read" });
+  });
+
+  it("rejects project routes when the role lacks module read permission", () => {
+    const matrix = {
+      CRA: {
+        project_overview: { read: false, write: false },
+        shared_library: { read: true, write: true },
+      },
+    } as any;
+
+    expect(hasProjectPermission(matrix, "CRA", getProjectRoutePermission("/project/overview"), false)).toBe(false);
+    expect(hasProjectPermission(matrix, "CRA", getProjectRoutePermission("/knowledge/notes"), false)).toBe(true);
+    expect(findFirstAccessibleProjectPath(matrix, "CRA", false)).toBe("/knowledge/notes");
+  });
+});

frontend/src/utils/projectRoutePermissions.ts

@@ -0,0 +1,69 @@
+import type { ProjectPermissionMatrix, UserRole } from "../types/api";
+
+export type ProjectRoutePermission = {
+  module: string;
+  action: "read" | "write";
+};
+
+const routePermissions: Array<{ prefixes: string[]; permission: ProjectRoutePermission }> = [
+  { prefixes: ["/project/overview"], permission: { module: "project_overview", action: "read" } },
+  { prefixes: ["/project/milestones"], permission: { module: "project_milestones", action: "read" } },
+  { prefixes: ["/fees/contracts", "/finance/contracts"], permission: { module: "fees", action: "read" } },
+  { prefixes: ["/drug/shipments", "/materials/equipment"], permission: { module: "materials", action: "read" } },
+  { prefixes: ["/file-versions", "/trial/", "/documents/"], permission: { module: "file_versions", action: "read" } },
+  { prefixes: ["/startup/feasibility-ethics", "/startup/feasibility", "/startup/ethics"], permission: { module: "startup_ethics", action: "read" } },
+  { prefixes: ["/startup/meeting-auth", "/startup/kickoff", "/startup/training"], permission: { module: "startup_auth", action: "read" } },
+  { prefixes: ["/subjects"], permission: { module: "subjects", action: "read" } },
+  { prefixes: ["/risk-issues"], permission: { module: "risk_issues", action: "read" } },
+  { prefixes: ["/monitoring-audit", "/monitoring", "/audit"], permission: { module: "monitoring_audit", action: "read" } },
+  { prefixes: ["/etmf"], permission: { module: "etmf", action: "read" } },
+  { prefixes: ["/knowledge/medical-consult"], permission: { module: "faq", action: "read" } },
+  { prefixes: ["/knowledge/notes", "/knowledge/support-files", "/knowledge/instruction-files"], permission: { module: "shared_library", action: "read" } },
+];
+
+export const projectRouteLandingPaths = [
+  "/project/overview",
+  "/project/milestones",
+  "/fees/contracts",
+  "/drug/shipments",
+  "/materials/equipment",
+  "/file-versions",
+  "/startup/feasibility-ethics",
+  "/startup/meeting-auth",
+  "/subjects",
+  "/risk-issues/sae",
+  "/monitoring-audit",
+  "/etmf",
+  "/knowledge/medical-consult",
+  "/knowledge/notes",
+  "/knowledge/support-files",
+  "/knowledge/instruction-files",
+];
+
+export const getProjectRoutePermission = (path: string): ProjectRoutePermission | null => {
+  const normalized = path || "";
+  for (const item of routePermissions) {
+    if (item.prefixes.some((prefix) => normalized === prefix || normalized.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`))) {
+      return item.permission;
+    }
+  }
+  return null;
+};
+
+export const hasProjectPermission = (
+  matrix: ProjectPermissionMatrix | null | undefined,
+  role: string | null | undefined,
+  permission: ProjectRoutePermission | null,
+  isAdmin: boolean,
+) => {
+  if (!permission || isAdmin) return true;
+  if (!role) return false;
+  const typedRole = role as UserRole;
+  return !!matrix?.[typedRole]?.[permission.module]?.[permission.action];
+};
+
+export const findFirstAccessibleProjectPath = (
+  matrix: ProjectPermissionMatrix | null | undefined,
+  role: string | null | undefined,
+  isAdmin: boolean,
+) => projectRouteLandingPaths.find((path) => hasProjectPermission(matrix, role, getProjectRoutePermission(path), isAdmin)) || null;

frontend/src/utils/roles.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { getProjectRole, getSystemRole, isProjectAdminOrPm, isSystemAdmin } from "./roles";
+import { getProjectRole, getSystemRole, isSystemAdmin } from "./roles";
 
 describe("role helpers", () => {
   it("keeps system admin separate from project admin", () => {
@@ -11,8 +11,5 @@ describe("role helpers", () => {
   it("uses only project role fields for project permissions", () => {
     expect(getProjectRole({ role_in_study: "PM" } as any, null)).toBe("PM");
     expect(getProjectRole({ role_in_study: null } as any, "ADMIN")).toBe("ADMIN");
-    expect(isProjectAdminOrPm("ADMIN")).toBe(true);
-    expect(isProjectAdminOrPm("PM")).toBe(true);
-    expect(isProjectAdminOrPm("CRA")).toBe(false);
   });
 });

frontend/src/utils/roles.ts

@@ -6,5 +6,3 @@ export const isSystemAdmin = (user?: Pick<UserInfo, "role"> | null) => getSystem
 
 export const getProjectRole = (study?: Pick<Study, "role_in_study"> | null, currentStudyRole?: string | null) =>
   currentStudyRole || study?.role_in_study || null;
-
-export const isProjectAdminOrPm = (role?: string | null) => role === "ADMIN" || role === "PM";

frontend/src/views/admin/AuditLogs.test.ts

@@ -5,7 +5,7 @@ import { resolve } from "node:path";
 const readAuditLogsView = () => readFileSync(resolve(__dirname, "./AuditLogs.vue"), "utf8");
 
 describe("audit logs access", () => {
-  it("allows current project PM access without relying on global PM role", () => {
+  it("allows only admins or authorized PMs to use audit export", () => {
     const source = readAuditLogsView();
 
     expect(source).toContain("const canAccessAuditLogs = computed");
@@ -13,6 +13,7 @@ describe("audit logs access", () => {
     expect(source).toContain("getProjectRole");
     expect(source).toContain("study.currentStudyRole");
     expect(source).toContain('projectRole.value === "PM"');
+    expect(source).toContain("roles?.PM?.audit_export?.read");
     expect(source).not.toContain('const role = auth.user?.role');
     expect(source).not.toContain('role !== "ADMIN"');
   });

frontend/src/views/admin/AuditLogs.vue

@@ -167,6 +167,7 @@ import { useRouter } from "vue-router";
 import { ElMessage, ElMessageBox } from "element-plus";
 import { ArrowDown } from "@element-plus/icons-vue";
 import { createAuditEvent, fetchAuditLogs } from "../../api/auditLogs";
+import { fetchProjectRolePermissions } from "../../api/projectPermissions";
 import { fetchUsers } from "../../api/users";
 import { listMembers } from "../../api/members";
 import { auditDict, normalizeAuditEvent } from "../../audit";
@@ -187,6 +188,7 @@ const exportLoading = ref(false);
 const logs = ref<any[]>([]);
 const users = ref<any[]>([]);
 const allLogs = ref<any[]>([]);
+const permissionMatrix = ref<any | null>(null);
 const page = ref(1);
 const pageSize = ref(20);
 const total = ref(0);
@@ -212,8 +214,14 @@ const resolveUserDisplayName = (u: any): string => {
 const userOptions = computed(() => users.value.map((u: any) => ({ label: resolveUserDisplayName(u), value: u.id })));
 const isAdmin = computed(() => isSystemAdmin(auth.user));
 const projectRole = computed(() => getProjectRole(study.currentStudy, study.currentStudyRole));
-const canProjectExport = computed(() => !!study.currentStudy && isAdmin.value);
-const canAccessAuditLogs = computed(() => isAdmin.value || projectRole.value === "PM");
+const canProjectExport = computed(() => {
+  if (isAdmin.value) return true;
+  return projectRole.value === "PM" && !!permissionMatrix.value?.roles?.PM?.audit_export?.read;
+});
+const canAccessAuditLogs = computed(() => {
+  if (isAdmin.value) return true;
+  return projectRole.value === "PM" && !!permissionMatrix.value?.roles?.PM?.audit_export?.read;
+});
 
 const ensureAccess = () => {
   if (!canAccessAuditLogs.value) {
@@ -221,6 +229,12 @@ const ensureAccess = () => {
   }
 };
 
+const loadPermissionMatrix = async () => {
+  if (!study.currentStudy) return;
+  const { data } = await fetchProjectRolePermissions(study.currentStudy.id);
+  permissionMatrix.value = data;
+};
+
 const loadUsers = async () => {
   try {
     if (isAdmin.value) {
@@ -244,6 +258,9 @@ const loadLogs = async () => {
   if (!study.currentStudy) return;
   loading.value = true;
   try {
+    if (!permissionMatrix.value) {
+      await loadPermissionMatrix();
+    }
     const batchLimit = 500;
     let skip = 0;
     const allItems: any[] = [];
@@ -418,6 +435,7 @@ onMounted(async () => {
   if (!auth.user && auth.token) {
     await auth.fetchMe().catch(() => {});
   }
+  await loadPermissionMatrix().catch(() => {});
   ensureAccess();
   await loadUsers();
   await loadLogs();

frontend/src/views/admin/ProjectDetail.test.ts

@@ -83,11 +83,11 @@ describe("ProjectDetail setup draft publish workflow", () => {
 });
 
 describe("project detail management role", () => {
-  it("allows only current project administrators and PMs to manage setup content", () => {
+  it("allows only system administrators to manage setup content", () => {
     const source = readProjectDetail();
 
-    expect(source).toContain("project.value?.role_in_study");
-    expect(source).toContain('["ADMIN", "PM"].includes(setupRole.value)');
+    expect(source).toContain("isSystemAdmin(authStore.user)");
+    expect(source).not.toContain('setupRole.value === "ADMIN"');
     expect(source).not.toContain("project.value?.role_in_study || authStore.user?.role");
   });
 });

frontend/src/views/admin/ProjectDetail.vue

@@ -1932,6 +1932,7 @@ import StateLoading from "../../components/StateLoading.vue";
 import { useStudyStore } from "../../store/study";
 import { useAuthStore } from "../../store/auth";
 import { TEXT, requiredMessage } from "../../locales";
+import { isSystemAdmin } from "../../utils/roles";
 import { groupErrorsBySection, parseFieldPath, type SetupValidationError } from "../../utils/setupFieldLocator";
 import { buildSetupReadableDiffRows, serializeDiffValue, type SetupDiffRow } from "../../utils/setupDiffRows";
 import {
@@ -2402,8 +2403,7 @@ const setupDraft = reactive<SetupConfigDraft>({
 
 const storageKey = computed(() => `ctms_setup_config_draft_${String(route.params.projectId || "")}`);
 const projectDraftStorageKey = computed(() => `ctms_setup_project_draft_${String(route.params.projectId || "")}`);
-const setupRole = computed(() => String(project.value?.role_in_study || "").toUpperCase());
-const canManageSetup = computed(() => ["ADMIN", "PM"].includes(setupRole.value));
+const canManageSetup = computed(() => isSystemAdmin(authStore.user));
 const isPreviewView = computed(() => setupViewMode.value === "preview");
 const isPublishedVersionView = computed(() => setupViewMode.value === "published");
 const isPublishedView = computed(() => isPreviewView.value || isPublishedVersionView.value);
@@ -4419,6 +4419,7 @@ const refreshProjectDisplayAfterPublish = async () => {
     formBaselineSnapshot.value = serializeFormForCompare();
     if (studyStore.currentStudy?.id === project.value.id) {
       studyStore.setCurrentStudy({ ...(studyStore.currentStudy as Study), ...project.value } as Study);
+      await studyStore.loadCurrentStudyPermissions().catch(() => {});
     }
   } catch {
     // Ignore refresh errors to avoid breaking publish success flow.
@@ -5559,9 +5560,10 @@ const confirmPublishConfig = async () => {
   }
 };
 
-const enterProject = () => {
+const enterProject = async () => {
   if (!project.value) return;
   studyStore.setCurrentStudy(project.value);
+  await studyStore.loadCurrentStudyPermissions().catch(() => {});
   router.push("/project/overview");
 };
 const goMembers = () => {

frontend/src/views/admin/ProjectPermissions.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const readProjectPermissions = () => readFileSync(resolve(__dirname, "./ProjectPermissions.vue"), "utf8");
+
+describe("project permissions matrix", () => {
+  it("locks management backend permissions to admin and PM roles", () => {
+    const source = readProjectPermissions();
+
+    expect(source).toContain('new Set(["project_members", "sites", "audit_export"])');
+    expect(source).toContain('role === "PM" || role === "ADMIN"');
+    expect(source).toContain("!canConfigureAdminModule(role, mod.key)");
+    expect(source).toContain("!canConfigureAdminModule(role, moduleKey)");
+  });
+});

frontend/src/views/admin/ProjectPermissions.vue

@@ -0,0 +1,475 @@
+<template>
+  <div class="permission-page">
+    <div class="permission-shell unified-shell" v-loading="loading">
+      <div class="permission-header unified-action-bar">
+        <div class="permission-title">
+          <div class="title-icon">
+            <el-icon><Key /></el-icon>
+          </div>
+          <div>
+            <h2>权限管理</h2>
+          </div>
+        </div>
+        <div class="permission-project-meta">
+          <span class="meta-item">
+            <span class="meta-label">项目编号</span>
+            <strong>{{ project?.code || "-" }}</strong>
+          </span>
+          <span class="meta-separator" />
+          <span class="meta-item meta-item--name">
+            <span class="meta-label">项目名称</span>
+            <strong>{{ project?.name || "-" }}</strong>
+          </span>
+        </div>
+        <div class="permission-actions">
+          <el-button type="primary" :loading="saving" :disabled="!dirty" @click="save">
+            <el-icon><Check /></el-icon>
+            保存
+          </el-button>
+        </div>
+      </div>
+
+      <section class="permission-matrix unified-section">
+        <div class="matrix-scroll">
+          <div class="matrix-grid" :style="{ '--module-count': modules.length }">
+            <div class="matrix-head matrix-role-head">角色</div>
+            <div v-for="mod in modules" :key="mod.key" class="matrix-head module-head" :class="{ 'is-admin-module': isAdminModule(mod.key) }">
+              <span>{{ mod.label }}</span>
+            </div>
+
+            <template v-for="role in roleOrder" :key="role">
+              <div class="role-cell">
+                <span class="role-badge" :class="`role-badge--${role.toLowerCase()}`">
+                  {{ roleLabel(role) }}
+                </span>
+              </div>
+              <div v-for="mod in modules" :key="`${role}-${mod.key}`" class="permission-cell" :class="{ 'is-admin-module': isAdminModule(mod.key), 'is-readonly-module': !isWriteSupported(mod) }">
+                <label class="perm-check" :class="{ 'is-checked': matrix[role]?.[mod.key]?.read, 'is-disabled': isReadLocked(role, mod) }">
+                  <input
+                    type="checkbox"
+                    :disabled="isReadLocked(role, mod)"
+                    :checked="!!matrix[role]?.[mod.key]?.read"
+                    @change="setPermission(role, mod.key, 'read', ($event.target as HTMLInputElement).checked)"
+                  />
+                  <span class="check-box" />
+                  <span>读</span>
+                </label>
+                <label v-if="isWriteSupported(mod)" class="perm-check" :class="{ 'is-checked': matrix[role]?.[mod.key]?.write, 'is-disabled': isWriteLocked(role, mod) }">
+                  <input
+                    type="checkbox"
+                    :disabled="isWriteLocked(role, mod)"
+                    :checked="!!matrix[role]?.[mod.key]?.write"
+                    @change="setPermission(role, mod.key, 'write', ($event.target as HTMLInputElement).checked)"
+                  />
+                  <span class="check-box" />
+                  <span>写</span>
+                </label>
+              </div>
+            </template>
+          </div>
+        </div>
+      </section>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, onMounted, ref } from "vue";
+import { useRoute } from "vue-router";
+import { ElMessage } from "element-plus";
+import { Check, Key } from "@element-plus/icons-vue";
+import { fetchStudyDetail } from "../../api/studies";
+import { fetchProjectRolePermissions, updateProjectRolePermissions } from "../../api/projectPermissions";
+import type { ProjectPermissionActionState, ProjectPermissionMatrix, ProjectPermissionModule, Study, UserRole } from "../../types/api";
+import { displayEnum } from "../../utils/display";
+import { TEXT } from "../../locales";
+
+const route = useRoute();
+const projectId = computed(() => route.params.projectId as string);
+const roleOrder: UserRole[] = ["ADMIN", "PM", "CRA", "PV", "IMP", "QA"];
+
+const loading = ref(false);
+const saving = ref(false);
+const project = ref<Study | null>(null);
+const modules = ref<ProjectPermissionModule[]>([]);
+const matrix = ref<ProjectPermissionMatrix>({} as ProjectPermissionMatrix);
+const initialSnapshot = ref("");
+
+const roleLabel = (role: UserRole) => displayEnum(TEXT.enums.userRole, role);
+const adminModuleKeys = new Set(["project_members", "sites", "audit_export"]);
+const isAdminModule = (moduleKey: string) => adminModuleKeys.has(moduleKey);
+const canConfigureAdminModule = (role: UserRole, moduleKey: string) => !isAdminModule(moduleKey) || role === "PM" || role === "ADMIN";
+const isWriteSupported = (mod: ProjectPermissionModule) => mod.writable !== false;
+const findModule = (moduleKey: string) => modules.value.find((mod) => mod.key === moduleKey);
+const isReadLocked = (role: UserRole, mod?: ProjectPermissionModule) => role === "ADMIN" || (mod ? !canConfigureAdminModule(role, mod.key) : false);
+const isWriteLocked = (role: UserRole, mod: ProjectPermissionModule) => role === "ADMIN" || !isWriteSupported(mod) || !canConfigureAdminModule(role, mod.key);
+
+const normalizeMatrix = (source: ProjectPermissionMatrix): ProjectPermissionMatrix => {
+  const normalized = {} as ProjectPermissionMatrix;
+  for (const role of roleOrder) {
+    normalized[role] = {};
+    for (const mod of modules.value) {
+      const item = source?.[role]?.[mod.key] || { read: false, write: false };
+      const canWrite = isWriteSupported(mod);
+      const canConfigure = canConfigureAdminModule(role, mod.key);
+      const write = role === "ADMIN" ? canWrite : canConfigure && canWrite ? !!item.write : false;
+      const read = role === "ADMIN" ? true : canConfigure && (!!item.read || write);
+      normalized[role][mod.key] = { read, write };
+    }
+  }
+  return normalized;
+};
+
+const snapshot = (source: ProjectPermissionMatrix) => JSON.stringify(normalizeMatrix(source));
+const dirty = computed(() => snapshot(matrix.value) !== initialSnapshot.value);
+
+const ensureCell = (role: UserRole, moduleKey: string): ProjectPermissionActionState => {
+  if (!matrix.value[role]) matrix.value[role] = {};
+  if (!matrix.value[role][moduleKey]) matrix.value[role][moduleKey] = { read: false, write: false };
+  return matrix.value[role][moduleKey];
+};
+
+const setPermission = (role: UserRole, moduleKey: string, action: "read" | "write", value: boolean) => {
+  const mod = findModule(moduleKey);
+  if (role === "ADMIN" || !mod || !canConfigureAdminModule(role, moduleKey) || (action === "write" && !isWriteSupported(mod))) return;
+  const cell = ensureCell(role, moduleKey);
+  cell[action] = value;
+  if (action === "write" && value) cell.read = true;
+  if (action === "read" && !value) cell.write = false;
+};
+
+const load = async () => {
+  if (!projectId.value) return;
+  loading.value = true;
+  try {
+    const [projectResp, permissionResp] = await Promise.all([
+      fetchStudyDetail(projectId.value),
+      fetchProjectRolePermissions(projectId.value),
+    ]);
+    project.value = projectResp.data;
+    modules.value = permissionResp.data.modules;
+    matrix.value = normalizeMatrix(permissionResp.data.roles);
+    initialSnapshot.value = snapshot(matrix.value);
+  } catch (error: any) {
+    ElMessage.error(error?.response?.data?.detail || "加载权限失败");
+  } finally {
+    loading.value = false;
+  }
+};
+
+const save = async () => {
+  if (!projectId.value) return;
+  saving.value = true;
+  try {
+    const payload = { roles: normalizeMatrix(matrix.value) };
+    const { data } = await updateProjectRolePermissions(projectId.value, payload);
+    modules.value = data.modules;
+    matrix.value = normalizeMatrix(data.roles);
+    initialSnapshot.value = snapshot(matrix.value);
+    ElMessage.success("权限已保存");
+  } catch (error: any) {
+    ElMessage.error(error?.response?.data?.detail || "保存权限失败");
+  } finally {
+    saving.value = false;
+  }
+};
+
+onMounted(load);
+</script>
+
+<style scoped>
+.permission-page {
+  display: flex;
+  flex-direction: column;
+}
+
+.permission-shell {
+  background: transparent;
+}
+
+.permission-header {
+  display: grid;
+  grid-template-columns: minmax(220px, 1fr) auto minmax(220px, 1fr);
+  align-items: center;
+  justify-content: space-between;
+  min-height: 52px;
+  padding-top: 10px;
+  padding-bottom: 10px;
+}
+
+.permission-title {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+
+.title-icon {
+  display: grid;
+  place-items: center;
+  width: 34px;
+  height: 34px;
+  border-radius: 8px;
+  color: #0f766e;
+  background: #e7f8f5;
+  border: 1px solid #b9ebe2;
+}
+
+.permission-title h2 {
+  margin: 0;
+  font-size: 18px;
+  line-height: 1.2;
+  color: #172033;
+}
+
+.permission-project-meta {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  max-width: min(720px, 48vw);
+  color: #172033;
+  white-space: nowrap;
+  justify-self: center;
+}
+
+.meta-item {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+}
+
+.meta-item--name strong {
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.meta-label {
+  color: #64748b;
+  font-size: 12px;
+  font-weight: 600;
+}
+
+.meta-item strong {
+  min-width: 0;
+  font-size: 14px;
+  font-weight: 800;
+}
+
+.meta-separator {
+  width: 1px;
+  height: 18px;
+  background: #dbe3ee;
+}
+
+.permission-actions {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-left: auto;
+  justify-content: flex-end;
+  justify-self: end;
+}
+
+.permission-actions :deep(.el-button) {
+  height: 30px;
+  padding: 0 12px;
+  font-size: 12px;
+}
+
+.permission-matrix {
+  padding: 0;
+  overflow: hidden;
+}
+
+.matrix-scroll {
+  overflow-x: auto;
+}
+
+.matrix-grid {
+  --module-count: 6;
+  display: grid;
+  grid-template-columns: 108px repeat(var(--module-count), minmax(82px, 1fr));
+  min-width: 1320px;
+  border-top: 1px solid #e6ebf2;
+  border-left: 1px solid #e6ebf2;
+}
+
+.matrix-head,
+.role-cell,
+.permission-cell {
+  border-right: 1px solid #e6ebf2;
+  border-bottom: 1px solid #e6ebf2;
+  background: #fff;
+}
+
+.matrix-head {
+  min-height: 46px;
+  padding: 8px 10px;
+  background: #f8fafc;
+  color: #334155;
+  font-weight: 700;
+  font-size: 13px;
+}
+
+.matrix-head.is-admin-module {
+  position: relative;
+  background: #fff7ed;
+  color: #9a3412;
+}
+
+.matrix-head.is-admin-module::before {
+  content: "";
+  position: absolute;
+  left: 0;
+  top: 0;
+  width: 100%;
+  height: 3px;
+  background: #f97316;
+}
+
+.matrix-role-head {
+  display: flex;
+  align-items: center;
+}
+
+.module-head {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+}
+
+.role-cell {
+  display: flex;
+  align-items: center;
+  padding: 8px 10px;
+}
+
+.permission-cell {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 6px;
+  padding: 7px 8px;
+}
+
+.permission-cell.is-admin-module {
+  background: #fffaf3;
+}
+
+.role-badge {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  min-width: 68px;
+  padding: 4px 10px;
+  border-radius: 999px;
+  font-weight: 700;
+  font-size: 12px;
+}
+
+.role-badge--admin {
+  color: #1d4ed8;
+  background: #dbeafe;
+}
+
+.role-badge--pm {
+  color: #047857;
+  background: #d1fae5;
+}
+
+.role-badge--cra {
+  color: #7c3aed;
+  background: #ede9fe;
+}
+
+.role-badge--pv {
+  color: #be123c;
+  background: #ffe4e6;
+}
+
+.role-badge--imp {
+  color: #b45309;
+  background: #fef3c7;
+}
+
+.role-badge--qa {
+  color: #475569;
+  background: #e2e8f0;
+}
+
+.perm-check {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  min-width: 48px;
+  color: #64748b;
+  font-weight: 700;
+  font-size: 12px;
+  cursor: pointer;
+  user-select: none;
+}
+
+.perm-check input {
+  position: absolute;
+  opacity: 0;
+  pointer-events: none;
+}
+
+.check-box {
+  width: 15px;
+  height: 15px;
+  border-radius: 5px;
+  border: 1.5px solid #cbd5e1;
+  background: #fff;
+  box-shadow: inset 0 0 0 1.5px #fff;
+}
+
+.perm-check.is-checked {
+  color: #1d4ed8;
+}
+
+.perm-check.is-checked .check-box {
+  border-color: #2563eb;
+  background: #2563eb;
+}
+
+.perm-check.is-checked .check-box::after {
+  content: "";
+  display: block;
+  width: 6px;
+  height: 3px;
+  margin: 3px auto 0;
+  border-left: 1.8px solid #fff;
+  border-bottom: 1.8px solid #fff;
+  transform: rotate(-45deg);
+}
+
+.perm-check.is-disabled {
+  cursor: not-allowed;
+  opacity: 0.58;
+}
+
+@media (max-width: 860px) {
+  .permission-header,
+  .permission-title,
+  .permission-actions {
+    align-items: stretch;
+  }
+
+  .permission-header {
+    flex-direction: column;
+    gap: 14px;
+  }
+
+  .permission-project-meta {
+    max-width: none;
+    white-space: normal;
+  }
+
+  .permission-actions {
+    margin-left: 0;
+  }
+}
+</style>

frontend/src/views/admin/Projects.vue

@@ -30,12 +30,15 @@
               <el-tag v-else type="success" effect="plain" round>未锁定</el-tag>
             </template>
           </el-table-column>
-          <el-table-column :label="TEXT.common.labels.actions" width="240" align="center">
+          <el-table-column :label="TEXT.common.labels.actions" width="176" align="center">
             <template #default="scope">
               <div class="action-row">
                 <el-tooltip :content="TEXT.modules.adminProjects.members" placement="top">
                   <el-button link type="primary" :icon="User" class="action-btn" @click="goMembers(scope.row)" />
                 </el-tooltip>
+                <el-tooltip content="权限管理" placement="top">
+                  <el-button link type="primary" :icon="Key" class="action-btn" @click="goPermissions(scope.row)" />
+                </el-tooltip>
                 <el-tooltip :content="TEXT.modules.adminProjects.sites" placement="top">
                   <el-button link type="primary" :icon="OfficeBuilding" class="action-btn" @click="goSites(scope.row)" />
                 </el-tooltip>
@@ -68,7 +71,7 @@
 import { onMounted, ref } from "vue";
 import { useRouter } from "vue-router";
 import { ElMessage, ElMessageBox } from "element-plus";
-import { User, OfficeBuilding, ArrowRight, Delete, Lock } from "@element-plus/icons-vue";
+import { User, OfficeBuilding, ArrowRight, Delete, Lock, Key } from "@element-plus/icons-vue";
 import { fetchStudies, deleteStudy, lockStudy } from "../../api/studies";
 import type { Study } from "../../types/api";
 import ProjectForm from "./ProjectForm.vue";
@@ -108,6 +111,10 @@ const goSites = (row: Study) => {
   router.push(`/admin/projects/${row.id}/sites`);
 };
 
+const goPermissions = (row: Study) => {
+  router.push(`/admin/projects/${row.id}/permissions`);
+};
+
 const handleDelete = async (study: Study) => {
   try {
     // 第一次确认
@@ -197,8 +204,9 @@ const handleLockToggle = async (study: Study) => {
   }
 };
 
-const enterStudy = (row: Study) => {
+const enterStudy = async (row: Study) => {
   studyStore.setCurrentStudy(row);
+  await studyStore.loadCurrentStudyPermissions().catch(() => {});
   router.push("/project/overview");
 };
 
@@ -244,7 +252,8 @@ onMounted(() => {
 .action-row {
   display: inline-flex;
   align-items: center;
-  gap: 10px;
+  gap: 4px;
+  justify-content: center;
   white-space: nowrap;
 }
 
@@ -263,20 +272,27 @@ onMounted(() => {
 }
 
 .action-btn {
-  font-size: 18px;
-  padding: 4px;
-  margin: 0 2px;
-  transition: all 0.3s;
+  width: 28px;
+  height: 28px;
+  min-height: 28px;
+  font-size: 16px;
+  padding: 0;
+  margin: 0;
+  border-radius: 4px;
+  transition: background-color 0.2s, color 0.2s, transform 0.2s;
+}
+
+.action-row :deep(.el-button + .el-button) {
+  margin-left: 0;
 }
 
 .action-btn:hover {
-  transform: scale(1.1);
+  transform: translateY(-1px);
   background-color: #f3f4f6;
-  border-radius: 4px;
 }
 
 .enter-btn {
-  font-size: 18px;
+  font-size: 16px;
   font-weight: bold;
 }
 </style>

frontend/src/views/ia/KnowledgeNotes.vue

@@ -24,7 +24,7 @@
             <el-button @click="resetFilters">{{ TEXT.common.actions.reset }}</el-button>
           </div>
           <div class="filter-spacer"></div>
-          <el-button type="primary" @click="goNew">
+          <el-button v-if="canWriteSharedLibrary" type="primary" @click="goNew">
             {{ TEXT.modules.knowledgeNotes.newTitle }}
           </el-button>
         </el-form>
@@ -48,6 +48,7 @@
           <el-table-column :label="TEXT.common.labels.actions" width="120">
             <template #default="scope">
               <el-button
+                v-if="canWriteSharedLibrary"
                 link
                 type="danger"
                 size="small"
@@ -75,10 +76,12 @@ import { useStudyStore } from "../../store/study";
 import { listKnowledgeNotes, deleteKnowledgeNote } from "../../api/knowledgeNotes";
 import { fetchSites } from "../../api/sites";
 import { displayDateTime } from "../../utils/display";
+import { usePermission } from "../../utils/permission";
 import { TEXT } from "../../locales";
 
 const router = useRouter();
 const study = useStudyStore();
+const { can } = usePermission();
 const loading = ref(false);
 const items = ref<any[]>([]);
 const sites = ref<any[]>([]);
@@ -109,6 +112,7 @@ const filteredItems = computed(() => {
 const sortedItems = computed(() =>
   [...filteredItems.value].sort((a, b) => Number(isInactiveSite(a?.site_name)) - Number(isInactiveSite(b?.site_name)))
 );
+const canWriteSharedLibrary = computed(() => can("shared.library.write"));
 
 const loadSites = async () => {
   const studyId = study.currentStudy?.id;

frontend/src/views/knowledge/NoteDetail.vue

@@ -38,11 +38,13 @@ import { useStudyStore } from "../../store/study";
 import { getKnowledgeNote } from "../../api/knowledgeNotes";
 import { fetchSites } from "../../api/sites";
 import AttachmentList from "../../components/attachments/AttachmentList.vue";
+import { usePermission } from "../../utils/permission";
 import { TEXT } from "../../locales";
 
 const route = useRoute();
 const router = useRouter();
 const study = useStudyStore();
+const { can } = usePermission();
 const loading = ref(false);
 const noteId = route.params.noteId as string;
 const studyId = study.currentStudy?.id || "";
@@ -62,7 +64,8 @@ const siteActiveMap = computed(() => {
   });
   return map;
 });
-const isReadOnly = computed(() => !!detail.site_name && siteActiveMap.value[detail.site_name] === false);
+const canWriteSharedLibrary = computed(() => can("shared.library.write"));
+const isReadOnly = computed(() => !canWriteSharedLibrary.value || (!!detail.site_name && siteActiveMap.value[detail.site_name] === false));
 
 const loadSites = async () => {
   if (!studyId) return;
@@ -89,7 +92,7 @@ const load = async () => {
 
 const goEdit = () => {
   if (isReadOnly.value) {
-    ElMessage.warning("中心已停用");
+    ElMessage.warning(canWriteSharedLibrary.value ? "中心已停用" : "权限不足");
     return;
   }
   router.push(`/knowledge/notes/${noteId}/edit`);

frontend/src/views/knowledge/NoteForm.vue

@@ -51,11 +51,13 @@ import { createKnowledgeNote, getKnowledgeNote, updateKnowledgeNote } from "../.
 import { fetchSites } from "../../api/sites";
 import AttachmentList from "../../components/attachments/AttachmentList.vue";
 import StateEmpty from "../../components/StateEmpty.vue";
+import { usePermission } from "../../utils/permission";
 import { TEXT } from "../../locales";
 
 const route = useRoute();
 const router = useRouter();
 const study = useStudyStore();
+const { can } = usePermission();
 const saving = ref(false);
 const sites = ref<any[]>([]);
 
@@ -77,7 +79,8 @@ const siteActiveMap = computed(() => {
   });
   return map;
 });
-const isReadOnly = computed(() => isEdit.value && !!form.site_name && siteActiveMap.value[form.site_name] === false);
+const canWriteSharedLibrary = computed(() => can("shared.library.write"));
+const isReadOnly = computed(() => !canWriteSharedLibrary.value || (isEdit.value && !!form.site_name && siteActiveMap.value[form.site_name] === false));
 
 const loadSites = async () => {
   if (!studyId.value) return;
@@ -107,7 +110,7 @@ const load = async () => {
 const submit = async () => {
   if (!studyId.value) return;
   if (isReadOnly.value) {
-    ElMessage.warning("中心已停用");
+    ElMessage.warning(canWriteSharedLibrary.value ? "中心已停用" : "权限不足");
     return;
   }
   if (!form.site_name) {

frontend/src/views/workbench/MyWorkbench.test.ts

@@ -14,7 +14,11 @@ describe("workbench project role context", () => {
     expect(source).toContain("study.currentStudyRole");
     expect(source).not.toContain('const role = computed(() => auth.user?.role || "")');
     expect(source).not.toContain("role_in_study || auth.user?.role");
-    expect(source).toContain('projectRole.value === "PM"');
-    expect(source).toContain('projectRole.value === "CRA"');
+    expect(source).toContain('const isCraWorkbench = computed(() => projectRole.value === "CRA")');
+    expect(source).toContain("const craRequests = isCraWorkbench.value");
+    expect(source).not.toContain('projectRole.value === "PM"');
+    expect(source).not.toContain('projectRole.value === "PV"');
+    expect(source).toContain("quickActionCandidates");
+    expect(source).toContain("canAccessProjectPath(action.path)");
   });
 });

frontend/src/views/workbench/MyWorkbench.vue

@@ -22,7 +22,7 @@
 
     <template v-if="currentStudyId">
       <!-- 汇总框 -->
-      <CenterSummary :data="centerSummaryData" :loading="loading" />
+      <CenterSummary v-if="isCraWorkbench" :data="centerSummaryData" :loading="loading" />
 
       <!-- 核心看板层 -->
       <div class="stats-row">
@@ -128,6 +128,7 @@ import { Right, Timer, Warning, Money, Collection, RefreshRight, ArrowRight } fr
 import StateEmpty from "../../components/StateEmpty.vue";
 import { displayEnum } from "../../utils/display";
 import { getProjectRole, isSystemAdmin } from "../../utils/roles";
+import { getProjectRoutePermission, hasProjectPermission } from "../../utils/projectRoutePermissions";
 import { TEXT } from "../../locales";
 import type { NotificationItem } from "../../types/notifications";
 import type { VisitLostItem } from "../../types/visits";
@@ -161,25 +162,23 @@ const projectRole = computed(() => {
 });
 const roleLabel = computed(() => displayEnum(TEXT.enums.userRole, projectRole.value));
 const emptyText = TEXT.modules.workbench.quickEmpty;
+const isCraWorkbench = computed(() => projectRole.value === "CRA");
+const canAccessProjectPath = (path: string) =>
+  hasProjectPermission(study.currentPermissions?.roles, projectRole.value, getProjectRoutePermission(path), isSystemAdmin(auth.user));
+const quickActionCandidates = [
+  { label: TEXT.modules.workbench.feasibilityEthics, path: "/startup/feasibility-ethics", icon: Timer },
+  { label: TEXT.modules.workbench.aeList, path: "/subjects", icon: Warning },
+  { label: TEXT.modules.workbench.contractList, path: "/finance/contracts", icon: Money },
+  { label: TEXT.modules.workbench.medicalConsult, path: "/knowledge/medical-consult", icon: Collection },
+];
 const quickActions = computed(() => {
   if (!currentStudyId.value) return [];
-  if (projectRole.value === "CRA")
-    return [
-      { label: TEXT.modules.workbench.feasibilityEthics, path: "/startup/feasibility-ethics", icon: Timer },
-      { label: TEXT.modules.workbench.aeList, path: "/subjects", icon: Warning },
-    ];
-  if (projectRole.value === "PM")
-    return [
-      { label: TEXT.modules.workbench.feasibilityEthics, path: "/startup/feasibility-ethics", icon: Timer },
-      { label: TEXT.modules.workbench.contractList, path: "/finance/contracts", icon: Money },
-      { label: TEXT.modules.workbench.medicalConsult, path: "/knowledge/medical-consult", icon: Collection },
-    ];
-  if (projectRole.value === "PV") return [{ label: TEXT.modules.workbench.aeList, path: "/subjects", icon: Warning }];
-  return [{ label: TEXT.modules.workbench.feasibilityEthics, path: "/startup/feasibility-ethics", icon: Timer }];
+  return quickActionCandidates.filter((action) => canAccessProjectPath(action.path));
 });
 
 const todayMorePath = computed(() => "/subjects");
 const overdueMorePath = computed(() => "/subjects");
+const canReadRiskIssues = computed(() => canAccessProjectPath("/risk-issues/sae"));
 
 const isOverdue = (d?: string | null) => {
   if (!d) return false;
@@ -207,14 +206,17 @@ const loadData = async () => {
   loading.value = true;
   try {
     const studyId = currentStudyId.value;
-    const aesReq = fetchAes(studyId, { status: "NEW", limit: 50 });
-    const overdueReq = fetchAes(studyId, { overdue: true, limit: 50 });
+    const shouldLoadAes = canReadRiskIssues.value;
+    const craRequests = isCraWorkbench.value;
+    const emptyListResponse = { data: { items: [] } } as any;
+    const aesReq = shouldLoadAes ? fetchAes(studyId, { status: "NEW", limit: 50 }) : Promise.resolve(emptyListResponse);
+    const overdueReq = shouldLoadAes ? fetchAes(studyId, { overdue: true, limit: 50 }) : Promise.resolve(emptyListResponse);
     const [aesRes, overdueRes, noticeRes, lostRes, centerRes] = await Promise.allSettled([
       aesReq,
       overdueReq,
       listNotifications(studyId, { limit: 5 }),
-      fetchLostVisits(studyId, { limit: 20 }),
-      fetchCenterSummary(studyId),
+      craRequests ? fetchLostVisits(studyId, { limit: 20 }) : Promise.resolve({ data: [] }),
+      craRequests ? fetchCenterSummary(studyId) : Promise.resolve({ data: [] }),
     ]);
     const aes = aesRes.status === "fulfilled" ? (aesRes.value.data.items || aesRes.value.data || []) : [];
     const overdueAes = overdueRes.status === "fulfilled" ? (overdueRes.value.data.items || overdueRes.value.data || []) : [];
@@ -237,16 +239,13 @@ const buildSections = (aes: any[], overdueAes: any[], lost: VisitLostItem[]) =>
   const openAes = aes.filter((a) => a.status !== "CLOSED");
   const lostVisitItems = lost.map(toLostVisitItem);
 
-  if (projectRole.value === "CRA") {
+  if (isCraWorkbench.value) {
     todayList.value = openAes.slice(0, 5).map(toAeItem);
     overdueList.value = [...lostVisitItems, ...overdueAes.map(toAeItem)].slice(0, 5);
-  } else if (projectRole.value === "PM" || projectRole.value === "ADMIN") {
-    todayList.value = openAes.slice(0, 5).map(toAeItem);
-    overdueList.value = [...lostVisitItems, ...overdueAes.map(toAeItem)].slice(0, 5);
-  } else if (projectRole.value === "PV") {
+  } else if (canReadRiskIssues.value) {
     const aeOpen = aes.filter((a) => a.status !== "CLOSED");
     todayList.value = aeOpen.slice(0, 5).map(toAeItem);
-    overdueList.value = [...lostVisitItems, ...overdueAes.map(toAeItem)].slice(0, 5);
+    overdueList.value = overdueAes.map(toAeItem).slice(0, 5);
   }
 };