完善项目级权限与项目管理入口

- 新增项目成员候选用户接口，避免 PM 读取全局用户列表
- 按项目角色和权限矩阵控制项目管理、成员、中心与审计入口
- 合并侧边栏管理后台入口，统一从项目管理进入成员等模块
- 加强成员管理安全约束，禁止 PM 修改自己、系统管理员或更高权限角色
- 修复多项目角色缓存串用问题，并补充前后端回归测试

backend/app/api/v1/members.py

@@ -10,10 +10,20 @@ from app.crud import member as member_crud
 from app.crud import study as study_crud
 from app.crud import user as user_crud
 from app.schemas.member import StudyMemberCreate, StudyMemberRead, StudyMemberReadWithUser, StudyMemberUpdate
-from app.schemas.user import UserDisplay
+from app.schemas.user import UserResponse
 
 router = APIRouter()
 
+PROJECT_ROLE_RANK = {
+    "ADMIN": 100,
+    "PM": 80,
+    "QA": 60,
+    "PV": 50,
+    "MEDICAL_REVIEW": 50,
+    "CRA": 40,
+    "IMP": 40,
+}
+
 
 async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     study = await study_crud.get(db, study_id)
@@ -22,6 +32,44 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     return study
 
 
+def _role_value(user) -> str:
+    return user.role.value if hasattr(user.role, "value") else str(user.role)
+
+
+def _role_rank(role: str | None) -> int:
+    return PROJECT_ROLE_RANK.get(role or "", 0)
+
+
+async def _ensure_member_mutation_allowed(
+    db: AsyncSession,
+    study_id: uuid.UUID,
+    current_user,
+    *,
+    target_member=None,
+    target_role: str | None = None,
+) -> None:
+    if _role_value(current_user) == "ADMIN":
+        return
+
+    actor_member = await member_crud.get_member(db, study_id, current_user.id)
+    actor_role = actor_member.role_in_study if actor_member else None
+    actor_rank = _role_rank(actor_role)
+
+    if target_member and target_member.user_id == current_user.id:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能修改自己的项目成员权限")
+
+    if target_member:
+        target_user = await user_crud.get_by_id(db, target_member.user_id)
+        if _role_value(target_user) == "ADMIN":
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能修改系统管理员账号的项目权限")
+
+    if target_member and _role_rank(target_member.role_in_study) > actor_rank:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能修改权限高于自己的项目成员")
+
+    if target_role and _role_rank(target_role) > actor_rank:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不能授予高于自己的项目角色")
+
+
 @router.post(
     "/",
     response_model=StudyMemberRead,
@@ -35,8 +83,16 @@ async def add_member(
     current_user=Depends(get_current_user),
 ) -> StudyMemberRead:
     await _ensure_study_exists(db, study_id)
+    await _ensure_member_mutation_allowed(db, study_id, current_user, target_role=member_in.role_in_study)
     existing = await member_crud.get_member(db, study_id, member_in.user_id)
     if existing:
+        await _ensure_member_mutation_allowed(
+            db,
+            study_id,
+            current_user,
+            target_member=existing,
+            target_role=member_in.role_in_study,
+        )
         if not existing.is_active:
             updated = await member_crud.update_member(
                 db,
@@ -106,12 +162,28 @@ async def list_members(
                 role_in_study=m.role_in_study,
                 is_active=m.is_active,
                 added_at=m.added_at,
-                user=UserDisplay.model_validate(user) if user else None,
+                user=UserResponse.model_validate(user) if user else None,
             )
         )
     return result
 
 
+@router.get(
+    "/candidates",
+    response_model=list[UserResponse],
+    dependencies=[Depends(require_study_permission("project_members", "write"))],
+)
+async def list_member_candidates(
+    study_id: uuid.UUID,
+    skip: int = 0,
+    limit: int = 500,
+    db: AsyncSession = Depends(get_db_session),
+) -> list[UserResponse]:
+    await _ensure_study_exists(db, study_id)
+    users = await user_crud.list_active_member_candidates_for_study(db, study_id, skip=skip, limit=limit)
+    return [UserResponse.model_validate(user) for user in users]
+
+
 @router.patch(
     "/{member_id}",
     response_model=StudyMemberRead,
@@ -128,6 +200,13 @@ async def update_member(
     member = await member_crud.get_member_by_id(db, member_id)
     if not member or member.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="成员不存在")
+    await _ensure_member_mutation_allowed(
+        db,
+        study_id,
+        current_user,
+        target_member=member,
+        target_role=member_in.role_in_study,
+    )
     before_data = {"role_in_study": member.role_in_study, "is_active": member.is_active}
     updated = await member_crud.update_member(db, member, member_in)
     after_data = {"role_in_study": updated.role_in_study, "is_active": updated.is_active}
@@ -159,6 +238,7 @@ async def remove_member(
     member = await member_crud.get_member_by_id(db, member_id)
     if not member or member.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="成员不存在")
+    await _ensure_member_mutation_allowed(db, study_id, current_user, target_member=member)
     before_data = {"role_in_study": member.role_in_study, "is_active": member.is_active}
     removed = await member_crud.remove_member(db, member)
     await audit_crud.log_action(

backend/app/api/v1/project_permissions.py

@@ -6,7 +6,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member
+from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_permission
 from app.core.project_permissions import PROJECT_PERMISSION_MODULES, get_project_role_permissions, replace_project_role_permissions
 from app.crud import audit as audit_crud
 from app.crud import study as study_crud
@@ -33,7 +33,7 @@ async def get_permissions(
     return ProjectRolePermissionsRead(modules=modules, roles=roles)
 
 
-@router.put("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_roles(["ADMIN"]))])
+@router.put("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_study_permission("project_members", "write"))])
 async def update_permissions(
     study_id: uuid.UUID,
     payload: ProjectRolePermissionsUpdate,

backend/app/crud/user.py

@@ -85,6 +85,29 @@ async def list_users(db: AsyncSession, skip: int = 0, limit: int = 100) -> Seque
     return result.scalars().all()
 
 
+async def list_active_member_candidates_for_study(
+    db: AsyncSession,
+    study_id: uuid.UUID,
+    skip: int = 0,
+    limit: int = 100,
+) -> Sequence[User]:
+    existing_member = (
+        select(StudyMember.id)
+        .where(StudyMember.study_id == study_id, StudyMember.user_id == User.id)
+        .exists()
+    )
+    stmt = (
+        select(User)
+        .where(User.status == UserStatus.ACTIVE)
+        .where(~existing_member)
+        .order_by(User.full_name.asc(), User.email.asc())
+        .offset(skip)
+        .limit(limit)
+    )
+    result = await db.execute(stmt)
+    return result.scalars().all()
+
+
 async def count_active_admins(db: AsyncSession) -> int:
     result = await db.execute(
         select(func.count())

backend/app/schemas/member.py

@@ -3,7 +3,7 @@ from datetime import datetime
 from typing import Literal, Optional
 
 from pydantic import BaseModel, ConfigDict, Field
-from app.schemas.user import UserDisplay
+from app.schemas.user import UserResponse
 
 StudyRole = Literal["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA", "ADMIN"]
 
@@ -31,4 +31,4 @@ class StudyMemberRead(BaseModel):
 
 
 class StudyMemberReadWithUser(StudyMemberRead):
-    user: Optional[UserDisplay] = None
+    user: Optional[UserResponse] = None

backend/tests/test_project_management_permissions_static.py

@@ -19,6 +19,13 @@ def test_project_permission_routes_are_registered():
     assert 'prefix="/studies/{study_id}/permissions"' in source
 
 
+def test_project_permission_updates_use_project_member_write_permission():
+    source = (ROOT / "app/api/v1/project_permissions.py").read_text(encoding="utf-8")
+
+    assert 'require_study_permission("project_members", "write")' in source
+    assert 'require_roles(["ADMIN"])' not in source
+
+
 def test_project_member_writes_use_saved_permission_matrix():
     source = (ROOT / "app/api/v1/members.py").read_text(encoding="utf-8")
 
@@ -26,6 +33,31 @@ def test_project_member_writes_use_saved_permission_matrix():
     assert 'require_study_roles(["ADMIN", "PM"])' not in source
 
 
+def test_project_member_candidates_use_project_write_permission():
+    source = (ROOT / "app/api/v1/members.py").read_text(encoding="utf-8")
+    user_crud_source = (ROOT / "app/crud/user.py").read_text(encoding="utf-8")
+
+    assert '"/candidates"' in source
+    assert 'response_model=list[UserResponse]' in source
+    assert 'dependencies=[Depends(require_study_permission("project_members", "write"))]' in source
+    assert "list_active_member_candidates_for_study" in source
+    assert "User.status == UserStatus.ACTIVE" in user_crud_source
+    assert ".where(~existing_member)" in user_crud_source
+
+
+def test_project_member_mutation_blocks_self_and_higher_role_changes():
+    source = (ROOT / "app/api/v1/members.py").read_text(encoding="utf-8")
+
+    assert "PROJECT_ROLE_RANK" in source
+    assert 'if target_member and target_member.user_id == current_user.id:' in source
+    assert "不能修改自己的项目成员权限" in source
+    assert "不能修改系统管理员账号的项目权限" in source
+    assert 'if _role_value(target_user) == "ADMIN":' in source
+    assert "不能修改权限高于自己的项目成员" in source
+    assert "不能授予高于自己的项目角色" in source
+    assert "_ensure_member_mutation_allowed(" in source
+
+
 def test_business_modules_use_saved_permission_matrix():
     expected = {
         "overview.py": [