优化前后端权限一致性

backend/app/api/v1/fees_contracts.py

@@ -314,7 +314,7 @@ async def create_contract_payment(
     contract = await contract_fee_crud.get_contract_fee(db, contract_id)
     if not contract:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同费用不存在")
-    await _ensure_project_access(db, contract.project_id, current_user, "POST:/fees/contracts/{id}/payments")
+    await _ensure_project_access(db, contract.project_id, current_user, "fees_payments:create")
     _validate_payment_rules(payment_in)
     payment = await payment_crud.create_payment(db, contract_id, payment_in)
     await audit_crud.log_action(
@@ -347,7 +347,7 @@ async def update_contract_payment(
     contract = await contract_fee_crud.get_contract_fee(db, payment.contract_fee_id)
     if not contract:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同费用不存在")
-    await _ensure_project_access(db, contract.project_id, current_user, "PATCH:/fees/payments/{id}")
+    await _ensure_project_access(db, contract.project_id, current_user, "fees_payments:update")
     merged_payment = ContractFeePaymentCreate(
         amount=payment_in.amount if payment_in.amount is not None else payment.amount,
         paid_date=payment_in.paid_date if payment_in.paid_date is not None else payment.paid_date,
@@ -387,7 +387,7 @@ async def delete_contract_payment(
     contract = await contract_fee_crud.get_contract_fee(db, payment.contract_fee_id)
     if not contract:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同费用不存在")
-    await _ensure_project_access(db, contract.project_id, current_user, "DELETE:/fees/payments/{id}")
+    await _ensure_project_access(db, contract.project_id, current_user, "fees_payments:delete")
     await payment_crud.delete_payment(db, payment)
     await payment_crud.resequence_payments(db, contract.id)
     await audit_crud.log_action(

backend/app/services/document_service.py

@@ -35,6 +35,14 @@ from app.schemas.user import UserDisplay
 
 UPLOAD_ROOT = Path(__file__).resolve().parent.parent / "uploads" / "documents"
 
+DOCUMENT_ACTION_PERMISSIONS = {
+    "view": "documents:read",
+    "ack": "documents:read",
+    "create_document": "documents:create",
+    "create_version": "documents:update",
+    "delete_document": "documents:delete",
+}
+
 
 def _role_value(user) -> str:
     return user.role.value if hasattr(user.role, "value") else str(user.role)
@@ -75,7 +83,7 @@ async def _ensure_study_access(db: AsyncSession, trial_id: uuid.UUID, current_us
     membership = await member_crud.get_member(db, trial_id, current_user.id)
     if not membership or not membership.is_active:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
-    endpoint_key = "documents:read" if action in {"view", "ack"} else "documents:update"
+    endpoint_key = DOCUMENT_ACTION_PERMISSIONS.get(action, "documents:update")
     allowed = await role_has_api_permission(db, trial_id, membership.role_in_study, endpoint_key, check_prerequisites=False)
     if not allowed:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")