优化前后端权限一致性

backend/app/services/document_service.py

@@ -35,6 +35,14 @@ from app.schemas.user import UserDisplay
 
 UPLOAD_ROOT = Path(__file__).resolve().parent.parent / "uploads" / "documents"
 
+DOCUMENT_ACTION_PERMISSIONS = {
+    "view": "documents:read",
+    "ack": "documents:read",
+    "create_document": "documents:create",
+    "create_version": "documents:update",
+    "delete_document": "documents:delete",
+}
+
 
 def _role_value(user) -> str:
     return user.role.value if hasattr(user.role, "value") else str(user.role)
@@ -75,7 +83,7 @@ async def _ensure_study_access(db: AsyncSession, trial_id: uuid.UUID, current_us
     membership = await member_crud.get_member(db, trial_id, current_user.id)
     if not membership or not membership.is_active:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
-    endpoint_key = "documents:read" if action in {"view", "ack"} else "documents:update"
+    endpoint_key = DOCUMENT_ACTION_PERMISSIONS.get(action, "documents:update")
     allowed = await role_has_api_permission(db, trial_id, membership.role_in_study, endpoint_key, check_prerequisites=False)
     if not allowed:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")