优化前后端权限一致性

frontend/src/views/documents/DocumentList.vue

@@ -22,7 +22,7 @@
             <el-button @click="resetFilters">{{ TEXT.common.actions.reset }}</el-button>
           </div>
           <div class="filter-spacer"></div>
-          <el-button type="primary" @click="openCreate" class="header-action-btn">
+          <el-button type="primary" :disabled="!canCreate" @click="openCreate" class="header-action-btn">
             <el-icon class="el-icon--left"><Plus /></el-icon>
             {{ TEXT.modules.fileVersionManagement.newDocument }}
           </el-button>
@@ -75,7 +75,7 @@
           </el-table-column>
           <el-table-column :label="TEXT.modules.fileVersionManagement.columns.actions" width="120" align="center">
             <template #default="{ row }">
-              <el-button v-if="isAdmin" link type="danger" :disabled="isInactiveSite(row.site_id)" @click.stop="confirmDelete(row)">
+              <el-button v-if="canDelete" link type="danger" :disabled="isInactiveSite(row.site_id)" @click.stop="confirmDelete(row)">
                  {{ TEXT.common.actions.delete }}
               </el-button>
             </template>
@@ -128,6 +128,7 @@ import { fetchDocuments, createDocument, deleteDocument } from "../../api/docume
 import { fetchSites } from "../../api/sites";
 import { useStudyStore } from "../../store/study";
 import { useAuthStore } from "../../store/auth";
+import { usePermission } from "../../utils/permission";
 import type { DocumentSummary } from "../../types/documents";
 import type { Site } from "../../types/api";
 import { displayEnum, displayText } from "../../utils/display";
@@ -137,6 +138,7 @@ const route = useRoute();
 const router = useRouter();
 const study = useStudyStore();
 const auth = useAuthStore();
+const { can } = usePermission();
 const loading = ref(false);
 const items = ref<DocumentSummary[]>([]);
 const sites = ref<Site[]>([]);
@@ -173,6 +175,8 @@ const siteActiveMap = computed(() => {
 const isAdmin = computed(() => {
   return !!auth.user?.is_admin;
 });
+const canCreate = computed(() => can("documents.create"));
+const canDelete = computed(() => can("documents.delete"));
 const isInactiveSite = (siteId?: string | null) => !!siteId && siteActiveMap.value[siteId] === false;
 const documentRowClass = ({ row }: { row: DocumentSummary }) =>
   `${row?.id ? "clickable-row" : ""}${isInactiveSite(row?.site_id) ? " row-inactive" : ""}`.trim();
@@ -259,6 +263,10 @@ const resetFilters = () => {
 };
 
 const openCreate = () => {
+  if (!canCreate.value) {
+    ElMessage.warning("权限不足");
+    return;
+  }
   createForm.doc_no = "";
   createForm.title = "";
   createForm.scope_type = "GLOBAL";
@@ -268,6 +276,10 @@ const openCreate = () => {
 };
 
 const submitCreate = async () => {
+  if (!canCreate.value) {
+    ElMessage.warning("权限不足");
+    return;
+  }
   if (!createFormRef.value) return;
   await createFormRef.value.validate(async (valid) => {
     if (!valid || !trialId.value) return;
@@ -305,6 +317,10 @@ const handleRowClick = (row: DocumentSummary) => {
 };
 
 const confirmDelete = async (row: DocumentSummary) => {
+  if (!canDelete.value) {
+    ElMessage.warning("权限不足");
+    return;
+  }
   if (!row?.id) return;
   const ok = await ElMessageBox.confirm(TEXT.common.confirm.delete, TEXT.common.labels.tips).catch(() => null);
   if (!ok) return;