优化前后端权限一致性

frontend/src/views/subjects/SubjectForm.vue

@@ -120,6 +120,7 @@ import { useStudyStore } from "../../store/study";
 import { createSubject, getSubject, updateSubject } from "../../api/subjects";
 import { fetchSites } from "../../api/sites";
 import { TEXT } from "../../locales";
+import { isApiPermissionAllowed } from "../../utils/apiPermissionValue";
 
 const route = useRoute();
 const router = useRouter();
@@ -137,7 +138,12 @@ const siteActiveMap = computed(() => {
 const subjectId = computed(() => route.params.subjectId as string | undefined);
 const isEdit = computed(() => !!subjectId.value);
 const studyId = computed(() => study.currentStudy?.id || "");
-const isReadOnly = computed(() => isEdit.value && !!form.site_id && siteActiveMap.value[form.site_id] === false);
+const projectRole = computed(() => study.currentStudyRole || (study.currentStudy as any)?.role_in_study || "");
+const canMutate = computed(() => {
+  const operationKey = isEdit.value ? "subjects:update" : "subjects:create";
+  return isApiPermissionAllowed(study.currentPermissions?.[projectRole.value]?.[operationKey]);
+});
+const isReadOnly = computed(() => !canMutate.value || (isEdit.value && !!form.site_id && siteActiveMap.value[form.site_id] === false));
 
 const form = reactive({
   subject_no: "",
@@ -180,6 +186,10 @@ const load = async () => {
 };
 
 const submit = async () => {
+  if (!canMutate.value) {
+    ElMessage.warning("权限不足");
+    return;
+  }
   if (isReadOnly.value) {
     ElMessage.warning("中心已停用");
     return;