Step 3：Study / Site / StudyMember + 项目权限

backend/app/core/deps.py

@@ -7,6 +7,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.security import decode_token, oauth2_scheme
 from app.crud import user as user_crud
+from app.crud import member as member_crud
 from app.db.session import SessionLocal
 from app.schemas.user import TokenPayload
 
@@ -52,3 +53,53 @@ def require_roles(roles: Iterable[str]) -> Callable:
         return current_user
 
     return dependency
+
+
+async def get_study_member(
+    study_id: uuid.UUID,
+    current_user=Depends(get_current_user),
+    db: AsyncSession = Depends(get_db_session),
+):
+    if current_user.role == "ADMIN":
+        return None
+    return await member_crud.get_member(db, study_id, current_user.id)
+
+
+def require_study_member():
+    async def dependency(
+        study_id: uuid.UUID,
+        current_user=Depends(get_current_user),
+        db: AsyncSession = Depends(get_db_session),
+    ):
+        if current_user.role == "ADMIN":
+            return current_user
+        membership = await member_crud.get_member(db, study_id, current_user.id)
+        if not membership or not membership.is_active:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Not a member of this study",
+            )
+        return current_user
+
+    return dependency
+
+
+def require_study_roles(roles: Iterable[str]):
+    roles_set = set(roles)
+
+    async def dependency(
+        study_id: uuid.UUID,
+        current_user=Depends(get_current_user),
+        db: AsyncSession = Depends(get_db_session),
+    ):
+        if current_user.role == "ADMIN":
+            return current_user
+        membership = await member_crud.get_member(db, study_id, current_user.id)
+        if not membership or not membership.is_active or membership.role_in_study not in roles_set:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Insufficient study permissions",
+            )
+        return current_user
+
+    return dependency