优化权限控制

web/backend/deps.py

@@ -8,7 +8,7 @@ from jose import JWTError
 from .database import get_db
 from .security import decode_access_token
 from .models import User
-from .permissions import get_role_permissions
+from .permissions import get_user_permissions
 
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/login")
 
@@ -43,7 +43,7 @@ def require_permission(permission: str):
     def checker(current_user: User = Depends(get_current_user)) -> User:
         if not current_user.is_active:
             raise HTTPException(status_code=403, detail="账号已禁用")
-        perms = get_role_permissions(current_user.role)
+        perms = get_user_permissions(current_user)
         if permission not in perms:
             raise HTTPException(status_code=403, detail=f"无权限: {permission}")
         return current_user