diff --git a/backend/main.py b/backend/main.py index 09e827b..d05dbe8 100644 --- a/backend/main.py +++ b/backend/main.py @@ -781,15 +781,15 @@ def create_recipe(recipe: RecipeIn, user=Depends(get_current_user)): def _check_recipe_permission(conn, recipe_id, user): - """Check if user can modify this recipe.""" + """Check if user can modify this recipe. Requires editor+ role.""" row = conn.execute("SELECT owner_id, name FROM recipes WHERE id = ?", (recipe_id,)).fetchone() if not row: raise HTTPException(404, "Recipe not found") if user["role"] in ("admin", "senior_editor"): return row - if row["owner_id"] == user.get("id"): + if user["role"] in ("editor",) and row["owner_id"] == user.get("id"): return row - raise HTTPException(403, "只能修改自己创建的配方") + raise HTTPException(403, "权限不足") @app.put("/api/recipes/{recipe_id}") @@ -974,6 +974,9 @@ def delete_user(user_id: int, user=Depends(require_role("admin"))): def update_user(user_id: int, body: UserUpdate, user=Depends(require_role("admin"))): conn = get_db() if body.role is not None: + if body.role == "admin": + conn.close() + raise HTTPException(403, "不能将用户设为管理员") conn.execute("UPDATE users SET role = ? WHERE id = ?", (body.role, user_id)) if body.display_name is not None: conn.execute("UPDATE users SET display_name = ? WHERE id = ?", (body.display_name, user_id)) diff --git a/frontend/src/App.vue b/frontend/src/App.vue index 593f672..0d23ac5 100644 --- a/frontend/src/App.vue +++ b/frontend/src/App.vue @@ -15,6 +15,7 @@