新增

backend/link_cards_router.py

@@ -12,7 +12,9 @@ from pydantic import BaseModel, Field
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from auth.dependencies import get_current_user, require_write
+from auth.dependencies import get_current_user, require_link_cards_write
+from auth.roles import has_permission
+from auth.permissions import LINK_CARDS_WRITE
 from link_cards import (
     absolute_media_url,
     build_keywords,
@@ -68,8 +70,8 @@ async def _get_owned_card(
     card = (await db.execute(stmt)).scalar_one_or_none()
     if not card or card.owner_id != user.id:
         raise HTTPException(status_code=404, detail="卡片不存在")
-    if write and user.role == "viewer":
-        raise HTTPException(status_code=403, detail="无写入权限")
+    if write and not has_permission(user.role, LINK_CARDS_WRITE):
+        raise HTTPException(status_code=403, detail="缺少权限：link_cards.write")
     return card
 
 
@@ -93,7 +95,7 @@ def _card_response(card: LinkCardPage, request: Request) -> LinkCardResponse:
 async def upload_link_card_image(
     request: Request,
     file: UploadFile = File(...),
-    user: User = Depends(require_write),
+    user: User = Depends(require_link_cards_write),
 ):
     if not file.content_type or not file.content_type.startswith("image/"):
         raise HTTPException(status_code=400, detail="仅支持上传图片文件")
@@ -137,7 +139,7 @@ async def upsert_link_card(
     body: LinkCardUpsert,
     request: Request,
     db: AsyncSession = Depends(get_db),
-    user: User = Depends(require_write),
+    user: User = Depends(require_link_cards_write),
 ):
     title = body.title.strip()
     content = (body.content or "").strip()