feat: yearly_targets 写权限收紧,12步冒烟全绿

backend/app/api/yearly_targets.py

@@ -22,9 +22,9 @@ router = APIRouter(prefix="/api/yearly_targets", tags=["年度目标"])
 @router.get("", response_model=list[YearlyTargetResponse])
 def list_targets(
     session: Session = Depends(get_session),
-    current_user: User = Depends(require_role(UserRole.zhipianren, UserRole.zebian)),
+    current_user: User = Depends(require_role(UserRole.zhipianren, UserRole.zebian, UserRole.biandao)),
 ):
-    """获取所有年度目标（仅管理员/责编）。"""
+    """获取所有年度目标（三角色均可读）。"""
     statement = select(YearlyTarget).order_by(YearlyTarget.year.desc())
     targets = session.exec(statement).all()
     return targets
@@ -34,9 +34,9 @@ def list_targets(
 def get_target(
     target_id: int,
     session: Session = Depends(get_session),
-    current_user: User = Depends(require_role(UserRole.zhipianren, UserRole.zebian)),
+    current_user: User = Depends(require_role(UserRole.zhipianren, UserRole.zebian, UserRole.biandao)),
 ):
-    """根据 ID 获取单个年度目标（仅管理员/责编）。"""
+    """根据 ID 获取单个年度目标（三角色均可读）。"""
     target = session.get(YearlyTarget, target_id)
     if target is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="目标不存在")
@@ -101,9 +101,9 @@ def update_target(
 def delete_target(
     target_id: int,
     session: Session = Depends(get_session),
-    current_user: User = Depends(require_role(UserRole.zhipianren, UserRole.zebian)),
+    current_user: User = Depends(require_role(UserRole.zhipianren)),
 ):
-    """删除年度目标（仅管理员/责编）。"""
+    """删除年度目标（仅制片人）。"""
     target = session.get(YearlyTarget, target_id)
     if target is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="目标不存在")