From 6ff8866ca39f209464582a23ef9bbed751304f42 Mon Sep 17 00:00:00 2001
From: wwwwwwwww <526125649@qq.com>
Date: Mon, 13 Jul 2026 17:23:56 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9=E5=90=8E=E5=8F=B0=E6=9D=83?=
 =?UTF-8?q?=E9=99=90=E7=9A=84=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 video-gen-api/app/api/v1/admin.py |  4 ++--
 video-gen-api/app/dependencies.py | 31 +++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/video-gen-api/app/api/v1/admin.py b/video-gen-api/app/api/v1/admin.py
index 604bc6ba..b7219a40 100644
--- a/video-gen-api/app/api/v1/admin.py
+++ b/video-gen-api/app/api/v1/admin.py
@@ -5,7 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import delete, func, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.dependencies import get_db, get_admin_user
+from app.dependencies import get_db, get_admin_user, require_menu_access
 from app.models.user import User
 from app.models.project import Project
 from app.models.generation_record import GenerationRecord
@@ -1663,7 +1663,7 @@ async def list_operation_logs(
 
 @router.get("/stats", response_model=AdminStatsOut)
 async def get_stats(
-    admin: User = Depends(get_admin_user),
+    admin: User = Depends(require_menu_access("/")),
     db: AsyncSession = Depends(get_db),
     start_date: str = Query(None),
     end_date: str = Query(None),
diff --git a/video-gen-api/app/dependencies.py b/video-gen-api/app/dependencies.py
index 38de6d74..e11d1523 100644
--- a/video-gen-api/app/dependencies.py
+++ b/video-gen-api/app/dependencies.py
@@ -115,3 +115,34 @@ async def get_backend_user(
             detail="需要后台用户权限",
         )
     return current_user
+
+
+def require_menu_access(menu_path: str):
+    """检查后台用户是否有指定菜单权限。
+
+    - 超级管理员 (is_admin=True): 直接放行
+    - 非管理员后台用户: 检查 allowed_menus 是否包含 menu_path
+    - 非后台用户: 403 拒绝
+
+    用法:
+        @router.get("/stats")
+        async def get_stats(admin: User = Depends(require_menu_access("/")), ...):
+    """
+    async def _dependency(
+        current_user: User = Depends(get_current_user_allow_password_pending),
+    ) -> User:
+        if current_user.user_type != "admin":
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="需要后台用户权限",
+            )
+        if current_user.is_admin:
+            return current_user
+        allowed = set(current_user.allowed_menus or [])
+        if menu_path not in allowed:
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="需要管理员权限",
+            )
+        return current_user
+    return _dependency