1

video-gen-api/app/api/v1/admin.py

@@ -5,7 +5,7 @@ from fastapi import APIRouter, Depends, HTTPException, Query, status
 from sqlalchemy import delete, func, select, update
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.dependencies import get_db, get_admin_user, require_menu_access
+from app.dependencies import get_db, get_admin_user
 from app.models.user import User
 from app.models.project import Project
 from app.models.generation_record import GenerationRecord
@@ -1663,7 +1663,7 @@ async def list_operation_logs(
 
 @router.get("/stats", response_model=AdminStatsOut)
 async def get_stats(
-    admin: User = Depends(require_menu_access("/")),
+    admin: User = Depends(get_admin_user),
     db: AsyncSession = Depends(get_db),
     start_date: str = Query(None),
     end_date: str = Query(None),

video-gen-api/app/dependencies.py

@@ -98,17 +98,12 @@ async def get_optional_current_user(
 async def get_admin_user(
     current_user: User = Depends(get_current_user_allow_password_pending),
 ) -> User:
-    if not current_user.is_admin or current_user.user_type != "admin":
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="需要管理员权限",
-        )
-    return current_user
+    """验证后台用户权限。
 
-
-async def get_backend_user(
-    current_user: User = Depends(get_current_user_allow_password_pending),
-) -> User:
+    - user_type="admin" 的后台用户即可通过（含非管理员子账号）
+    - 前端通过 allowed_menus 控制非管理员子账号的菜单可见性
+    - 非后台用户: 403 拒绝
+    """
     if current_user.user_type != "admin":
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
@@ -117,32 +112,13 @@ async def get_backend_user(
     return current_user
 
 
-def require_menu_access(menu_path: str):
-    """检查后台用户是否有指定菜单权限。
-
-    - 超级管理员 (is_admin=True): 直接放行
-    - 非管理员后台用户: 检查 allowed_menus 是否包含 menu_path
-    - 非后台用户: 403 拒绝
-
-    用法:
-        @router.get("/stats")
-        async def get_stats(admin: User = Depends(require_menu_access("/")), ...):
-    """
-    async def _dependency(
-        current_user: User = Depends(get_current_user_allow_password_pending),
-    ) -> User:
-        if current_user.user_type != "admin":
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="需要后台用户权限",
-            )
-        if current_user.is_admin:
-            return current_user
-        allowed = set(current_user.allowed_menus or [])
-        if menu_path not in allowed:
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="需要管理员权限",
-            )
-        return current_user
-    return _dependency
+async def get_backend_user(
+    current_user: User = Depends(get_current_user_allow_password_pending),
+) -> User:
+    """与 get_admin_user 等价: 验证 user_type="admin" 的后台用户。"""
+    if current_user.user_type != "admin":
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="需要后台用户权限",
+        )
+    return current_user