权限: receive/reject校验assignee_id匹配 + 前端myActiveTask只显示本人任务 + 403处理

backend/app/services/task_service.py

@@ -238,12 +238,16 @@ async def receive_task(
     """
     task = await _get_task_or_404(db, task_id)
 
+    # 权限校验：只有负责人本人可接收
+    if operator_id and task.assignee_id and operator_id != task.assignee_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"您无权操作此任务，当前任务负责人为 {task.assignee_id}",
+        )
+
     # 校验：只有 PENDING 状态可接收
     if task.status != TASK_STATUS_PENDING:
         raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"只有待接收(PENDING)状态的任务可接收，当前状态: {task.status}",
-        )
 
     now = get_beijing_time()
     task.status = TASK_STATUS_WIP
@@ -284,6 +288,13 @@ async def reject_task(
     """
     task = await _get_task_or_404(db, task_id)
 
+    # 权限校验：只有负责人本人可驳回
+    if operator_id and task.assignee_id and operator_id != task.assignee_id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=f"您无权操作此任务，当前任务负责人为 {task.assignee_id}",
+        )
+
     # 校验：不能重复驳回已完成/已驳回的任务
     if task.status in (TASK_STATUS_COMPLETED, TASK_STATUS_REJECTED):
         raise HTTPException(