From d40a8d480eaff974396bdefa71712c118e69ae30 Mon Sep 17 00:00:00 2001
From: duxingchen <duxingchen@iris-rs.cn>
Date: Tue, 11 Aug 2026 10:13:40 +0800
Subject: [PATCH] =?UTF-8?q?fix(backend):=20end=5Ftask=20=E5=92=8C=20comple?=
 =?UTF-8?q?te=5Ftask=20=E8=A1=A5=E9=BD=90=E6=9D=83=E9=99=90=E6=A0=A1?=
 =?UTF-8?q?=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- end_task 新增 operator_role 参数 + _check_permission 调用
- complete_task 新增 operator_role 参数 + _check_permission 调用
- 两个端点均注入 current_user Depends(get_current_user)
- 非任务负责人且非管理员/主管调用时返回 403
---
 backend/app/api/v1/endpoints/tasks.py | 10 ++++++++--
 backend/app/services/task_service.py  | 12 ++++++++++--
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/backend/app/api/v1/endpoints/tasks.py b/backend/app/api/v1/endpoints/tasks.py
index 981b251..c6a88f6 100644
--- a/backend/app/api/v1/endpoints/tasks.py
+++ b/backend/app/api/v1/endpoints/tasks.py
@@ -84,6 +84,7 @@ async def complete_task_endpoint(
     task_id: str,
     request: TaskCompleteRequest,
     db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
 ):
     """
     **核心接口：完成任务 + 可选创建下一步任务（转交）**
@@ -100,7 +101,8 @@ async def complete_task_endpoint(
     - 完成后自动创建下一步任务并指定负责人
     """
     return await task_service.complete_task(
-        db, uuid.UUID(task_id), request
+        db, uuid.UUID(task_id), request,
+        operator_role=current_user.get("role"),
     )
 
 
@@ -113,13 +115,17 @@ async def end_task_endpoint(
     task_id: str,
     operator_id: str | None = Query(None),
     db: AsyncSession = Depends(get_db),
+    current_user: dict = Depends(get_current_user),
 ):
     """
     **结束当前分支：标记任务为 COMPLETED，不创建下游任务。**
 
     用于工人认为工序已完结、无需转交下一人的场景。
     """
-    return await task_service.end_task(db, uuid.UUID(task_id), operator_id)
+    return await task_service.end_task(
+        db, uuid.UUID(task_id), operator_id,
+        operator_role=current_user.get("role"),
+    )
 
 
 # ============================================================
diff --git a/backend/app/services/task_service.py b/backend/app/services/task_service.py
index 3224e14..e9865a7 100644
--- a/backend/app/services/task_service.py
+++ b/backend/app/services/task_service.py
@@ -349,7 +349,8 @@ async def get_all_tasks(
 # ============================================================
 
 async def end_task(
-    db: AsyncSession, task_id: uuid.UUID, operator_id: str | None = None
+    db: AsyncSession, task_id: uuid.UUID, operator_id: str | None = None,
+    operator_role: str | None = None,
 ) -> TaskResponse:
     """
     结束当前分支：标记任务为 COMPLETED，不创建下游任务。
@@ -357,6 +358,9 @@ async def end_task(
     """
     task = await _get_task_or_404(db, task_id)
 
+    # 权限校验：本人 或 管理员/主管 可结束
+    _check_permission(task.assignee_id, operator_id, operator_role)
+
     # 校验：仅 SPAWN 协助分支可以结束，主分支（TRANSFER/RECOVERY）不能通过此接口终止
     if not task.parent_task_id:
         raise HTTPException(status_code=409, detail="根任务无法结束，请使用完工转交")
@@ -857,7 +861,8 @@ async def transfer_task(
 # ============================================================
 
 async def complete_task(
-    db: AsyncSession, task_id: uuid.UUID, request: TaskCompleteRequest
+    db: AsyncSession, task_id: uuid.UUID, request: TaskCompleteRequest,
+    operator_role: str | None = None,
 ) -> TaskCompleteResponse:
     """
     核心业务：完成任务 + 可选创建下一步任务。
@@ -872,6 +877,9 @@ async def complete_task(
     """
     task = await _get_task_or_404(db, task_id)
 
+    # 权限校验：本人 或 管理员/主管 可操作
+    _check_permission(task.assignee_id, request.operator_id, operator_role)
+
     # --- 1. 幂等检查 ---
     if task.status == TASK_STATUS_COMPLETED:
         raise HTTPException(