PayrollManagementSystem/backend/app/services/payroll_access.py

"""工资操作使用账号继承的角色权限，不使用全局制作人绑定。"""

from app.core.exceptions import ForbiddenError


def can_write_payroll(user) -> bool:
    """兼容工资写入口；各操作的具体权限仍由接口和服务校验。"""
    from sqlalchemy.orm import object_session

    from app.models import User
    from app.services.authorization_service import is_maker

    if not isinstance(user, User) or user.status != 1:
        return False
    session = object_session(user)
    return session is not None and is_maker(session, user)


def ensure_payroll_writer(user):
    if not can_write_payroll(user):
        raise ForbiddenError("当前账号没有工资操作权限，请联系管理员分配相应角色")
    return user