Merge branch 'rbac' into lsf

runtime/datamate-python/app/module/annotation/service/editor.py

@@ -54,6 +54,10 @@ from app.module.annotation.service.knowledge_sync import KnowledgeSyncService
 from app.module.annotation.service.annotation_text_splitter import (
     AnnotationTextSplitter,
 )
+from app.module.annotation.security import (
+    RequestUserContext,
+    ensure_dataset_owner_access,
+)
 from app.module.annotation.service.text_fetcher import (
     fetch_text_content_via_download_api,
 )
@@ -104,8 +108,9 @@ class AnnotationEditorService:
     # 分段阈值：超过此字符数自动分段
     SEGMENT_THRESHOLD = 200
 
-    def __init__(self, db: AsyncSession):
+    def __init__(self, db: AsyncSession, user_context: RequestUserContext):
         self.db = db
+        self.user_context = user_context
         self.template_service = AnnotationTemplateService()
 
     @staticmethod
@@ -157,14 +162,24 @@ class AnnotationEditorService:
 
     async def _get_project_or_404(self, project_id: str) -> LabelingProject:
         result = await self.db.execute(
-            select(LabelingProject).where(
+            select(LabelingProject, Dataset.created_by).join(
+                Dataset,
+                LabelingProject.dataset_id == Dataset.id,
+            ).where(
                 LabelingProject.id == project_id,
                 LabelingProject.deleted_at.is_(None),
             )
         )
-        project = result.scalar_one_or_none()
-        if not project:
+        row = result.first()
+        if not row:
             raise HTTPException(status_code=404, detail=f"标注项目不存在: {project_id}")
+        project = row[0]
+        dataset_owner = row[1]
+        ensure_dataset_owner_access(
+            self.user_context,
+            str(dataset_owner) if dataset_owner is not None else None,
+            project.dataset_id,
+        )
         return project
 
     async def _get_dataset_type(self, dataset_id: str) -> Optional[str]: