更新v1.4版本，修复了一些已知问题

backend/routes/admin.py

@@ -27,7 +27,8 @@ from schemas.admin import (
     AddPointsRequest, RevokeRequest, AddAdminRequest,
     AddStudentRequest, UpdateStudentRequest,
     UpdateHomeworkStatusRequest, AddAttendanceRequest,
-    UpdateAdminRequest, DeleteAdminRequest, ResetPasswordRequest
+    UpdateAdminRequest, DeleteAdminRequest, ResetPasswordRequest,
+    CreateAssignmentRequest
 )
 from utils.response import success_response, error_response
 from utils.logger import get_logger
@@ -48,6 +49,8 @@ async def get_students(
 ):
     """获取所有学生列表（单班级）"""
     user = await get_current_user(request)
+    if user["user_type"] != "admin":
+        return error_response(message="仅管理员可查看学生列表", code=403)
     result = await AdminService.get_students(page=page, page_size=page_size, search=search)
     return success_response(data=result)
 
@@ -138,6 +141,13 @@ async def update_student(request: Request, student_id: int, req: UpdateStudentRe
         parent_phone=req.parent_phone
     )
     if result["success"]:
+        await LogService.write_operation_log(
+            operator_id=user["user_id"], operator_name=user["real_name"],
+            operator_role="班主任", operation_type="update_student",
+            target_type="student", target_id=student_id,
+            details=f"编辑学生ID: {student_id}",
+            ip=request.client.host
+        )
         return success_response(message=result["message"])
     else:
         return error_response(message=result["message"])
@@ -153,6 +163,13 @@ async def delete_student(request: Request, student_id: int):
     
     result = await AdminService.delete_student(student_id=student_id)
     if result["success"]:
+        await LogService.write_operation_log(
+            operator_id=user["user_id"], operator_name=user["real_name"],
+            operator_role="班主任", operation_type="delete_student",
+            target_type="student", target_id=student_id,
+            details=f"删除学生ID: {student_id}",
+            ip=request.client.host
+        )
         return success_response(message=result["message"])
     else:
         return error_response(message=result["message"])
@@ -171,6 +188,13 @@ async def reset_student_password(request: Request, student_id: int, req: ResetPa
         new_password=req.new_password
     )
     if result["success"]:
+        await LogService.write_operation_log(
+            operator_id=user["user_id"], operator_name=user["real_name"],
+            operator_role="班主任", operation_type="reset_student_password",
+            target_type="student", target_id=student_id,
+            details=f"重置学生密码, 学生ID: {student_id}",
+            ip=request.client.host
+        )
         return success_response(message=result["message"])
     else:
         return error_response(message=result["message"])
@@ -272,6 +296,8 @@ async def get_conduct_history(
     """获取操行分历史记录"""
     try:
         user = await get_current_user(request)
+        if user["user_type"] != "admin":
+            return error_response(message="仅管理员可查看历史记录", code=403)
         result = await ConductService.get_history(
             user_id=user["user_id"],
             student_id=student_id,
@@ -316,23 +342,17 @@ async def get_submissions(request: Request, assignment_id: int):
 
 
 @router.post("/homework/assignment")
-async def create_assignment(
-    request: Request,
-    subject_id: int,
-    title: str,
-    description: Optional[str] = None,
-    deadline: str = None
-):
+async def create_assignment(request: Request, req: CreateAssignmentRequest):
     """发布作业（班主任）"""
     user = await get_current_user(request)
     is_teacher = await PermissionChecker.check_is_teacher(user["user_id"])
     if not is_teacher:
         return error_response(message="仅班主任可发布作业", code=403)
     result = await HomeworkService.create_assignment(
-        subject_id=subject_id,
-        title=title,
-        description=description,
-        deadline=deadline,
+        subject_id=req.subject_id,
+        title=req.title,
+        description=req.description,
+        deadline=req.deadline,
         created_by=user["user_id"]
     )
     if result["success"]:
@@ -416,6 +436,9 @@ async def get_attendance_records(
 ):
     """获取考勤记录"""
     user = await get_current_user(request)
+    role = await PermissionChecker.get_user_role(user["user_id"])
+    if role not in ["班主任", "考勤委员"]:
+        return error_response(message="无权查看考勤记录", code=403)
     result = await AttendanceService.get_records(
         user_id=user["user_id"],
         date=date,