fix(auth): unknown project role denies instead of KeyError 500

check_permission now returns False for roles not in _ROLE_LEVEL
(e.g. a directly-written 'member' row, which set_member itself
rejects but legacy/direct DB rows can still carry), so the failure
mode is PermissionError/403, never an unhandled 500. Regression test
test_unknown_role_denied_not_500 fails with KeyError on old code.

cloud/tests/test_auth.py

@@ -93,6 +93,31 @@ class TestAuth(unittest.TestCase):
         with self.assertRaises(PermissionError):
             self.store.require_permission(outsider_id, project_id, "read")
 
+    def test_unknown_role_denied_not_500(self):
+        # 回归：project_members 里直接写库留下的未知角色（如
+        # 'member'，set_member 本身会拦，但旧行/直写库拦不住）
+        # 在生产上曾让 check_permission 以 KeyError 冒泡成 500。
+        # 权限检查的失败语义只能是 False / PermissionError。
+        project_id, _o, viewer_id, _c, _m, _outsider = (
+            self._project_with_roles()
+        )
+        db_path = os.path.join(self.tmp.name, "auth.db")
+        conn = sqlite3.connect(db_path)
+        try:
+            conn.execute(
+                "UPDATE project_members SET role = ?"
+                " WHERE project_id = ? AND user_id = ?",
+                ("member", project_id, viewer_id))
+            conn.commit()
+        finally:
+            conn.close()
+        self.assertFalse(
+            self.store.check_permission(viewer_id, project_id, "read"))
+        self.assertFalse(
+            self.store.check_permission(viewer_id, project_id, "create_task"))
+        with self.assertRaises(PermissionError):
+            self.store.require_permission(viewer_id, project_id, "read")
+
     def test_permission_grants(self):
         project_id, owner_id, viewer_id, contributor_id, maintainer_id, _ = (
             self._project_with_roles()