zhouchengcheng/ctms
1
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

启动与授权-初步优化

Browse Source
This commit is contained in:
Cheng Zhou
2026-01-15 11:25:13 +08:00
parent 4fc5f0ee9b
commit 05c1f9579a
28 changed files with 1082 additions and 300 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/api/v1/attachments.py
+60 -2
View File
@@ -1,6 +1,7 @@
import os
import uuid
from pathlib import Path
from urllib.parse import quote
import aiofiles
from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status, Request
@@ -23,6 +24,12 @@ global_router = APIRouter()
UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
def _content_disposition(filename: str, disposition: str = "inline") -> str:
fallback = "".join((ch if ord(ch) < 128 else "_") for ch in filename) or "download"
quoted = quote(filename, safe="")
return f"{disposition}; filename=\"{fallback}\"; filename*=UTF-8''{quoted}"
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
study = await study_crud.get(db, study_id)
if not study:
@@ -79,6 +86,7 @@ async def upload_attachment(
id=attachment.id,
filename=attachment.filename,
file_size=attachment.file_size,
content_type=attachment.content_type,
uploaded_by=UserDisplay.model_validate(current_user) if current_user else None,
uploaded_by_id=attachment.uploaded_by,
uploaded_at=attachment.uploaded_at,
@@ -108,6 +116,7 @@ async def list_attachments(
id=a.id,
filename=a.filename,
file_size=a.file_size,
content_type=a.content_type,
uploaded_by=UserDisplay.model_validate(user) if user else None,
uploaded_by_id=a.uploaded_by,
uploaded_at=a.uploaded_at,
@@ -137,7 +146,32 @@ async def download_attachment(
path=attachment.file_path,
filename=attachment.filename,
media_type=attachment.content_type or "application/octet-stream",
headers={"Content-Disposition": f'inline; filename="{attachment.filename}"'},
headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="attachment")},
)
@router.get(
"/{attachment_id}/preview",
dependencies=[Depends(require_study_member())],
)
async def preview_attachment(
study_id: uuid.UUID,
entity_type: str,
entity_id: uuid.UUID,
attachment_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
) -> FileResponse:
await _ensure_study_exists(db, study_id)
attachment = await attachment_crud.get_attachment(db, attachment_id)
if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
if not os.path.exists(attachment.file_path):
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
return FileResponse(
path=attachment.file_path,
filename=attachment.filename,
media_type=attachment.content_type or "application/octet-stream",
headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="inline")},
)
@@ -182,7 +216,31 @@ async def global_download_attachment(
path=attachment.file_path,
filename=attachment.filename,
media_type=attachment.content_type or "application/octet-stream",
headers={"Content-Disposition": f'inline; filename="{attachment.filename}"'},
headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="attachment")},
)
@global_router.get(
"/{attachment_id}/preview",
response_class=FileResponse,
)
async def global_preview_attachment(
attachment_id: uuid.UUID,
request: Request,
db: AsyncSession = Depends(get_db_session),
):
attachment = await attachment_crud.get_attachment(db, attachment_id)
if not attachment:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
await _ensure_study_exists(db, attachment.study_id)
await _authorize_global(request, db, attachment.study_id)
if not os.path.exists(attachment.file_path):
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
return FileResponse(
path=attachment.file_path,
filename=attachment.filename,
media_type=attachment.content_type or "application/octet-stream",
headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="inline")},
)
backend/app/api/v1/fees_contracts.py
+18 -9
View File
@@ -4,12 +4,12 @@ from typing import Any
from fastapi import APIRouter, Depends, HTTPException, Query, status
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
from app.core.deps import get_current_user, get_db_session
from app.crud import audit as audit_crud
from app.crud import contract_fee as contract_fee_crud
from app.crud import contract_fee_payment as payment_crud
from app.crud import fee_attachment as fee_attachment_crud
from app.crud import member as member_crud
from app.crud import site as site_crud
from app.crud import user as user_crud
@@ -23,6 +23,7 @@ from app.schemas.contract_fee_payment import (
from app.schemas.fee_common import FeeApiResponse
from app.schemas.fee_attachment import FeeAttachmentRead
from app.schemas.user import UserDisplay
from app.models.attachment import Attachment
router = APIRouter()
@@ -123,7 +124,15 @@ async def get_contract_fee(
await _ensure_project_access(db, contract.project_id, current_user, write=False)
payments = await payment_crud.list_payments(db, contract.id)
attachments = await fee_attachment_crud.list_attachments(db, entity_type="contract_fee", entity_id=contract.id)
attachment_types = ["contract_fee_contract", "contract_fee_voucher", "contract_fee_invoice"]
result = await db.execute(
select(Attachment).where(
Attachment.entity_id == contract.id,
Attachment.entity_type.in_(attachment_types),
Attachment.is_deleted.is_(False),
)
)
attachments = result.scalars().all()
user_ids = {a.uploaded_by for a in attachments if a.uploaded_by}
users_map = await user_crud.get_users_by_ids(db, user_ids)
@@ -133,20 +142,20 @@ async def get_contract_fee(
"invoice": [],
}
for attachment in attachments:
key = attachment.file_type
key = attachment.entity_type.replace("contract_fee_", "", 1)
attachments_map.setdefault(key, [])
user = users_map.get(attachment.uploaded_by)
attachments_map[key].append(
FeeAttachmentRead(
id=attachment.id,
entity_type=attachment.entity_type,
entity_type="contract_fee",
entity_id=attachment.entity_id,
file_type=attachment.file_type,
file_type=key,
filename=attachment.filename,
mime_type=attachment.mime_type,
size=attachment.size,
storage_key=attachment.storage_key,
url=attachment.url,
mime_type=attachment.content_type,
size=attachment.file_size,
storage_key=attachment.file_path,
url=None,
uploaded_by_id=attachment.uploaded_by,
uploaded_by=UserDisplay.model_validate(user) if user else None,
uploaded_at=attachment.uploaded_at,
backend/app/api/v1/startup.py
-28
View File
@@ -358,34 +358,6 @@ async def update_kickoff(
return KickoffMeetingRead.model_validate(meeting)
@router.delete(
"/kickoff/{meeting_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
)
async def delete_kickoff(
study_id: uuid.UUID,
meeting_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> None:
await _ensure_study_exists(db, study_id)
meeting = await startup_crud.get_kickoff(db, meeting_id)
if not meeting or meeting.study_id != study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="启动会记录不存在")
await startup_crud.delete_kickoff(db, meeting)
await audit_crud.log_action(
db,
study_id=study_id,
entity_type="startup_kickoff",
entity_id=meeting_id,
action="DELETE_KICKOFF_MEETING",
detail="启动会记录已删除",
operator_id=current_user.id,
operator_role=current_user.role,
)
@router.post(
"/training-authorizations",
response_model=TrainingAuthorizationRead,