拆分系统监测模块并统一运维化文案

backend/tests/test_permission_monitoring_api.py

@@ -3,10 +3,12 @@
 import uuid
 
 import pytest
+from fastapi import HTTPException
 from sqlalchemy import text
 
 from app.core.permission_monitor import set_permission_monitor, PermissionMonitor
 from app.api.v1 import permission_monitoring
+from app.api.v1.system_permissions import list_system_permissions
 
 
 class FakeIpInfo:
@@ -22,6 +24,35 @@ class AdminUserStub:
     is_admin = True
 
 
+class ProjectPmUserStub:
+    id = uuid.uuid4()
+    is_admin = False
+
+
+@pytest.mark.asyncio
+async def test_resolve_monitoring_scope_rejects_project_pm(db_session):
+    """系统监测模块仅允许系统管理员访问，项目 PM 不再具备监测范围。"""
+    with pytest.raises(HTTPException) as exc_info:
+        await permission_monitoring.resolve_monitoring_scope(db_session, ProjectPmUserStub())
+
+    assert exc_info.value.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_system_permission_monitoring_definitions_are_admin_only():
+    """系统级权限定义中的系统监测模块不应再标注 PM 角色。"""
+    data = await list_system_permissions()
+    monitoring_items = [
+        item for item in data["permissions"]
+        if item["module"] == "system_monitoring"
+    ]
+
+    assert monitoring_items
+    assert data["module_labels"]["system_monitoring"] == "系统监测"
+    assert all(item["roles"] == ["ADMIN"] for item in monitoring_items)
+    assert all("PM" not in item["roles"] for item in monitoring_items)
+
+
 async def _seed_permission_log(db_session, study_id: uuid.UUID, user_id: uuid.UUID, *, allowed: bool, elapsed_ms: float) -> None:
     study_exists = (
         await db_session.execute(text("SELECT id FROM studies WHERE id = :id"), {"id": str(study_id)})