统一项目角色与接口权限配置

backend/tests/test_api_permissions_prerequisites.py

@@ -2,6 +2,7 @@
 
 import pytest
 import uuid
+from pathlib import Path
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.api.v1.api_permissions import (
@@ -32,6 +33,63 @@ async def test_list_operations_with_prerequisites():
     assert "sites:read" in subjects_create["prerequisite_permissions"]
 
 
+@pytest.mark.asyncio
+async def test_material_equipment_operations_are_grouped_under_materials_module():
+    """测试设备管理权限归入物资管理模块"""
+    data = await list_api_operations()
+    operations = data["operations"]
+
+    material_equipment_read = next(
+        (op for op in operations if op["operation_key"] == "material_equipments:read"),
+        None,
+    )
+
+    assert material_equipment_read is not None
+    assert material_equipment_read["module"] == "materials"
+
+
+@pytest.mark.asyncio
+async def test_materials_module_only_contains_drug_flow_and_equipment_sections():
+    """测试物资管理模块只包含药品流向管理和设备管理"""
+    data = await list_api_operations()
+    operations = data["operations"]
+
+    material_prefixes = {
+        op["operation_key"].split(":", 1)[0]
+        for op in operations
+        if op["module"] == "materials"
+    }
+
+    assert material_prefixes == {"drug_shipments", "material_equipments"}
+
+
+@pytest.mark.asyncio
+async def test_project_overview_replaces_dashboard_permission():
+    """测试项目总览权限合并仪表板读取权限"""
+    data = await list_api_operations()
+    operations = data["operations"]
+    operation_keys = {op["operation_key"] for op in operations}
+
+    project_overview = next(
+        (op for op in operations if op["operation_key"] == "project_overview:read"),
+        None,
+    )
+
+    assert "dashboard:read" not in operation_keys
+    assert project_overview is not None
+    assert project_overview["module"] == "project_overview"
+    assert "sites:read" in project_overview["prerequisite_permissions"]
+    assert "subjects:read" in project_overview["prerequisite_permissions"]
+
+
+def test_dashboard_summary_uses_project_overview_permission():
+    """测试仪表盘统计接口复用项目总览读取权限"""
+    source = Path(__file__).parents[1].joinpath("app/api/v1/dashboard.py").read_text()
+
+    assert 'require_api_permission("project_overview:read")' in source
+    assert 'require_api_permission("dashboard:read")' not in source
+
+
 @pytest.mark.asyncio
 async def test_list_operation_prerequisites_endpoint():
     """测试获取所有操作的前置权限依赖"""