zhouchengcheng/ctms
1
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

统一项目角色与接口权限配置

Browse Source
This commit is contained in:
Cheng Zhou
2026-05-28 10:48:33 +08:00
parent 6d1c98bcae
commit 2c85742040
45 changed files with 2863 additions and 1329 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/test_migrated_endpoints.py
+41 -216
View File
@@ -18,7 +18,7 @@ async def test_create_subject_with_api_permission(db_session: AsyncSession):
perm = ApiEndpointPermission(
study_id=study_id,
role="CRA",
endpoint_key="POST:/subjects",
endpoint_key="subjects:create",
allowed=True,
)
db_session.add(perm)
@@ -26,7 +26,7 @@ async def test_create_subject_with_api_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "CRA", "POST:/subjects"
db_session, study_id, "CRA", "subjects:create"
)
assert result is True
@@ -40,7 +40,7 @@ async def test_create_subject_without_permission(db_session: AsyncSession):
perm = ApiEndpointPermission(
study_id=study_id,
role="PV",
endpoint_key="POST:/subjects",
endpoint_key="subjects:create",
allowed=False,
)
db_session.add(perm)
@@ -48,7 +48,7 @@ async def test_create_subject_without_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PV", "POST:/subjects"
db_session, study_id, "PV", "subjects:create"
)
assert result is False
@@ -62,7 +62,7 @@ async def test_list_subjects_with_permission(db_session: AsyncSession):
perm = ApiEndpointPermission(
study_id=study_id,
role="CRA",
endpoint_key="GET:/subjects",
endpoint_key="subjects:list",
allowed=True,
)
db_session.add(perm)
@@ -70,7 +70,7 @@ async def test_list_subjects_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "CRA", "GET:/subjects"
db_session, study_id, "CRA", "subjects:list"
)
assert result is True
@@ -84,7 +84,7 @@ async def test_get_subject_detail_with_permission(db_session: AsyncSession):
perm = ApiEndpointPermission(
study_id=study_id,
role="PV",
endpoint_key="GET:/subjects/{id}",
endpoint_key="subjects:read",
allowed=True,
)
db_session.add(perm)
@@ -92,7 +92,7 @@ async def test_get_subject_detail_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PV", "GET:/subjects/{id}"
db_session, study_id, "PV", "subjects:read"
)
assert result is True
@@ -106,7 +106,7 @@ async def test_update_subject_with_permission(db_session: AsyncSession):
perm = ApiEndpointPermission(
study_id=study_id,
role="CRA",
endpoint_key="PATCH:/subjects/{id}",
endpoint_key="subjects:update",
allowed=True,
)
db_session.add(perm)
@@ -114,7 +114,7 @@ async def test_update_subject_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "CRA", "PATCH:/subjects/{id}"
db_session, study_id, "CRA", "subjects:update"
)
assert result is True
@@ -128,7 +128,7 @@ async def test_delete_subject_with_permission(db_session: AsyncSession):
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="DELETE:/subjects/{id}",
endpoint_key="subjects:delete",
allowed=True,
)
db_session.add(perm)
@@ -136,21 +136,21 @@ async def test_delete_subject_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "DELETE:/subjects/{id}"
db_session, study_id, "PM", "subjects:delete"
)
assert result is True
@pytest.mark.asyncio
async def test_create_risk_issue_with_permission(db_session: AsyncSession):
"""测试创建不良事件 - 有权限"""
async def test_create_subject_ae_with_permission(db_session: AsyncSession):
"""测试创建参与者AE - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="CRA",
endpoint_key="POST:/risk-issues",
endpoint_key="subject_aes:create",
allowed=True,
)
db_session.add(perm)
@@ -158,21 +158,21 @@ async def test_create_risk_issue_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "CRA", "POST:/risk-issues"
db_session, study_id, "CRA", "subject_aes:create"
)
assert result is True
@pytest.mark.asyncio
async def test_list_risk_issues_with_permission(db_session: AsyncSession):
"""测试查询不良事件列表 - 有权限"""
async def test_list_subject_aes_with_permission(db_session: AsyncSession):
"""测试查询参与者AE列表 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PV",
endpoint_key="GET:/risk-issues",
endpoint_key="subject_aes:list",
allowed=True,
)
db_session.add(perm)
@@ -180,21 +180,21 @@ async def test_list_risk_issues_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PV", "GET:/risk-issues"
db_session, study_id, "PV", "subject_aes:list"
)
assert result is True
@pytest.mark.asyncio
async def test_get_risk_issue_detail_with_permission(db_session: AsyncSession):
"""测试查询不良事件详情 - 有权限"""
async def test_get_subject_ae_detail_with_permission(db_session: AsyncSession):
"""测试查询参与者AE详情 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="MEDICAL_REVIEW",
endpoint_key="GET:/risk-issues/{id}",
role="QA",
endpoint_key="subject_aes:read",
allowed=True,
)
db_session.add(perm)
@@ -202,21 +202,21 @@ async def test_get_risk_issue_detail_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "MEDICAL_REVIEW", "GET:/risk-issues/{id}"
db_session, study_id, "QA", "subject_aes:read"
)
assert result is True
@pytest.mark.asyncio
async def test_create_fee_contract_with_permission(db_session: AsyncSession):
"""测试创建费用合同 - 有权限"""
"""测试创建合同费用 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="POST:/fees/contracts",
endpoint_key="fees_contracts:create",
allowed=True,
)
db_session.add(perm)
@@ -224,21 +224,21 @@ async def test_create_fee_contract_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "POST:/fees/contracts"
db_session, study_id, "PM", "fees_contracts:create"
)
assert result is True
@pytest.mark.asyncio
async def test_list_fee_contracts_with_permission(db_session: AsyncSession):
"""测试查询费用合同列表 - 有权限"""
"""测试查询合同费用列表 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="CRA",
endpoint_key="GET:/fees/contracts",
endpoint_key="fees_contracts:list",
allowed=True,
)
db_session.add(perm)
@@ -246,21 +246,21 @@ async def test_list_fee_contracts_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "CRA", "GET:/fees/contracts"
db_session, study_id, "CRA", "fees_contracts:list"
)
assert result is True
@pytest.mark.asyncio
async def test_get_fee_contract_detail_with_permission(db_session: AsyncSession):
"""测试查询费用合同详情 - 有权限"""
"""测试查询合同费用详情 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="IMP",
endpoint_key="GET:/fees/contracts/{id}",
role="CTA",
endpoint_key="fees_contracts:read",
allowed=True,
)
db_session.add(perm)
@@ -268,21 +268,21 @@ async def test_get_fee_contract_detail_with_permission(db_session: AsyncSession)
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "IMP", "GET:/fees/contracts/{id}"
db_session, study_id, "CTA", "fees_contracts:read"
)
assert result is True
@pytest.mark.asyncio
async def test_update_fee_contract_with_permission(db_session: AsyncSession):
"""测试更新费用合同 - 有权限"""
"""测试更新合同费用 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="PATCH:/fees/contracts/{id}",
endpoint_key="fees_contracts:update",
allowed=True,
)
db_session.add(perm)
@@ -290,21 +290,21 @@ async def test_update_fee_contract_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "PATCH:/fees/contracts/{id}"
db_session, study_id, "PM", "fees_contracts:update"
)
assert result is True
@pytest.mark.asyncio
async def test_delete_fee_contract_with_permission(db_session: AsyncSession):
"""测试删除费用合同 - 有权限"""
"""测试删除合同费用 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="DELETE:/fees/contracts/{id}",
endpoint_key="fees_contracts:delete",
allowed=True,
)
db_session.add(perm)
@@ -312,182 +312,7 @@ async def test_delete_fee_contract_with_permission(db_session: AsyncSession):
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "DELETE:/fees/contracts/{id}"
db_session, study_id, "PM", "fees_contracts:delete"
)
assert result is True
@pytest.mark.asyncio
async def test_create_fee_payment_with_permission(db_session: AsyncSession):
"""测试创建费用分期 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="POST:/fees/contracts/{id}/payments",
allowed=True,
)
db_session.add(perm)
await db_session.commit()
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "POST:/fees/contracts/{id}/payments"
)
assert result is True
@pytest.mark.asyncio
async def test_update_fee_payment_with_permission(db_session: AsyncSession):
"""测试更新费用分期 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="PATCH:/fees/payments/{id}",
allowed=True,
)
db_session.add(perm)
await db_session.commit()
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "PATCH:/fees/payments/{id}"
)
assert result is True
@pytest.mark.asyncio
async def test_delete_fee_payment_with_permission(db_session: AsyncSession):
"""测试删除费用分期 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="DELETE:/fees/payments/{id}",
allowed=True,
)
db_session.add(perm)
await db_session.commit()
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "DELETE:/fees/payments/{id}"
)
assert result is True
@pytest.mark.asyncio
async def test_create_finance_contract_with_permission(db_session: AsyncSession):
"""测试创建财务合同 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="POST:/finance/contracts",
allowed=True,
)
db_session.add(perm)
await db_session.commit()
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "POST:/finance/contracts"
)
assert result is True
@pytest.mark.asyncio
async def test_list_finance_contracts_with_permission(db_session: AsyncSession):
"""测试查询财务合同列表 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="CRA",
endpoint_key="GET:/finance/contracts",
allowed=True,
)
db_session.add(perm)
await db_session.commit()
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "CRA", "GET:/finance/contracts"
)
assert result is True
@pytest.mark.asyncio
async def test_get_finance_contract_detail_with_permission(db_session: AsyncSession):
"""测试查询财务合同详情 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="IMP",
endpoint_key="GET:/finance/contracts/{id}",
allowed=True,
)
db_session.add(perm)
await db_session.commit()
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "IMP", "GET:/finance/contracts/{id}"
)
assert result is True
@pytest.mark.asyncio
async def test_update_finance_contract_with_permission(db_session: AsyncSession):
"""测试更新财务合同 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="PATCH:/finance/contracts/{id}",
allowed=True,
)
db_session.add(perm)
await db_session.commit()
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "PATCH:/finance/contracts/{id}"
)
assert result is True
@pytest.mark.asyncio
async def test_delete_finance_contract_with_permission(db_session: AsyncSession):
"""测试删除财务合同 - 有权限"""
study_id = uuid.uuid4()
# 创建权限
perm = ApiEndpointPermission(
study_id=study_id,
role="PM",
endpoint_key="DELETE:/finance/contracts/{id}",
allowed=True,
)
db_session.add(perm)
await db_session.commit()
# 验证权限
result = await role_has_api_permission(
db_session, study_id, "PM", "DELETE:/finance/contracts/{id}"
)
assert result is True