统一项目角色与接口权限配置
This commit is contained in:
Cheng Zhou
@@ -12,91 +12,91 @@ from app.models.api_endpoint_permission import ApiEndpointPermission
|
||||
|
||||
|
||||
# ============================================================================
|
||||
# 启动管理 (startup) - 19个端点
|
||||
# 启动管理 (startup)
|
||||
# ============================================================================
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_startup_ethics_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的PM可以创建伦理审批"""
|
||||
"""验证有权限的PM可以创建伦理记录"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="POST:/studies/{study_id}/startup/ethics",
|
||||
endpoint_key="startup_ethics:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "POST:/studies/{study_id}/startup/ethics")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "startup_ethics:create")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_startup_ethics_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的PM可以查询伦理审批列表"""
|
||||
"""验证有权限的PM可以查询伦理记录列表"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="GET:/studies/{study_id}/startup/ethics",
|
||||
endpoint_key="startup_ethics:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "GET:/studies/{study_id}/startup/ethics")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "startup_ethics:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_startup_feasibility_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的PM可以创建可行性评估"""
|
||||
async def test_startup_initiation_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的PM可以创建立项记录"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="POST:/studies/{study_id}/startup/feasibility",
|
||||
endpoint_key="startup_initiation:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "POST:/studies/{study_id}/startup/feasibility")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "startup_initiation:create")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_startup_budget_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的PM可以创建预算评估"""
|
||||
async def test_startup_auth_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的PM可以创建启动会或培训授权"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="POST:/studies/{study_id}/startup/budget",
|
||||
endpoint_key="startup_auth:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "POST:/studies/{study_id}/startup/budget")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "startup_auth:create")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_startup_timeline_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的PM可以创建时间表"""
|
||||
async def test_startup_auth_read_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以查询启动会或培训授权"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="POST:/studies/{study_id}/startup/timeline",
|
||||
role="CRA",
|
||||
endpoint_key="startup_auth:read",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "POST:/studies/{study_id}/startup/timeline")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "startup_auth:read")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -111,13 +111,13 @@ async def test_project_permissions_get_with_permission(db_session: AsyncSession)
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="GET:/studies/{study_id}/permissions",
|
||||
endpoint_key="permissions:read",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "GET:/studies/{study_id}/permissions")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "permissions:read")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -128,13 +128,13 @@ async def test_project_permissions_update_with_permission(db_session: AsyncSessi
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="PUT:/studies/{study_id}/permissions",
|
||||
endpoint_key="permissions:update",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "PUT:/studies/{study_id}/permissions")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "permissions:update")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -149,51 +149,34 @@ async def test_overview_get_with_permission(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="GET:/studies/{study_id}/overview",
|
||||
endpoint_key="project_overview:read",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "GET:/studies/{study_id}/overview")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "project_overview:read")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
# ============================================================================
|
||||
# 监查问题 (monitoring_visit_issues) - 7个端点
|
||||
# 监查访视问题汇总 (monitoring_visit_issues)
|
||||
# ============================================================================
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_monitoring_issues_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以创建监查问题"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/studies/{study_id}/monitoring-visits/{visit_id}/issues",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "POST:/studies/{study_id}/monitoring-visits/{visit_id}/issues")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_monitoring_issues_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以查询监查问题列表"""
|
||||
"""验证有权限的CRA可以查询监查访视问题列表"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="GET:/studies/{study_id}/monitoring-visits/{visit_id}/issues",
|
||||
endpoint_key="monitoring_issues:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "GET:/studies/{study_id}/monitoring-visits/{visit_id}/issues")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "monitoring_issues:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -203,111 +186,111 @@ async def test_monitoring_issues_list_with_permission(db_session: AsyncSession):
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_drug_shipments_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的IMP可以创建药物发货"""
|
||||
"""验证有权限的CTA可以创建药物发货"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="IMP",
|
||||
endpoint_key="POST:/studies/{study_id}/drug-shipments",
|
||||
role="CTA",
|
||||
endpoint_key="drug_shipments:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "IMP", "POST:/studies/{study_id}/drug-shipments")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CTA", "drug_shipments:create")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_drug_shipments_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的IMP可以查询药物发货列表"""
|
||||
"""验证有权限的CTA可以查询药物发货列表"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="IMP",
|
||||
endpoint_key="GET:/studies/{study_id}/drug-shipments",
|
||||
role="CTA",
|
||||
endpoint_key="drug_shipments:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "IMP", "GET:/studies/{study_id}/drug-shipments")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CTA", "drug_shipments:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
# ============================================================================
|
||||
# 物资管理 (material_equipments) - 5个端点
|
||||
# 设备管理 (material_equipments) - 5个端点
|
||||
# ============================================================================
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_materials_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的IMP可以创建物资"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="IMP",
|
||||
endpoint_key="POST:/studies/{study_id}/materials",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "IMP", "POST:/studies/{study_id}/materials")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_materials_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的IMP可以查询物资列表"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="IMP",
|
||||
endpoint_key="GET:/studies/{study_id}/materials",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "IMP", "GET:/studies/{study_id}/materials")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
# ============================================================================
|
||||
# 参与者PDS (subject_pds) - 4个端点
|
||||
# ============================================================================
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_subject_pds_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以创建参与者PDS"""
|
||||
async def test_material_equipments_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以创建设备"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/studies/{study_id}/subjects/{subject_id}/pds",
|
||||
endpoint_key="material_equipments:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "POST:/studies/{study_id}/subjects/{subject_id}/pds")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "material_equipments:create")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_material_equipments_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CTA可以查询设备列表"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CTA",
|
||||
endpoint_key="material_equipments:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CTA", "material_equipments:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
# ============================================================================
|
||||
# 参与者PD (subject_pds) - 4个端点
|
||||
# ============================================================================
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_subject_pds_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以创建参与者PD"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="subject_pds:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "subject_pds:create")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_subject_pds_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以查询参与者PDS列表"""
|
||||
"""验证有权限的CRA可以查询参与者PD列表"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="GET:/studies/{study_id}/subjects/{subject_id}/pds",
|
||||
endpoint_key="subject_pds:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "GET:/studies/{study_id}/subjects/{subject_id}/pds")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "subject_pds:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -322,13 +305,13 @@ async def test_audit_logs_list_with_permission(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="GET:/studies/{study_id}/audit-logs",
|
||||
endpoint_key="audit_logs:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "GET:/studies/{study_id}/audit-logs")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "audit_logs:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -339,13 +322,13 @@ async def test_audit_logs_export_with_permission(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="POST:/studies/{study_id}/audit-logs/export",
|
||||
endpoint_key="audit_logs:export",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "POST:/studies/{study_id}/audit-logs/export")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "audit_logs:export")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -360,13 +343,13 @@ async def test_visits_create_with_permission(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PV",
|
||||
endpoint_key="POST:/studies/{study_id}/visits",
|
||||
endpoint_key="visits:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PV", "POST:/studies/{study_id}/visits")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PV", "visits:create")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -377,89 +360,89 @@ async def test_visits_list_with_permission(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PV",
|
||||
endpoint_key="GET:/studies/{study_id}/visits",
|
||||
endpoint_key="visits:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PV", "GET:/studies/{study_id}/visits")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PV", "visits:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
# ============================================================================
|
||||
# 知识库笔记 (knowledge_notes) - 5个端点
|
||||
# 注意事项 (precautions) - 5个端点
|
||||
# ============================================================================
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_knowledge_notes_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的MEDICAL_REVIEW可以创建知识库笔记"""
|
||||
async def test_precautions_create_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的QA可以创建注意事项"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="MEDICAL_REVIEW",
|
||||
endpoint_key="POST:/studies/{study_id}/knowledge-notes",
|
||||
role="QA",
|
||||
endpoint_key="precautions:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "MEDICAL_REVIEW", "POST:/studies/{study_id}/knowledge-notes")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "QA", "precautions:create")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_knowledge_notes_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的MEDICAL_REVIEW可以查询知识库笔记列表"""
|
||||
async def test_precautions_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的QA可以查询注意事项列表"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="MEDICAL_REVIEW",
|
||||
endpoint_key="GET:/studies/{study_id}/knowledge-notes",
|
||||
role="QA",
|
||||
endpoint_key="precautions:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "MEDICAL_REVIEW", "GET:/studies/{study_id}/knowledge-notes")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "QA", "precautions:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
# ============================================================================
|
||||
# 参与者历史 (subject_histories) - 5个端点
|
||||
# 病史记录 (subject_histories)
|
||||
# ============================================================================
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_subject_histories_list_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以查询参与者历史列表"""
|
||||
"""验证有权限的CRA可以查询病史记录列表"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="GET:/studies/{study_id}/subjects/{subject_id}/history",
|
||||
endpoint_key="subject_histories:list",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "GET:/studies/{study_id}/subjects/{subject_id}/history")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "subject_histories:list")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_subject_histories_export_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以导出参与者历史"""
|
||||
async def test_subject_histories_read_with_permission(db_session: AsyncSession):
|
||||
"""验证有权限的CRA可以查询病史记录详情"""
|
||||
study_id = uuid.uuid4()
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="GET:/studies/{study_id}/subjects/{subject_id}/history/export",
|
||||
endpoint_key="subject_histories:read",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "GET:/studies/{study_id}/subjects/{subject_id}/history/export")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "subject_histories:read")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -474,13 +457,13 @@ async def test_milestones_list_with_permission(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="GET:/studies/{study_id}/milestones",
|
||||
endpoint_key="project_milestones:read",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "GET:/studies/{study_id}/milestones")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "project_milestones:read")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -491,13 +474,13 @@ async def test_milestones_update_with_permission(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PM",
|
||||
endpoint_key="PATCH:/studies/{study_id}/milestones/{id}",
|
||||
endpoint_key="project_milestones:update",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "PATCH:/studies/{study_id}/milestones/{id}")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "PM", "project_milestones:update")
|
||||
assert allowed is True
|
||||
|
||||
|
||||
@@ -512,13 +495,13 @@ async def test_startup_permission_denied_for_cra(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/studies/{study_id}/startup/ethics",
|
||||
endpoint_key="startup_ethics:create",
|
||||
allowed=False,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "POST:/studies/{study_id}/startup/ethics")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "startup_ethics:create")
|
||||
assert allowed is False
|
||||
|
||||
|
||||
@@ -529,11 +512,11 @@ async def test_project_permissions_denied_for_cra(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="PUT:/studies/{study_id}/permissions",
|
||||
endpoint_key="permissions:update",
|
||||
allowed=False,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "PUT:/studies/{study_id}/permissions")
|
||||
allowed = await role_has_api_permission(db_session, study_id, "CRA", "permissions:update")
|
||||
assert allowed is False
|
||||
|
||||
Reference in New Issue
Block a user