zhouchengcheng/ctms
1
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(router): check system permissions against target project

Browse Source
This commit is contained in:
Cheng Zhou
2026-06-08 11:08:23 +08:00
parent 8cd8c38900
commit 30e2398400
9 changed files with 283 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/views/admin/Projects.test.ts
+26 -6
View File
@@ -47,8 +47,8 @@ describe("project management access", () => {
expect(source).toContain("suppressErrorMessage: true");
expect(source).toContain("const canProject = (row: Study, module: string, action: \"read\" | \"write\")");
expect(source).toContain("canProject(scope.row, 'project_members', 'read')");
expect(source).toContain("canProject(scope.row, 'project_members', 'write')");
expect(source).toContain("canProject(scope.row, 'sites', 'read')");
expect(source).toContain("canConfigureProject(scope.row)");
expect(source).toContain("canManageProjectBackend(scope.row)");
expect(source).toContain("canProject(scope.row, 'audit_export', 'read')");
});
@@ -74,13 +74,33 @@ describe("project management access", () => {
expect(source).not.toContain('fixed="right"');
});
it("opens project names in management detail when the user has setup config read permission", () => {
it("renders project names as plain text and moves setup configuration to a gear action", () => {
const source = readProjects();
expect(source).toContain("v-if=\"canProject(scope.row, 'setup_config', 'read')\"");
expect(source).toContain('@click="goProject(scope.row)" class="project-name"');
expect(source).not.toContain("<el-link");
expect(source).not.toContain('@click="goProject(scope.row)" class="project-name"');
expect(source).toContain('<span class="project-name">{{ scope.row.name }}</span>');
expect(source).toContain('v-if="canProject(scope.row, \'setup_config\', \'write\')" content="项目配置"');
expect(source).toContain(':icon="Setting"');
expect(source).toContain('@click="goProject(scope.row)"');
expect(source).toContain('@click="enterStudy(scope.row)"');
expect(source).toContain('if (!canProject(row, "setup_config", "read"))');
expect(source).toContain('if (!canProject(row, "setup_config", "write"))');
});
it("shows project permission configuration only for admins and target project PMs", () => {
const source = readProjects();
expect(source).toContain('v-if="canConfigureProject(scope.row)" content="权限管理"');
expect(source).toContain("const canConfigureProject = (row: Study) => canManageProjectBackend(row);");
expect(source).not.toContain("canProject(scope.row, 'project_members', 'write')");
});
it("shows center management only for admins and target project PMs", () => {
const source = readProjects();
expect(source).toContain('v-if="canManageProjectBackend(scope.row)" :content="TEXT.modules.adminProjects.sites"');
expect(source).toContain("const canManageProjectBackend = (row: Study) => isAdmin.value || row.role_in_study === \"PM\";");
expect(source).not.toContain("canProject(scope.row, 'sites', 'read')");
});
it("checks project management actions against the current row role instead of the first permission role", () => {