Step 4：评论 / 附件 / 审计日志

2025-12-16 17:02:11 +08:00
parent f3692e1145
commit 31892247bf
69 changed files with 506 additions and 2 deletions
@@ -0,0 +1,113 @@
+import os
+import uuid
+from pathlib import Path
+
+import aiofiles
+from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status
+from fastapi.responses import FileResponse
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_current_user, get_db_session, require_study_member
+from app.crud import attachment as attachment_crud
+from app.crud import audit as audit_crud
+from app.crud import study as study_crud
+from app.schemas.attachment import AttachmentRead
+
+router = APIRouter()
+
+UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
+
+
+async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
+    study = await study_crud.get(db, study_id)
+    if not study:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Study not found")
+    return study
+
+
+@router.post(
+    "/",
+    response_model=AttachmentRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_study_member())],
+)
+async def upload_attachment(
+    study_id: uuid.UUID,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    file: UploadFile = File(...),
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> AttachmentRead:
+    await _ensure_study_exists(db, study_id)
+    dest_dir = UPLOAD_ROOT / f"study_{study_id}" / f"{entity_type}_{entity_id}"
+    dest_dir.mkdir(parents=True, exist_ok=True)
+    unique_name = f"{uuid.uuid4()}{Path(file.filename).suffix}"
+    dest_path = dest_dir / unique_name
+
+    content = await file.read()
+    async with aiofiles.open(dest_path, "wb") as out_file:
+        await out_file.write(content)
+
+    attachment = await attachment_crud.create_attachment(
+        db,
+        study_id=study_id,
+        entity_type=entity_type,
+        entity_id=entity_id,
+        filename=file.filename,
+        file_path=str(dest_path),
+        file_size=len(content),
+        content_type=file.content_type,
+        uploaded_by=current_user.id,
+    )
+    await audit_crud.log_action(
+        db,
+        study_id=study_id,
+        entity_type=entity_type,
+        entity_id=entity_id,
+        action="UPLOAD_FILE",
+        detail=f"File uploaded: {file.filename}",
+        operator_id=current_user.id,
+        operator_role=current_user.role,
+    )
+    return attachment
+
+
+@router.get(
+    "/",
+    response_model=list[AttachmentRead],
+    dependencies=[Depends(require_study_member())],
+)
+async def list_attachments(
+    study_id: uuid.UUID,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+) -> list[AttachmentRead]:
+    await _ensure_study_exists(db, study_id)
+    attachments = await attachment_crud.list_attachments(db, study_id, entity_type, entity_id)
+    return list(attachments)
+
+
+@router.get(
+    "/{attachment_id}/download",
+    dependencies=[Depends(require_study_member())],
+)
+async def download_attachment(
+    study_id: uuid.UUID,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    attachment_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+) -> FileResponse:
+    await _ensure_study_exists(db, study_id)
+    attachment = await attachment_crud.get_attachment(db, attachment_id)
+    if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Attachment not found")
+    if not os.path.exists(attachment.file_path):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="File missing on server")
+    return FileResponse(
+        path=attachment.file_path,
+        filename=attachment.filename,
+        media_type=attachment.content_type or "application/octet-stream",
+    )
@@ -0,0 +1,36 @@
+import uuid
+
+from fastapi import APIRouter, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_db_session, require_study_member
+from app.crud import audit as audit_crud
+from app.schemas.audit import AuditLogRead
+
+router = APIRouter()
+
+
+@router.get(
+    "/",
+    response_model=list[AuditLogRead],
+    dependencies=[Depends(require_study_member())],
+)
+async def list_audit_logs(
+    study_id: uuid.UUID,
+    entity_type: str | None = None,
+    entity_id: uuid.UUID | None = None,
+    action: str | None = None,
+    skip: int = 0,
+    limit: int = 100,
+    db: AsyncSession = Depends(get_db_session),
+) -> list[AuditLogRead]:
+    logs = await audit_crud.list_logs(
+        db,
+        study_id=study_id,
+        entity_type=entity_type,
+        entity_id=entity_id,
+        action=action,
+        skip=skip,
+        limit=limit,
+    )
+    return list(logs)
@@ -0,0 +1,71 @@
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_current_user, get_db_session, require_study_member
+from app.crud import comment as comment_crud
+from app.crud import audit as audit_crud
+from app.crud import study as study_crud
+from app.schemas.comment import CommentCreate, CommentRead
+
+router = APIRouter()
+
+
+async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
+    study = await study_crud.get(db, study_id)
+    if not study:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Study not found")
+    return study
+
+
+@router.post(
+    "/",
+    response_model=CommentRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_study_member())],
+)
+async def create_comment(
+    study_id: uuid.UUID,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    comment_in: CommentCreate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> CommentRead:
+    await _ensure_study_exists(db, study_id)
+    comment = await comment_crud.create_comment(
+        db,
+        study_id=study_id,
+        entity_type=entity_type,
+        entity_id=entity_id,
+        comment_in=comment_in,
+        created_by=current_user.id,
+    )
+    await audit_crud.log_action(
+        db,
+        study_id=study_id,
+        entity_type=entity_type,
+        entity_id=entity_id,
+        action="CREATE_COMMENT",
+        detail=f"Comment created by {current_user.username}",
+        operator_id=current_user.id,
+        operator_role=current_user.role,
+    )
+    return comment
+
+
+@router.get(
+    "/",
+    response_model=list[CommentRead],
+    dependencies=[Depends(require_study_member())],
+)
+async def list_comments(
+    study_id: uuid.UUID,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+) -> list[CommentRead]:
+    await _ensure_study_exists(db, study_id)
+    comments = await comment_crud.list_comments(db, study_id, entity_type, entity_id)
+    return list(comments)
@@ -1,6 +1,6 @@
 from fastapi import APIRouter

-from app.api.v1 import auth, users, studies, sites, members
+from app.api.v1 import auth, users, studies, sites, members, comments, attachments, audit_logs

 api_router = APIRouter()
 api_router.include_router(auth.router, prefix="/auth", tags=["auth"])
@@ -8,3 +8,6 @@ api_router.include_router(users.router, prefix="/users", tags=["users"])
 api_router.include_router(studies.router, prefix="/studies", tags=["studies"])
 api_router.include_router(sites.router, prefix="/studies/{study_id}/sites", tags=["sites"])
 api_router.include_router(members.router, prefix="/studies/{study_id}/members", tags=["study-members"])
+api_router.include_router(comments.router, prefix="/studies/{study_id}/{entity_type}/{entity_id}/comments", tags=["comments"])
+api_router.include_router(attachments.router, prefix="/studies/{study_id}/{entity_type}/{entity_id}/attachments", tags=["attachments"])
+api_router.include_router(audit_logs.router, prefix="/studies/{study_id}/audit-logs", tags=["audit-logs"])