按业务模块拆分附件权限

backend/app/api/v1/attachments.py

@@ -8,11 +8,16 @@ from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status,
 from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, get_study_member, require_study_not_locked, require_api_permission
+from app.core.deps import get_current_user, get_db_session, get_study_member, require_study_not_locked
 from app.core.project_permissions import role_has_api_permission
 from app.crud import attachment as attachment_crud
 from app.crud import audit as audit_crud
+from app.crud import contract_fee as contract_fee_crud
+from app.crud import drug_shipment as drug_shipment_crud
+from app.crud import faq_reply as faq_reply_crud
+from app.crud import precaution as precaution_crud
 from app.crud import study as study_crud
+from app.crud import startup as startup_crud
 from app.crud import user as user_crud
 from app.crud import member as member_crud
 from app.core.security import decode_token
@@ -23,6 +28,34 @@ router = APIRouter()
 global_router = APIRouter()
 
 UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
+FEE_ATTACHMENT_ENTITY_TYPES = {
+    "contract_fee_contract",
+    "contract_fee_voucher",
+    "contract_fee_invoice",
+}
+STARTUP_AUTH_ATTACHMENT_ENTITY_TYPES = {
+    "startup_kickoff",
+    "startup_kickoff_minutes",
+    "startup_kickoff_signin",
+    "startup_kickoff_ppt",
+    "training_authorization",
+}
+
+ATTACHMENT_PERMISSION_MODULES = {
+    "contract_fee_contract": "fees_contracts_attachments",
+    "contract_fee_voucher": "fees_contracts_attachments",
+    "contract_fee_invoice": "fees_contracts_attachments",
+    "startup_feasibility": "startup_initiation_attachments",
+    "startup_ethics": "startup_ethics_attachments",
+    "startup_kickoff": "startup_auth_attachments",
+    "startup_kickoff_minutes": "startup_auth_attachments",
+    "startup_kickoff_signin": "startup_auth_attachments",
+    "startup_kickoff_ppt": "startup_auth_attachments",
+    "training_authorization": "startup_auth_attachments",
+    "drug_shipment": "drug_shipments_attachments",
+    "precaution": "precautions_attachments",
+    "faq_replies": "faq_attachments",
+}
 
 
 def _content_disposition(filename: str, disposition: str = "inline") -> str:
@@ -38,12 +71,132 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     return study
 
 
+def _role_value(user) -> str:
+    return user.role.value if hasattr(user.role, "value") else user.role
+
+
+def _attachment_operation(action: str) -> str:
+    if action in {"create", "read", "delete"}:
+        return action
+    return "read" if action == "read" else "create"
+
+
+async def _resolve_attachment_parent_permission(
+    db: AsyncSession,
+    study_id: uuid.UUID,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    action: str,
+) -> str | None:
+    parent_action = "read" if action == "read" else "update"
+
+    if entity_type in FEE_ATTACHMENT_ENTITY_TYPES:
+        contract = await contract_fee_crud.get_contract_fee(db, entity_id)
+        if not contract or contract.project_id != study_id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同费用不存在")
+        return "fees_contracts:read" if action == "read" else "fees_contracts:update"
+
+    if entity_type == "startup_feasibility":
+        record = await startup_crud.get_feasibility(db, entity_id)
+        if not record or record.study_id != study_id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="立项记录不存在")
+        return f"startup_initiation:{parent_action}"
+
+    if entity_type == "startup_ethics":
+        record = await startup_crud.get_ethics(db, entity_id)
+        if not record or record.study_id != study_id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="伦理记录不存在")
+        return f"startup_ethics:{parent_action}"
+
+    if entity_type in STARTUP_AUTH_ATTACHMENT_ENTITY_TYPES:
+        if entity_type == "training_authorization":
+            record = await startup_crud.get_training_authorization(db, entity_id)
+            missing_detail = "培训授权不存在"
+        else:
+            record = await startup_crud.get_kickoff(db, entity_id)
+            missing_detail = "启动会不存在"
+        if not record or record.study_id != study_id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=missing_detail)
+        return "startup_auth:read" if action == "read" else "startup_auth:update"
+
+    if entity_type == "drug_shipment":
+        shipment = await drug_shipment_crud.get_shipment(db, entity_id)
+        if not shipment or shipment.study_id != study_id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="药物发货不存在")
+        return "drug_shipments:read" if action == "read" else "drug_shipments:update"
+
+    if entity_type == "precaution":
+        precaution = await precaution_crud.get_precaution(db, entity_id)
+        if not precaution or precaution.study_id != study_id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="注意事项不存在")
+        return "precautions:read" if action == "read" else "precautions:update"
+
+    if entity_type == "faq_replies":
+        reply = await faq_reply_crud.get_reply(db, entity_id)
+        if not reply or reply.study_id != study_id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ回复不存在")
+        if action == "read":
+            return "faq:read"
+        if action == "delete":
+            return "faq_reply:delete"
+        return "faq_reply:create"
+
+    return None
+
+
+async def _ensure_attachment_permission(
+    db: AsyncSession,
+    study_id: uuid.UUID,
+    entity_type: str,
+    entity_id: uuid.UUID,
+    action: str,
+    current_user,
+    membership=None,
+) -> None:
+    parent_permission = await _resolve_attachment_parent_permission(db, study_id, entity_type, entity_id, action)
+    role_value = _role_value(current_user)
+    if role_value == "ADMIN":
+        return
+
+    if membership is None:
+        membership = await member_crud.get_member(db, study_id, current_user.id)
+    if not membership or not membership.is_active:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
+
+    operation = _attachment_operation(action)
+    module_prefix = ATTACHMENT_PERMISSION_MODULES.get(entity_type)
+    if not module_prefix:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="附件类型未配置权限")
+
+    attachment_allowed = await role_has_api_permission(
+        db,
+        study_id,
+        membership.role_in_study,
+        f"{module_prefix}:{operation}",
+        check_prerequisites=False,
+    )
+    if not attachment_allowed:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="接口权限不足")
+
+    if not parent_permission:
+        return
+
+    allowed = await role_has_api_permission(
+        db,
+        study_id,
+        membership.role_in_study,
+        parent_permission,
+        check_prerequisites=False,
+    )
+    if not allowed:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
+
+
 @router.post(
     "/",
     response_model=AttachmentRead,
     status_code=status.HTTP_201_CREATED,
     dependencies=[
-        Depends(require_api_permission("attachments:create")),
         Depends(require_study_not_locked())
     ],
 )
@@ -56,6 +209,7 @@ async def upload_attachment(
     current_user=Depends(get_current_user),
 ) -> AttachmentRead:
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "create", current_user)
     dest_dir = UPLOAD_ROOT / f"study_{study_id}" / f"{entity_type}_{entity_id}"
     dest_dir.mkdir(parents=True, exist_ok=True)
     unique_name = f"{uuid.uuid4()}{Path(file.filename).suffix}"
@@ -100,7 +254,6 @@ async def upload_attachment(
 @router.get(
     "/",
     response_model=list[AttachmentRead],
-    dependencies=[Depends(require_api_permission("attachments:read"))],
 )
 async def list_attachments(
     study_id: uuid.UUID,
@@ -110,6 +263,7 @@ async def list_attachments(
     current_user=Depends(get_current_user),
 ) -> list[AttachmentRead]:
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "read", current_user)
     attachments = await attachment_crud.list_attachments(db, study_id, entity_type, entity_id)
     user_ids = {a.uploaded_by for a in attachments if a.uploaded_by}
     users_map = await user_crud.get_users_by_ids(db, user_ids)
@@ -132,7 +286,6 @@ async def list_attachments(
 
 @router.get(
     "/{attachment_id}/download",
-    dependencies=[Depends(require_api_permission("attachments:read"))],
 )
 async def download_attachment(
     study_id: uuid.UUID,
@@ -143,6 +296,7 @@ async def download_attachment(
     current_user=Depends(get_current_user),
 ) -> FileResponse:
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "read", current_user)
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -158,7 +312,6 @@ async def download_attachment(
 
 @router.get(
     "/{attachment_id}/preview",
-    dependencies=[Depends(require_api_permission("attachments:read"))],
 )
 async def preview_attachment(
     study_id: uuid.UUID,
@@ -169,6 +322,7 @@ async def preview_attachment(
     current_user=Depends(get_current_user),
 ) -> FileResponse:
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "read", current_user)
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -195,7 +349,7 @@ async def _authorize_global(request: Request, db: AsyncSession, study_id: uuid.U
     user = await user_crud.get_by_id(db, uuid.UUID(str(payload.get("sub"))))
     if not user or not user.is_active:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="账号不存在或已停用")
-    if user.role == "ADMIN":
+    if _role_value(user) == "ADMIN":
         return user, None
     membership = await member_crud.get_member(db, study_id, user.id)
     if not membership or not membership.is_active:
@@ -216,20 +370,10 @@ async def global_download_attachment(
     if not attachment:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
     await _ensure_study_exists(db, attachment.study_id)
-    user, _ = await _authorize_global(request, db, attachment.study_id)
-    membership = None
-    if user.role != "ADMIN":
-        membership = await get_study_member(attachment.study_id, current_user=user, db=db)
-    if user.role != "ADMIN":
-        allowed = await role_has_api_permission(
-            db,
-            attachment.study_id,
-            membership.role_in_study if membership else None,
-            "attachments:read",
-            check_prerequisites=False,
-        )
-        if not allowed:
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
+    user, membership = await _authorize_global(request, db, attachment.study_id)
+    await _ensure_attachment_permission(
+        db, attachment.study_id, attachment.entity_type, attachment.entity_id, "read", user, membership
+    )
     if not os.path.exists(attachment.file_path):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
     return FileResponse(
@@ -254,16 +398,9 @@ async def global_preview_attachment(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
     await _ensure_study_exists(db, attachment.study_id)
     user, membership = await _authorize_global(request, db, attachment.study_id)
-    if user.role != "ADMIN":
-        allowed = await role_has_api_permission(
-            db,
-            attachment.study_id,
-            membership.role_in_study if membership else None,
-            "attachments:read",
-            check_prerequisites=False,
-        )
-        if not allowed:
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
+    await _ensure_attachment_permission(
+        db, attachment.study_id, attachment.entity_type, attachment.entity_id, "read", user, membership
+    )
     if not os.path.exists(attachment.file_path):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
     return FileResponse(
@@ -288,18 +425,11 @@ async def global_delete_attachment(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
     await _ensure_study_exists(db, attachment.study_id)
     user, membership = await _authorize_global(request, db, attachment.study_id)
-    if user.role != "ADMIN":
-        allowed = await role_has_api_permission(
-            db,
-            attachment.study_id,
-            membership.role_in_study if membership else None,
-            "attachments:delete",
-            check_prerequisites=False,
-        )
-        if not allowed:
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
+    await _ensure_attachment_permission(
+        db, attachment.study_id, attachment.entity_type, attachment.entity_id, "delete", user, membership
+    )
     can_delete = (
-        user.role == "ADMIN"
+        _role_value(user) == "ADMIN"
         or attachment.uploaded_by == user.id
         or membership is not None
     )
@@ -322,7 +452,6 @@ async def global_delete_attachment(
     "/{attachment_id}",
     status_code=status.HTTP_204_NO_CONTENT,
     dependencies=[
-        Depends(require_api_permission("attachments:delete")),
         Depends(require_study_not_locked())
     ],
 )
@@ -335,6 +464,7 @@ async def delete_attachment(
     current_user=Depends(get_current_user),
 ):
     await _ensure_study_exists(db, study_id)
+    await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "delete", current_user)
     attachment = await attachment_crud.get_attachment(db, attachment_id)
     if (
         not attachment
@@ -346,11 +476,11 @@ async def delete_attachment(
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
 
     membership = None
-    if current_user.role != "ADMIN":
+    if _role_value(current_user) != "ADMIN":
         membership = await get_study_member(study_id, current_user=current_user, db=db)
 
     can_delete = (
-        current_user.role == "ADMIN"
+        _role_value(current_user) == "ADMIN"
         or attachment.uploaded_by == current_user.id
         or membership is not None
     )

backend/app/api/v1/fees_attachments.py

@@ -69,7 +69,7 @@ async def _authorize_download_user(request: Request, db: AsyncSession):
     response_model=FeeApiResponse[FeeAttachmentRead],
     status_code=status.HTTP_201_CREATED,
     dependencies=[
-        Depends(require_api_permission("fees_attachments:create")),
+        Depends(require_api_permission("fees_contracts:update")),
         Depends(require_study_not_locked())
     ],
 )
@@ -139,7 +139,7 @@ async def upload_fee_attachment(
 @router.get(
     "/attachments",
     response_model=FeeApiResponse[list[FeeAttachmentRead]],
-    dependencies=[Depends(require_api_permission("fees_attachments:read"))],
+    dependencies=[Depends(require_api_permission("fees_contracts:read"))],
 )
 async def list_fee_attachments(
     entity_type: str,
@@ -195,7 +195,7 @@ async def download_fee_attachment(
         if not membership or not membership.is_active:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
         allowed = await role_has_api_permission(
-            db, project_id, membership.role_in_study, "fees_attachments:read", check_prerequisites=False
+            db, project_id, membership.role_in_study, "fees_contracts:read", check_prerequisites=False
         )
         if not allowed:
             raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
@@ -213,7 +213,7 @@ async def download_fee_attachment(
     "/attachments/{attachment_id}",
     status_code=status.HTTP_204_NO_CONTENT,
     dependencies=[
-        Depends(require_api_permission("fees_attachments:delete")),
+        Depends(require_api_permission("fees_contracts:update")),
         Depends(require_study_not_locked())
     ],
 )