权限系统迁移完成：接口级权限 + 前置权限检查

## 核心改进 - 完全迁移到接口级权限（68个API端点） - 实现前置权限检查机制，解决跨模块数据访问权限问题 - 添加权限管理API端点，支持前置权限查询 ## 关键变更 1. 权限配置系统 - 添加OPERATION_PREREQUISITES映射表 - 所有操作配置前置权限依赖 2. 权限检查函数 - role_has_api_permission()支持前置权限检查 - get_missing_prerequisites()获取缺失权限列表 3. 权限管理API - GET /api-permissions/operations - 获取所有操作及前置权限 - GET /api-permissions/operations/prerequisites - 获取前置权限依赖 - GET /api-permissions/{endpoint_key}/prerequisites - 检查缺失权限 4. API端点迁移 - 第1批：subjects, visits, aes, monitoring_visit_issues (23个) - 第2批：members, sites, project_milestones (11个) - 第3批：finance_contracts, fees_contracts, drug_shipments (15个) - 第4批：startup endpoints (19个) ## 测试验证 - 单元测试：24个测试全部通过 - 集成测试：22个迁移端点测试通过 - 前置权限测试：12个测试全部通过 - 总计：46个测试全部通过 ## 向后兼容性 - 模块级权限表保留用于历史数据 - 接口级权限未配置时自动回退到模块级权限 - 现有权限配置继续有效 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-05-14 12:44:18 +08:00
parent 5327e00cf1
commit 3630b9000f
22 changed files with 1382 additions and 243 deletions
@@ -14,30 +14,35 @@ API_ENDPOINT_PERMISSIONS = {
        "action": "write",
        "description": "创建参与者",
        "default_roles": ["PM", "CRA"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "subjects:list": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
+        "prerequisite_permissions": [],
    },
    "subjects:read": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
+        "prerequisite_permissions": [],
    },
    "subjects:update": {
        "module": "subjects",
        "action": "write",
        "description": "更新参与者",
        "default_roles": ["PM", "CRA"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "subjects:delete": {
        "module": "subjects",
        "action": "write",
        "description": "删除参与者",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
    },
    # 访视管理 (visits)
    "visits:create": {
@@ -45,30 +50,35 @@ API_ENDPOINT_PERMISSIONS = {
        "action": "write",
        "description": "创建访视",
        "default_roles": ["PM", "CRA"],
+        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "visits:list": {
        "module": "subjects",
        "action": "read",
        "description": "查询访视列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
+        "prerequisite_permissions": [],
    },
    "visits:read": {
        "module": "subjects",
        "action": "read",
        "description": "查询访视详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
+        "prerequisite_permissions": [],
    },
    "visits:update": {
        "module": "subjects",
        "action": "write",
        "description": "更新访视",
        "default_roles": ["PM", "CRA"],
+        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "visits:delete": {
        "module": "subjects",
        "action": "write",
        "description": "删除访视",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    # 不良事件 (risk_issues)
    "risk_issues:create": {
@@ -76,30 +86,35 @@ API_ENDPOINT_PERMISSIONS = {
        "action": "write",
        "description": "创建不良事件",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
+        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "risk_issues:list": {
        "module": "risk_issues",
        "action": "read",
        "description": "查询不良事件列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
+        "prerequisite_permissions": [],
    },
    "risk_issues:read": {
        "module": "risk_issues",
        "action": "read",
        "description": "查询不良事件详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
+        "prerequisite_permissions": [],
    },
    "risk_issues:update": {
        "module": "risk_issues",
        "action": "write",
        "description": "更新不良事件",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
+        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "risk_issues:delete": {
        "module": "risk_issues",
        "action": "write",
        "description": "删除不良事件",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    # 财务合同管理 (finance_contracts)
    "finance_contracts:create": {
@@ -107,30 +122,35 @@ API_ENDPOINT_PERMISSIONS = {
        "action": "write",
        "description": "创建财务合同",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "finance_contracts:list": {
        "module": "fees",
        "action": "read",
        "description": "查询财务合同列表",
        "default_roles": ["PM", "CRA", "IMP"],
+        "prerequisite_permissions": [],
    },
    "finance_contracts:read": {
        "module": "fees",
        "action": "read",
        "description": "查询财务合同详情",
        "default_roles": ["PM", "CRA", "IMP"],
+        "prerequisite_permissions": [],
    },
    "finance_contracts:update": {
        "module": "fees",
        "action": "write",
        "description": "更新财务合同",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "finance_contracts:delete": {
        "module": "fees",
        "action": "write",
        "description": "删除财务合同",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
    },
    # 费用合同管理 (fees_contracts)
    "fees_contracts:create": {
@@ -138,48 +158,56 @@ API_ENDPOINT_PERMISSIONS = {
        "action": "write",
        "description": "创建费用合同",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "fees_contracts:list": {
        "module": "fees",
        "action": "read",
        "description": "查询费用合同列表",
        "default_roles": ["PM", "CRA", "IMP"],
+        "prerequisite_permissions": [],
    },
    "fees_contracts:read": {
        "module": "fees",
        "action": "read",
        "description": "查询费用合同详情",
        "default_roles": ["PM", "CRA", "IMP"],
+        "prerequisite_permissions": [],
    },
    "fees_contracts:update": {
        "module": "fees",
        "action": "write",
        "description": "更新费用合同",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "fees_contracts:delete": {
        "module": "fees",
        "action": "write",
        "description": "删除费用合同",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "fees_payments:create": {
        "module": "fees",
        "action": "write",
        "description": "创建费用分期",
        "default_roles": ["PM"],
+        "prerequisite_permissions": [],
    },
    "fees_payments:update": {
        "module": "fees",
        "action": "write",
        "description": "更新费用分期",
        "default_roles": ["PM"],
+        "prerequisite_permissions": [],
    },
    "fees_payments:delete": {
        "module": "fees",
        "action": "write",
        "description": "删除费用分期",
        "default_roles": ["PM"],
+        "prerequisite_permissions": [],
    },
    # 项目成员管理
    "project_members:create": {
@@ -430,36 +458,70 @@ API_ENDPOINT_PERMISSIONS = {
        "description": "查询监查问题历史",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
+    # 监查访视问题管理
+    "monitoring_audit:create": {
+        "module": "monitoring_audit",
+        "action": "write",
+        "description": "创建监查访视问题",
+        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
+        "prerequisite_permissions": ["sites:read"],
+    },
+    "monitoring_audit:read": {
+        "module": "monitoring_audit",
+        "action": "read",
+        "description": "查询监查访视问题",
+        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "QA"],
+        "prerequisite_permissions": [],
+    },
+    "monitoring_audit:update": {
+        "module": "monitoring_audit",
+        "action": "write",
+        "description": "更新监查访视问题",
+        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
+        "prerequisite_permissions": ["sites:read"],
+    },
+    "monitoring_audit:delete": {
+        "module": "monitoring_audit",
+        "action": "write",
+        "description": "删除监查访视问题",
+        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
+    },
    # 药物发货管理
    "drug_shipments:create": {
        "module": "materials",
        "action": "write",
        "description": "创建药物发货",
        "default_roles": ["PM", "IMP"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "drug_shipments:list": {
        "module": "materials",
        "action": "read",
        "description": "查询药物发货列表",
        "default_roles": ["PM", "CRA", "IMP", "QA"],
+        "prerequisite_permissions": [],
    },
    "drug_shipments:read": {
        "module": "materials",
        "action": "read",
        "description": "查询药物发货详情",
        "default_roles": ["PM", "CRA", "IMP", "QA"],
+        "prerequisite_permissions": [],
    },
    "drug_shipments:update": {
        "module": "materials",
        "action": "write",
        "description": "更新药物发货",
        "default_roles": ["PM", "IMP"],
+        "prerequisite_permissions": ["sites:read"],
    },
    "drug_shipments:delete": {
        "module": "materials",
        "action": "write",
        "description": "删除药物发货",
        "default_roles": ["PM"],
+        "prerequisite_permissions": ["sites:read"],
    },
    # 物资管理
    "materials:create": {
@@ -498,24 +560,28 @@ API_ENDPOINT_PERMISSIONS = {
        "action": "write",
        "description": "创建参与者PDS",
        "default_roles": ["PM", "CRA"],
+        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "subject_pds:list": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者PDS列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
+        "prerequisite_permissions": [],
    },
    "subject_pds:read": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者PDS详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
+        "prerequisite_permissions": [],
    },
    "subject_pds:update": {
        "module": "subjects",
        "action": "write",
        "description": "更新参与者PDS",
        "default_roles": ["PM", "CRA"],
+        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    # 审计日志管理
    "audit_logs:list": {
@@ -788,3 +854,46 @@ OPERATION_TO_ENDPOINTS: dict[str, dict[str, list[str]]] = {

 # 项目级权限角色列表
 PROJECT_PERMISSION_ROLES = ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"]
+
+# 前置权限映射表（用于权限检查）
+# 定义每个操作需要的前置权限
+OPERATION_PREREQUISITES: dict[str, list[str]] = {
+    # 参与者管理
+    "subjects:create": ["sites:read"],
+    "subjects:update": ["sites:read"],
+    "subjects:delete": ["sites:read"],
+
+    # 访视管理
+    "visits:create": ["subjects:read", "sites:read"],
+    "visits:update": ["subjects:read", "sites:read"],
+    "visits:delete": ["subjects:read", "sites:read"],
+
+    # 不良事件
+    "risk_issues:create": ["subjects:read", "sites:read"],
+    "risk_issues:update": ["subjects:read", "sites:read"],
+    "risk_issues:delete": ["subjects:read", "sites:read"],
+
+    # 财务合同
+    "finance_contracts:create": ["sites:read"],
+    "finance_contracts:update": ["sites:read"],
+    "finance_contracts:delete": ["sites:read"],
+
+    # 费用合同
+    "fees_contracts:create": ["sites:read"],
+    "fees_contracts:update": ["sites:read"],
+    "fees_contracts:delete": ["sites:read"],
+
+    # 药物发货
+    "drug_shipments:create": ["sites:read"],
+    "drug_shipments:update": ["sites:read"],
+    "drug_shipments:delete": ["sites:read"],
+
+    # 参与者PDS
+    "subject_pds:create": ["subjects:read", "sites:read"],
+    "subject_pds:update": ["subjects:read", "sites:read"],
+
+    # 监查访视问题
+    "monitoring_audit:create": ["sites:read"],
+    "monitoring_audit:update": ["sites:read"],
+    "monitoring_audit:delete": ["sites:read"],
+}