权限系统迁移完成：接口级权限 + 前置权限检查

## 核心改进 - 完全迁移到接口级权限（68个API端点） - 实现前置权限检查机制，解决跨模块数据访问权限问题 - 添加权限管理API端点，支持前置权限查询 ## 关键变更 1. 权限配置系统 - 添加OPERATION_PREREQUISITES映射表 - 所有操作配置前置权限依赖 2. 权限检查函数 - role_has_api_permission()支持前置权限检查 - get_missing_prerequisites()获取缺失权限列表 3. 权限管理API - GET /api-permissions/operations - 获取所有操作及前置权限 - GET /api-permissions/operations/prerequisites - 获取前置权限依赖 - GET /api-permissions/{endpoint_key}/prerequisites - 检查缺失权限 4. API端点迁移 - 第1批：subjects, visits, aes, monitoring_visit_issues (23个) - 第2批：members, sites, project_milestones (11个) - 第3批：finance_contracts, fees_contracts, drug_shipments (15个) - 第4批：startup endpoints (19个) ## 测试验证 - 单元测试：24个测试全部通过 - 集成测试：22个迁移端点测试通过 - 前置权限测试：12个测试全部通过 - 总计：46个测试全部通过 ## 向后兼容性 - 模块级权限表保留用于历史数据 - 接口级权限未配置时自动回退到模块级权限 - 现有权限配置继续有效 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-05-14 12:44:18 +08:00
parent 5327e00cf1
commit 3630b9000f
22 changed files with 1382 additions and 243 deletions
@@ -18,15 +18,15 @@ async def test_api_permission_check_allowed(db_session: AsyncSession):
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
-        endpoint_key="POST:/subjects",
+        endpoint_key="subjects:create",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

-    # 验证权限
+    # 验证权限（禁用前置权限检查）
    result = await role_has_api_permission(
-        db_session, study_id, "CRA", "POST:/subjects"
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
    )
    assert result is True

@@ -40,15 +40,15 @@ async def test_api_permission_check_denied(db_session: AsyncSession):
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PV",
-        endpoint_key="POST:/subjects",
+        endpoint_key="subjects:create",
        allowed=False,
    )
    db_session.add(perm)
    await db_session.commit()

-    # 验证权限
+    # 验证权限（禁用前置权限检查）
    result = await role_has_api_permission(
-        db_session, study_id, "PV", "POST:/subjects"
+        db_session, study_id, "PV", "subjects:create", check_prerequisites=False
    )
    assert result is False

@@ -68,9 +68,9 @@ async def test_api_permission_fallback_to_module_level(db_session: AsyncSession)
    db_session.add(module_perm)
    await db_session.commit()

-    # 不创建接口级权限，应该回退到模块级权限
+    # 不创建接口级权限，应该回退到模块级权限（禁用前置权限检查）
    result = await role_has_api_permission(
-        db_session, study_id, "CRA", "POST:/subjects"
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
    )
    assert result is True

@@ -90,9 +90,9 @@ async def test_api_permission_fallback_denied(db_session: AsyncSession):
    db_session.add(module_perm)
    await db_session.commit()

-    # 不创建接口级权限，应该回退到模块级权限
+    # 不创建接口级权限，应该回退到模块级权限（禁用前置权限检查）
    result = await role_has_api_permission(
-        db_session, study_id, "PV", "POST:/subjects"
+        db_session, study_id, "PV", "subjects:create", check_prerequisites=False
    )
    assert result is False

@@ -126,15 +126,15 @@ async def test_api_permission_priority_over_module(db_session: AsyncSession):
    api_perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
-        endpoint_key="POST:/subjects",
+        endpoint_key="subjects:create",
        allowed=False,
    )
    db_session.add(api_perm)
    await db_session.commit()

-    # 应该返回接口级权限的结果（False）
+    # 应该返回接口级权限的结果（False）（禁用前置权限检查）
    result = await role_has_api_permission(
-        db_session, study_id, "CRA", "POST:/subjects"
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
    )
    assert result is False

@@ -148,15 +148,15 @@ async def test_api_permission_read_endpoint(db_session: AsyncSession):
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PV",
-        endpoint_key="GET:/subjects/{id}",
+        endpoint_key="subjects:read",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

-    # 验证权限
+    # 验证权限（禁用前置权限检查）
    result = await role_has_api_permission(
-        db_session, study_id, "PV", "GET:/subjects/{id}"
+        db_session, study_id, "PV", "subjects:read", check_prerequisites=False
    )
    assert result is True

@@ -170,25 +170,25 @@ async def test_api_permission_different_endpoints(db_session: AsyncSession):
    get_perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
-        endpoint_key="GET:/subjects",
+        endpoint_key="subjects:read",
        allowed=True,
    )
    post_perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
-        endpoint_key="POST:/subjects",
+        endpoint_key="subjects:create",
        allowed=False,
    )
    db_session.add(get_perm)
    db_session.add(post_perm)
    await db_session.commit()

-    # 验证权限
+    # 验证权限（禁用前置权限检查）
    get_result = await role_has_api_permission(
-        db_session, study_id, "CRA", "GET:/subjects"
+        db_session, study_id, "CRA", "subjects:read", check_prerequisites=False
    )
    post_result = await role_has_api_permission(
-        db_session, study_id, "CRA", "POST:/subjects"
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
    )

    assert get_result is True
@@ -204,25 +204,25 @@ async def test_api_permission_different_roles(db_session: AsyncSession):
    cra_perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
-        endpoint_key="POST:/subjects",
+        endpoint_key="subjects:create",
        allowed=True,
    )
    pv_perm = ApiEndpointPermission(
        study_id=study_id,
        role="PV",
-        endpoint_key="POST:/subjects",
+        endpoint_key="subjects:create",
        allowed=False,
    )
    db_session.add(cra_perm)
    db_session.add(pv_perm)
    await db_session.commit()

-    # 验证权限
+    # 验证权限（禁用前置权限检查）
    cra_result = await role_has_api_permission(
-        db_session, study_id, "CRA", "POST:/subjects"
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
    )
    pv_result = await role_has_api_permission(
-        db_session, study_id, "PV", "POST:/subjects"
+        db_session, study_id, "PV", "subjects:create", check_prerequisites=False
    )

    assert cra_result is True
@@ -239,25 +239,25 @@ async def test_api_permission_different_studies(db_session: AsyncSession):
    perm_1 = ApiEndpointPermission(
        study_id=study_id_1,
        role="CRA",
-        endpoint_key="POST:/subjects",
+        endpoint_key="subjects:create",
        allowed=True,
    )
    perm_2 = ApiEndpointPermission(
        study_id=study_id_2,
        role="CRA",
-        endpoint_key="POST:/subjects",
+        endpoint_key="subjects:create",
        allowed=False,
    )
    db_session.add(perm_1)
    db_session.add(perm_2)
    await db_session.commit()

-    # 验证权限
+    # 验证权限（禁用前置权限检查）
    result_1 = await role_has_api_permission(
-        db_session, study_id_1, "CRA", "POST:/subjects"
+        db_session, study_id_1, "CRA", "subjects:create", check_prerequisites=False
    )
    result_2 = await role_has_api_permission(
-        db_session, study_id_2, "CRA", "POST:/subjects"
+        db_session, study_id_2, "CRA", "subjects:create", check_prerequisites=False
    )

    assert result_1 is True
@@ -270,7 +270,7 @@ async def test_api_permission_none_role(db_session: AsyncSession):
    study_id = uuid.uuid4()

    result = await role_has_api_permission(
-        db_session, study_id, None, "POST:/subjects"
+        db_session, study_id, None, "subjects:create", check_prerequisites=False
    )
    assert result is False

@@ -281,6 +281,6 @@ async def test_api_permission_unknown_endpoint(db_session: AsyncSession):
    study_id = uuid.uuid4()

    result = await role_has_api_permission(
-        db_session, study_id, "CRA", "POST:/unknown-endpoint"
+        db_session, study_id, "CRA", "unknown:endpoint", check_prerequisites=False
    )
    assert result is False
@@ -0,0 +1,216 @@
+"""集成测试：权限管理API - 前置权限端点"""
+
+import pytest
+import uuid
+from httpx import AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.study import Study
+from app.models.user import User
+from app.models.study_member import StudyMember
+from app.models.api_endpoint_permission import ApiEndpointPermission
+
+
+@pytest.mark.asyncio
+async def test_list_operations_with_prerequisites(client: AsyncClient, db_session: AsyncSession):
+    """测试获取所有权限操作及其前置权限"""
+    response = await client.get("/api-permissions/operations")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert "operations" in data
+
+    # 验证返回的操作包含前置权限字段
+    operations = data["operations"]
+    assert len(operations) > 0
+
+    # 查找 subjects:create 操作
+    subjects_create = next(
+        (op for op in operations if op["operation_key"] == "subjects:create"),
+        None
+    )
+    assert subjects_create is not None
+    assert "prerequisite_permissions" in subjects_create
+    assert "sites:read" in subjects_create["prerequisite_permissions"]
+
+
+@pytest.mark.asyncio
+async def test_list_operation_prerequisites(client: AsyncClient):
+    """测试获取所有操作的前置权限依赖"""
+    response = await client.get("/api-permissions/operations/prerequisites")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert "prerequisites" in data
+
+    prerequisites = data["prerequisites"]
+
+    # 验证 subjects:create 的前置权限
+    assert "subjects:create" in prerequisites
+    assert "sites:read" in prerequisites["subjects:create"]["prerequisites"]
+
+    # 验证 visits:create 的前置权限
+    assert "visits:create" in prerequisites
+    assert "subjects:read" in prerequisites["visits:create"]["prerequisites"]
+    assert "sites:read" in prerequisites["visits:create"]["prerequisites"]
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_satisfied(
+    client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - 满足"""
+    # 创建权限：主权限 + 前置权限都允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=True,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    response = await client.get(
+        f"/api-permissions/subjects:create/prerequisites",
+        params={"study_id": str(study_id), "role": "CRA"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["endpoint_key"] == "subjects:create"
+    assert data["role"] == "CRA"
+    assert data["has_main_permission"] is True
+    assert data["missing_prerequisites"] == []
+    assert data["can_perform"] is True
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_missing(
+    client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - 缺失"""
+    # 创建权限：主权限允许，前置权限不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    response = await client.get(
+        f"/api-permissions/subjects:create/prerequisites",
+        params={"study_id": str(study_id), "role": "CRA"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["endpoint_key"] == "subjects:create"
+    assert data["role"] == "CRA"
+    assert data["has_main_permission"] is True
+    assert "sites:read" in data["missing_prerequisites"]
+    assert data["can_perform"] is False
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_multiple_missing(
+    client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - 多个缺失"""
+    # 创建权限：主权限允许，两个前置权限都不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="visits:create",
+        allowed=True,
+    )
+    prereq1 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:read",
+        allowed=False,
+    )
+    prereq2 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq1)
+    db_session.add(prereq2)
+    await db_session.commit()
+
+    response = await client.get(
+        f"/api-permissions/visits:create/prerequisites",
+        params={"study_id": str(study_id), "role": "CRA"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["endpoint_key"] == "visits:create"
+    assert data["role"] == "CRA"
+    assert data["has_main_permission"] is True
+    assert set(data["missing_prerequisites"]) == {"subjects:read", "sites:read"}
+    assert data["can_perform"] is False
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_admin(
+    client: AsyncClient, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - ADMIN角色"""
+    response = await client.get(
+        f"/api-permissions/subjects:create/prerequisites",
+        params={"study_id": str(study_id), "role": "ADMIN"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["role"] == "ADMIN"
+    assert data["has_main_permission"] is True
+    assert data["missing_prerequisites"] == []
+    assert data["can_perform"] is True
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_no_main_permission(
+    client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - 没有主权限"""
+    # 创建权限：主权限不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    await db_session.commit()
+
+    response = await client.get(
+        f"/api-permissions/subjects:create/prerequisites",
+        params={"study_id": str(study_id), "role": "CRA"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["endpoint_key"] == "subjects:create"
+    assert data["role"] == "CRA"
+    assert data["has_main_permission"] is False
+    assert data["can_perform"] is False
@@ -0,0 +1,345 @@
+"""单元测试：前置权限检查"""
+
+import pytest
+import uuid
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.project_permissions import (
+    role_has_api_permission,
+    get_missing_prerequisites,
+)
+from app.models.api_endpoint_permission import ApiEndpointPermission
+from app.models.study_role_permission import StudyRolePermission
+
+
+@pytest.mark.asyncio
+async def test_prerequisite_permission_satisfied(db_session: AsyncSession):
+    """测试前置权限满足的情况"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：主权限 + 前置权限都允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=True,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    # 验证权限（包含前置权限检查）
+    result = await role_has_api_permission(
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=True
+    )
+    assert result is True
+
+
+@pytest.mark.asyncio
+async def test_prerequisite_permission_missing(db_session: AsyncSession):
+    """测试前置权限缺失的情况"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：主权限允许，但前置权限不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    # 验证权限（包含前置权限检查）
+    result = await role_has_api_permission(
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=True
+    )
+    assert result is False
+
+
+@pytest.mark.asyncio
+async def test_prerequisite_permission_not_configured(db_session: AsyncSession):
+    """测试前置权限未配置的情况"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：主权限允许，前置权限未配置
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    db_session.add(main_perm)
+    await db_session.commit()
+
+    # 验证权限（包含前置权限检查）
+    result = await role_has_api_permission(
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=True
+    )
+    assert result is False
+
+
+@pytest.mark.asyncio
+async def test_multiple_prerequisites_all_satisfied(db_session: AsyncSession):
+    """测试多个前置权限都满足的情况"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：主权限 + 所有前置权限都允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="visits:create",
+        allowed=True,
+    )
+    prereq1 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:read",
+        allowed=True,
+    )
+    prereq2 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=True,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq1)
+    db_session.add(prereq2)
+    await db_session.commit()
+
+    # 验证权限
+    result = await role_has_api_permission(
+        db_session, study_id, "CRA", "visits:create", check_prerequisites=True
+    )
+    assert result is True
+
+
+@pytest.mark.asyncio
+async def test_multiple_prerequisites_one_missing(db_session: AsyncSession):
+    """测试多个前置权限中有一个缺失的情况"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：主权限允许，但其中一个前置权限不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="visits:create",
+        allowed=True,
+    )
+    prereq1 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:read",
+        allowed=True,
+    )
+    prereq2 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq1)
+    db_session.add(prereq2)
+    await db_session.commit()
+
+    # 验证权限
+    result = await role_has_api_permission(
+        db_session, study_id, "CRA", "visits:create", check_prerequisites=True
+    )
+    assert result is False
+
+
+@pytest.mark.asyncio
+async def test_get_missing_prerequisites_empty(db_session: AsyncSession):
+    """测试获取缺失的前置权限 - 无缺失"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：所有权限都允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=True,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    # 获取缺失的前置权限
+    missing = await get_missing_prerequisites(
+        db_session, study_id, "CRA", "subjects:create"
+    )
+    assert missing == []
+
+
+@pytest.mark.asyncio
+async def test_get_missing_prerequisites_single(db_session: AsyncSession):
+    """测试获取缺失的前置权限 - 单个缺失"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：前置权限不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    # 获取缺失的前置权限
+    missing = await get_missing_prerequisites(
+        db_session, study_id, "CRA", "subjects:create"
+    )
+    assert missing == ["sites:read"]
+
+
+@pytest.mark.asyncio
+async def test_get_missing_prerequisites_multiple(db_session: AsyncSession):
+    """测试获取缺失的前置权限 - 多个缺失"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：两个前置权限都不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="visits:create",
+        allowed=True,
+    )
+    prereq1 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:read",
+        allowed=False,
+    )
+    prereq2 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq1)
+    db_session.add(prereq2)
+    await db_session.commit()
+
+    # 获取缺失的前置权限
+    missing = await get_missing_prerequisites(
+        db_session, study_id, "CRA", "visits:create"
+    )
+    assert set(missing) == {"subjects:read", "sites:read"}
+
+
+@pytest.mark.asyncio
+async def test_prerequisite_check_disabled(db_session: AsyncSession):
+    """测试禁用前置权限检查"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：主权限允许，前置权限不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    # 验证权限（禁用前置权限检查）
+    result = await role_has_api_permission(
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
+    )
+    assert result is True
+
+
+@pytest.mark.asyncio
+async def test_admin_bypasses_prerequisites(db_session: AsyncSession):
+    """测试ADMIN角色绕过前置权限检查"""
+    study_id = uuid.uuid4()
+
+    # 不创建任何权限
+
+    # 验证权限（ADMIN应该总是被允许）
+    result = await role_has_api_permission(
+        db_session, study_id, "ADMIN", "subjects:create", check_prerequisites=True
+    )
+    assert result is True
+
+
+@pytest.mark.asyncio
+async def test_prerequisite_with_no_prerequisites_operation(db_session: AsyncSession):
+    """测试没有前置权限的操作"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：操作允许（没有前置权限）
+    perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=True,
+    )
+    db_session.add(perm)
+    await db_session.commit()
+
+    # 验证权限
+    result = await role_has_api_permission(
+        db_session, study_id, "CRA", "sites:read", check_prerequisites=True
+    )
+    assert result is True
+
+
+@pytest.mark.asyncio
+async def test_prerequisite_missing_not_configured(db_session: AsyncSession):
+    """测试前置权限未配置时的缺失检查"""
+    study_id = uuid.uuid4()
+
+    # 创建权限：主权限允许，前置权限未配置
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    db_session.add(main_perm)
+    await db_session.commit()
+
+    # 获取缺失的前置权限
+    missing = await get_missing_prerequisites(
+        db_session, study_id, "CRA", "subjects:create"
+    )
+    assert "sites:read" in missing