权限系统迁移完成：接口级权限 + 前置权限检查
## 核心改进
- 完全迁移到接口级权限（68个API端点）
- 实现前置权限检查机制，解决跨模块数据访问权限问题
- 添加权限管理API端点，支持前置权限查询
## 关键变更
1. 权限配置系统
- 添加OPERATION_PREREQUISITES映射表
- 所有操作配置前置权限依赖
2. 权限检查函数
- role_has_api_permission()支持前置权限检查
- get_missing_prerequisites()获取缺失权限列表
3. 权限管理API
- GET /api-permissions/operations - 获取所有操作及前置权限
- GET /api-permissions/operations/prerequisites - 获取前置权限依赖
- GET /api-permissions/{endpoint_key}/prerequisites - 检查缺失权限
4. API端点迁移
- 第1批：subjects, visits, aes, monitoring_visit_issues (23个)
- 第2批：members, sites, project_milestones (11个)
- 第3批：finance_contracts, fees_contracts, drug_shipments (15个)
- 第4批：startup endpoints (19个)
## 测试验证
- 单元测试：24个测试全部通过
- 集成测试：22个迁移端点测试通过
- 前置权限测试：12个测试全部通过
- 总计：46个测试全部通过
## 向后兼容性
- 模块级权限表保留用于历史数据
- 接口级权限未配置时自动回退到模块级权限
- 现有权限配置继续有效
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
Cheng Zhou
@@ -18,15 +18,15 @@ async def test_api_permission_check_allowed(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/subjects",
|
||||
endpoint_key="subjects:create",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
# 验证权限
|
||||
# 验证权限（禁用前置权限检查）
|
||||
result = await role_has_api_permission(
|
||||
db_session, study_id, "CRA", "POST:/subjects"
|
||||
db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
assert result is True
|
||||
|
||||
@@ -40,15 +40,15 @@ async def test_api_permission_check_denied(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PV",
|
||||
endpoint_key="POST:/subjects",
|
||||
endpoint_key="subjects:create",
|
||||
allowed=False,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
# 验证权限
|
||||
# 验证权限（禁用前置权限检查）
|
||||
result = await role_has_api_permission(
|
||||
db_session, study_id, "PV", "POST:/subjects"
|
||||
db_session, study_id, "PV", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
assert result is False
|
||||
|
||||
@@ -68,9 +68,9 @@ async def test_api_permission_fallback_to_module_level(db_session: AsyncSession)
|
||||
db_session.add(module_perm)
|
||||
await db_session.commit()
|
||||
|
||||
# 不创建接口级权限，应该回退到模块级权限
|
||||
# 不创建接口级权限，应该回退到模块级权限（禁用前置权限检查）
|
||||
result = await role_has_api_permission(
|
||||
db_session, study_id, "CRA", "POST:/subjects"
|
||||
db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
assert result is True
|
||||
|
||||
@@ -90,9 +90,9 @@ async def test_api_permission_fallback_denied(db_session: AsyncSession):
|
||||
db_session.add(module_perm)
|
||||
await db_session.commit()
|
||||
|
||||
# 不创建接口级权限，应该回退到模块级权限
|
||||
# 不创建接口级权限，应该回退到模块级权限（禁用前置权限检查）
|
||||
result = await role_has_api_permission(
|
||||
db_session, study_id, "PV", "POST:/subjects"
|
||||
db_session, study_id, "PV", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
assert result is False
|
||||
|
||||
@@ -126,15 +126,15 @@ async def test_api_permission_priority_over_module(db_session: AsyncSession):
|
||||
api_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/subjects",
|
||||
endpoint_key="subjects:create",
|
||||
allowed=False,
|
||||
)
|
||||
db_session.add(api_perm)
|
||||
await db_session.commit()
|
||||
|
||||
# 应该返回接口级权限的结果（False）
|
||||
# 应该返回接口级权限的结果（False）（禁用前置权限检查）
|
||||
result = await role_has_api_permission(
|
||||
db_session, study_id, "CRA", "POST:/subjects"
|
||||
db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
assert result is False
|
||||
|
||||
@@ -148,15 +148,15 @@ async def test_api_permission_read_endpoint(db_session: AsyncSession):
|
||||
perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PV",
|
||||
endpoint_key="GET:/subjects/{id}",
|
||||
endpoint_key="subjects:read",
|
||||
allowed=True,
|
||||
)
|
||||
db_session.add(perm)
|
||||
await db_session.commit()
|
||||
|
||||
# 验证权限
|
||||
# 验证权限（禁用前置权限检查）
|
||||
result = await role_has_api_permission(
|
||||
db_session, study_id, "PV", "GET:/subjects/{id}"
|
||||
db_session, study_id, "PV", "subjects:read", check_prerequisites=False
|
||||
)
|
||||
assert result is True
|
||||
|
||||
@@ -170,25 +170,25 @@ async def test_api_permission_different_endpoints(db_session: AsyncSession):
|
||||
get_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="GET:/subjects",
|
||||
endpoint_key="subjects:read",
|
||||
allowed=True,
|
||||
)
|
||||
post_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/subjects",
|
||||
endpoint_key="subjects:create",
|
||||
allowed=False,
|
||||
)
|
||||
db_session.add(get_perm)
|
||||
db_session.add(post_perm)
|
||||
await db_session.commit()
|
||||
|
||||
# 验证权限
|
||||
# 验证权限（禁用前置权限检查）
|
||||
get_result = await role_has_api_permission(
|
||||
db_session, study_id, "CRA", "GET:/subjects"
|
||||
db_session, study_id, "CRA", "subjects:read", check_prerequisites=False
|
||||
)
|
||||
post_result = await role_has_api_permission(
|
||||
db_session, study_id, "CRA", "POST:/subjects"
|
||||
db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
|
||||
assert get_result is True
|
||||
@@ -204,25 +204,25 @@ async def test_api_permission_different_roles(db_session: AsyncSession):
|
||||
cra_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/subjects",
|
||||
endpoint_key="subjects:create",
|
||||
allowed=True,
|
||||
)
|
||||
pv_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
role="PV",
|
||||
endpoint_key="POST:/subjects",
|
||||
endpoint_key="subjects:create",
|
||||
allowed=False,
|
||||
)
|
||||
db_session.add(cra_perm)
|
||||
db_session.add(pv_perm)
|
||||
await db_session.commit()
|
||||
|
||||
# 验证权限
|
||||
# 验证权限（禁用前置权限检查）
|
||||
cra_result = await role_has_api_permission(
|
||||
db_session, study_id, "CRA", "POST:/subjects"
|
||||
db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
pv_result = await role_has_api_permission(
|
||||
db_session, study_id, "PV", "POST:/subjects"
|
||||
db_session, study_id, "PV", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
|
||||
assert cra_result is True
|
||||
@@ -239,25 +239,25 @@ async def test_api_permission_different_studies(db_session: AsyncSession):
|
||||
perm_1 = ApiEndpointPermission(
|
||||
study_id=study_id_1,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/subjects",
|
||||
endpoint_key="subjects:create",
|
||||
allowed=True,
|
||||
)
|
||||
perm_2 = ApiEndpointPermission(
|
||||
study_id=study_id_2,
|
||||
role="CRA",
|
||||
endpoint_key="POST:/subjects",
|
||||
endpoint_key="subjects:create",
|
||||
allowed=False,
|
||||
)
|
||||
db_session.add(perm_1)
|
||||
db_session.add(perm_2)
|
||||
await db_session.commit()
|
||||
|
||||
# 验证权限
|
||||
# 验证权限（禁用前置权限检查）
|
||||
result_1 = await role_has_api_permission(
|
||||
db_session, study_id_1, "CRA", "POST:/subjects"
|
||||
db_session, study_id_1, "CRA", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
result_2 = await role_has_api_permission(
|
||||
db_session, study_id_2, "CRA", "POST:/subjects"
|
||||
db_session, study_id_2, "CRA", "subjects:create", check_prerequisites=False
|
||||
)
|
||||
|
||||
assert result_1 is True
|
||||
@@ -270,7 +270,7 @@ async def test_api_permission_none_role(db_session: AsyncSession):
|
||||
study_id = uuid.uuid4()
|
||||
|
||||
result = await role_has_api_permission(
|
||||
db_session, study_id, None, "POST:/subjects"
|
||||
db_session, study_id, None, "subjects:create", check_prerequisites=False
|
||||
)
|
||||
assert result is False
|
||||
|
||||
@@ -281,6 +281,6 @@ async def test_api_permission_unknown_endpoint(db_session: AsyncSession):
|
||||
study_id = uuid.uuid4()
|
||||
|
||||
result = await role_has_api_permission(
|
||||
db_session, study_id, "CRA", "POST:/unknown-endpoint"
|
||||
db_session, study_id, "CRA", "unknown:endpoint", check_prerequisites=False
|
||||
)
|
||||
assert result is False
|
||||
|
||||
Reference in New Issue
Block a user