权限系统迁移完成：接口级权限 + 前置权限检查

## 核心改进 - 完全迁移到接口级权限（68个API端点） - 实现前置权限检查机制，解决跨模块数据访问权限问题 - 添加权限管理API端点，支持前置权限查询 ## 关键变更 1. 权限配置系统 - 添加OPERATION_PREREQUISITES映射表 - 所有操作配置前置权限依赖 2. 权限检查函数 - role_has_api_permission()支持前置权限检查 - get_missing_prerequisites()获取缺失权限列表 3. 权限管理API - GET /api-permissions/operations - 获取所有操作及前置权限 - GET /api-permissions/operations/prerequisites - 获取前置权限依赖 - GET /api-permissions/{endpoint_key}/prerequisites - 检查缺失权限 4. API端点迁移 - 第1批：subjects, visits, aes, monitoring_visit_issues (23个) - 第2批：members, sites, project_milestones (11个) - 第3批：finance_contracts, fees_contracts, drug_shipments (15个) - 第4批：startup endpoints (19个) ## 测试验证 - 单元测试：24个测试全部通过 - 集成测试：22个迁移端点测试通过 - 前置权限测试：12个测试全部通过 - 总计：46个测试全部通过 ## 向后兼容性 - 模块级权限表保留用于历史数据 - 接口级权限未配置时自动回退到模块级权限 - 现有权限配置继续有效 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
2026-05-14 12:44:18 +08:00
parent 5327e00cf1
commit 3630b9000f
22 changed files with 1382 additions and 243 deletions
@@ -0,0 +1,216 @@
+"""集成测试：权限管理API - 前置权限端点"""
+
+import pytest
+import uuid
+from httpx import AsyncClient
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models.study import Study
+from app.models.user import User
+from app.models.study_member import StudyMember
+from app.models.api_endpoint_permission import ApiEndpointPermission
+
+
+@pytest.mark.asyncio
+async def test_list_operations_with_prerequisites(client: AsyncClient, db_session: AsyncSession):
+    """测试获取所有权限操作及其前置权限"""
+    response = await client.get("/api-permissions/operations")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert "operations" in data
+
+    # 验证返回的操作包含前置权限字段
+    operations = data["operations"]
+    assert len(operations) > 0
+
+    # 查找 subjects:create 操作
+    subjects_create = next(
+        (op for op in operations if op["operation_key"] == "subjects:create"),
+        None
+    )
+    assert subjects_create is not None
+    assert "prerequisite_permissions" in subjects_create
+    assert "sites:read" in subjects_create["prerequisite_permissions"]
+
+
+@pytest.mark.asyncio
+async def test_list_operation_prerequisites(client: AsyncClient):
+    """测试获取所有操作的前置权限依赖"""
+    response = await client.get("/api-permissions/operations/prerequisites")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert "prerequisites" in data
+
+    prerequisites = data["prerequisites"]
+
+    # 验证 subjects:create 的前置权限
+    assert "subjects:create" in prerequisites
+    assert "sites:read" in prerequisites["subjects:create"]["prerequisites"]
+
+    # 验证 visits:create 的前置权限
+    assert "visits:create" in prerequisites
+    assert "subjects:read" in prerequisites["visits:create"]["prerequisites"]
+    assert "sites:read" in prerequisites["visits:create"]["prerequisites"]
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_satisfied(
+    client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - 满足"""
+    # 创建权限：主权限 + 前置权限都允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=True,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    response = await client.get(
+        f"/api-permissions/subjects:create/prerequisites",
+        params={"study_id": str(study_id), "role": "CRA"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["endpoint_key"] == "subjects:create"
+    assert data["role"] == "CRA"
+    assert data["has_main_permission"] is True
+    assert data["missing_prerequisites"] == []
+    assert data["can_perform"] is True
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_missing(
+    client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - 缺失"""
+    # 创建权限：主权限允许，前置权限不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=True,
+    )
+    prereq_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq_perm)
+    await db_session.commit()
+
+    response = await client.get(
+        f"/api-permissions/subjects:create/prerequisites",
+        params={"study_id": str(study_id), "role": "CRA"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["endpoint_key"] == "subjects:create"
+    assert data["role"] == "CRA"
+    assert data["has_main_permission"] is True
+    assert "sites:read" in data["missing_prerequisites"]
+    assert data["can_perform"] is False
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_multiple_missing(
+    client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - 多个缺失"""
+    # 创建权限：主权限允许，两个前置权限都不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="visits:create",
+        allowed=True,
+    )
+    prereq1 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:read",
+        allowed=False,
+    )
+    prereq2 = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="sites:read",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    db_session.add(prereq1)
+    db_session.add(prereq2)
+    await db_session.commit()
+
+    response = await client.get(
+        f"/api-permissions/visits:create/prerequisites",
+        params={"study_id": str(study_id), "role": "CRA"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["endpoint_key"] == "visits:create"
+    assert data["role"] == "CRA"
+    assert data["has_main_permission"] is True
+    assert set(data["missing_prerequisites"]) == {"subjects:read", "sites:read"}
+    assert data["can_perform"] is False
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_admin(
+    client: AsyncClient, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - ADMIN角色"""
+    response = await client.get(
+        f"/api-permissions/subjects:create/prerequisites",
+        params={"study_id": str(study_id), "role": "ADMIN"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["role"] == "ADMIN"
+    assert data["has_main_permission"] is True
+    assert data["missing_prerequisites"] == []
+    assert data["can_perform"] is True
+
+
+@pytest.mark.asyncio
+async def test_check_operation_prerequisites_no_main_permission(
+    client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
+):
+    """测试检查操作前置权限 - 没有主权限"""
+    # 创建权限：主权限不允许
+    main_perm = ApiEndpointPermission(
+        study_id=study_id,
+        role="CRA",
+        endpoint_key="subjects:create",
+        allowed=False,
+    )
+    db_session.add(main_perm)
+    await db_session.commit()
+
+    response = await client.get(
+        f"/api-permissions/subjects:create/prerequisites",
+        params={"study_id": str(study_id), "role": "CRA"}
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["endpoint_key"] == "subjects:create"
+    assert data["role"] == "CRA"
+    assert data["has_main_permission"] is False
+    assert data["can_perform"] is False