zhouchengcheng/ctms
1
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

清理全局角色残留并修复项目权限判断

Browse Source
This commit is contained in:
Cheng Zhou
2026-05-29 10:20:42 +08:00
parent 63457aab11
commit 44d69c2d7b
63 changed files with 739 additions and 443 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/tests/test_admin_pm_permissions.py
+48 -17
View File
@@ -10,22 +10,22 @@ from app.api.v1.api_permissions import get_my_study_api_permissions, update_stud
from app.api.v1.members import update_member
from app.api.v1.permission_monitoring import resolve_monitoring_scope
from app.api.v1.system_permissions import list_system_permissions
from app.core.deps import require_admin_or_any_project_pm
from app.core.deps import require_admin_or_any_project_pm, require_system_permission
from app.schemas.member import StudyMemberUpdate
@dataclass
class UserStub:
id: uuid.UUID
role: str
is_admin: bool = False
async def _seed_user(db: AsyncSession, user_id: uuid.UUID, role: str = "PM") -> None:
async def _seed_user(db: AsyncSession, user_id: uuid.UUID, *, is_admin: bool = False) -> None:
await db.execute(
text(
"""
INSERT INTO users (id, email, password_hash, full_name, role, clinical_department, status)
VALUES (:id, :email, :password_hash, :full_name, :role, :clinical_department, :status)
INSERT INTO users (id, email, password_hash, full_name, clinical_department, is_admin, status)
VALUES (:id, :email, :password_hash, :full_name, :clinical_department, :is_admin, :status)
"""
),
{
@@ -33,8 +33,8 @@ async def _seed_user(db: AsyncSession, user_id: uuid.UUID, role: str = "PM") ->
"email": f"{user_id.hex}@example.com",
"password_hash": "hash",
"full_name": f"User {user_id.hex[:6]}",
"role": role,
"clinical_department": "Clinical",
"is_admin": is_admin,
"status": "ACTIVE",
},
)
@@ -114,7 +114,7 @@ async def test_project_pm_can_view_system_permission_definitions(db_session: Asy
await db_session.commit()
dependency = require_admin_or_any_project_pm()
await dependency(current_user=UserStub(id=pm_id, role="PM"), db=db_session)
await dependency(current_user=UserStub(id=pm_id), db=db_session)
data = await list_system_permissions()
assert data["permissions"]
@@ -124,14 +124,45 @@ async def test_project_pm_can_view_system_permission_definitions(db_session: Asy
async def test_non_pm_cannot_view_system_permission_definitions(db_session: AsyncSession):
cra_id = uuid.uuid4()
study_id = uuid.uuid4()
await _seed_user(db_session, cra_id, role="CRA")
await _seed_user(db_session, cra_id)
await _seed_study(db_session, study_id, "CRA-SYSTEM-PERMS")
await _seed_member(db_session, study_id, cra_id, "CRA")
await db_session.commit()
with pytest.raises(HTTPException) as exc_info:
dependency = require_admin_or_any_project_pm()
await dependency(current_user=UserStub(id=cra_id, role="CRA"), db=db_session)
await dependency(current_user=UserStub(id=cra_id), db=db_session)
assert exc_info.value.status_code == 403
@pytest.mark.asyncio
async def test_project_pm_can_open_project_permission_config_without_global_pm_role(db_session: AsyncSession):
user_id = uuid.uuid4()
study_id = uuid.uuid4()
await _seed_user(db_session, user_id)
await _seed_study(db_session, study_id, "PROJECT-PM-NO-GLOBAL-ROLE")
await _seed_member(db_session, study_id, user_id, "PM")
await db_session.commit()
dependency = require_system_permission("system:permissions:project_config")
result = await dependency(study_id=study_id, current_user=UserStub(id=user_id), db=db_session)
assert result.id == user_id
@pytest.mark.asyncio
async def test_non_project_pm_cannot_open_project_permission_config_even_with_active_membership(db_session: AsyncSession):
user_id = uuid.uuid4()
study_id = uuid.uuid4()
await _seed_user(db_session, user_id)
await _seed_study(db_session, study_id, "PROJECT-NON-PM-DENIED")
await _seed_member(db_session, study_id, user_id, "CRA")
await db_session.commit()
dependency = require_system_permission("system:permissions:project_config")
with pytest.raises(HTTPException) as exc_info:
await dependency(study_id=study_id, current_user=UserStub(id=user_id), db=db_session)
assert exc_info.value.status_code == 403
@@ -141,7 +172,7 @@ async def test_pm_permission_update_does_not_persist_admin_or_pm_overrides(db_se
study_id = uuid.uuid4()
admin_id = uuid.uuid4()
await _seed_study(db_session, study_id, "PM-PERM-SKIP")
await _seed_user(db_session, admin_id, role="ADMIN")
await _seed_user(db_session, admin_id, is_admin=True)
await db_session.commit()
result = await update_study_api_permissions(
@@ -151,7 +182,7 @@ async def test_pm_permission_update_does_not_persist_admin_or_pm_overrides(db_se
"PM": {"subjects:delete": False},
"CRA": {"subjects:delete": True},
},
current_user=UserStub(id=admin_id, role="ADMIN"),
current_user=UserStub(id=admin_id, is_admin=True),
db=db_session,
)
@@ -177,14 +208,14 @@ async def test_pm_permission_update_does_not_persist_admin_or_pm_overrides(db_se
async def test_project_member_can_read_own_effective_permissions(db_session: AsyncSession):
cra_id = uuid.uuid4()
study_id = uuid.uuid4()
await _seed_user(db_session, cra_id, role="CRA")
await _seed_user(db_session, cra_id)
await _seed_study(db_session, study_id, "CRA-MY-PERMS")
await _seed_member(db_session, study_id, cra_id, "CRA")
await db_session.commit()
result = await get_my_study_api_permissions(
study_id=study_id,
current_user=UserStub(id=cra_id, role="CRA"),
current_user=UserStub(id=cra_id),
db=db_session,
)
@@ -204,7 +235,7 @@ async def test_project_pm_monitoring_scope_is_limited_to_own_projects(db_session
await _seed_member(db_session, own_study_id, pm_id, "PM")
await db_session.commit()
scope = await resolve_monitoring_scope(db_session, UserStub(id=pm_id, role="PM"))
scope = await resolve_monitoring_scope(db_session, UserStub(id=pm_id))
assert scope.is_admin is False
assert scope.study_ids == {own_study_id}
@@ -229,7 +260,7 @@ async def test_project_pm_cannot_update_peer_pm_member(db_session: AsyncSession)
study_id=study_id,
member_id=peer_member_id,
member_in=StudyMemberUpdate(role_in_study="CRA"),
current_user=UserStub(id=actor_id, role="PM"),
current_user=UserStub(id=actor_id),
db=db_session,
)
@@ -243,7 +274,7 @@ async def test_project_pm_cannot_grant_peer_pm_role(db_session: AsyncSession):
cra_id = uuid.uuid4()
await _seed_study(db_session, study_id, "PM-GRANT-PM")
await _seed_user(db_session, actor_id)
await _seed_user(db_session, cra_id, role="CRA")
await _seed_user(db_session, cra_id)
await _seed_member(db_session, study_id, actor_id, "PM")
cra_member_id = await _seed_member_return_id(db_session, study_id, cra_id, "CRA")
await db_session.commit()
@@ -253,7 +284,7 @@ async def test_project_pm_cannot_grant_peer_pm_role(db_session: AsyncSession):
study_id=study_id,
member_id=cra_member_id,
member_in=StudyMemberUpdate(role_in_study="PM"),
current_user=UserStub(id=actor_id, role="PM"),
current_user=UserStub(id=actor_id),
db=db_session,
)