清理全局角色残留并修复项目权限判断

backend/tests/test_api_permissions_prerequisites.py

@@ -49,8 +49,8 @@ async def test_material_equipment_operations_are_grouped_under_materials_module(
 
 
 @pytest.mark.asyncio
-async def test_materials_module_only_contains_drug_flow_and_equipment_sections():
-    """测试物资管理模块只包含药品流向管理和设备管理"""
+async def test_materials_module_only_contains_drug_flow_attachments_and_equipment_sections():
+    """测试物资管理模块只包含药品流向、药品流向附件和设备管理"""
     data = await list_api_operations()
     operations = data["operations"]
 
@@ -60,7 +60,7 @@ async def test_materials_module_only_contains_drug_flow_and_equipment_sections()
         if op["module"] == "materials"
     }
 
-    assert material_prefixes == {"drug_shipments", "material_equipments"}
+    assert material_prefixes == {"drug_shipments", "drug_shipments_attachments", "material_equipments"}
 
 
 @pytest.mark.asyncio
@@ -90,6 +90,29 @@ def test_dashboard_summary_uses_project_overview_permission():
     assert 'require_api_permission("dashboard:read")' not in source
 
 
+def test_project_overview_dashboard_endpoints_require_project_overview_permission():
+    """项目总览聚合接口应统一使用 project_overview:read，而不是仅要求项目成员。"""
+    source = Path(__file__).parents[1].joinpath("app/api/v1/dashboard.py").read_text()
+    progress_chunk = source[source.index("async def get_progress") : source.index("@router.get", source.index("async def get_progress"))]
+    lost_visits_chunk = source[source.index("async def list_lost_visits") : source.index("@router.get", source.index("async def list_lost_visits"))]
+    center_summary_chunk = source[source.index("async def get_center_summary") :]
+
+    assert 'require_api_permission("project_overview:read")' in progress_chunk
+    assert 'require_api_permission("project_overview:read")' in lost_visits_chunk
+    assert 'require_api_permission("project_overview:read")' in center_summary_chunk
+    assert "require_study_member()" not in progress_chunk
+    assert "require_study_member()" not in lost_visits_chunk
+
+
+def test_finance_summary_requires_contract_fee_read_permission():
+    """项目首页财务汇总应使用费用读取权限，避免绕过费用模块权限。"""
+    source = Path(__file__).parents[1].joinpath("app/api/v1/finance_dashboard.py").read_text()
+    summary_chunk = source[source.index("async def finance_summary") :]
+
+    assert 'require_api_permission("fees_contracts:read")' in summary_chunk
+    assert "require_study_member()" not in summary_chunk
+
+
 @pytest.mark.asyncio
 async def test_list_operation_prerequisites_endpoint():
     """测试获取所有操作的前置权限依赖"""