chore: clean legacy setup artifacts

backend/app/db/base.py

@@ -37,6 +37,9 @@ from app.models.study_setup_config import StudySetupConfig  # noqa: F401
 from app.models.study_setup_config_version import StudySetupConfigVersion  # noqa: F401
 from app.models.study_monitoring_strategy import StudyMonitoringStrategy  # noqa: F401
 from app.models.study_center_confirm import StudyCenterConfirm  # noqa: F401
+from app.models.api_endpoint_permission import ApiEndpointPermission  # noqa: F401
+from app.models.api_endpoint_registry import ApiEndpointRegistry  # noqa: F401
 from app.models.permission_access_log import PermissionAccessLog  # noqa: F401
 from app.models.permission_metric_snapshot import PermissionMetricSnapshot  # noqa: F401
+from app.models.permission_template import PermissionTemplate, PermissionTemplateVersion  # noqa: F401
 from app.models.security_access_log import SecurityAccessLog  # noqa: F401

backend/app/main.py

@@ -40,9 +40,6 @@ async def lifespan(_: FastAPI):
     aggregator_task = asyncio.create_task(run_hourly_metric_aggregation(stop_event))
     await start_log_writer()
     await start_security_log_writer()
-    # Ensure models are imported so metadata is populated
-    from app.models import user as user_model  # noqa: F401
-
     if settings.ENV == "development":
         async with engine.begin() as conn:
             await _ensure_legacy_primary_keys(conn)

backend/app/models/api_endpoint_permission.py

@@ -1,5 +1,4 @@
 from __future__ import annotations
-from typing import Optional
 
 import uuid
 from datetime import datetime

backend/app/models/api_endpoint_registry.py

@@ -1,5 +1,4 @@
 from __future__ import annotations
-from typing import Optional
 
 import uuid
 from datetime import datetime

backend/scripts/smoke_setup_config.py

@@ -13,7 +13,7 @@ from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 
 
 BASE = os.getenv("BASE_URL", "http://localhost:8000")
-ADMIN_EMAIL = os.getenv("EMAIL", "admin@example.com")
+ADMIN_EMAIL = os.getenv("EMAIL", "admin@huapont.cn")
 ADMIN_PASSWORD = os.getenv("PASSWORD", "admin123")
 STUDY_ID = os.getenv("STUDY_ID", "").strip()
 DATABASE_URL = (os.getenv("DATABASE_URL") or "postgresql://ctms_user:secret_password@db/ctms_db").replace("+asyncpg", "")

backend/tests/test_app_startup.py

@@ -1,4 +1,8 @@
 from contextlib import asynccontextmanager
+import os
+from pathlib import Path
+import subprocess
+import sys
 from unittest.mock import AsyncMock
 
 import pytest
@@ -7,6 +11,41 @@ from fastapi import FastAPI
 from app import main
 
 
+def test_db_base_registers_permission_models_for_create_all():
+    backend_dir = Path(__file__).resolve().parents[1]
+    code = """
+from app.db.base_class import Base
+import app.db.base
+
+required_tables = {
+    "api_endpoint_permissions",
+    "api_endpoint_registries",
+    "permission_templates",
+    "permission_template_versions",
+}
+missing = sorted(required_tables - set(Base.metadata.tables))
+if missing:
+    print(",".join(missing))
+    raise SystemExit(1)
+"""
+    env = {
+        **os.environ,
+        "PYTHONDONTWRITEBYTECODE": "1",
+        "PYTHONPATH": str(backend_dir),
+    }
+
+    result = subprocess.run(
+        [sys.executable, "-c", code],
+        cwd=backend_dir,
+        env=env,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+    assert result.returncode == 0, result.stdout + result.stderr
+
+
 class _DummyTask:
     def __init__(self):
         self.awaited = False