未知（继上次中断）

backend/app/api/v1/drug_shipments.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
+from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
 from app.crud import audit as audit_crud
 from app.crud import drug_shipment as shipment_crud
 from app.crud import site as site_crud
@@ -42,6 +42,9 @@ async def create_shipment(
     current_user=Depends(get_current_user),
 ) -> DrugShipmentRead:
     await _ensure_study_exists(db, study_id)
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and shipment_in.center_id not in cra_scope[0]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     site = await _ensure_center_active(db, study_id, shipment_in.center_id)
     shipment_in = shipment_in.model_copy(update={"site_name": site.name})
     shipment = await shipment_crud.create_shipment(db, study_id, shipment_in, created_by=current_user.id)
@@ -73,12 +76,18 @@ async def list_shipments(
     skip: int = 0,
     limit: int = 100,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> list[DrugShipmentRead]:
     await _ensure_study_exists(db, study_id)
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    center_ids = cra_scope[0] if cra_scope else None
+    if center_id and center_ids is not None and center_id not in center_ids:
+        return []
     items = await shipment_crud.list_shipments(
         db,
         study_id,
         center_id=center_id,
+        center_ids=center_ids,
         site_name=site_name,
         tracking_no=tracking_no,
         direction=direction,
@@ -98,11 +107,15 @@ async def get_shipment(
     study_id: uuid.UUID,
     shipment_id: uuid.UUID,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> DrugShipmentRead:
     await _ensure_study_exists(db, study_id)
     shipment = await shipment_crud.get_shipment(db, shipment_id)
     if not shipment or shipment.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="运输记录不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and shipment.center_id not in cra_scope[0]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     return DrugShipmentRead.model_validate(shipment)
 
 
@@ -122,6 +135,9 @@ async def update_shipment(
     shipment = await shipment_crud.get_shipment(db, shipment_id)
     if not shipment or shipment.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="运输记录不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and shipment.center_id not in cra_scope[0]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     if shipment_in.center_id:
         site = await _ensure_center_active(db, study_id, shipment_in.center_id)
         shipment_in = shipment_in.model_copy(update={"site_name": site.name})
@@ -156,6 +172,9 @@ async def delete_shipment(
     shipment = await shipment_crud.get_shipment(db, shipment_id)
     if not shipment or shipment.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="运输记录不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and shipment.center_id not in cra_scope[0]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     await _ensure_center_active(db, study_id, shipment.center_id)
     await shipment_crud.delete_shipment(db, shipment)
     await audit_crud.log_action(