未知（继上次中断）

backend/app/api/v1/finance_contracts.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
+from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
 from app.crud import audit as audit_crud
 from app.crud import finance_contract as contract_crud
 from app.crud import site as site_crud
@@ -41,6 +41,9 @@ async def create_contract(
     current_user=Depends(get_current_user),
 ) -> FinanceContractRead:
     await _ensure_study_exists(db, study_id)
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and contract_in.site_name not in cra_scope[1]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     await _ensure_site_name_active(db, study_id, contract_in.site_name)
     contract = await contract_crud.create_contract(db, study_id, contract_in, created_by=current_user.id)
     await audit_crud.log_action(
@@ -68,9 +71,22 @@ async def list_contracts(
     skip: int = 0,
     limit: int = 100,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> list[FinanceContractRead]:
     await _ensure_study_exists(db, study_id)
-    items = await contract_crud.list_contracts(db, study_id, site_name=site_name, contract_no=contract_no, skip=skip, limit=limit)
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    site_names = cra_scope[1] if cra_scope else None
+    if site_name and site_names is not None and site_name not in site_names:
+        return []
+    items = await contract_crud.list_contracts(
+        db,
+        study_id,
+        site_name=site_name,
+        site_names=site_names,
+        contract_no=contract_no,
+        skip=skip,
+        limit=limit,
+    )
     return [FinanceContractRead.model_validate(item) for item in items]
 
 
@@ -83,11 +99,15 @@ async def get_contract(
     study_id: uuid.UUID,
     contract_id: uuid.UUID,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> FinanceContractRead:
     await _ensure_study_exists(db, study_id)
     contract = await contract_crud.get_contract(db, contract_id)
     if not contract or contract.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and contract.site_name not in cra_scope[1]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     return FinanceContractRead.model_validate(contract)
 
 
@@ -107,6 +127,9 @@ async def update_contract(
     contract = await contract_crud.get_contract(db, contract_id)
     if not contract or contract.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and contract.site_name not in cra_scope[1]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     await _ensure_site_name_active(db, study_id, contract.site_name)
     contract = await contract_crud.update_contract(db, contract, contract_in)
     await audit_crud.log_action(
@@ -137,6 +160,9 @@ async def delete_contract(
     contract = await contract_crud.get_contract(db, contract_id)
     if not contract or contract.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and contract.site_name not in cra_scope[1]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     await _ensure_site_name_active(db, study_id, contract.site_name)
     await contract_crud.delete_contract(db, contract)
     await audit_crud.log_action(