未知（继上次中断）

backend/app/api/v1/finance_specials.py

@@ -3,7 +3,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
+from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
 from app.crud import audit as audit_crud
 from app.crud import finance_special as special_crud
 from app.crud import site as site_crud
@@ -41,6 +41,9 @@ async def create_special(
     current_user=Depends(get_current_user),
 ) -> FinanceSpecialRead:
     await _ensure_study_exists(db, study_id)
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and special_in.site_name not in cra_scope[1]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     await _ensure_site_name_active(db, study_id, special_in.site_name)
     item = await special_crud.create_special(db, study_id, special_in, created_by=current_user.id)
     await audit_crud.log_action(
@@ -68,9 +71,22 @@ async def list_specials(
     skip: int = 0,
     limit: int = 100,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> list[FinanceSpecialRead]:
     await _ensure_study_exists(db, study_id)
-    items = await special_crud.list_specials(db, study_id, site_name=site_name, fee_type=fee_type, skip=skip, limit=limit)
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    site_names = cra_scope[1] if cra_scope else None
+    if site_name and site_names is not None and site_name not in site_names:
+        return []
+    items = await special_crud.list_specials(
+        db,
+        study_id,
+        site_name=site_name,
+        site_names=site_names,
+        fee_type=fee_type,
+        skip=skip,
+        limit=limit,
+    )
     return [FinanceSpecialRead.model_validate(item) for item in items]
 
 
@@ -83,11 +99,15 @@ async def get_special(
     study_id: uuid.UUID,
     special_id: uuid.UUID,
     db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
 ) -> FinanceSpecialRead:
     await _ensure_study_exists(db, study_id)
     item = await special_crud.get_special(db, special_id)
     if not item or item.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="特殊费用不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and item.site_name not in cra_scope[1]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     return FinanceSpecialRead.model_validate(item)
 
 
@@ -107,6 +127,9 @@ async def update_special(
     item = await special_crud.get_special(db, special_id)
     if not item or item.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="特殊费用不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and item.site_name not in cra_scope[1]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     await _ensure_site_name_active(db, study_id, item.site_name)
     item = await special_crud.update_special(db, item, special_in)
     await audit_crud.log_action(
@@ -137,6 +160,9 @@ async def delete_special(
     item = await special_crud.get_special(db, special_id)
     if not item or item.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="特殊费用不存在")
+    cra_scope = await get_cra_site_scope(db, study_id, current_user)
+    if cra_scope and item.site_name not in cra_scope[1]:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
     await _ensure_site_name_active(db, study_id, item.site_name)
     await special_crud.delete_special(db, item)
     await audit_crud.log_action(