feat(perm): 项目 PM 共管接口权限与监控并细化 PM 写权限边界
- deps 新增 list_active_pm_study_ids、is_active_project_pm 与 require_admin_or_any_project_pm 依赖，用于把 PM 项目范围带进鉴权与 监控。get_cra_site_scope 内部延后导入 site CRUD，避免循环依赖。 - system_permissions API 改用 PM/ADMIN 双角色入口，permissions/monitoring 系统级权限新增 PM 配额，并细化访问日志、告警、监控指标的可见范围。 - members API 调整：项目 PM 仅可管理低于 PM 的项目角色，禁止互相 改写或授予 PM。 - api_permissions API 增加 GET /api-permissions/me，返回当前用户在该 项目的有效权限矩阵；保存权限矩阵时校验 PM 行为不被篡改。 - core/api_permissions：新增立项配置接口键、PM 默认拥有的监控/权限 系统级条目，并在权限元信息中标注 PM 共享角色。 - core/project_permissions：role_has_api_permission 命中默认角色矩阵； replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。 - studies setup-config 各端点改用接口级权限装饰器，与新的 setup_config 权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。 - 测试：新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和 成员管理边界；conftest 兼容 SA_UUID 列；权限相关用例同步移除已失效 的 module_permission 链路。 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cheng Zhou
@@ -0,0 +1,260 @@
|
||||
import uuid
|
||||
from dataclasses import dataclass
|
||||
|
||||
import pytest
|
||||
from fastapi import HTTPException
|
||||
from sqlalchemy import text
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.api.v1.api_permissions import get_my_study_api_permissions, update_study_api_permissions
|
||||
from app.api.v1.members import update_member
|
||||
from app.api.v1.permission_monitoring import resolve_monitoring_scope
|
||||
from app.api.v1.system_permissions import list_system_permissions
|
||||
from app.core.deps import require_admin_or_any_project_pm
|
||||
from app.schemas.member import StudyMemberUpdate
|
||||
|
||||
|
||||
@dataclass
|
||||
class UserStub:
|
||||
id: uuid.UUID
|
||||
role: str
|
||||
|
||||
|
||||
async def _seed_user(db: AsyncSession, user_id: uuid.UUID, role: str = "PM") -> None:
|
||||
await db.execute(
|
||||
text(
|
||||
"""
|
||||
INSERT INTO users (id, email, password_hash, full_name, role, clinical_department, status)
|
||||
VALUES (:id, :email, :password_hash, :full_name, :role, :clinical_department, :status)
|
||||
"""
|
||||
),
|
||||
{
|
||||
"id": str(user_id),
|
||||
"email": f"{user_id.hex}@example.com",
|
||||
"password_hash": "hash",
|
||||
"full_name": f"User {user_id.hex[:6]}",
|
||||
"role": role,
|
||||
"clinical_department": "Clinical",
|
||||
"status": "ACTIVE",
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
async def _seed_study(db: AsyncSession, study_id: uuid.UUID, code: str) -> None:
|
||||
await db.execute(
|
||||
text(
|
||||
"""
|
||||
INSERT INTO studies (id, code, name, status, is_locked, visit_schedule, active_roles)
|
||||
VALUES (:id, :code, :name, :status, :is_locked, :visit_schedule, :active_roles)
|
||||
"""
|
||||
),
|
||||
{
|
||||
"id": str(study_id),
|
||||
"code": code,
|
||||
"name": code,
|
||||
"status": "ACTIVE",
|
||||
"is_locked": False,
|
||||
"visit_schedule": "[]",
|
||||
"active_roles": "[]",
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
async def _seed_member(db: AsyncSession, study_id: uuid.UUID, user_id: uuid.UUID, role: str, active: bool = True) -> None:
|
||||
await db.execute(
|
||||
text(
|
||||
"""
|
||||
INSERT INTO study_members (id, study_id, user_id, role_in_study, is_active)
|
||||
VALUES (:id, :study_id, :user_id, :role, :active)
|
||||
"""
|
||||
),
|
||||
{
|
||||
"id": str(uuid.uuid4()),
|
||||
"study_id": str(study_id),
|
||||
"user_id": str(user_id),
|
||||
"role": role,
|
||||
"active": active,
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
async def _seed_member_return_id(
|
||||
db: AsyncSession,
|
||||
study_id: uuid.UUID,
|
||||
user_id: uuid.UUID,
|
||||
role: str,
|
||||
active: bool = True,
|
||||
) -> uuid.UUID:
|
||||
member_id = uuid.uuid4()
|
||||
await db.execute(
|
||||
text(
|
||||
"""
|
||||
INSERT INTO study_members (id, study_id, user_id, role_in_study, is_active)
|
||||
VALUES (:id, :study_id, :user_id, :role, :active)
|
||||
"""
|
||||
),
|
||||
{
|
||||
"id": str(member_id),
|
||||
"study_id": str(study_id),
|
||||
"user_id": str(user_id),
|
||||
"role": role,
|
||||
"active": active,
|
||||
},
|
||||
)
|
||||
return member_id
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_project_pm_can_view_system_permission_definitions(db_session: AsyncSession):
|
||||
pm_id = uuid.uuid4()
|
||||
study_id = uuid.uuid4()
|
||||
await _seed_user(db_session, pm_id)
|
||||
await _seed_study(db_session, study_id, "PM-SYSTEM-PERMS")
|
||||
await _seed_member(db_session, study_id, pm_id, "PM")
|
||||
await db_session.commit()
|
||||
|
||||
dependency = require_admin_or_any_project_pm()
|
||||
await dependency(current_user=UserStub(id=pm_id, role="PM"), db=db_session)
|
||||
data = await list_system_permissions()
|
||||
|
||||
assert data["permissions"]
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_non_pm_cannot_view_system_permission_definitions(db_session: AsyncSession):
|
||||
cra_id = uuid.uuid4()
|
||||
study_id = uuid.uuid4()
|
||||
await _seed_user(db_session, cra_id, role="CRA")
|
||||
await _seed_study(db_session, study_id, "CRA-SYSTEM-PERMS")
|
||||
await _seed_member(db_session, study_id, cra_id, "CRA")
|
||||
await db_session.commit()
|
||||
|
||||
with pytest.raises(HTTPException) as exc_info:
|
||||
dependency = require_admin_or_any_project_pm()
|
||||
await dependency(current_user=UserStub(id=cra_id, role="CRA"), db=db_session)
|
||||
|
||||
assert exc_info.value.status_code == 403
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_pm_permission_update_does_not_persist_admin_or_pm_overrides(db_session: AsyncSession):
|
||||
study_id = uuid.uuid4()
|
||||
admin_id = uuid.uuid4()
|
||||
await _seed_study(db_session, study_id, "PM-PERM-SKIP")
|
||||
await _seed_user(db_session, admin_id, role="ADMIN")
|
||||
await db_session.commit()
|
||||
|
||||
result = await update_study_api_permissions(
|
||||
study_id=study_id,
|
||||
payload={
|
||||
"ADMIN": {"subjects:delete": False},
|
||||
"PM": {"subjects:delete": False},
|
||||
"CRA": {"subjects:delete": True},
|
||||
},
|
||||
current_user=UserStub(id=admin_id, role="ADMIN"),
|
||||
db=db_session,
|
||||
)
|
||||
|
||||
rows = (
|
||||
await db_session.execute(
|
||||
text(
|
||||
"""
|
||||
SELECT role, endpoint_key, allowed
|
||||
FROM api_endpoint_permissions
|
||||
WHERE study_id = :study_id
|
||||
"""
|
||||
),
|
||||
{"study_id": str(study_id)},
|
||||
)
|
||||
).all()
|
||||
assert ("CRA", "subjects:delete", True) in rows
|
||||
assert all(row.role not in {"ADMIN", "PM"} for row in rows)
|
||||
assert "ADMIN" not in result
|
||||
assert result["PM"]["subjects:delete"]["allowed"] is True
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_project_member_can_read_own_effective_permissions(db_session: AsyncSession):
|
||||
cra_id = uuid.uuid4()
|
||||
study_id = uuid.uuid4()
|
||||
await _seed_user(db_session, cra_id, role="CRA")
|
||||
await _seed_study(db_session, study_id, "CRA-MY-PERMS")
|
||||
await _seed_member(db_session, study_id, cra_id, "CRA")
|
||||
await db_session.commit()
|
||||
|
||||
result = await get_my_study_api_permissions(
|
||||
study_id=study_id,
|
||||
current_user=UserStub(id=cra_id, role="CRA"),
|
||||
db=db_session,
|
||||
)
|
||||
|
||||
assert list(result) == ["CRA"]
|
||||
assert result["CRA"]["sites:read"]["allowed"] is True
|
||||
assert result["CRA"]["sites:update"]["allowed"] is False
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_project_pm_monitoring_scope_is_limited_to_own_projects(db_session: AsyncSession):
|
||||
pm_id = uuid.uuid4()
|
||||
own_study_id = uuid.uuid4()
|
||||
other_study_id = uuid.uuid4()
|
||||
await _seed_user(db_session, pm_id)
|
||||
await _seed_study(db_session, own_study_id, "PM-MONITOR-OWN")
|
||||
await _seed_study(db_session, other_study_id, "PM-MONITOR-OTHER")
|
||||
await _seed_member(db_session, own_study_id, pm_id, "PM")
|
||||
await db_session.commit()
|
||||
|
||||
scope = await resolve_monitoring_scope(db_session, UserStub(id=pm_id, role="PM"))
|
||||
|
||||
assert scope.is_admin is False
|
||||
assert scope.study_ids == {own_study_id}
|
||||
assert scope.can_access_study(own_study_id)
|
||||
assert not scope.can_access_study(other_study_id)
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_project_pm_cannot_update_peer_pm_member(db_session: AsyncSession):
|
||||
study_id = uuid.uuid4()
|
||||
actor_id = uuid.uuid4()
|
||||
peer_id = uuid.uuid4()
|
||||
await _seed_study(db_session, study_id, "PM-PEER-MEMBER")
|
||||
await _seed_user(db_session, actor_id)
|
||||
await _seed_user(db_session, peer_id)
|
||||
await _seed_member(db_session, study_id, actor_id, "PM")
|
||||
peer_member_id = await _seed_member_return_id(db_session, study_id, peer_id, "PM")
|
||||
await db_session.commit()
|
||||
|
||||
with pytest.raises(HTTPException) as exc_info:
|
||||
await update_member(
|
||||
study_id=study_id,
|
||||
member_id=peer_member_id,
|
||||
member_in=StudyMemberUpdate(role_in_study="CRA"),
|
||||
current_user=UserStub(id=actor_id, role="PM"),
|
||||
db=db_session,
|
||||
)
|
||||
|
||||
assert exc_info.value.status_code == 403
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_project_pm_cannot_grant_peer_pm_role(db_session: AsyncSession):
|
||||
study_id = uuid.uuid4()
|
||||
actor_id = uuid.uuid4()
|
||||
cra_id = uuid.uuid4()
|
||||
await _seed_study(db_session, study_id, "PM-GRANT-PM")
|
||||
await _seed_user(db_session, actor_id)
|
||||
await _seed_user(db_session, cra_id, role="CRA")
|
||||
await _seed_member(db_session, study_id, actor_id, "PM")
|
||||
cra_member_id = await _seed_member_return_id(db_session, study_id, cra_id, "CRA")
|
||||
await db_session.commit()
|
||||
|
||||
with pytest.raises(HTTPException) as exc_info:
|
||||
await update_member(
|
||||
study_id=study_id,
|
||||
member_id=cra_member_id,
|
||||
member_in=StudyMemberUpdate(role_in_study="PM"),
|
||||
current_user=UserStub(id=actor_id, role="PM"),
|
||||
db=db_session,
|
||||
)
|
||||
|
||||
assert exc_info.value.status_code == 403
|
||||
Reference in New Issue
Block a user