feat(perm): 项目 PM 共管接口权限与监控并细化 PM 写权限边界
- deps 新增 list_active_pm_study_ids、is_active_project_pm 与 require_admin_or_any_project_pm 依赖，用于把 PM 项目范围带进鉴权与 监控。get_cra_site_scope 内部延后导入 site CRUD，避免循环依赖。 - system_permissions API 改用 PM/ADMIN 双角色入口，permissions/monitoring 系统级权限新增 PM 配额，并细化访问日志、告警、监控指标的可见范围。 - members API 调整：项目 PM 仅可管理低于 PM 的项目角色，禁止互相 改写或授予 PM。 - api_permissions API 增加 GET /api-permissions/me，返回当前用户在该 项目的有效权限矩阵；保存权限矩阵时校验 PM 行为不被篡改。 - core/api_permissions：新增立项配置接口键、PM 默认拥有的监控/权限 系统级条目，并在权限元信息中标注 PM 共享角色。 - core/project_permissions：role_has_api_permission 命中默认角色矩阵； replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。 - studies setup-config 各端点改用接口级权限装饰器，与新的 setup_config 权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。 - 测试：新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和 成员管理边界；conftest 兼容 SA_UUID 列；权限相关用例同步移除已失效 的 module_permission 链路。 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cheng Zhou
@@ -2,22 +2,20 @@
|
||||
|
||||
import pytest
|
||||
import uuid
|
||||
from httpx import AsyncClient
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.models.study import Study
|
||||
from app.models.user import User
|
||||
from app.models.study_member import StudyMember
|
||||
from app.api.v1.api_permissions import (
|
||||
check_operation_prerequisites,
|
||||
list_api_operations,
|
||||
list_operation_prerequisites,
|
||||
)
|
||||
from app.models.api_endpoint_permission import ApiEndpointPermission
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_list_operations_with_prerequisites(client: AsyncClient, db_session: AsyncSession):
|
||||
async def test_list_operations_with_prerequisites():
|
||||
"""测试获取所有权限操作及其前置权限"""
|
||||
response = await client.get("/api-permissions/operations")
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
data = await list_api_operations()
|
||||
assert "operations" in data
|
||||
|
||||
# 验证返回的操作包含前置权限字段
|
||||
@@ -35,12 +33,9 @@ async def test_list_operations_with_prerequisites(client: AsyncClient, db_sessio
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_list_operation_prerequisites(client: AsyncClient):
|
||||
async def test_list_operation_prerequisites_endpoint():
|
||||
"""测试获取所有操作的前置权限依赖"""
|
||||
response = await client.get("/api-permissions/operations/prerequisites")
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
data = await list_operation_prerequisites()
|
||||
assert "prerequisites" in data
|
||||
|
||||
prerequisites = data["prerequisites"]
|
||||
@@ -57,9 +52,10 @@ async def test_list_operation_prerequisites(client: AsyncClient):
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_check_operation_prerequisites_satisfied(
|
||||
client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
|
||||
db_session: AsyncSession
|
||||
):
|
||||
"""测试检查操作前置权限 - 满足"""
|
||||
study_id = uuid.uuid4()
|
||||
# 创建权限：主权限 + 前置权限都允许
|
||||
main_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
@@ -77,13 +73,13 @@ async def test_check_operation_prerequisites_satisfied(
|
||||
db_session.add(prereq_perm)
|
||||
await db_session.commit()
|
||||
|
||||
response = await client.get(
|
||||
f"/api-permissions/subjects:create/prerequisites",
|
||||
params={"study_id": str(study_id), "role": "CRA"}
|
||||
data = await check_operation_prerequisites(
|
||||
study_id=study_id,
|
||||
endpoint_key="subjects:create",
|
||||
role="CRA",
|
||||
db=db_session,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["endpoint_key"] == "subjects:create"
|
||||
assert data["role"] == "CRA"
|
||||
assert data["has_main_permission"] is True
|
||||
@@ -93,9 +89,10 @@ async def test_check_operation_prerequisites_satisfied(
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_check_operation_prerequisites_missing(
|
||||
client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
|
||||
db_session: AsyncSession
|
||||
):
|
||||
"""测试检查操作前置权限 - 缺失"""
|
||||
study_id = uuid.uuid4()
|
||||
# 创建权限：主权限允许，前置权限不允许
|
||||
main_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
@@ -113,13 +110,13 @@ async def test_check_operation_prerequisites_missing(
|
||||
db_session.add(prereq_perm)
|
||||
await db_session.commit()
|
||||
|
||||
response = await client.get(
|
||||
f"/api-permissions/subjects:create/prerequisites",
|
||||
params={"study_id": str(study_id), "role": "CRA"}
|
||||
data = await check_operation_prerequisites(
|
||||
study_id=study_id,
|
||||
endpoint_key="subjects:create",
|
||||
role="CRA",
|
||||
db=db_session,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["endpoint_key"] == "subjects:create"
|
||||
assert data["role"] == "CRA"
|
||||
assert data["has_main_permission"] is True
|
||||
@@ -129,9 +126,10 @@ async def test_check_operation_prerequisites_missing(
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_check_operation_prerequisites_multiple_missing(
|
||||
client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
|
||||
db_session: AsyncSession
|
||||
):
|
||||
"""测试检查操作前置权限 - 多个缺失"""
|
||||
study_id = uuid.uuid4()
|
||||
# 创建权限：主权限允许，两个前置权限都不允许
|
||||
main_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
@@ -156,13 +154,13 @@ async def test_check_operation_prerequisites_multiple_missing(
|
||||
db_session.add(prereq2)
|
||||
await db_session.commit()
|
||||
|
||||
response = await client.get(
|
||||
f"/api-permissions/visits:create/prerequisites",
|
||||
params={"study_id": str(study_id), "role": "CRA"}
|
||||
data = await check_operation_prerequisites(
|
||||
study_id=study_id,
|
||||
endpoint_key="visits:create",
|
||||
role="CRA",
|
||||
db=db_session,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["endpoint_key"] == "visits:create"
|
||||
assert data["role"] == "CRA"
|
||||
assert data["has_main_permission"] is True
|
||||
@@ -171,17 +169,15 @@ async def test_check_operation_prerequisites_multiple_missing(
|
||||
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_check_operation_prerequisites_admin(
|
||||
client: AsyncClient, study_id: uuid.UUID
|
||||
):
|
||||
async def test_check_operation_prerequisites_admin():
|
||||
"""测试检查操作前置权限 - ADMIN角色"""
|
||||
response = await client.get(
|
||||
f"/api-permissions/subjects:create/prerequisites",
|
||||
params={"study_id": str(study_id), "role": "ADMIN"}
|
||||
data = await check_operation_prerequisites(
|
||||
study_id=uuid.uuid4(),
|
||||
endpoint_key="subjects:create",
|
||||
role="ADMIN",
|
||||
db=None,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["role"] == "ADMIN"
|
||||
assert data["has_main_permission"] is True
|
||||
assert data["missing_prerequisites"] == []
|
||||
@@ -190,9 +186,10 @@ async def test_check_operation_prerequisites_admin(
|
||||
|
||||
@pytest.mark.asyncio
|
||||
async def test_check_operation_prerequisites_no_main_permission(
|
||||
client: AsyncClient, db_session: AsyncSession, study_id: uuid.UUID
|
||||
db_session: AsyncSession
|
||||
):
|
||||
"""测试检查操作前置权限 - 没有主权限"""
|
||||
study_id = uuid.uuid4()
|
||||
# 创建权限：主权限不允许
|
||||
main_perm = ApiEndpointPermission(
|
||||
study_id=study_id,
|
||||
@@ -203,13 +200,13 @@ async def test_check_operation_prerequisites_no_main_permission(
|
||||
db_session.add(main_perm)
|
||||
await db_session.commit()
|
||||
|
||||
response = await client.get(
|
||||
f"/api-permissions/subjects:create/prerequisites",
|
||||
params={"study_id": str(study_id), "role": "CRA"}
|
||||
data = await check_operation_prerequisites(
|
||||
study_id=study_id,
|
||||
endpoint_key="subjects:create",
|
||||
role="CRA",
|
||||
db=db_session,
|
||||
)
|
||||
|
||||
assert response.status_code == 200
|
||||
data = response.json()
|
||||
assert data["endpoint_key"] == "subjects:create"
|
||||
assert data["role"] == "CRA"
|
||||
assert data["has_main_permission"] is False
|
||||
|
||||
Reference in New Issue
Block a user