管理后台前后端逻辑、UI美化

backend/app/api/v1/aes.py

@@ -5,10 +5,12 @@ from datetime import date
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.deps import get_current_user, get_db_session, require_study_member
+from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_not_locked
 from app.crud import ae as ae_crud
 from app.crud import audit as audit_crud
 from app.crud import member as member_crud
+from app.crud import site as site_crud
+from app.crud import subject as subject_crud
 from app.crud import study as study_crud
 from app.schemas.ae import AECreate, AERead, AEUpdate
 
@@ -25,6 +27,22 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
     return study
 
 
+async def _ensure_ae_visible(db: AsyncSession, study_id: uuid.UUID, ae: AERead | None):
+    if not ae:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
+    if ae.site_id:
+        site = await site_crud.get_site(db, ae.site_id)
+        if not site or site.study_id != study_id or not site.is_active:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
+    if ae.subject_id:
+        subject = await subject_crud.get_subject(db, ae.subject_id)
+        if not subject or subject.study_id != study_id:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
+        site = await site_crud.get_site(db, subject.site_id)
+        if not site or not site.is_active:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
+
+
 async def _get_member_role(db: AsyncSession, study_id: uuid.UUID, user_id: uuid.UUID) -> str | None:
     member = await member_crud.get_member(db, study_id, user_id)
     return member.role_in_study if member else None
@@ -38,7 +56,7 @@ def _is_overdue(ae: AERead) -> bool:
     "/",
     response_model=AERead,
     status_code=status.HTTP_201_CREATED,
-    dependencies=[Depends(require_study_member())],
+    dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
 )
 async def create_ae(
     study_id: uuid.UUID,
@@ -117,7 +135,7 @@ async def get_ae(
 @router.patch(
     "/{ae_id}",
     response_model=AERead,
-    dependencies=[Depends(require_study_member())],
+    dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
 )
 async def update_ae(
     study_id: uuid.UUID,
@@ -132,6 +150,7 @@ async def update_ae(
     ae = await ae_crud.get_ae(db, ae_id)
     if not ae or ae.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
+    await _ensure_ae_visible(db, study_id, AERead.model_validate(ae))
 
     member_role = await _get_member_role(db, study_id, current_user.id)
     if current_user.role == "ADMIN":
@@ -184,7 +203,7 @@ async def update_ae(
 @router.delete(
     "/{ae_id}",
     status_code=status.HTTP_204_NO_CONTENT,
-    dependencies=[Depends(require_study_member())],
+    dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
 )
 async def delete_ae(
     study_id: uuid.UUID,
@@ -196,6 +215,7 @@ async def delete_ae(
     ae = await ae_crud.get_ae(db, ae_id)
     if not ae or ae.study_id != study_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
+    await _ensure_ae_visible(db, study_id, AERead.model_validate(ae))
     member_role = await _get_member_role(db, study_id, current_user.id)
     if current_user.role != "ADMIN" and member_role not in {"PM", "PV"}:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")