补齐业务路由与页面权限控制

2026-05-28 10:56:28 +08:00
parent fa961f1391
commit 8611bd66f8
39 changed files with 458 additions and 250 deletions
@@ -48,4 +48,45 @@ describe("SubjectDetail medication adherence", () => {
    expect(source).toContain("row.window_start === row.planned_date && row.window_end === row.planned_date");
    expect(source).toContain("return \"不适用\";");
  });
+
+  it("gates participant subresource mutations by concrete API permissions", () => {
+    const source = readSubjectDetail();
+
+    expect(source).toContain("isApiPermissionAllowed");
+    expect(source).toContain("getProjectRole");
+    expect(source).toContain("isSystemAdmin");
+    [
+      "subjects:update",
+      "subject_histories:create",
+      "subject_histories:update",
+      "subject_histories:delete",
+      "visits:create",
+      "visits:update",
+      "visits:delete",
+      "subject_aes:create",
+      "subject_aes:list",
+      "subject_aes:update",
+      "subject_aes:delete",
+      "subject_pds:create",
+      "subject_pds:list",
+      "subject_pds:update",
+      "subject_pds:delete",
+    ].forEach((operationKey) => {
+      expect(source).toContain(operationKey);
+    });
+    expect(source).toContain("v-if=\"currentTabAction.allowed\"");
+    expect(source).toContain("v-if=\"canUpdateHistory || canDeleteHistory\"");
+    expect(source).toContain("v-if=\"canUpdateVisit || canDeleteVisit\"");
+    expect(source).toContain("v-if=\"canUpdateAe || canDeleteAe\"");
+    expect(source).toContain("v-if=\"canUpdatePd || canDeletePd\"");
+    expect(source).toContain("const canSaveHistory = computed(() => (historyEditingId.value ? canUpdateHistory.value : canCreateHistory.value));");
+    expect(source).toContain("const canSaveVisit = computed(() => (visitEditingId.value ? canUpdateVisit.value : canCreateVisit.value));");
+    expect(source).toContain("const canSaveAe = computed(() => (aeEditingId.value ? canUpdateAe.value : canCreateAe.value));");
+    expect(source).toContain("const canSavePd = computed(() => (pdEditingId.value ? canUpdatePd.value : canCreatePd.value));");
+    expect(source).toContain("const canCreateAe = computed(() => canUseApiPermission(\"subject_aes:create\"));");
+    expect(source).toContain("const canUpdateAe = computed(() => canUseApiPermission(\"subject_aes:update\"));");
+    expect(source).toContain("const canDeleteAe = computed(() => canUseApiPermission(\"subject_aes:delete\"));");
+    expect(source).toContain("const canListAe = computed(() => canUseApiPermission(\"subject_aes:list\"));");
+    expect(source).toContain("const canListPd = computed(() => canUseApiPermission(\"subject_pds:list\"));");
+  });
 });