zhouchengcheng/ctms
1
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

权限管理：接入项目级权限矩阵

Browse Source 
新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。
This commit is contained in:
Cheng Zhou
2026-05-13 08:58:03 +08:00
parent 77e842637d
commit 939fc70532
63 changed files with 1952 additions and 387 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/alembic/versions/20260512_03_add_study_role_permissions.py
+57
View File
@@ -0,0 +1,57 @@
"""add study role permissions
Revision ID: 20260512_03
Revises: 20260512_02
Create Date: 2026-05-12 10:45:00.000000
"""
from typing import Sequence, Union
from alembic import op
import sqlalchemy as sa
from sqlalchemy.dialects import postgresql
revision: str = "20260512_03"
down_revision: Union[str, None] = "20260512_02"
branch_labels: Union[str, Sequence[str], None] = None
depends_on: Union[str, Sequence[str], None] = None
def _table_exists(inspector: sa.Inspector, table_name: str) -> bool:
return table_name in inspector.get_table_names()
def upgrade() -> None:
bind = op.get_bind()
inspector = sa.inspect(bind)
if _table_exists(inspector, "study_role_permissions"):
return
op.create_table(
"study_role_permissions",
sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
sa.Column("study_id", postgresql.UUID(as_uuid=True), nullable=False),
sa.Column("role", sa.String(length=20), nullable=False),
sa.Column("module", sa.String(length=80), nullable=False),
sa.Column("can_read", sa.Boolean(), server_default="false", nullable=False),
sa.Column("can_write", sa.Boolean(), server_default="false", nullable=False),
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
sa.ForeignKeyConstraint(["study_id"], ["studies.id"]),
sa.PrimaryKeyConstraint("id"),
sa.UniqueConstraint("study_id", "role", "module", name="uq_study_role_permissions_study_role_module"),
)
op.create_index("ix_study_role_permissions_study_id", "study_role_permissions", ["study_id"])
op.create_index("ix_study_role_permissions_role", "study_role_permissions", ["role"])
def downgrade() -> None:
bind = op.get_bind()
inspector = sa.inspect(bind)
if not _table_exists(inspector, "study_role_permissions"):
return
op.drop_index("ix_study_role_permissions_role", table_name="study_role_permissions")
op.drop_index("ix_study_role_permissions_study_id", table_name="study_role_permissions")
op.drop_table("study_role_permissions")
backend/app/api/v1/aes.py
+6 -33
View File
@@ -5,7 +5,7 @@ from datetime import date
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import ae as ae_crud
from app.crud import audit as audit_crud
from app.crud import member as member_crud
@@ -16,9 +16,6 @@ from app.schemas.ae import AECreate, AERead, AEUpdate
router = APIRouter()
ALLOWED_CREATE_ROLES = {"PM", "CRA", "PV"}
ALLOWED_UPDATE_ROLES = {"PM", "PV", "CRA"}
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
study = await study_crud.get(db, study_id)
@@ -43,11 +40,6 @@ async def _ensure_ae_visible(db: AsyncSession, study_id: uuid.UUID, ae: AERead |
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
async def _get_member_role(db: AsyncSession, study_id: uuid.UUID, user_id: uuid.UUID) -> str | None:
member = await member_crud.get_member(db, study_id, user_id)
return member.role_in_study if member else None
def _is_overdue(ae: AERead) -> bool:
return bool(ae.report_due_date and date.today() > ae.report_due_date and ae.status != "CLOSED")
@@ -56,7 +48,7 @@ def _is_overdue(ae: AERead) -> bool:
"/",
response_model=AERead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def create_ae(
study_id: uuid.UUID,
@@ -75,9 +67,6 @@ async def create_ae(
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if ae_in.onset_date and ae_in.onset_date > date.today():
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="发生日期不能晚于今天")
member_role = await _get_member_role(db, study_id, current_user.id)
if current_user.role != "ADMIN" and member_role not in ALLOWED_CREATE_ROLES:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
try:
ae = await ae_crud.create_ae(db, study_id, ae_in, created_by=current_user.id)
except ValueError as exc:
@@ -100,7 +89,7 @@ async def create_ae(
@router.get(
"/",
response_model=list[AERead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("risk_issues", "read"))],
)
async def list_ae(
study_id: uuid.UUID,
@@ -138,7 +127,7 @@ async def list_ae(
@router.get(
"/{ae_id}",
response_model=AERead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("risk_issues", "read"))],
)
async def get_ae(
study_id: uuid.UUID,
@@ -166,7 +155,7 @@ async def get_ae(
@router.patch(
"/{ae_id}",
response_model=AERead,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def update_ae(
study_id: uuid.UUID,
@@ -183,19 +172,6 @@ async def update_ae(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
await _ensure_ae_visible(db, study_id, AERead.model_validate(ae))
member_role = await _get_member_role(db, study_id, current_user.id)
if current_user.role == "ADMIN":
pass
elif member_role in ALLOWED_UPDATE_ROLES:
pass
elif member_role == "CRA":
if ae.created_by != current_user.id:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="仅创建人可更新 AE")
if ae_in.status == "CLOSED":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="CRA 无法关闭 AE")
else:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
old_status = ae.status
detail_before = {
"event": ae.term,
@@ -234,7 +210,7 @@ async def update_ae(
@router.delete(
"/{ae_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def delete_ae(
study_id: uuid.UUID,
@@ -247,9 +223,6 @@ async def delete_ae(
if not ae or ae.study_id != study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
await _ensure_ae_visible(db, study_id, AERead.model_validate(ae))
member_role = await _get_member_role(db, study_id, current_user.id)
if current_user.role != "ADMIN" and member_role not in {"PM", "PV"}:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
await ae_crud.delete_ae(db, ae)
await audit_crud.log_action(
db,
backend/app/api/v1/attachments.py
+79 -9
View File
@@ -8,7 +8,8 @@ from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status,
from fastapi.responses import FileResponse
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, get_study_member, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, get_study_member, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.crud import attachment as attachment_crud
from app.crud import audit as audit_crud
from app.crud import study as study_crud
@@ -22,6 +23,9 @@ router = APIRouter()
global_router = APIRouter()
UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
ATTACHMENT_PERMISSION_MODULE_BY_ENTITY = {
"knowledge_note": "shared_library",
}
def _content_disposition(filename: str, disposition: str = "inline") -> str:
@@ -37,11 +41,39 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
return study
def _permission_module_for_entity(entity_type: str) -> str:
return ATTACHMENT_PERMISSION_MODULE_BY_ENTITY.get(entity_type, "file_versions")
async def _ensure_attachment_permission(
db: AsyncSession,
study_id: uuid.UUID,
current_user,
entity_type: str,
action: str,
) -> None:
role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
if role_value == "ADMIN":
return
membership = await member_crud.get_member(db, study_id, current_user.id)
if not membership or not membership.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
allowed = await role_has_project_permission(
db,
study_id,
membership.role_in_study,
_permission_module_for_entity(entity_type),
action,
)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
@router.post(
"/",
response_model=AttachmentRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_not_locked())],
)
async def upload_attachment(
study_id: uuid.UUID,
@@ -52,6 +84,7 @@ async def upload_attachment(
current_user=Depends(get_current_user),
) -> AttachmentRead:
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "write")
dest_dir = UPLOAD_ROOT / f"study_{study_id}" / f"{entity_type}_{entity_id}"
dest_dir.mkdir(parents=True, exist_ok=True)
unique_name = f"{uuid.uuid4()}{Path(file.filename).suffix}"
@@ -96,15 +129,16 @@ async def upload_attachment(
@router.get(
"/",
response_model=list[AttachmentRead],
dependencies=[Depends(require_study_member())],
)
async def list_attachments(
study_id: uuid.UUID,
entity_type: str,
entity_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> list[AttachmentRead]:
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
attachments = await attachment_crud.list_attachments(db, study_id, entity_type, entity_id)
user_ids = {a.uploaded_by for a in attachments if a.uploaded_by}
users_map = await user_crud.get_users_by_ids(db, user_ids)
@@ -127,7 +161,6 @@ async def list_attachments(
@router.get(
"/{attachment_id}/download",
dependencies=[Depends(require_study_member())],
)
async def download_attachment(
study_id: uuid.UUID,
@@ -135,8 +168,10 @@ async def download_attachment(
entity_id: uuid.UUID,
attachment_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> FileResponse:
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
attachment = await attachment_crud.get_attachment(db, attachment_id)
if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -152,7 +187,6 @@ async def download_attachment(
@router.get(
"/{attachment_id}/preview",
dependencies=[Depends(require_study_member())],
)
async def preview_attachment(
study_id: uuid.UUID,
@@ -160,8 +194,10 @@ async def preview_attachment(
entity_id: uuid.UUID,
attachment_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> FileResponse:
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
attachment = await attachment_crud.get_attachment(db, attachment_id)
if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -210,6 +246,19 @@ async def global_download_attachment(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
await _ensure_study_exists(db, attachment.study_id)
user, _ = await _authorize_global(request, db, attachment.study_id)
membership = None
if user.role != "ADMIN":
membership = await get_study_member(attachment.study_id, current_user=user, db=db)
if user.role != "ADMIN":
allowed = await role_has_project_permission(
db,
attachment.study_id,
membership.role_in_study if membership else None,
_permission_module_for_entity(attachment.entity_type),
"read",
)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if not os.path.exists(attachment.file_path):
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
return FileResponse(
@@ -233,7 +282,17 @@ async def global_preview_attachment(
if not attachment:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
await _ensure_study_exists(db, attachment.study_id)
await _authorize_global(request, db, attachment.study_id)
user, membership = await _authorize_global(request, db, attachment.study_id)
if user.role != "ADMIN":
allowed = await role_has_project_permission(
db,
attachment.study_id,
membership.role_in_study if membership else None,
_permission_module_for_entity(attachment.entity_type),
"read",
)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if not os.path.exists(attachment.file_path):
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
return FileResponse(
@@ -258,10 +317,20 @@ async def global_delete_attachment(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
await _ensure_study_exists(db, attachment.study_id)
user, membership = await _authorize_global(request, db, attachment.study_id)
if user.role != "ADMIN":
allowed = await role_has_project_permission(
db,
attachment.study_id,
membership.role_in_study if membership else None,
_permission_module_for_entity(attachment.entity_type),
"write",
)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
can_delete = (
user.role == "ADMIN"
or attachment.uploaded_by == user.id
or (membership and getattr(membership, "role_in_study", None) == "PM")
or membership is not None
)
if not can_delete:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
@@ -281,7 +350,7 @@ async def global_delete_attachment(
@router.delete(
"/{attachment_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_not_locked())],
)
async def delete_attachment(
study_id: uuid.UUID,
@@ -292,6 +361,7 @@ async def delete_attachment(
current_user=Depends(get_current_user),
):
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "write")
attachment = await attachment_crud.get_attachment(db, attachment_id)
if (
not attachment
@@ -309,7 +379,7 @@ async def delete_attachment(
can_delete = (
current_user.role == "ADMIN"
or attachment.uploaded_by == current_user.id
or (membership and getattr(membership, "role_in_study", None) == "PM")
or membership is not None
)
if not can_delete:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
backend/app/api/v1/audit_logs.py
+2 -2
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member
from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member, require_study_permission
from app.crud import audit as audit_crud
from app.schemas.audit import AuditEventCreate, AuditLogRead
@@ -13,7 +13,7 @@ router = APIRouter()
@router.get(
"/",
response_model=list[AuditLogRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("audit_export", "read"))],
)
async def list_audit_logs(
study_id: uuid.UUID,
backend/app/api/v1/dashboard.py
+8 -4
View File
@@ -4,6 +4,7 @@ from sqlalchemy import func, select
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member
from app.core.project_permissions import role_has_project_permission
from app.crud import member as member_crud
from app.models.milestone import Milestone
from app.schemas.progress import StudyProgressRead
@@ -74,12 +75,15 @@ async def get_center_summary(
current_user=Depends(get_current_user),
) -> list[CenterSummaryItem]:
role_value = _role_value(current_user)
member_role = None
membership = None
if role_value != "ADMIN":
membership = await member_crud.get_member(db, study_id, current_user.id)
member_role = membership.role_in_study if membership and membership.is_active else None
if role_value != "ADMIN" and member_role not in {"PM", "CRA"}:
return []
if not membership or not membership.is_active:
return []
can_read_sites = await role_has_project_permission(db, study_id, membership.role_in_study, "sites", "read")
can_read_subjects = await role_has_project_permission(db, study_id, membership.role_in_study, "subjects", "read")
if not (can_read_sites or can_read_subjects):
return []
cra_scope = await get_cra_site_scope(db, study_id, current_user)
scope_ids = cra_scope[0] if cra_scope else None
scope_id_strs = {str(cid) for cid in scope_ids} if scope_ids is not None else None
backend/app/api/v1/drug_shipments.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import drug_shipment as shipment_crud
from app.crud import site as site_crud
@@ -33,7 +33,7 @@ async def _ensure_center_active(db: AsyncSession, study_id: uuid.UUID, center_id
"/shipments",
response_model=DrugShipmentRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def create_shipment(
study_id: uuid.UUID,
@@ -64,7 +64,7 @@ async def create_shipment(
@router.get(
"/shipments",
response_model=list[DrugShipmentRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("materials", "read"))],
)
async def list_shipments(
study_id: uuid.UUID,
@@ -101,7 +101,7 @@ async def list_shipments(
@router.get(
"/shipments/{shipment_id}",
response_model=DrugShipmentRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("materials", "read"))],
)
async def get_shipment(
study_id: uuid.UUID,
@@ -122,7 +122,7 @@ async def get_shipment(
@router.patch(
"/shipments/{shipment_id}",
response_model=DrugShipmentRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def update_shipment(
study_id: uuid.UUID,
@@ -160,7 +160,7 @@ async def update_shipment(
@router.delete(
"/shipments/{shipment_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def delete_shipment(
study_id: uuid.UUID,
backend/app/api/v1/faq_categories.py
+25 -23
View File
@@ -4,6 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.crud import audit as audit_crud
from app.crud import faq_category as category_crud
from app.crud import faq_item as item_crud
@@ -15,9 +16,21 @@ from app.utils.pagination import paginate
router = APIRouter()
def _check_permission_for_scope(study_id: uuid.UUID, current_user, member_role: str | None):
if current_user.role != "ADMIN" and member_role != "PM":
def _is_system_admin(current_user) -> bool:
role = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
return role == "ADMIN"
async def _require_category_permission(db: AsyncSession, study_id: uuid.UUID, current_user, action: str):
if _is_system_admin(current_user):
return None
member = await member_crud.get_member(db, study_id, current_user.id)
if not member or not member.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
allowed = await role_has_project_permission(db, study_id, member.role_in_study, "faq", action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
return member
@router.post(
@@ -25,7 +38,7 @@ def _check_permission_for_scope(study_id: uuid.UUID, current_user, member_role:
response_model=CategoryRead,
status_code=status.HTTP_201_CREATED,
summary="创建 FAQ 分类",
description="创建全局或项目内 FAQ 分类，项目 PM/ADMIN 可用，全局仅 ADMIN。",
description="创建项目内 FAQ 分类，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def create_category(
@@ -38,12 +51,7 @@ async def create_category(
existing = await category_crud.get_category_by_name(db, payload.study_id, payload.name)
if existing:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类名称已存在")
member_role = None
member = await member_crud.get_member(db, payload.study_id, current_user.id)
if not member and current_user.role != "ADMIN":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
member_role = member.role_in_study if member else None
_check_permission_for_scope(payload.study_id, current_user, member_role)
await _require_category_permission(db, payload.study_id, current_user, "write")
category = await category_crud.create_category(db, payload)
await audit_crud.log_action(
db,
@@ -73,9 +81,7 @@ async def list_categories(
if not study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
if study_id:
member = await member_crud.get_member(db, study_id, current_user.id)
if not member and current_user.role != "ADMIN":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
await _require_category_permission(db, study_id, current_user, "read")
categories = await category_crud.list_categories(db, study_id, include_global=False, is_active=is_active)
return paginate([CategoryRead.model_validate(c) for c in categories], total=len(categories))
@@ -84,7 +90,7 @@ async def list_categories(
"/{category_id}",
response_model=CategoryRead,
summary="更新 FAQ 分类",
description="更新分类名称或启停状态，项目 PM/ADMIN 或全局 ADMIN。",
description="更新分类名称或启停状态，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def update_category(
@@ -96,22 +102,17 @@ async def update_category(
category = await category_crud.get_category(db, category_id)
if not category:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="分类不存在")
member_role = None
update_data = payload.model_dump(exclude_unset=True)
target_study_id = update_data.get("study_id", category.study_id)
target_name = update_data.get("name", category.name)
if "study_id" in update_data and update_data["study_id"] != category.study_id and current_user.role != "ADMIN":
if "study_id" in update_data and update_data["study_id"] != category.study_id and not _is_system_admin(current_user):
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="仅管理员可修改分类范围")
existing = await category_crud.get_category_by_name(db, target_study_id, target_name)
if existing and existing.id != category.id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类名称已存在")
if not target_study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
member = await member_crud.get_member(db, target_study_id, current_user.id)
member_role = member.role_in_study if member else None
if not member and current_user.role != "ADMIN":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
_check_permission_for_scope(target_study_id, current_user, member_role)
await _require_category_permission(db, target_study_id, current_user, "write")
updated = await category_crud.update_category(db, category, payload)
await audit_crud.log_action(
db,
@@ -130,7 +131,7 @@ async def update_category(
"/{category_id}",
status_code=status.HTTP_204_NO_CONTENT,
summary="删除 FAQ 分类",
description="仅 ADMIN 可删除分类，分类下存在 FAQ 时不可删除。",
description="删除分类，权限由项目级权限矩阵控制；分类下存在 FAQ 时不可删除。",
dependencies=[Depends(require_study_not_locked())],
)
async def delete_category(
@@ -141,8 +142,9 @@ async def delete_category(
category = await category_crud.get_category(db, category_id)
if not category:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="分类不存在")
if current_user.role != "ADMIN":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="仅管理员可删除 FAQ 分类")
if not category.study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
await _require_category_permission(db, category.study_id, current_user, "write")
item_count = await item_crud.count_items_by_category(db, category_id)
if item_count > 0:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类下存在 FAQ，无法删除")
backend/app/api/v1/faqs.py
+52 -77
View File
@@ -4,6 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.crud import audit as audit_crud
from app.crud import faq_category as category_crud
from app.crud import faq_item as faq_crud
@@ -25,14 +26,28 @@ from app.utils.pagination import paginate
router = APIRouter()
def _check_write_permission(study_id: uuid.UUID, current_user, member_role: str | None):
if current_user.role != "ADMIN" and member_role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
def _is_system_admin(current_user) -> bool:
role = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
return role == "ADMIN"
def _check_create_permission(current_user, is_member: bool):
if current_user.role != "ADMIN" and not is_member:
async def _require_project_permission(
db: AsyncSession,
study_id: uuid.UUID | None,
current_user,
action: str,
):
if not study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if _is_system_admin(current_user):
return None
member = await member_crud.get_member(db, study_id, current_user.id)
if not member or not member.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
allowed = await role_has_project_permission(db, study_id, member.role_in_study, "faq", action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
return member
@router.post(
@@ -40,7 +55,7 @@ def _check_create_permission(current_user, is_member: bool):
response_model=FaqRead,
status_code=status.HTTP_201_CREATED,
summary="创建 FAQ",
description="创建全局或项目内 FAQ，项目 FAQ 需项目 PM/ADMIN 权限。",
description="创建项目内 FAQ，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def create_faq(
@@ -55,12 +70,7 @@ async def create_faq(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="分类不存在")
if cat.study_id != payload.study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类范围不匹配")
member_role = None
is_member = False
member = await member_crud.get_member(db, payload.study_id, current_user.id)
member_role = member.role_in_study if member else None
is_member = member is not None
_check_create_permission(current_user, is_member)
await _require_project_permission(db, payload.study_id, current_user, "write")
try:
item = await faq_crud.create_item(db, payload, created_by=current_user.id)
except ValueError as exc:
@@ -106,22 +116,14 @@ async def list_faqs(
async def _get_member_role(sid: uuid.UUID) -> str | None:
if sid in membership_cache:
return membership_cache[sid]
member = await member_crud.get_member(db, sid, current_user.id)
role = member.role_in_study if member else None
member = await _require_project_permission(db, sid, current_user, "read")
role = member.role_in_study if member else "ADMIN"
membership_cache[sid] = role
return role
if not study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
if current_user.role != "ADMIN":
role = await _get_member_role(study_id)
if not role:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
if is_active is False and current_user.role != "ADMIN":
role = await _get_member_role(study_id)
if role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
await _require_project_permission(db, study_id, current_user, "write" if is_active is False else "read")
items = await faq_crud.list_items(
db,
@@ -134,13 +136,13 @@ async def list_faqs(
visible: list[FaqRead] = []
for it in items:
if current_user.role != "ADMIN":
if not _is_system_admin(current_user):
role = await _get_member_role(it.study_id)
if not role:
continue
if not it.is_active and current_user.role != "ADMIN":
role = await _get_member_role(it.study_id)
if role != "PM":
if not it.is_active and not _is_system_admin(current_user):
allowed = await role_has_project_permission(db, it.study_id, role, "faq", "write")
if not allowed:
continue
visible.append(FaqRead.model_validate(it))
return paginate(visible, total=len(visible))
@@ -150,7 +152,7 @@ async def list_faqs(
"/{item_id}",
response_model=FaqRead,
summary="FAQ 详情",
description="获取单条 FAQ，非 PM 不能查看停用 FAQ。",
description="获取单条 FAQ，停用 FAQ 需项目级写权限。",
)
async def get_faq(
item_id: uuid.UUID,
@@ -162,15 +164,7 @@ async def get_faq(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if not item.study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if current_user.role != "ADMIN":
member = await member_crud.get_member(db, item.study_id, current_user.id)
if not member:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
if not item.is_active and current_user.role not in {"ADMIN"}:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
if member_role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="FAQ 已停用")
await _require_project_permission(db, item.study_id, current_user, "write" if not item.is_active else "read")
return FaqRead.model_validate(item)
@@ -178,7 +172,7 @@ async def get_faq(
"/{item_id}",
response_model=FaqRead,
summary="更新 FAQ",
description="更新 FAQ 内容或启停状态，项目内需 PM/ADMIN 权限。",
description="更新 FAQ 内容或启停状态，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def update_faq(
@@ -191,11 +185,9 @@ async def update_faq(
if not item:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if item.created_by != current_user.id:
member_role = None
if item.study_id:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
_check_write_permission(item.study_id, current_user, member_role)
await _require_project_permission(db, item.study_id, current_user, "write")
else:
await _require_project_permission(db, item.study_id, current_user, "write")
old_active = item.is_active
updated = await faq_crud.update_item(db, item, payload)
action = "UPDATE_FAQ_ITEM"
@@ -220,7 +212,7 @@ async def update_faq(
"/{item_id}/status",
response_model=FaqRead,
summary="更新 FAQ 状态",
description="提问者或项目 PM/ADMIN 可确认已解决。",
description="提问者或具备项目级写权限的成员可确认已解决。",
dependencies=[Depends(require_study_not_locked())],
)
async def update_faq_status(
@@ -234,13 +226,10 @@ async def update_faq_status(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if payload.status != "RESOLVED":
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="仅允许设置为已解决")
if item.created_by != current_user.id and current_user.role != "ADMIN":
member_role = None
if item.study_id:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
if member_role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if item.created_by != current_user.id:
await _require_project_permission(db, item.study_id, current_user, "write")
else:
await _require_project_permission(db, item.study_id, current_user, "read")
await faq_crud.set_status(db, item.id, "RESOLVED", resolved_by_confirm=True)
updated = await faq_crud.get_item(db, item_id)
return FaqRead.model_validate(updated)
@@ -264,10 +253,7 @@ async def set_best_reply(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if not item.study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
is_member = False
member = await member_crud.get_member(db, item.study_id, current_user.id)
is_member = member is not None
_check_create_permission(current_user, is_member)
await _require_project_permission(db, item.study_id, current_user, "write")
if payload.best_reply_id:
reply = await reply_crud.get_reply(db, payload.best_reply_id)
if not reply or reply.faq_id != item.id:
@@ -304,10 +290,7 @@ async def list_replies(
item = await faq_crud.get_item(db, item_id)
if not item:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if item.study_id and current_user.role != "ADMIN":
member = await member_crud.get_member(db, item.study_id, current_user.id)
if not member:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
await _require_project_permission(db, item.study_id, current_user, "read")
replies = await reply_crud.list_replies(db, item_id)
reply_map = {r.id: r for r in replies}
result: list[FaqReplyRead] = []
@@ -349,10 +332,7 @@ async def create_reply(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if not payload.content.strip():
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="回复内容不能为空")
is_member = False
member = await member_crud.get_member(db, item.study_id, current_user.id)
is_member = member is not None
_check_create_permission(current_user, is_member)
await _require_project_permission(db, item.study_id, current_user, "write")
quote = None
if payload.quote_reply_id:
quote = await reply_crud.get_reply(db, payload.quote_reply_id)
@@ -396,7 +376,7 @@ async def create_reply(
"/{item_id}",
status_code=status.HTTP_204_NO_CONTENT,
summary="删除 FAQ",
description="删除 FAQ，项目内需 PM/ADMIN 权限，全局仅 ADMIN。",
description="删除 FAQ，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def delete_faq(
@@ -408,11 +388,9 @@ async def delete_faq(
if not item:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if item.created_by != current_user.id:
member_role = None
if item.study_id:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
_check_write_permission(item.study_id, current_user, member_role)
await _require_project_permission(db, item.study_id, current_user, "write")
else:
await _require_project_permission(db, item.study_id, current_user, "write")
await reply_crud.delete_replies_by_faq_id(db, item.id)
await db.delete(item)
await db.commit()
@@ -432,7 +410,7 @@ async def delete_faq(
"/{item_id}/replies/{reply_id}",
status_code=status.HTTP_204_NO_CONTENT,
summary="删除 FAQ 回复",
description="删除 FAQ 回复，管理员、项目 PM 或回复者可删除。",
description="删除 FAQ 回复，回复者或具备项目级写权限的成员可删除。",
dependencies=[Depends(require_study_not_locked())],
)
async def delete_reply(
@@ -447,13 +425,10 @@ async def delete_reply(
reply = await reply_crud.get_reply(db, reply_id)
if not reply or reply.faq_id != item.id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="回复不存在")
if reply.created_by != current_user.id and current_user.role != "ADMIN":
member_role = None
if item.study_id:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
if member_role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if reply.created_by != current_user.id:
await _require_project_permission(db, item.study_id, current_user, "write")
else:
await _require_project_permission(db, item.study_id, current_user, "read")
if item.best_reply_id == reply.id:
await faq_crud.set_best_reply(db, item.id, None)
ref_count = await reply_crud.count_quote_references(db, reply.id)
backend/app/api/v1/fees_attachments.py
+5 -2
View File
@@ -8,6 +8,7 @@ from fastapi.responses import FileResponse
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.core.security import decode_token
from app.crud import audit as audit_crud
from app.crud import contract_fee as contract_fee_crud
@@ -54,7 +55,9 @@ async def _ensure_project_access(db: AsyncSession, project_id: uuid.UUID, curren
membership = await member_crud.get_member(db, project_id, current_user.id)
if not membership or not membership.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
if write and membership.role_in_study not in {"ADMIN", "PM"}:
action = "write" if write else "read"
allowed = await role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
return membership
@@ -230,7 +233,7 @@ async def delete_fee_attachment(
can_delete = (
role_value == "ADMIN"
or attachment.uploaded_by == current_user.id
or (membership and getattr(membership, "role_in_study", None) == "PM")
or membership is not None
)
if not can_delete:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
backend/app/api/v1/fees_contracts.py
+4 -1
View File
@@ -7,6 +7,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.crud import audit as audit_crud
from app.crud import contract_fee as contract_fee_crud
from app.crud import contract_fee_payment as payment_crud
@@ -38,7 +39,9 @@ async def _ensure_project_access(db: AsyncSession, project_id: uuid.UUID, curren
membership = await member_crud.get_member(db, project_id, current_user.id)
if not membership or not membership.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
if write and membership.role_in_study not in {"ADMIN", "PM"}:
action = "write" if write else "read"
allowed = await role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
return membership
backend/app/api/v1/finance_contracts.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import finance_contract as contract_crud
from app.crud import site as site_crud
@@ -32,7 +32,7 @@ async def _ensure_site_name_active(db: AsyncSession, study_id: uuid.UUID, site_n
"/contracts",
response_model=FinanceContractRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("fees", "write"))],
)
async def create_contract(
study_id: uuid.UUID,
@@ -62,7 +62,7 @@ async def create_contract(
@router.get(
"/contracts",
response_model=list[FinanceContractRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("fees", "read"))],
)
async def list_contracts(
study_id: uuid.UUID,
@@ -93,7 +93,7 @@ async def list_contracts(
@router.get(
"/contracts/{contract_id}",
response_model=FinanceContractRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("fees", "read"))],
)
async def get_contract(
study_id: uuid.UUID,
@@ -114,7 +114,7 @@ async def get_contract(
@router.patch(
"/contracts/{contract_id}",
response_model=FinanceContractRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("fees", "write"))],
)
async def update_contract(
study_id: uuid.UUID,
@@ -148,7 +148,7 @@ async def update_contract(
@router.delete(
"/contracts/{contract_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("fees", "write"))],
)
async def delete_contract(
study_id: uuid.UUID,
backend/app/api/v1/knowledge_notes.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import knowledge_note as note_crud
from app.crud import site as site_crud
@@ -32,7 +32,7 @@ async def _ensure_site_name_active(db: AsyncSession, study_id: uuid.UUID, site_n
"/notes",
response_model=KnowledgeNoteRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("shared_library", "write"))],
)
async def create_note(
study_id: uuid.UUID,
@@ -59,7 +59,7 @@ async def create_note(
@router.get(
"/notes",
response_model=list[KnowledgeNoteRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("shared_library", "read"))],
)
async def list_notes(
study_id: uuid.UUID,
@@ -77,7 +77,7 @@ async def list_notes(
@router.get(
"/notes/{note_id}",
response_model=KnowledgeNoteRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("shared_library", "read"))],
)
async def get_note(
study_id: uuid.UUID,
@@ -94,7 +94,7 @@ async def get_note(
@router.patch(
"/notes/{note_id}",
response_model=KnowledgeNoteRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("shared_library", "write"))],
)
async def update_note(
study_id: uuid.UUID,
@@ -125,7 +125,7 @@ async def update_note(
@router.delete(
"/notes/{note_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("shared_library", "write"))],
)
async def delete_note(
study_id: uuid.UUID,
backend/app/api/v1/material_equipments.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_not_locked, require_study_roles
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import material_equipment as equipment_crud
from app.crud import study as study_crud
@@ -28,7 +28,7 @@ def _validate_calibration(need_calibration: bool, calibration_cycle_days: int |
"/equipment",
response_model=MaterialEquipmentRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def create_equipment(
study_id: uuid.UUID,
@@ -57,7 +57,7 @@ async def create_equipment(
@router.get(
"/equipment",
response_model=list[MaterialEquipmentRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("materials", "read"))],
)
async def list_equipments(
study_id: uuid.UUID,
@@ -74,7 +74,7 @@ async def list_equipments(
@router.get(
"/equipment/{equipment_id}",
response_model=MaterialEquipmentRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("materials", "read"))],
)
async def get_equipment(
study_id: uuid.UUID,
@@ -91,7 +91,7 @@ async def get_equipment(
@router.patch(
"/equipment/{equipment_id}",
response_model=MaterialEquipmentRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def update_equipment(
study_id: uuid.UUID,
@@ -128,7 +128,7 @@ async def update_equipment(
@router.delete(
"/equipment/{equipment_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def delete_equipment(
study_id: uuid.UUID,
backend/app/api/v1/members.py
+4 -4
View File
@@ -4,7 +4,7 @@ import json
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_permission, require_study_not_locked
from app.crud import audit as audit_crud
from app.crud import member as member_crud
from app.crud import study as study_crud
@@ -26,7 +26,7 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
"/",
response_model=StudyMemberRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
)
async def add_member(
study_id: uuid.UUID,
@@ -115,7 +115,7 @@ async def list_members(
@router.patch(
"/{member_id}",
response_model=StudyMemberRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
)
async def update_member(
study_id: uuid.UUID,
@@ -147,7 +147,7 @@ async def update_member(
@router.delete(
"/{member_id}",
response_model=StudyMemberRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
)
async def remove_member(
study_id: uuid.UUID,
backend/app/api/v1/monitoring_visit_issues.py
+8 -8
View File
@@ -11,7 +11,7 @@ from openpyxl import Workbook, load_workbook
from sqlalchemy.exc import IntegrityError
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_not_locked, require_study_roles
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import monitoring_visit_issue as issue_crud
from app.crud import site as site_crud
@@ -332,7 +332,7 @@ def _normalize_file_rows(filename: str, content: bytes) -> list[dict[str, object
@router.get(
"/issues",
response_model=list[MonitoringVisitIssueRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("monitoring_audit", "read"))],
)
async def list_monitoring_visit_issues(
study_id: uuid.UUID,
@@ -382,7 +382,7 @@ async def list_monitoring_visit_issues(
"/issues",
response_model=MonitoringVisitIssueRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("monitoring_audit", "write")), Depends(require_study_not_locked())],
)
async def create_monitoring_visit_issue(
study_id: uuid.UUID,
@@ -421,7 +421,7 @@ async def create_monitoring_visit_issue(
@router.get(
"/issues/export",
response_class=StreamingResponse,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("monitoring_audit", "read"))],
)
async def export_monitoring_visit_issues(
study_id: uuid.UUID,
@@ -553,7 +553,7 @@ async def export_monitoring_visit_issues(
@router.get(
"/issues/{issue_id}",
response_model=MonitoringVisitIssueRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("monitoring_audit", "read"))],
)
async def get_monitoring_visit_issue(
study_id: uuid.UUID,
@@ -570,7 +570,7 @@ async def get_monitoring_visit_issue(
@router.patch(
"/issues/{issue_id}",
response_model=MonitoringVisitIssueRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("monitoring_audit", "write")), Depends(require_study_not_locked())],
)
async def update_monitoring_visit_issue(
study_id: uuid.UUID,
@@ -625,7 +625,7 @@ async def update_monitoring_visit_issue(
@router.delete(
"/issues/{issue_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("monitoring_audit", "write")), Depends(require_study_not_locked())],
)
async def delete_monitoring_visit_issue(
study_id: uuid.UUID,
@@ -655,7 +655,7 @@ async def delete_monitoring_visit_issue(
@router.post(
"/issues/import",
response_model=MonitoringVisitIssueImportSummary,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("monitoring_audit", "write")), Depends(require_study_not_locked())],
)
async def import_monitoring_visit_issues(
study_id: uuid.UUID,
backend/app/api/v1/overview.py
+2 -2
View File
@@ -4,7 +4,7 @@ import uuid
from fastapi import APIRouter, Depends
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_db_session, require_study_member
from app.core.deps import get_db_session, require_study_permission
from app.crud import overview as overview_crud
from app.schemas.overview import ProjectOverviewResponse
@@ -14,7 +14,7 @@ router = APIRouter()
@router.get(
"/overview",
response_model=ProjectOverviewResponse,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("project_overview", "read"))],
)
async def get_project_overview(
study_id: uuid.UUID,
backend/app/api/v1/project_milestones.py
+3 -3
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_not_locked, require_study_roles
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import project_milestone as milestone_crud
from app.crud import study as study_crud
@@ -29,7 +29,7 @@ def _validate_date_range(start, end, label: str):
@router.get(
"/milestones",
response_model=list[ProjectMilestoneRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("project_milestones", "read"))],
)
async def list_project_milestones(
study_id: uuid.UUID,
@@ -43,7 +43,7 @@ async def list_project_milestones(
@router.patch(
"/milestones/{milestone_id}",
response_model=ProjectMilestoneRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("project_milestones", "write")), Depends(require_study_not_locked())],
)
async def update_project_milestone(
study_id: uuid.UUID,
backend/app/api/v1/project_permissions.py
+66
View File
@@ -0,0 +1,66 @@
from __future__ import annotations
import json
import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member
from app.core.project_permissions import PROJECT_PERMISSION_MODULES, get_project_role_permissions, replace_project_role_permissions
from app.crud import audit as audit_crud
from app.crud import study as study_crud
from app.schemas.project_permission import ProjectPermissionModule, ProjectRolePermissionsRead, ProjectRolePermissionsUpdate
router = APIRouter()
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
study = await study_crud.get(db, study_id)
if not study:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在")
return study
@router.get("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_study_member())])
async def get_permissions(
study_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
) -> ProjectRolePermissionsRead:
await _ensure_study_exists(db, study_id)
roles = await get_project_role_permissions(db, study_id)
modules = [ProjectPermissionModule(**item) for item in PROJECT_PERMISSION_MODULES]
return ProjectRolePermissionsRead(modules=modules, roles=roles)
@router.put("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_roles(["ADMIN"]))])
async def update_permissions(
study_id: uuid.UUID,
payload: ProjectRolePermissionsUpdate,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> ProjectRolePermissionsRead:
await _ensure_study_exists(db, study_id)
roles = await replace_project_role_permissions(
db,
study_id,
{
role: {
module: actions.model_dump()
for module, actions in modules.items()
}
for role, modules in payload.roles.items()
},
)
await audit_crud.log_action(
db,
study_id=study_id,
entity_type="project_permissions",
entity_id=study_id,
action="PROJECT_PERMISSIONS_UPDATED",
detail=json.dumps({"targetName": "项目权限", "after": roles}, ensure_ascii=False),
operator_id=current_user.id,
operator_role=current_user.role,
)
modules = [ProjectPermissionModule(**item) for item in PROJECT_PERMISSION_MODULES]
return ProjectRolePermissionsRead(modules=modules, roles=roles)
backend/app/api/v1/router.py
+2 -1
View File
@@ -1,6 +1,6 @@
from fastapi import APIRouter
from app.api.v1 import auth, users, admin_users, studies, sites, members, attachments, audit_logs, dashboard, subjects, visits, aes, finance_dashboard, finance_contracts, fees_contracts, fees_attachments, drug_shipments, material_equipments, project_milestones, startup, knowledge_notes, subject_histories, subject_pds, study_subject_pds, faq_categories, faqs, documents, overview, notifications, monitoring_visit_issues
from app.api.v1 import auth, users, admin_users, studies, sites, members, attachments, audit_logs, dashboard, subjects, visits, aes, finance_dashboard, finance_contracts, fees_contracts, fees_attachments, drug_shipments, material_equipments, project_milestones, startup, knowledge_notes, subject_histories, subject_pds, study_subject_pds, faq_categories, faqs, documents, overview, notifications, monitoring_visit_issues, project_permissions
api_router = APIRouter()
@@ -12,6 +12,7 @@ api_router.include_router(overview.router, prefix="/studies/{study_id}", tags=["
api_router.include_router(notifications.router, prefix="/studies/{study_id}", tags=["notifications"])
api_router.include_router(sites.router, prefix="/studies/{study_id}/sites", tags=["sites"])
api_router.include_router(members.router, prefix="/studies/{study_id}/members", tags=["study-members"])
api_router.include_router(project_permissions.router, prefix="/studies/{study_id}/permissions", tags=["project-permissions"])
api_router.include_router(attachments.router, prefix="/studies/{study_id}/{entity_type}/{entity_id}/attachments", tags=["attachments"])
api_router.include_router(attachments.global_router, prefix="/attachments", tags=["attachments"])
api_router.include_router(audit_logs.router, prefix="/studies/{study_id}/audit-logs", tags=["audit-logs"])
backend/app/api/v1/sites.py
+3 -3
View File
@@ -4,7 +4,7 @@ import json
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_permission, require_study_not_locked
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import startup as startup_crud
@@ -26,7 +26,7 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
"/",
response_model=SiteRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("sites", "write")), Depends(require_study_not_locked())],
)
async def create_site(
study_id: uuid.UUID,
@@ -91,7 +91,7 @@ async def list_sites(
@router.patch(
"/{site_id}",
response_model=SiteRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("sites", "write")), Depends(require_study_not_locked())],
)
async def update_site(
study_id: uuid.UUID,
backend/app/api/v1/startup.py
+20 -20
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_permission
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import startup as startup_crud
@@ -53,7 +53,7 @@ async def _ensure_site_active(db: AsyncSession, site_id: uuid.UUID | None):
"/feasibility",
response_model=StartupFeasibilityRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def create_feasibility(
study_id: uuid.UUID,
@@ -83,7 +83,7 @@ async def create_feasibility(
@router.get(
"/feasibility",
response_model=list[StartupFeasibilityRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "read"))],
)
async def list_feasibilities(
study_id: uuid.UUID,
@@ -102,7 +102,7 @@ async def list_feasibilities(
@router.get(
"/feasibility/{record_id}",
response_model=StartupFeasibilityRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "read"))],
)
async def get_feasibility(
study_id: uuid.UUID,
@@ -123,7 +123,7 @@ async def get_feasibility(
@router.patch(
"/feasibility/{record_id}",
response_model=StartupFeasibilityRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def update_feasibility(
study_id: uuid.UUID,
@@ -157,7 +157,7 @@ async def update_feasibility(
@router.delete(
"/feasibility/{record_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def delete_feasibility(
study_id: uuid.UUID,
@@ -190,7 +190,7 @@ async def delete_feasibility(
"/ethics",
response_model=StartupEthicsRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def create_ethics(
study_id: uuid.UUID,
@@ -220,7 +220,7 @@ async def create_ethics(
@router.get(
"/ethics",
response_model=list[StartupEthicsRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "read"))],
)
async def list_ethics(
study_id: uuid.UUID,
@@ -239,7 +239,7 @@ async def list_ethics(
@router.get(
"/ethics/{record_id}",
response_model=StartupEthicsRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "read"))],
)
async def get_ethics(
study_id: uuid.UUID,
@@ -260,7 +260,7 @@ async def get_ethics(
@router.patch(
"/ethics/{record_id}",
response_model=StartupEthicsRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def update_ethics(
study_id: uuid.UUID,
@@ -294,7 +294,7 @@ async def update_ethics(
@router.delete(
"/ethics/{record_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def delete_ethics(
study_id: uuid.UUID,
@@ -327,7 +327,7 @@ async def delete_ethics(
"/kickoff",
response_model=KickoffMeetingRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def create_kickoff(
study_id: uuid.UUID,
@@ -357,7 +357,7 @@ async def create_kickoff(
@router.get(
"/kickoff",
response_model=list[KickoffMeetingRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "read"))],
)
async def list_kickoffs(
study_id: uuid.UUID,
@@ -376,7 +376,7 @@ async def list_kickoffs(
@router.get(
"/kickoff/{meeting_id}",
response_model=KickoffMeetingRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "read"))],
)
async def get_kickoff(
study_id: uuid.UUID,
@@ -397,7 +397,7 @@ async def get_kickoff(
@router.patch(
"/kickoff/{meeting_id}",
response_model=KickoffMeetingRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def update_kickoff(
study_id: uuid.UUID,
@@ -432,7 +432,7 @@ async def update_kickoff(
"/training-authorizations",
response_model=TrainingAuthorizationRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def create_training_authorization(
study_id: uuid.UUID,
@@ -462,7 +462,7 @@ async def create_training_authorization(
@router.get(
"/training-authorizations",
response_model=list[TrainingAuthorizationRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "read"))],
)
async def list_training_authorizations(
study_id: uuid.UUID,
@@ -481,7 +481,7 @@ async def list_training_authorizations(
@router.get(
"/training-authorizations/{record_id}",
response_model=TrainingAuthorizationRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "read"))],
)
async def get_training_authorization(
study_id: uuid.UUID,
@@ -502,7 +502,7 @@ async def get_training_authorization(
@router.patch(
"/training-authorizations/{record_id}",
response_model=TrainingAuthorizationRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def update_training_authorization(
study_id: uuid.UUID,
@@ -536,7 +536,7 @@ async def update_training_authorization(
@router.delete(
"/training-authorizations/{record_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def delete_training_authorization(
study_id: uuid.UUID,
backend/app/api/v1/studies.py
+9 -9
View File
@@ -813,7 +813,7 @@ async def get_study(
@router.patch(
"/{study_id}",
response_model=StudyRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"]))],
dependencies=[Depends(require_roles(["ADMIN"]))],
)
async def update_study(
study_id: uuid.UUID,
@@ -990,7 +990,7 @@ async def get_study_setup_config(
@router.put(
"/{study_id}/setup-config",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def upsert_study_setup_config(
study_id: uuid.UUID,
@@ -1068,7 +1068,7 @@ async def upsert_study_setup_config(
@router.post(
"/{study_id}/setup-config/publish",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def publish_study_setup_config(
study_id: uuid.UUID,
@@ -1221,7 +1221,7 @@ async def list_study_setup_config_versions(
@router.post(
"/{study_id}/setup-config/rollback",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def rollback_study_setup_config(
study_id: uuid.UUID,
@@ -1279,7 +1279,7 @@ async def rollback_study_setup_config(
@router.post(
"/{study_id}/setup-config/draft/checkout-branch",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def checkout_study_setup_config_branch_draft(
study_id: uuid.UUID,
@@ -1338,7 +1338,7 @@ async def checkout_study_setup_config_branch_draft(
@router.post(
"/{study_id}/setup-config/draft/clear",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def clear_study_setup_config_draft(
study_id: uuid.UUID,
@@ -1390,7 +1390,7 @@ async def clear_study_setup_config_draft(
@router.post(
"/{study_id}/setup-config/draft/refill",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def refill_study_setup_config_draft(
study_id: uuid.UUID,
@@ -1444,7 +1444,7 @@ async def refill_study_setup_config_draft(
@router.post(
"/{study_id}/setup-config/merge-main",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def merge_study_setup_config_to_main(
study_id: uuid.UUID,
@@ -1539,7 +1539,7 @@ async def merge_study_setup_config_to_main(
@router.delete(
"/{study_id}/setup-config/versions/{target_version}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def delete_study_setup_config_version(
study_id: uuid.UUID,
backend/app/api/v1/subject_histories.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import subject as subject_crud
@@ -33,7 +33,7 @@ async def _ensure_subject_active(db: AsyncSession, subject) -> None:
"/histories",
response_model=SubjectHistoryRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("subjects", "write"))],
)
async def create_history(
study_id: uuid.UUID,
@@ -66,7 +66,7 @@ async def create_history(
@router.get(
"/histories",
response_model=list[SubjectHistoryRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def list_histories(
study_id: uuid.UUID,
@@ -86,7 +86,7 @@ async def list_histories(
@router.get(
"/histories/{history_id}",
response_model=SubjectHistoryRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def get_history(
study_id: uuid.UUID,
@@ -107,7 +107,7 @@ async def get_history(
@router.patch(
"/histories/{history_id}",
response_model=SubjectHistoryRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("subjects", "write"))],
)
async def update_history(
study_id: uuid.UUID,
@@ -141,7 +141,7 @@ async def update_history(
@router.delete(
"/histories/{history_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("subjects", "write"))],
)
async def delete_history(
study_id: uuid.UUID,
backend/app/api/v1/subject_pds.py
+5 -6
View File
@@ -6,9 +6,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import (
get_current_user,
get_db_session,
require_study_member,
require_study_not_locked,
require_study_roles,
require_study_permission,
)
from app.crud import audit as audit_crud
from app.crud import site as site_crud
@@ -65,7 +64,7 @@ def _normalize_choice(value: str | None, allowed: set[str], field_name: str) ->
@router.get(
"/pds",
response_model=list[SubjectPdRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("risk_issues", "read"))],
)
async def list_subject_pds(
study_id: uuid.UUID,
@@ -84,7 +83,7 @@ async def list_subject_pds(
"/pds",
response_model=SubjectPdRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def create_subject_pd(
study_id: uuid.UUID,
@@ -129,7 +128,7 @@ async def create_subject_pd(
@router.patch(
"/pds/{pd_id}",
response_model=SubjectPdRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def update_subject_pd(
study_id: uuid.UUID,
@@ -176,7 +175,7 @@ async def update_subject_pd(
@router.delete(
"/pds/{pd_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def delete_subject_pd(
study_id: uuid.UUID,
backend/app/api/v1/subjects.py
+6 -6
View File
@@ -4,7 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import subject as subject_crud
@@ -34,7 +34,7 @@ async def _ensure_subject_active(db: AsyncSession, subject) -> None:
"/",
response_model=SubjectRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def create_subject(
study_id: uuid.UUID,
@@ -66,7 +66,7 @@ async def create_subject(
@router.get(
"/",
response_model=list[SubjectRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def list_subjects(
study_id: uuid.UUID,
@@ -115,7 +115,7 @@ async def list_subjects(
@router.get(
"/{subject_id}",
response_model=SubjectRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def get_subject(
study_id: uuid.UUID,
@@ -154,7 +154,7 @@ async def get_subject(
@router.patch(
"/{subject_id}",
response_model=SubjectRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def update_subject(
study_id: uuid.UUID,
@@ -195,7 +195,7 @@ async def update_subject(
@router.delete(
"/{subject_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def delete_subject(
study_id: uuid.UUID,
backend/app/api/v1/visits.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import subject as subject_crud
@@ -33,7 +33,7 @@ async def _ensure_subject_active(db: AsyncSession, subject) -> None:
@router.get(
"/",
response_model=list[VisitRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def list_visits(
study_id: uuid.UUID,
@@ -50,7 +50,7 @@ async def list_visits(
"/",
response_model=VisitRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def create_visit(
study_id: uuid.UUID,
@@ -115,7 +115,7 @@ async def create_visit(
"/early-termination",
response_model=VisitRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def create_early_termination(
study_id: uuid.UUID,
@@ -168,7 +168,7 @@ async def create_early_termination(
@router.patch(
"/{visit_id}",
response_model=VisitRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def update_visit(
study_id: uuid.UUID,
@@ -211,7 +211,7 @@ async def update_visit(
@router.delete(
"/{visit_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def delete_visit(
study_id: uuid.UUID,
backend/app/core/deps.py
+29
View File
@@ -10,6 +10,7 @@ from app.core.security import decode_token, oauth2_scheme
from app.crud import user as user_crud
from app.crud import member as member_crud
from app.crud import site as site_crud
from app.core.project_permissions import role_has_project_permission
from app.db.session import SessionLocal
from app.schemas.user import TokenPayload
@@ -118,6 +119,34 @@ def require_study_roles(roles: Iterable[str], *, allow_system_admin: bool = True
return dependency
def require_study_permission(module: str, action: str, *, allow_system_admin: bool = True):
async def dependency(
study_id: uuid.UUID,
current_user=Depends(get_current_user),
db: AsyncSession = Depends(get_db_session),
):
role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
if allow_system_admin and role_value == "ADMIN":
return current_user
membership = await member_crud.get_member(db, study_id, current_user.id)
if not membership or not membership.is_active:
raise AppException(
code="FORBIDDEN",
message="不是该项目成员",
status_code=status.HTTP_403_FORBIDDEN,
)
allowed = await role_has_project_permission(db, study_id, membership.role_in_study, module, action)
if not allowed:
raise AppException(
code="FORBIDDEN",
message="项目权限不足",
status_code=status.HTTP_403_FORBIDDEN,
)
return current_user
return dependency
async def get_cra_site_scope(
db: AsyncSession,
study_id: uuid.UUID,
backend/app/core/project_permissions.py
+233
View File
@@ -0,0 +1,233 @@
from __future__ import annotations
import uuid
from sqlalchemy import delete, select
from sqlalchemy.ext.asyncio import AsyncSession
from app.models.study_role_permission import StudyRolePermission
PROJECT_PERMISSION_ROLES = ("ADMIN", "PM", "CRA", "PV", "IMP", "QA")
PROJECT_PERMISSION_MODULES = (
{"key": "project_members", "label": "项目成员", "description": "维护项目账号、成员角色与启停状态"},
{"key": "sites", "label": "中心管理", "description": "维护中心资料与 CRA 绑定"},
{"key": "audit_export", "label": "审计日志导出", "description": "导出项目审计日志"},
{"key": "project_overview", "label": "项目总览", "description": "查看项目整体进度与中心概览", "writable": False},
{"key": "project_milestones", "label": "项目里程碑", "description": "维护项目级里程碑"},
{"key": "fees", "label": "合同费用管理", "description": "维护合同、费用与付款"},
{"key": "materials", "label": "物资管理", "description": "维护药品出入库与物资设备"},
{"key": "file_versions", "label": "文件版本管理", "description": "维护文件版本、分发与确认"},
{"key": "startup_ethics", "label": "立项与伦理", "description": "维护立项、可行性与伦理资料"},
{"key": "startup_auth", "label": "启动与授权", "description": "维护启动会、培训与授权"},
{"key": "subjects", "label": "参与者管理", "description": "维护参与者、访视与 PD"},
{"key": "risk_issues", "label": "风险问题", "description": "维护 SAE、PD 与监查问题"},
{"key": "monitoring_audit", "label": "监查稽查", "description": "维护监查稽查记录"},
{"key": "etmf", "label": "eTMF", "description": "维护 eTMF 文件"},
{"key": "faq", "label": "FAQ", "description": "维护项目 FAQ 分类、问题与回复"},
{"key": "shared_library", "label": "共享库", "description": "维护注意事项、支持性文件与说明文件"},
)
MANAGEMENT_BACKEND_PERMISSION_MODULES = {"project_members", "sites", "audit_export"}
READ_ONLY_PERMISSION_MODULES = {
module["key"]
for module in PROJECT_PERMISSION_MODULES
if module.get("writable") is False
}
DEFAULT_PROJECT_ROLE_PERMISSIONS: dict[str, dict[str, dict[str, bool]]] = {
"ADMIN": {
module["key"]: {"read": True, "write": module["key"] not in READ_ONLY_PERMISSION_MODULES}
for module in PROJECT_PERMISSION_MODULES
},
"PM": {
"project_overview": {"read": True, "write": False},
"project_milestones": {"read": True, "write": True},
"fees": {"read": True, "write": True},
"materials": {"read": True, "write": True},
"file_versions": {"read": True, "write": True},
"startup_ethics": {"read": True, "write": True},
"startup_auth": {"read": True, "write": True},
"subjects": {"read": True, "write": True},
"risk_issues": {"read": True, "write": True},
"monitoring_audit": {"read": True, "write": True},
"etmf": {"read": True, "write": True},
"faq": {"read": True, "write": True},
"shared_library": {"read": True, "write": True},
"project_members": {"read": True, "write": True},
"sites": {"read": True, "write": True},
"audit_export": {"read": True, "write": False},
},
"CRA": {
"project_overview": {"read": True, "write": False},
"project_milestones": {"read": True, "write": True},
"fees": {"read": True, "write": True},
"materials": {"read": True, "write": True},
"file_versions": {"read": True, "write": True},
"startup_ethics": {"read": True, "write": True},
"startup_auth": {"read": True, "write": True},
"subjects": {"read": True, "write": True},
"risk_issues": {"read": True, "write": True},
"monitoring_audit": {"read": True, "write": True},
"etmf": {"read": True, "write": True},
"faq": {"read": True, "write": True},
"shared_library": {"read": True, "write": True},
"project_members": {"read": False, "write": False},
"sites": {"read": False, "write": False},
"audit_export": {"read": True, "write": False},
},
"PV": {
"project_overview": {"read": True, "write": False},
"project_milestones": {"read": True, "write": False},
"fees": {"read": True, "write": False},
"materials": {"read": True, "write": False},
"file_versions": {"read": True, "write": False},
"startup_ethics": {"read": True, "write": False},
"startup_auth": {"read": True, "write": False},
"subjects": {"read": True, "write": False},
"risk_issues": {"read": True, "write": True},
"monitoring_audit": {"read": True, "write": True},
"etmf": {"read": True, "write": False},
"faq": {"read": True, "write": True},
"shared_library": {"read": True, "write": True},
"project_members": {"read": False, "write": False},
"sites": {"read": False, "write": False},
"audit_export": {"read": False, "write": False},
},
"IMP": {
"project_overview": {"read": True, "write": False},
"project_milestones": {"read": True, "write": False},
"fees": {"read": True, "write": False},
"materials": {"read": True, "write": True},
"file_versions": {"read": True, "write": True},
"startup_ethics": {"read": True, "write": False},
"startup_auth": {"read": True, "write": True},
"subjects": {"read": True, "write": False},
"risk_issues": {"read": True, "write": False},
"monitoring_audit": {"read": True, "write": False},
"etmf": {"read": True, "write": False},
"faq": {"read": True, "write": True},
"shared_library": {"read": True, "write": True},
"project_members": {"read": False, "write": False},
"sites": {"read": False, "write": False},
"audit_export": {"read": False, "write": False},
},
"QA": {
"project_overview": {"read": True, "write": False},
"project_milestones": {"read": True, "write": False},
"fees": {"read": True, "write": False},
"materials": {"read": True, "write": False},
"file_versions": {"read": True, "write": False},
"startup_ethics": {"read": True, "write": False},
"startup_auth": {"read": True, "write": False},
"subjects": {"read": True, "write": False},
"risk_issues": {"read": True, "write": False},
"monitoring_audit": {"read": True, "write": True},
"etmf": {"read": True, "write": False},
"faq": {"read": True, "write": False},
"shared_library": {"read": True, "write": True},
"project_members": {"read": False, "write": False},
"sites": {"read": False, "write": False},
"audit_export": {"read": False, "write": False},
},
}
def _empty_action_state() -> dict[str, bool]:
return {"read": False, "write": False}
def _normalize_action_state(value: dict | None, role: str) -> dict[str, bool]:
if role == "ADMIN":
return {"read": True, "write": True}
read = bool((value or {}).get("read", False))
write = bool((value or {}).get("write", False))
if write:
read = True
return {"read": read, "write": write}
def _normalize_module_action_state(value: dict | None, role: str, module: str) -> dict[str, bool]:
if role == "ADMIN":
return {"read": True, "write": module not in READ_ONLY_PERMISSION_MODULES}
if module in MANAGEMENT_BACKEND_PERMISSION_MODULES and role != "PM":
return _empty_action_state()
if module in READ_ONLY_PERMISSION_MODULES:
return {"read": bool((value or {}).get("read", False) or (value or {}).get("write", False)), "write": False}
return _normalize_action_state(value, role)
def normalize_permission_matrix(matrix: dict | None = None) -> dict[str, dict[str, dict[str, bool]]]:
normalized: dict[str, dict[str, dict[str, bool]]] = {}
matrix = matrix or {}
for role in PROJECT_PERMISSION_ROLES:
normalized[role] = {}
role_matrix = matrix.get(role) or DEFAULT_PROJECT_ROLE_PERMISSIONS.get(role, {})
for module in PROJECT_PERMISSION_MODULES:
module_key = module["key"]
normalized[role][module_key] = _normalize_module_action_state(
role_matrix.get(module_key, _empty_action_state()),
role,
module_key,
)
return normalized
async def get_project_role_permissions(db: AsyncSession, study_id: uuid.UUID) -> dict[str, dict[str, dict[str, bool]]]:
result = await db.execute(select(StudyRolePermission).where(StudyRolePermission.study_id == study_id))
rows = result.scalars().all()
if not rows:
return normalize_permission_matrix(DEFAULT_PROJECT_ROLE_PERMISSIONS)
matrix = normalize_permission_matrix(DEFAULT_PROJECT_ROLE_PERMISSIONS)
for row in rows:
if row.role not in PROJECT_PERMISSION_ROLES:
continue
if row.module not in matrix[row.role]:
continue
matrix[row.role][row.module] = _normalize_module_action_state(
{"read": row.can_read, "write": row.can_write},
row.role,
row.module,
)
return matrix
async def replace_project_role_permissions(
db: AsyncSession,
study_id: uuid.UUID,
payload: dict[str, dict[str, dict[str, bool]]],
) -> dict[str, dict[str, dict[str, bool]]]:
matrix = normalize_permission_matrix(payload)
await db.execute(delete(StudyRolePermission).where(StudyRolePermission.study_id == study_id))
for role, role_matrix in matrix.items():
if role == "ADMIN":
continue
for module, actions in role_matrix.items():
db.add(
StudyRolePermission(
study_id=study_id,
role=role,
module=module,
can_read=actions["read"],
can_write=actions["write"],
)
)
await db.commit()
return matrix
async def role_has_project_permission(
db: AsyncSession,
study_id: uuid.UUID,
role: str | None,
module: str,
action: str,
) -> bool:
if role == "ADMIN":
return True
matrix = await get_project_role_permissions(db, study_id)
actions = matrix.get(role or "", {}).get(module)
if not actions:
return False
if action == "write":
return bool(actions["write"])
return bool(actions["read"])
backend/app/db/base.py
+1
View File
@@ -37,3 +37,4 @@ from app.models.study_setup_config import StudySetupConfig # noqa: F401
from app.models.study_setup_config_version import StudySetupConfigVersion # noqa: F401
from app.models.study_monitoring_strategy import StudyMonitoringStrategy # noqa: F401
from app.models.study_center_confirm import StudyCenterConfirm # noqa: F401
from app.models.study_role_permission import StudyRolePermission # noqa: F401
backend/app/models/study_role_permission.py
+25
View File
@@ -0,0 +1,25 @@
from __future__ import annotations
import uuid
from datetime import datetime
from sqlalchemy import Boolean, DateTime, ForeignKey, String, UniqueConstraint, func
from sqlalchemy.dialects.postgresql import UUID
from sqlalchemy.orm import Mapped, mapped_column
from app.db.base_class import Base
class StudyRolePermission(Base):
__tablename__ = "study_role_permissions"
__table_args__ = (
UniqueConstraint("study_id", "role", "module", name="uq_study_role_permissions_study_role_module"),
)
id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
study_id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), ForeignKey("studies.id"), nullable=False, index=True)
role: Mapped[str] = mapped_column(String(20), nullable=False, index=True)
module: Mapped[str] = mapped_column(String(80), nullable=False)
can_read: Mapped[bool] = mapped_column(Boolean, nullable=False, server_default="false")
can_write: Mapped[bool] = mapped_column(Boolean, nullable=False, server_default="false")
updated_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False, server_default=func.now(), onupdate=func.now())
backend/app/schemas/project_permission.py
+33
View File
@@ -0,0 +1,33 @@
from __future__ import annotations
from typing import Literal
from pydantic import BaseModel, Field
ProjectPermissionRole = Literal["ADMIN", "PM", "CRA", "PV", "IMP", "QA"]
ProjectPermissionAction = Literal["read", "write"]
class ProjectPermissionActionState(BaseModel):
read: bool = False
write: bool = False
class ProjectPermissionModule(BaseModel):
key: str
label: str
description: str | None = None
writable: bool = True
class ProjectRolePermissionMatrix(BaseModel):
roles: dict[ProjectPermissionRole, dict[str, ProjectPermissionActionState]]
class ProjectRolePermissionsRead(ProjectRolePermissionMatrix):
modules: list[ProjectPermissionModule]
class ProjectRolePermissionsUpdate(ProjectRolePermissionMatrix):
roles: dict[ProjectPermissionRole, dict[str, ProjectPermissionActionState]] = Field(default_factory=dict)
backend/app/services/document_service.py
+5 -2
View File
@@ -11,8 +11,8 @@ from fastapi.responses import FileResponse
from sqlalchemy import delete as sa_delete, or_, select, update as sa_update
from sqlalchemy.ext.asyncio import AsyncSession
from app.core import rbac
from app.core.deps import get_cra_site_scope
from app.core.project_permissions import role_has_project_permission
from app.crud import acknowledgement as acknowledgement_crud
from app.crud import distribution as distribution_crud
from app.crud import document as document_crud
@@ -75,7 +75,10 @@ async def _ensure_study_access(db: AsyncSession, trial_id: uuid.UUID, current_us
membership = await member_crud.get_member(db, trial_id, current_user.id)
if not membership or not membership.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
if not rbac.is_allowed(action, current_user, membership):
module = "file_versions"
permission_action = "read" if action in {"view", "ack"} else "write"
allowed = await role_has_project_permission(db, trial_id, membership.role_in_study, module, permission_action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
return membership
backend/tests/test_project_management_permissions_static.py
+127 -9
View File
@@ -4,13 +4,131 @@ from pathlib import Path
ROOT = Path(__file__).resolve().parents[1]
def test_project_management_write_routes_allow_project_admin_and_pm():
for relative_path in (
"app/api/v1/studies.py",
"app/api/v1/sites.py",
"app/api/v1/members.py",
):
source = (ROOT / relative_path).read_text(encoding="utf-8")
def test_project_setup_routes_keep_project_admin_and_pm_defaults():
source = (ROOT / "app/api/v1/studies.py").read_text(encoding="utf-8")
assert 'require_study_roles(["PM"])' not in source
assert 'require_study_roles(["ADMIN", "PM"])' in source
assert 'require_study_roles(["PM"])' not in source
assert 'require_study_roles(["ADMIN", "PM"])' not in source
assert 'require_roles(["ADMIN"])' in source
def test_project_permission_routes_are_registered():
source = (ROOT / "app/api/v1/router.py").read_text(encoding="utf-8")
assert "project_permissions" in source
assert 'prefix="/studies/{study_id}/permissions"' in source
def test_project_member_writes_use_saved_permission_matrix():
source = (ROOT / "app/api/v1/members.py").read_text(encoding="utf-8")
assert 'require_study_permission("project_members", "write")' in source
assert 'require_study_roles(["ADMIN", "PM"])' not in source
def test_business_modules_use_saved_permission_matrix():
expected = {
"overview.py": [
'require_study_permission("project_overview", "read")',
],
"project_milestones.py": [
'require_study_permission("project_milestones", "read")',
'require_study_permission("project_milestones", "write")',
],
"subjects.py": [
'require_study_permission("subjects", "read")',
'require_study_permission("subjects", "write")',
],
"material_equipments.py": [
'require_study_permission("materials", "read")',
'require_study_permission("materials", "write")',
],
"startup.py": [
'require_study_permission("startup_ethics", "read")',
'require_study_permission("startup_ethics", "write")',
'require_study_permission("startup_auth", "read")',
'require_study_permission("startup_auth", "write")',
],
"aes.py": [
'require_study_permission("risk_issues", "read")',
'require_study_permission("risk_issues", "write")',
],
"monitoring_visit_issues.py": [
'require_study_permission("monitoring_audit", "read")',
'require_study_permission("monitoring_audit", "write")',
],
}
for filename, checks in expected.items():
source = (ROOT / f"app/api/v1/{filename}").read_text(encoding="utf-8")
for check in checks:
assert check in source
ae_source = (ROOT / "app/api/v1/aes.py").read_text(encoding="utf-8")
assert "ALLOWED_CREATE_ROLES" not in ae_source
assert "ALLOWED_UPDATE_ROLES" not in ae_source
assert 'member_role not in {"PM", "PV"}' not in ae_source
def test_fee_contracts_use_saved_permission_matrix():
source = (ROOT / "app/api/v1/fees_contracts.py").read_text(encoding="utf-8")
assert 'role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)' in source
assert 'if write and membership.role_in_study not in {"ADMIN", "PM"}' not in source
def test_attachment_deletes_use_saved_permission_matrix():
source = (ROOT / "app/api/v1/attachments.py").read_text(encoding="utf-8")
fees_source = (ROOT / "app/api/v1/fees_attachments.py").read_text(encoding="utf-8")
assert "_permission_module_for_entity(entity_type)" in source
assert '"knowledge_note": "shared_library"' in source
assert "_permission_module_for_entity(attachment.entity_type)" in source
assert 'getattr(membership, "role_in_study", None) == "PM"' not in source
assert 'role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)' in fees_source
assert 'getattr(membership, "role_in_study", None) == "PM"' not in fees_source
def test_faq_uses_dedicated_permission_matrix():
source = (ROOT / "app/api/v1/faqs.py").read_text(encoding="utf-8")
category_source = (ROOT / "app/api/v1/faq_categories.py").read_text(encoding="utf-8")
assert 'role_has_project_permission(db, study_id, member.role_in_study, "faq", action)' in source
assert 'role_has_project_permission(db, study_id, member.role_in_study, "faq", action)' in category_source
assert '"etmf"' not in source
assert '"etmf"' not in category_source
assert 'member_role != "PM"' not in source
assert 'member_role != "PM"' not in category_source
def test_audit_logs_use_saved_permission_matrix():
source = (ROOT / "app/api/v1/audit_logs.py").read_text(encoding="utf-8")
get_block = source[source.index("@router.get("):source.index("@router.delete(")]
assert 'require_study_permission("audit_export", "read")' in get_block
assert 'require_study_member()' not in get_block
def test_document_service_uses_saved_permission_matrix():
source = (ROOT / "app/services/document_service.py").read_text(encoding="utf-8")
assert 'role_has_project_permission' in source
assert '"file_versions"' in source
assert 'rbac.is_allowed' not in source
def test_remaining_business_reads_use_saved_permission_matrix():
expected = {
"finance_contracts.py": ['require_study_permission("fees", "read")'],
"drug_shipments.py": ['require_study_permission("materials", "read")'],
"knowledge_notes.py": ['require_study_permission("shared_library", "read")'],
"subject_histories.py": ['require_study_permission("subjects", "read")'],
"subject_pds.py": ['require_study_permission("risk_issues", "read")'],
"visits.py": ['require_study_permission("subjects", "read")'],
"attachments.py": ['_permission_module_for_entity(entity_type)'],
}
for filename, checks in expected.items():
source = (ROOT / f"app/api/v1/{filename}").read_text(encoding="utf-8")
for check in checks:
assert check in source
backend/tests/test_project_permissions.py
+172
View File
@@ -0,0 +1,172 @@
from app.core.project_permissions import PROJECT_PERMISSION_MODULES, normalize_permission_matrix
def test_normalize_permission_matrix_makes_admin_fixed_full_access():
matrix = normalize_permission_matrix({"ADMIN": {}})
for module in PROJECT_PERMISSION_MODULES:
assert matrix["ADMIN"][module["key"]] == {
"read": True,
"write": module.get("writable") is not False,
}
def test_normalize_permission_matrix_keeps_admin_fixed_even_when_disabled():
payload = {
"ADMIN": {
module["key"]: {"read": False, "write": False}
for module in PROJECT_PERMISSION_MODULES
}
}
matrix = normalize_permission_matrix(payload)
for module in PROJECT_PERMISSION_MODULES:
assert matrix["ADMIN"][module["key"]] == {
"read": True,
"write": module.get("writable") is not False,
}
def test_normalize_permission_matrix_write_implies_read():
matrix = normalize_permission_matrix({
"CRA": {
"subjects": {"read": False, "write": True},
}
})
assert matrix["CRA"]["subjects"] == {"read": True, "write": True}
def test_business_permission_modules_follow_project_menu():
module_labels = [module["label"] for module in PROJECT_PERMISSION_MODULES]
assert module_labels == [
"项目成员",
"中心管理",
"审计日志导出",
"项目总览",
"项目里程碑",
"合同费用管理",
"物资管理",
"文件版本管理",
"立项与伦理",
"启动与授权",
"参与者管理",
"风险问题",
"监查稽查",
"eTMF",
"FAQ",
"共享库",
]
def test_default_business_permissions_match_role_responsibilities():
matrix = normalize_permission_matrix()
assert matrix["PM"]["project_members"] == {"read": True, "write": True}
assert matrix["PM"]["sites"] == {"read": True, "write": True}
assert matrix["CRA"]["project_members"] == {"read": False, "write": False}
assert matrix["CRA"]["audit_export"] == {"read": False, "write": False}
assert matrix["PV"]["sites"] == {"read": False, "write": False}
assert matrix["IMP"]["audit_export"] == {"read": False, "write": False}
assert matrix["QA"]["audit_export"] == {"read": False, "write": False}
assert matrix["CRA"]["project_milestones"] == {"read": True, "write": True}
assert matrix["CRA"]["subjects"] == {"read": True, "write": True}
assert matrix["CRA"]["monitoring_audit"] == {"read": True, "write": True}
assert matrix["PV"]["risk_issues"] == {"read": True, "write": True}
assert matrix["IMP"]["materials"] == {"read": True, "write": True}
assert matrix["PM"]["faq"] == {"read": True, "write": True}
assert matrix["CRA"]["faq"] == {"read": True, "write": True}
assert matrix["PM"]["project_overview"] == {"read": True, "write": False}
assert matrix["CRA"]["project_overview"] == {"read": True, "write": False}
assert matrix["PM"]["shared_library"] == {"read": True, "write": True}
assert matrix["CRA"]["shared_library"] == {"read": True, "write": True}
def test_project_overview_is_read_only_even_when_write_is_submitted():
matrix = normalize_permission_matrix({
"CRA": {
"project_overview": {"read": False, "write": True},
}
})
assert matrix["CRA"]["project_overview"] == {"read": True, "write": False}
def test_pm_can_be_granted_management_backend_permissions():
matrix = normalize_permission_matrix({
"PM": {
"project_members": {"read": True, "write": True},
"sites": {"read": True, "write": True},
"audit_export": {"read": True, "write": True},
}
})
assert matrix["PM"]["project_members"] == {"read": True, "write": True}
assert matrix["PM"]["sites"] == {"read": True, "write": True}
assert matrix["PM"]["audit_export"] == {"read": True, "write": True}
def test_non_pm_roles_cannot_be_granted_management_backend_permissions():
management_modules = ["project_members", "sites", "audit_export"]
matrix = normalize_permission_matrix({
role: {
module: {"read": True, "write": True}
for module in management_modules
}
for role in ["CRA", "PV", "IMP", "QA"]
})
for role in ["CRA", "PV", "IMP", "QA"]:
for module in management_modules:
assert matrix[role][module] == {"read": False, "write": False}
def test_each_non_admin_role_can_toggle_each_writable_module():
roles = ["PM", "CRA", "PV", "IMP", "QA"]
management_modules = {"project_members", "sites", "audit_export"}
writable_modules = [
module["key"]
for module in PROJECT_PERMISSION_MODULES
if module.get("writable") is not False and module["key"] not in management_modules
]
for role in roles:
enabled = normalize_permission_matrix({
role: {
module: {"read": False, "write": True}
for module in writable_modules
}
})
disabled = normalize_permission_matrix({
role: {
module["key"]: {"read": False, "write": False}
for module in PROJECT_PERMISSION_MODULES
}
})
for module in writable_modules:
assert enabled[role][module] == {"read": True, "write": True}
assert disabled[role][module] == {"read": False, "write": False}
def test_read_only_modules_never_accept_write_for_any_role():
read_only_modules = [
module["key"]
for module in PROJECT_PERMISSION_MODULES
if module.get("writable") is False
]
payload = {
role: {
module: {"read": False, "write": True}
for module in read_only_modules
}
for role in ["ADMIN", "PM", "CRA", "PV", "IMP", "QA"]
}
matrix = normalize_permission_matrix(payload)
for role in ["ADMIN", "PM", "CRA", "PV", "IMP", "QA"]:
for module in read_only_modules:
assert matrix[role][module] == {"read": True, "write": False}
frontend/src/api/projectPermissions.ts
+8
View File
@@ -0,0 +1,8 @@
import { apiGet, apiPut } from "./axios";
import type { ProjectRolePermissionsResponse, ProjectRolePermissionsUpdate } from "../types/api";
export const fetchProjectRolePermissions = (studyId: string) =>
apiGet<ProjectRolePermissionsResponse>(`/api/v1/studies/${studyId}/permissions/`);
export const updateProjectRolePermissions = (studyId: string, payload: ProjectRolePermissionsUpdate) =>
apiPut<ProjectRolePermissionsResponse>(`/api/v1/studies/${studyId}/permissions/`, payload);
frontend/src/components/Layout.vue
+53 -23
View File
@@ -34,73 +34,91 @@
<span>{{ TEXT.menu.auditLogs }}</span>
</el-menu-item>
</el-menu-item-group>
<el-menu-item-group v-if="canAccessPmAdminBackend" class="menu-group">
<template #title>
<span class="menu-divider">{{ TEXT.menu.admin }}</span>
</template>
<el-menu-item v-if="canAccessPmAdminModule('project_members')" :index="`/admin/projects/${study.currentStudy?.id}/members`">
<el-icon><User /></el-icon>
<span>{{ TEXT.modules.adminProjectMembers.memberLabel }}</span>
</el-menu-item>
<el-menu-item v-if="canAccessPmAdminModule('sites')" :index="`/admin/projects/${study.currentStudy?.id}/sites`">
<el-icon><Suitcase /></el-icon>
<span>{{ TEXT.modules.adminSites.title }}</span>
</el-menu-item>
<el-menu-item v-if="canAccessPmAdminModule('audit_export')" index="/admin/audit-logs">
<el-icon><Document /></el-icon>
<span>{{ TEXT.menu.auditLogs }}</span>
</el-menu-item>
</el-menu-item-group>
<el-menu-item-group v-if="study.currentStudy" class="menu-group">
<el-menu-item-group v-if="study.currentStudy && hasAnyProjectModuleAccess" class="menu-group">
<template #title>
<span class="menu-divider">{{ TEXT.menu.currentProject }}</span>
</template>
<el-menu-item index="/project/overview">
<el-menu-item v-if="canAccessProjectPath('/project/overview')" index="/project/overview">
<el-icon><House /></el-icon>
<span>{{ TEXT.menu.projectOverview }}</span>
</el-menu-item>
<el-menu-item index="/project/milestones">
<el-menu-item v-if="canAccessProjectPath('/project/milestones')" index="/project/milestones">
<el-icon><Calendar /></el-icon>
<span>{{ TEXT.menu.projectMilestones }}</span>
</el-menu-item>
<el-menu-item index="/fees/contracts">
<el-menu-item v-if="canAccessProjectPath('/fees/contracts')" index="/fees/contracts">
<el-icon><Coin /></el-icon>
<span>{{ TEXT.menu.feeContracts }}</span>
</el-menu-item>
<el-sub-menu index="materials">
<el-sub-menu v-if="canAccessAnyProjectPath(['/drug/shipments', '/materials/equipment'])" index="materials">
<template #title>
<el-icon><Box /></el-icon>
<span>{{ TEXT.menu.materialManagement }}</span>
</template>
<el-menu-item index="/drug/shipments">{{ TEXT.menu.drugShipments }}</el-menu-item>
<el-menu-item index="/materials/equipment">{{ TEXT.menu.materialEquipment }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/drug/shipments')" index="/drug/shipments">{{ TEXT.menu.drugShipments }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/materials/equipment')" index="/materials/equipment">{{ TEXT.menu.materialEquipment }}</el-menu-item>
</el-sub-menu>
<el-menu-item index="/file-versions">
<el-menu-item v-if="canAccessProjectPath('/file-versions')" index="/file-versions">
<el-icon><Files /></el-icon>
<span>{{ TEXT.menu.fileVersionManagement }}</span>
</el-menu-item>
<el-menu-item index="/startup/feasibility-ethics">
<el-menu-item v-if="canAccessProjectPath('/startup/feasibility-ethics')" index="/startup/feasibility-ethics">
<el-icon><Calendar /></el-icon>
<span>{{ TEXT.menu.startupFeasibilityEthics }}</span>
</el-menu-item>
<el-menu-item index="/startup/meeting-auth">
<el-menu-item v-if="canAccessProjectPath('/startup/meeting-auth')" index="/startup/meeting-auth">
<el-icon><CircleCheck /></el-icon>
<span>{{ TEXT.menu.startupMeetingAuth }}</span>
</el-menu-item>
<el-menu-item index="/subjects">
<el-menu-item v-if="canAccessProjectPath('/subjects')" index="/subjects">
<el-icon><User /></el-icon>
<span>{{ TEXT.menu.subjects }}</span>
</el-menu-item>
<el-sub-menu index="risk-issues">
<el-sub-menu v-if="canAccessAnyProjectPath(['/risk-issues/sae', '/risk-issues/pd', '/risk-issues/monitoring-visits'])" index="risk-issues">
<template #title>
<el-icon><Flag /></el-icon>
<span>{{ TEXT.menu.riskIssues }}</span>
</template>
<el-menu-item index="/risk-issues/sae">{{ TEXT.menu.riskIssueSae }}</el-menu-item>
<el-menu-item index="/risk-issues/pd">{{ TEXT.menu.riskIssuePd }}</el-menu-item>
<el-menu-item index="/risk-issues/monitoring-visits">{{ TEXT.menu.riskIssueMonitoringVisits }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/risk-issues/sae')" index="/risk-issues/sae">{{ TEXT.menu.riskIssueSae }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/risk-issues/pd')" index="/risk-issues/pd">{{ TEXT.menu.riskIssuePd }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/risk-issues/monitoring-visits')" index="/risk-issues/monitoring-visits">{{ TEXT.menu.riskIssueMonitoringVisits }}</el-menu-item>
</el-sub-menu>
<el-menu-item index="/monitoring-audit">
<el-menu-item v-if="canAccessProjectPath('/monitoring-audit')" index="/monitoring-audit">
<el-icon><ChatDotRound /></el-icon>
<span>{{ TEXT.menu.monitoringAudit }}</span>
</el-menu-item>
<el-menu-item index="/etmf">
<el-menu-item v-if="canAccessProjectPath('/etmf')" index="/etmf">
<el-icon><Flag /></el-icon>
<span>{{ TEXT.menu.etmf }}</span>
</el-menu-item>
<el-sub-menu index="knowledge">
<el-sub-menu v-if="canAccessAnyProjectPath(['/knowledge/medical-consult', '/knowledge/notes', '/knowledge/support-files', '/knowledge/instruction-files'])" index="knowledge">
<template #title>
<el-icon><Notebook /></el-icon>
<span>{{ TEXT.menu.sharedLibrary }}</span>
</template>
<el-menu-item index="/knowledge/medical-consult">{{ TEXT.menu.knowledgeMedicalConsult }}</el-menu-item>
<el-menu-item index="/knowledge/notes">{{ TEXT.menu.knowledgeNotes }}</el-menu-item>
<el-menu-item index="/knowledge/support-files">{{ TEXT.menu.knowledgeSupportFiles }}</el-menu-item>
<el-menu-item index="/knowledge/instruction-files">{{ TEXT.menu.knowledgeInstructionFiles }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/knowledge/medical-consult')" index="/knowledge/medical-consult">{{ TEXT.menu.knowledgeMedicalConsult }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/knowledge/notes')" index="/knowledge/notes">{{ TEXT.menu.knowledgeNotes }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/knowledge/support-files')" index="/knowledge/support-files">{{ TEXT.menu.knowledgeSupportFiles }}</el-menu-item>
<el-menu-item v-if="canAccessProjectPath('/knowledge/instruction-files')" index="/knowledge/instruction-files">{{ TEXT.menu.knowledgeInstructionFiles }}</el-menu-item>
</el-sub-menu>
</el-menu-item-group>
</el-menu>
@@ -217,6 +235,7 @@ import {
CircleCheck, Box, Coin, Notebook, Document, ArrowDown, SwitchButton, Files
} from "@element-plus/icons-vue";
import { ElMessage } from "element-plus";
import { getProjectRoutePermission, hasProjectPermission, projectRouteLandingPaths } from "../utils/projectRoutePermissions";
const auth = useAuthStore();
const study = useStudyStore();
@@ -224,6 +243,16 @@ const router = useRouter();
const route = useRoute();
const isAdmin = computed(() => auth.user?.role === "ADMIN");
const isCollapsed = ref(localStorage.getItem("ctms_sidebar_collapsed") === "1");
const projectRole = computed(() => study.currentStudyRole || (study.currentStudy as any)?.role_in_study || "");
const canAccessPmAdminModule = (module: string) =>
!isAdmin.value && projectRole.value === "PM" && !!study.currentPermissions?.roles?.PM?.[module]?.read;
const canAccessPmAdminBackend = computed(() =>
!!study.currentStudy && ["project_members", "sites", "audit_export"].some((module) => canAccessPmAdminModule(module))
);
const canAccessProjectPath = (path: string) =>
hasProjectPermission(study.currentPermissions?.roles, projectRole.value, getProjectRoutePermission(path), isAdmin.value);
const canAccessAnyProjectPath = (paths: string[]) => paths.some((path) => canAccessProjectPath(path));
const hasAnyProjectModuleAccess = computed(() => canAccessAnyProjectPath(projectRouteLandingPaths));
/* 动态设置 body 上的侧边栏宽度 CSS 变量，用于全局弹窗定位偏移 */
const hasSidebar = computed(() => isAdmin.value || !!study.currentStudy);
@@ -375,9 +404,10 @@ const breadcrumbs = computed(() => {
return items;
});
const handleBreadcrumbCommand = (cmd: any) => {
const handleBreadcrumbCommand = async (cmd: any) => {
if (cmd.type === 'study') {
study.setCurrentStudy(cmd.value);
await study.loadCurrentStudyPermissions().catch(() => {});
router.push("/project/overview");
} else if (cmd.type === 'site') {
study.setCurrentSite(cmd.value);
frontend/src/components/StudySelector.vue
+2 -1
View File
@@ -57,7 +57,7 @@ const loadStudies = async () => {
}
};
const onCommand = (cmd: any) => {
const onCommand = async (cmd: any) => {
if (cmd === "clear") {
study.clearCurrentStudy();
router.push("/workbench");
@@ -65,6 +65,7 @@ const onCommand = (cmd: any) => {
}
if (cmd?.type === "switch" && cmd.study) {
study.setCurrentStudy(cmd.study as Study);
await study.loadCurrentStudyPermissions().catch(() => {});
router.push("/project/overview");
}
};
frontend/src/components/attachments/AttachmentList.vue
+5 -6
View File
@@ -67,7 +67,8 @@ import AttachmentUploader from "./AttachmentUploader.vue";
import { formatFileSize } from "./attachmentUtils";
import { useAuthStore } from "../../store/auth";
import { useStudyStore } from "../../store/study";
import { getProjectRole, isSystemAdmin } from "../../utils/roles";
import { isSystemAdmin } from "../../utils/roles";
import { usePermission } from "../../utils/permission";
import { listMembers } from "../../api/members";
import { displayDateTime, displayUser, getMemberDisplayName, getUserDisplayName } from "../../utils/display";
import { TEXT } from "../../locales";
@@ -84,6 +85,7 @@ const attachments = ref<any[]>([]);
const loading = ref(false);
const auth = useAuthStore();
const study = useStudyStore();
const permission = usePermission();
const members = ref<any[]>([]);
const previewVisible = ref(false);
const previewUrl = ref("");
@@ -203,11 +205,8 @@ const preview = (row: any) => {
const canDelete = (row: any) => {
if (props.readonly) return false;
const userId = auth.user?.id;
const projectRole = getProjectRole(study.currentStudy, study.currentStudyRole);
const ownerId =
row.uploaded_by_id || (row.uploaded_by && typeof row.uploaded_by === "object" ? row.uploaded_by.id : row.uploaded_by);
return userId === ownerId || isSystemAdmin(auth.user) || projectRole === "PM";
const action = props.entityType === "knowledge_note" ? "shared.library.write" : "file.attachment.delete";
return isSystemAdmin(auth.user) || permission.can(action);
};
const remove = async (row: any) => {
frontend/src/components/fees/FeeAttachmentPanel.vue
+4 -6
View File
@@ -83,7 +83,8 @@ import { fetchAttachments, uploadAttachment, deleteAttachment } from "../../api/
import { listMembers } from "../../api/members";
import { useAuthStore } from "../../store/auth";
import { useStudyStore } from "../../store/study";
import { getProjectRole, isSystemAdmin } from "../../utils/roles";
import { isSystemAdmin } from "../../utils/roles";
import { usePermission } from "../../utils/permission";
import { formatFileSize } from "../attachments/attachmentUtils";
import { displayUser, getMemberDisplayName, getUserDisplayName } from "../../utils/display";
import StateEmpty from "../StateEmpty.vue";
@@ -110,6 +111,7 @@ const grouped = reactive<Record<string, any[]>>({});
const progressMap = reactive<Record<string, number>>({});
const auth = useAuthStore();
const study = useStudyStore();
const permission = usePermission();
const members = ref<any[]>([]);
const previewVisible = ref(false);
const previewUrl = ref("");
@@ -269,11 +271,7 @@ const download = (row: any) => {
const canDelete = (row: any) => {
if (props.readonly) return false;
const userId = auth.user?.id;
const projectRole = getProjectRole(study.currentStudy, study.currentStudyRole);
const ownerId =
row.uploaded_by_id || (row.uploaded_by && typeof row.uploaded_by === "object" ? row.uploaded_by.id : row.uploaded_by);
return userId === ownerId || isSystemAdmin(auth.user) || projectRole === "PM";
return isSystemAdmin(auth.user) || permission.can("fees.attachment.delete");
};
const remove = async (row: any) => {
frontend/src/main.ts
+1
View File
@@ -24,6 +24,7 @@ const studyStore = useStudyStore();
studyStore.loadCurrentStudy();
if (getToken()) {
await studyStore.rehydrateStudyForLastUser();
await studyStore.loadCurrentStudyPermissions().catch(() => {});
}
app.use(router);
frontend/src/router.test.ts
+17
View File
@@ -0,0 +1,17 @@
import { describe, expect, it } from "vitest";
import { readFileSync } from "node:fs";
import { resolve } from "node:path";
const readRouter = () => readFileSync(resolve(__dirname, "./router/index.ts"), "utf8");
describe("admin project route permissions", () => {
it("allows project admin pages through matrix-authorized PMs instead of all project roles", () => {
const source = readRouter();
expect(source).toContain('adminProjectPermission: { module: "project_members", action: "read" }');
expect(source).toContain('adminProjectPermission: { module: "sites", action: "read" }');
expect(source).toContain('adminProjectPermission: { module: "audit_export", action: "read" }');
expect(source).toContain('if (role !== "PM") return false;');
expect(source).toContain("roles?.PM?.[permission.module]?.[permission.action]");
});
});
frontend/src/router/index.ts
+64 -7
View File
@@ -1,7 +1,10 @@
import { createRouter, createWebHistory, RouteRecordRaw } from "vue-router";
import { useAuthStore } from "../store/auth";
import { useStudyStore } from "../store/study";
import { getProjectRole, isSystemAdmin } from "../utils/roles";
import { isSystemAdmin } from "../utils/roles";
import { findFirstAccessibleProjectPath, getProjectRoutePermission, hasProjectPermission } from "../utils/projectRoutePermissions";
import { fetchStudyDetail } from "../api/studies";
import { fetchProjectRolePermissions } from "../api/projectPermissions";
import Layout from "../components/Layout.vue";
import Login from "../views/Login.vue";
import Register from "../views/Register.vue";
@@ -16,6 +19,7 @@ import AdminProjects from "../views/admin/Projects.vue";
import ProjectMembers from "../views/admin/ProjectMembers.vue";
import AdminSites from "../views/admin/Sites.vue";
import ProjectDetail from "../views/admin/ProjectDetail.vue";
import ProjectPermissions from "../views/admin/ProjectPermissions.vue";
import ProfileSettings from "../views/ProfileSettings.vue";
import ProjectOverview from "../views/ia/ProjectOverview.vue";
import ProjectMilestones from "../views/ia/ProjectMilestones.vue";
@@ -435,19 +439,25 @@ const routes: RouteRecordRaw[] = [
path: "projects/:projectId/members",
name: "AdminProjectMembers",
component: ProjectMembers,
meta: { title: TEXT.modules.adminProjectMembers.memberLabel, requiresAdmin: true },
meta: { title: TEXT.modules.adminProjectMembers.memberLabel, adminProjectPermission: { module: "project_members", action: "read" } },
},
{
path: "projects/:projectId/permissions",
name: "AdminProjectPermissions",
component: ProjectPermissions,
meta: { title: "权限管理", requiresAdmin: true },
},
{
path: "projects/:projectId/sites",
name: "AdminSites",
component: AdminSites,
meta: { title: TEXT.modules.adminSites.title, requiresAdmin: true },
meta: { title: TEXT.modules.adminSites.title, adminProjectPermission: { module: "sites", action: "read" } },
},
{
path: "audit-logs",
name: "AdminAuditLogs",
component: AuditLogs,
meta: { title: TEXT.menu.auditLogs, requiresAdmin: true },
meta: { title: TEXT.menu.auditLogs, adminProjectPermission: { module: "audit_export", action: "read" } },
},
],
},
@@ -462,6 +472,29 @@ const router = createRouter({
routes,
});
const ensureAdminProjectAccess = async (to: any, isAdmin: boolean) => {
if (isAdmin) return true;
const studyStore = useStudyStore();
const permission = to.meta.adminProjectPermission as { module: string; action: "read" | "write" } | undefined;
if (!permission) return true;
const routeProjectId = typeof to.params.projectId === "string" ? to.params.projectId : "";
if (routeProjectId && studyStore.currentStudy?.id !== routeProjectId) {
const [{ data: project }, { data: permissions }] = await Promise.all([
fetchStudyDetail(routeProjectId),
fetchProjectRolePermissions(routeProjectId),
]);
studyStore.setCurrentStudy(project);
studyStore.currentPermissions = permissions;
} else if (!studyStore.currentPermissions) {
await studyStore.loadCurrentStudyPermissions();
}
const role = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
if (role !== "PM") return false;
return !!studyStore.currentPermissions?.roles?.PM?.[permission.module]?.[permission.action];
};
router.beforeEach(async (to, _from, next) => {
const auth = useAuthStore();
const studyStore = useStudyStore();
@@ -511,13 +544,24 @@ router.beforeEach(async (to, _from, next) => {
return;
}
}
if (to.meta.adminProjectPermission) {
const allowed = await ensureAdminProjectAccess(to, isAdmin).catch(() => false);
if (!allowed) {
next({ path: isAdmin ? "/admin/users" : "/workbench" });
return;
}
}
if (to.meta.requiresAdmin && !isAdmin) {
next({ path: "/workbench" });
return;
}
if (to.name === "AuditLogs") {
const projectRole = getProjectRole(studyStore.currentStudy, studyStore.currentStudyRole);
if (!(isAdmin || projectRole === "PM")) {
if (to.name === "AdminAuditLogs") {
if (studyStore.currentStudy && !studyStore.currentPermissions) {
await studyStore.loadCurrentStudyPermissions().catch(() => {});
}
const role = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
const canReadAudit = !!studyStore.currentPermissions?.roles?.[role]?.audit_export?.read;
if (!(isAdmin || (role === "PM" && canReadAudit))) {
next({ path: "/project/overview" });
return;
}
@@ -526,6 +570,19 @@ router.beforeEach(async (to, _from, next) => {
next({ path: isAdmin ? "/admin/users" : "/workbench" });
return;
}
if (to.meta.requiresStudy && studyStore.currentStudy) {
if (!studyStore.currentPermissions) {
await studyStore.loadCurrentStudyPermissions().catch(() => {});
}
const projectRole = studyStore.currentStudyRole || (studyStore.currentStudy as any)?.role_in_study || "";
const permission = getProjectRoutePermission(to.path);
const canAccessProjectRoute = hasProjectPermission(studyStore.currentPermissions?.roles, projectRole, permission, isAdmin);
if (!canAccessProjectRoute) {
const fallback = findFirstAccessibleProjectPath(studyStore.currentPermissions?.roles, projectRole, isAdmin);
next({ path: fallback || "/workbench" });
return;
}
}
next();
});
frontend/src/store/auth.ts
+1
View File
@@ -37,6 +37,7 @@ export const useAuthStore = defineStore("auth", () => {
const studyStore = useStudyStore();
const userKey = me?.email || email;
await studyStore.restoreStudyForUser(userKey, { preferActive: me?.role === "ADMIN" });
await studyStore.loadCurrentStudyPermissions().catch(() => {});
forceLogin.value = false;
} finally {
loading.value = false;
frontend/src/store/study.ts
+16
View File
@@ -1,6 +1,7 @@
import { defineStore } from "pinia";
import { ref } from "vue";
import { fetchStudies } from "../api/studies";
import { fetchProjectRolePermissions } from "../api/projectPermissions";
import type { Study } from "../types/api";
const STUDY_KEY = "ctms_current_study";
@@ -13,6 +14,7 @@ export const useStudyStore = defineStore("study", () => {
const currentStudyRole = ref<string | null>(null);
const currentSite = ref<any | null>(null);
const viewContext = ref<{ siteName?: string } | null>(null);
const currentPermissions = ref<any | null>(null);
const normalizeUserKey = (value: string) => value.trim().toLowerCase();
const readLastStudyMap = (): Record<string, Study> => {
@@ -49,6 +51,7 @@ export const useStudyStore = defineStore("study", () => {
if (role) {
localStorage.setItem(STUDY_ROLE_KEY, role);
}
currentPermissions.value = null;
const loginEmail = localStorage.getItem("ctms_last_login_email") || "";
if (loginEmail) {
rememberStudyForUser(loginEmail, study);
@@ -157,6 +160,17 @@ export const useStudyStore = defineStore("study", () => {
localStorage.removeItem(STUDY_KEY);
localStorage.removeItem(STUDY_ROLE_KEY);
localStorage.removeItem(SITE_KEY);
currentPermissions.value = null;
};
const loadCurrentStudyPermissions = async () => {
if (!currentStudy.value?.id) {
currentPermissions.value = null;
return null;
}
const { data } = await fetchProjectRolePermissions(currentStudy.value.id);
currentPermissions.value = data;
return data;
};
const rememberCurrentStudyForUser = (userKey: string) => {
@@ -221,6 +235,8 @@ export const useStudyStore = defineStore("study", () => {
ensureDefaultActiveStudy,
restoreStudyForUser,
rehydrateStudyForLastUser,
loadCurrentStudyPermissions,
currentPermissions,
clearCurrentStudy,
};
});
frontend/src/types/api.ts
+23
View File
@@ -128,3 +128,26 @@ export interface Site {
is_active: boolean;
created_at?: string;
}
export type ProjectPermissionActionState = {
read: boolean;
write: boolean;
};
export type ProjectPermissionMatrix = Record<UserRole, Record<string, ProjectPermissionActionState>>;
export interface ProjectPermissionModule {
key: string;
label: string;
description?: string | null;
writable?: boolean;
}
export interface ProjectRolePermissionsResponse {
modules: ProjectPermissionModule[];
roles: ProjectPermissionMatrix;
}
export interface ProjectRolePermissionsUpdate {
roles: ProjectPermissionMatrix;
}
frontend/src/utils/permission.test.ts
+5 -11
View File
@@ -5,21 +5,15 @@ import { resolve } from "node:path";
const readPermissionSource = () => readFileSync(resolve(__dirname, "./permission.ts"), "utf8");
describe("permission project role model", () => {
it("does not fall back to non-admin global roles for project permissions", () => {
it("does not fall back to project role names for permission decisions", () => {
const source = readPermissionSource();
expect(source).toContain("isSystemAdmin");
expect(source).toContain("getProjectRole");
expect(source).toContain("study.currentStudyRole");
expect(source).not.toContain("role_in_study || auth.user?.role");
expect(source).not.toContain("role_in_study || userRole.value");
});
it("allows project administrators and PMs to manage project configuration", () => {
const source = readPermissionSource();
expect(source).toContain('"project.members.manage": ["ADMIN", "PM"]');
expect(source).toContain('"site.manage": ["ADMIN", "PM"]');
expect(source).toContain('"site.cra.bind": ["ADMIN", "PM"]');
expect(source).toContain("study.currentPermissions");
expect(source).toContain('"faq.edit": { module: "faq", action: "write" }');
expect(source).not.toContain('"faq.edit": { module: "etmf"');
expect(source).not.toContain('"ADMIN", "PM"');
});
});
frontend/src/utils/permission.ts
+40 -16
View File
@@ -5,19 +5,19 @@ import { TEXT } from "../locales";
import { getProjectRole, isSystemAdmin } from "./roles";
const PERMISSIONS: Record<string, string[]> = {
"subject.create": ["ADMIN", "PM", "CRA"],
"subject.enroll": ["ADMIN", "PM", "CRA"],
"subject.complete": ["ADMIN", "PM", "CRA"],
"subject.drop": ["ADMIN", "PM", "CRA"],
"ae.create": ["ADMIN", "PM", "CRA", "PV"],
"ae.close": ["ADMIN", "PM", "PV", "CRA"],
"faq.edit": ["ADMIN", "PM"],
"faq.create": ["ADMIN", "PM", "CRA", "PV", "IMP"],
"faq.reply": ["ADMIN", "PM", "CRA", "PV", "IMP"],
"project.members.manage": ["ADMIN", "PM"],
"site.manage": ["ADMIN", "PM"],
"site.cra.bind": ["ADMIN", "PM"],
"fees.contract.write": ["ADMIN", "PM"],
"subject.create": ["ADMIN"],
"subject.enroll": ["ADMIN"],
"subject.complete": ["ADMIN"],
"subject.drop": ["ADMIN"],
"ae.create": ["ADMIN"],
"ae.close": ["ADMIN"],
"faq.edit": ["ADMIN"],
"faq.create": ["ADMIN"],
"faq.reply": ["ADMIN"],
"project.members.manage": ["ADMIN"],
"site.manage": ["ADMIN"],
"site.cra.bind": ["ADMIN"],
"fees.contract.write": ["ADMIN"],
};
const REASONS: Record<string, string> = {
@@ -40,13 +40,37 @@ export const usePermission = () => {
const systemAdmin = computed(() => isSystemAdmin(auth.user));
const projectRole = computed(() => getProjectRole(study.currentStudy, study.currentStudyRole));
const projectPermissions = computed(() => study.currentPermissions);
const can = (action: string): boolean => {
if (systemAdmin.value) return true;
const allowList = PERMISSIONS[action];
if (!allowList) return false;
if (!projectRole.value) return false;
return allowList.includes(projectRole.value);
const permissionMap: Record<string, { module: string; action: "read" | "write" }> = {
"subject.create": { module: "subjects", action: "write" },
"subject.enroll": { module: "subjects", action: "write" },
"subject.complete": { module: "subjects", action: "write" },
"subject.drop": { module: "subjects", action: "write" },
"ae.create": { module: "risk_issues", action: "write" },
"ae.close": { module: "risk_issues", action: "write" },
"project.overview.read": { module: "project_overview", action: "read" },
"faq.edit": { module: "faq", action: "write" },
"faq.create": { module: "faq", action: "write" },
"faq.reply": { module: "faq", action: "write" },
"knowledge.notes.write": { module: "shared_library", action: "write" },
"shared.library.read": { module: "shared_library", action: "read" },
"shared.library.write": { module: "shared_library", action: "write" },
"project.members.manage": { module: "project_members", action: "write" },
"site.manage": { module: "sites", action: "write" },
"site.cra.bind": { module: "sites", action: "write" },
"fees.contract.write": { module: "fees", action: "write" },
"fees.attachment.delete": { module: "fees", action: "write" },
"file.attachment.delete": { module: "file_versions", action: "write" },
"audit.export.read": { module: "audit_export", action: "read" },
};
const mapped = permissionMap[action];
if (!mapped) return false;
const allowed = projectPermissions.value?.roles?.[projectRole.value]?.[mapped.module]?.[mapped.action];
return !!allowed;
};
const reason = (action: string): string => {
frontend/src/utils/projectRoutePermissions.test.ts
+24
View File
@@ -0,0 +1,24 @@
import { describe, expect, it } from "vitest";
import { findFirstAccessibleProjectPath, getProjectRoutePermission, hasProjectPermission } from "./projectRoutePermissions";
describe("project route permissions", () => {
it("maps project routes to read permission modules", () => {
expect(getProjectRoutePermission("/project/overview")).toEqual({ module: "project_overview", action: "read" });
expect(getProjectRoutePermission("/knowledge/medical-consult/abc")).toEqual({ module: "faq", action: "read" });
expect(getProjectRoutePermission("/knowledge/notes/new")).toEqual({ module: "shared_library", action: "read" });
expect(getProjectRoutePermission("/startup/kickoff/new")).toEqual({ module: "startup_auth", action: "read" });
});
it("rejects project routes when the role lacks module read permission", () => {
const matrix = {
CRA: {
project_overview: { read: false, write: false },
shared_library: { read: true, write: true },
},
} as any;
expect(hasProjectPermission(matrix, "CRA", getProjectRoutePermission("/project/overview"), false)).toBe(false);
expect(hasProjectPermission(matrix, "CRA", getProjectRoutePermission("/knowledge/notes"), false)).toBe(true);
expect(findFirstAccessibleProjectPath(matrix, "CRA", false)).toBe("/knowledge/notes");
});
});
frontend/src/utils/projectRoutePermissions.ts
+69
View File
@@ -0,0 +1,69 @@
import type { ProjectPermissionMatrix, UserRole } from "../types/api";
export type ProjectRoutePermission = {
module: string;
action: "read" | "write";
};
const routePermissions: Array<{ prefixes: string[]; permission: ProjectRoutePermission }> = [
{ prefixes: ["/project/overview"], permission: { module: "project_overview", action: "read" } },
{ prefixes: ["/project/milestones"], permission: { module: "project_milestones", action: "read" } },
{ prefixes: ["/fees/contracts", "/finance/contracts"], permission: { module: "fees", action: "read" } },
{ prefixes: ["/drug/shipments", "/materials/equipment"], permission: { module: "materials", action: "read" } },
{ prefixes: ["/file-versions", "/trial/", "/documents/"], permission: { module: "file_versions", action: "read" } },
{ prefixes: ["/startup/feasibility-ethics", "/startup/feasibility", "/startup/ethics"], permission: { module: "startup_ethics", action: "read" } },
{ prefixes: ["/startup/meeting-auth", "/startup/kickoff", "/startup/training"], permission: { module: "startup_auth", action: "read" } },
{ prefixes: ["/subjects"], permission: { module: "subjects", action: "read" } },
{ prefixes: ["/risk-issues"], permission: { module: "risk_issues", action: "read" } },
{ prefixes: ["/monitoring-audit", "/monitoring", "/audit"], permission: { module: "monitoring_audit", action: "read" } },
{ prefixes: ["/etmf"], permission: { module: "etmf", action: "read" } },
{ prefixes: ["/knowledge/medical-consult"], permission: { module: "faq", action: "read" } },
{ prefixes: ["/knowledge/notes", "/knowledge/support-files", "/knowledge/instruction-files"], permission: { module: "shared_library", action: "read" } },
];
export const projectRouteLandingPaths = [
"/project/overview",
"/project/milestones",
"/fees/contracts",
"/drug/shipments",
"/materials/equipment",
"/file-versions",
"/startup/feasibility-ethics",
"/startup/meeting-auth",
"/subjects",
"/risk-issues/sae",
"/monitoring-audit",
"/etmf",
"/knowledge/medical-consult",
"/knowledge/notes",
"/knowledge/support-files",
"/knowledge/instruction-files",
];
export const getProjectRoutePermission = (path: string): ProjectRoutePermission | null => {
const normalized = path || "";
for (const item of routePermissions) {
if (item.prefixes.some((prefix) => normalized === prefix || normalized.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`))) {
return item.permission;
}
}
return null;
};
export const hasProjectPermission = (
matrix: ProjectPermissionMatrix | null | undefined,
role: string | null | undefined,
permission: ProjectRoutePermission | null,
isAdmin: boolean,
) => {
if (!permission || isAdmin) return true;
if (!role) return false;
const typedRole = role as UserRole;
return !!matrix?.[typedRole]?.[permission.module]?.[permission.action];
};
export const findFirstAccessibleProjectPath = (
matrix: ProjectPermissionMatrix | null | undefined,
role: string | null | undefined,
isAdmin: boolean,
) => projectRouteLandingPaths.find((path) => hasProjectPermission(matrix, role, getProjectRoutePermission(path), isAdmin)) || null;
frontend/src/utils/roles.test.ts
+1 -4
View File
@@ -1,5 +1,5 @@
import { describe, expect, it } from "vitest";
import { getProjectRole, getSystemRole, isProjectAdminOrPm, isSystemAdmin } from "./roles";
import { getProjectRole, getSystemRole, isSystemAdmin } from "./roles";
describe("role helpers", () => {
it("keeps system admin separate from project admin", () => {
@@ -11,8 +11,5 @@ describe("role helpers", () => {
it("uses only project role fields for project permissions", () => {
expect(getProjectRole({ role_in_study: "PM" } as any, null)).toBe("PM");
expect(getProjectRole({ role_in_study: null } as any, "ADMIN")).toBe("ADMIN");
expect(isProjectAdminOrPm("ADMIN")).toBe(true);
expect(isProjectAdminOrPm("PM")).toBe(true);
expect(isProjectAdminOrPm("CRA")).toBe(false);
});
});
frontend/src/utils/roles.ts
-2
View File
@@ -6,5 +6,3 @@ export const isSystemAdmin = (user?: Pick<UserInfo, "role"> | null) => getSystem
export const getProjectRole = (study?: Pick<Study, "role_in_study"> | null, currentStudyRole?: string | null) =>
currentStudyRole || study?.role_in_study || null;
export const isProjectAdminOrPm = (role?: string | null) => role === "ADMIN" || role === "PM";
frontend/src/views/admin/AuditLogs.test.ts
+2 -1
View File
@@ -5,7 +5,7 @@ import { resolve } from "node:path";
const readAuditLogsView = () => readFileSync(resolve(__dirname, "./AuditLogs.vue"), "utf8");
describe("audit logs access", () => {
it("allows current project PM access without relying on global PM role", () => {
it("allows only admins or authorized PMs to use audit export", () => {
const source = readAuditLogsView();
expect(source).toContain("const canAccessAuditLogs = computed");
@@ -13,6 +13,7 @@ describe("audit logs access", () => {
expect(source).toContain("getProjectRole");
expect(source).toContain("study.currentStudyRole");
expect(source).toContain('projectRole.value === "PM"');
expect(source).toContain("roles?.PM?.audit_export?.read");
expect(source).not.toContain('const role = auth.user?.role');
expect(source).not.toContain('role !== "ADMIN"');
});
frontend/src/views/admin/AuditLogs.vue
+20 -2
View File
@@ -167,6 +167,7 @@ import { useRouter } from "vue-router";
import { ElMessage, ElMessageBox } from "element-plus";
import { ArrowDown } from "@element-plus/icons-vue";
import { createAuditEvent, fetchAuditLogs } from "../../api/auditLogs";
import { fetchProjectRolePermissions } from "../../api/projectPermissions";
import { fetchUsers } from "../../api/users";
import { listMembers } from "../../api/members";
import { auditDict, normalizeAuditEvent } from "../../audit";
@@ -187,6 +188,7 @@ const exportLoading = ref(false);
const logs = ref<any[]>([]);
const users = ref<any[]>([]);
const allLogs = ref<any[]>([]);
const permissionMatrix = ref<any | null>(null);
const page = ref(1);
const pageSize = ref(20);
const total = ref(0);
@@ -212,8 +214,14 @@ const resolveUserDisplayName = (u: any): string => {
const userOptions = computed(() => users.value.map((u: any) => ({ label: resolveUserDisplayName(u), value: u.id })));
const isAdmin = computed(() => isSystemAdmin(auth.user));
const projectRole = computed(() => getProjectRole(study.currentStudy, study.currentStudyRole));
const canProjectExport = computed(() => !!study.currentStudy && isAdmin.value);
const canAccessAuditLogs = computed(() => isAdmin.value || projectRole.value === "PM");
const canProjectExport = computed(() => {
if (isAdmin.value) return true;
return projectRole.value === "PM" && !!permissionMatrix.value?.roles?.PM?.audit_export?.read;
});
const canAccessAuditLogs = computed(() => {
if (isAdmin.value) return true;
return projectRole.value === "PM" && !!permissionMatrix.value?.roles?.PM?.audit_export?.read;
});
const ensureAccess = () => {
if (!canAccessAuditLogs.value) {
@@ -221,6 +229,12 @@ const ensureAccess = () => {
}
};
const loadPermissionMatrix = async () => {
if (!study.currentStudy) return;
const { data } = await fetchProjectRolePermissions(study.currentStudy.id);
permissionMatrix.value = data;
};
const loadUsers = async () => {
try {
if (isAdmin.value) {
@@ -244,6 +258,9 @@ const loadLogs = async () => {
if (!study.currentStudy) return;
loading.value = true;
try {
if (!permissionMatrix.value) {
await loadPermissionMatrix();
}
const batchLimit = 500;
let skip = 0;
const allItems: any[] = [];
@@ -418,6 +435,7 @@ onMounted(async () => {
if (!auth.user && auth.token) {
await auth.fetchMe().catch(() => {});
}
await loadPermissionMatrix().catch(() => {});
ensureAccess();
await loadUsers();
await loadLogs();
frontend/src/views/admin/ProjectDetail.test.ts
+3 -3
View File
@@ -83,11 +83,11 @@ describe("ProjectDetail setup draft publish workflow", () => {
});
describe("project detail management role", () => {
it("allows only current project administrators and PMs to manage setup content", () => {
it("allows only system administrators to manage setup content", () => {
const source = readProjectDetail();
expect(source).toContain("project.value?.role_in_study");
expect(source).toContain('["ADMIN", "PM"].includes(setupRole.value)');
expect(source).toContain("isSystemAdmin(authStore.user)");
expect(source).not.toContain('setupRole.value === "ADMIN"');
expect(source).not.toContain("project.value?.role_in_study || authStore.user?.role");
});
});
frontend/src/views/admin/ProjectDetail.vue
+5 -3
View File
@@ -1932,6 +1932,7 @@ import StateLoading from "../../components/StateLoading.vue";
import { useStudyStore } from "../../store/study";
import { useAuthStore } from "../../store/auth";
import { TEXT, requiredMessage } from "../../locales";
import { isSystemAdmin } from "../../utils/roles";
import { groupErrorsBySection, parseFieldPath, type SetupValidationError } from "../../utils/setupFieldLocator";
import { buildSetupReadableDiffRows, serializeDiffValue, type SetupDiffRow } from "../../utils/setupDiffRows";
import {
@@ -2402,8 +2403,7 @@ const setupDraft = reactive<SetupConfigDraft>({
const storageKey = computed(() => `ctms_setup_config_draft_${String(route.params.projectId || "")}`);
const projectDraftStorageKey = computed(() => `ctms_setup_project_draft_${String(route.params.projectId || "")}`);
const setupRole = computed(() => String(project.value?.role_in_study || "").toUpperCase());
const canManageSetup = computed(() => ["ADMIN", "PM"].includes(setupRole.value));
const canManageSetup = computed(() => isSystemAdmin(authStore.user));
const isPreviewView = computed(() => setupViewMode.value === "preview");
const isPublishedVersionView = computed(() => setupViewMode.value === "published");
const isPublishedView = computed(() => isPreviewView.value || isPublishedVersionView.value);
@@ -4419,6 +4419,7 @@ const refreshProjectDisplayAfterPublish = async () => {
formBaselineSnapshot.value = serializeFormForCompare();
if (studyStore.currentStudy?.id === project.value.id) {
studyStore.setCurrentStudy({ ...(studyStore.currentStudy as Study), ...project.value } as Study);
await studyStore.loadCurrentStudyPermissions().catch(() => {});
}
} catch {
// Ignore refresh errors to avoid breaking publish success flow.
@@ -5559,9 +5560,10 @@ const confirmPublishConfig = async () => {
}
};
const enterProject = () => {
const enterProject = async () => {
if (!project.value) return;
studyStore.setCurrentStudy(project.value);
await studyStore.loadCurrentStudyPermissions().catch(() => {});
router.push("/project/overview");
};
const goMembers = () => {
frontend/src/views/admin/ProjectPermissions.test.ts
+16
View File
@@ -0,0 +1,16 @@
import { describe, expect, it } from "vitest";
import { readFileSync } from "node:fs";
import { resolve } from "node:path";
const readProjectPermissions = () => readFileSync(resolve(__dirname, "./ProjectPermissions.vue"), "utf8");
describe("project permissions matrix", () => {
it("locks management backend permissions to admin and PM roles", () => {
const source = readProjectPermissions();
expect(source).toContain('new Set(["project_members", "sites", "audit_export"])');
expect(source).toContain('role === "PM" || role === "ADMIN"');
expect(source).toContain("!canConfigureAdminModule(role, mod.key)");
expect(source).toContain("!canConfigureAdminModule(role, moduleKey)");
});
});
frontend/src/views/admin/ProjectPermissions.vue
+475
View File
@@ -0,0 +1,475 @@
<template>
<div class="permission-page">
<div class="permission-shell unified-shell" v-loading="loading">
<div class="permission-header unified-action-bar">
<div class="permission-title">
<div class="title-icon">
<el-icon><Key /></el-icon>
</div>
<div>
<h2>权限管理</h2>
</div>
</div>
<div class="permission-project-meta">
<span class="meta-item">
<span class="meta-label">项目编号</span>
<strong>{{ project?.code || "-" }}</strong>
</span>
<span class="meta-separator" />
<span class="meta-item meta-item--name">
<span class="meta-label">项目名称</span>
<strong>{{ project?.name || "-" }}</strong>
</span>
</div>
<div class="permission-actions">
<el-button type="primary" :loading="saving" :disabled="!dirty" @click="save">
<el-icon><Check /></el-icon>
保存
</el-button>
</div>
</div>
<section class="permission-matrix unified-section">
<div class="matrix-scroll">
<div class="matrix-grid" :style="{ '--module-count': modules.length }">
<div class="matrix-head matrix-role-head">角色</div>
<div v-for="mod in modules" :key="mod.key" class="matrix-head module-head" :class="{ 'is-admin-module': isAdminModule(mod.key) }">
<span>{{ mod.label }}</span>
</div>
<template v-for="role in roleOrder" :key="role">
<div class="role-cell">
<span class="role-badge" :class="`role-badge--${role.toLowerCase()}`">
{{ roleLabel(role) }}
</span>
</div>
<div v-for="mod in modules" :key="`${role}-${mod.key}`" class="permission-cell" :class="{ 'is-admin-module': isAdminModule(mod.key), 'is-readonly-module': !isWriteSupported(mod) }">
<label class="perm-check" :class="{ 'is-checked': matrix[role]?.[mod.key]?.read, 'is-disabled': isReadLocked(role, mod) }">
<input
type="checkbox"
:disabled="isReadLocked(role, mod)"
:checked="!!matrix[role]?.[mod.key]?.read"
@change="setPermission(role, mod.key, 'read', ($event.target as HTMLInputElement).checked)"
/>
<span class="check-box" />
<span>读</span>
</label>
<label v-if="isWriteSupported(mod)" class="perm-check" :class="{ 'is-checked': matrix[role]?.[mod.key]?.write, 'is-disabled': isWriteLocked(role, mod) }">
<input
type="checkbox"
:disabled="isWriteLocked(role, mod)"
:checked="!!matrix[role]?.[mod.key]?.write"
@change="setPermission(role, mod.key, 'write', ($event.target as HTMLInputElement).checked)"
/>
<span class="check-box" />
<span>写</span>
</label>
</div>
</template>
</div>
</div>
</section>
</div>
</div>
</template>
<script setup lang="ts">
import { computed, onMounted, ref } from "vue";
import { useRoute } from "vue-router";
import { ElMessage } from "element-plus";
import { Check, Key } from "@element-plus/icons-vue";
import { fetchStudyDetail } from "../../api/studies";
import { fetchProjectRolePermissions, updateProjectRolePermissions } from "../../api/projectPermissions";
import type { ProjectPermissionActionState, ProjectPermissionMatrix, ProjectPermissionModule, Study, UserRole } from "../../types/api";
import { displayEnum } from "../../utils/display";
import { TEXT } from "../../locales";
const route = useRoute();
const projectId = computed(() => route.params.projectId as string);
const roleOrder: UserRole[] = ["ADMIN", "PM", "CRA", "PV", "IMP", "QA"];
const loading = ref(false);
const saving = ref(false);
const project = ref<Study | null>(null);
const modules = ref<ProjectPermissionModule[]>([]);
const matrix = ref<ProjectPermissionMatrix>({} as ProjectPermissionMatrix);
const initialSnapshot = ref("");
const roleLabel = (role: UserRole) => displayEnum(TEXT.enums.userRole, role);
const adminModuleKeys = new Set(["project_members", "sites", "audit_export"]);
const isAdminModule = (moduleKey: string) => adminModuleKeys.has(moduleKey);
const canConfigureAdminModule = (role: UserRole, moduleKey: string) => !isAdminModule(moduleKey) || role === "PM" || role === "ADMIN";
const isWriteSupported = (mod: ProjectPermissionModule) => mod.writable !== false;
const findModule = (moduleKey: string) => modules.value.find((mod) => mod.key === moduleKey);
const isReadLocked = (role: UserRole, mod?: ProjectPermissionModule) => role === "ADMIN" || (mod ? !canConfigureAdminModule(role, mod.key) : false);
const isWriteLocked = (role: UserRole, mod: ProjectPermissionModule) => role === "ADMIN" || !isWriteSupported(mod) || !canConfigureAdminModule(role, mod.key);
const normalizeMatrix = (source: ProjectPermissionMatrix): ProjectPermissionMatrix => {
const normalized = {} as ProjectPermissionMatrix;
for (const role of roleOrder) {
normalized[role] = {};
for (const mod of modules.value) {
const item = source?.[role]?.[mod.key] || { read: false, write: false };
const canWrite = isWriteSupported(mod);
const canConfigure = canConfigureAdminModule(role, mod.key);
const write = role === "ADMIN" ? canWrite : canConfigure && canWrite ? !!item.write : false;
const read = role === "ADMIN" ? true : canConfigure && (!!item.read || write);
normalized[role][mod.key] = { read, write };
}
}
return normalized;
};
const snapshot = (source: ProjectPermissionMatrix) => JSON.stringify(normalizeMatrix(source));
const dirty = computed(() => snapshot(matrix.value) !== initialSnapshot.value);
const ensureCell = (role: UserRole, moduleKey: string): ProjectPermissionActionState => {
if (!matrix.value[role]) matrix.value[role] = {};
if (!matrix.value[role][moduleKey]) matrix.value[role][moduleKey] = { read: false, write: false };
return matrix.value[role][moduleKey];
};
const setPermission = (role: UserRole, moduleKey: string, action: "read" | "write", value: boolean) => {
const mod = findModule(moduleKey);
if (role === "ADMIN" || !mod || !canConfigureAdminModule(role, moduleKey) || (action === "write" && !isWriteSupported(mod))) return;
const cell = ensureCell(role, moduleKey);
cell[action] = value;
if (action === "write" && value) cell.read = true;
if (action === "read" && !value) cell.write = false;
};
const load = async () => {
if (!projectId.value) return;
loading.value = true;
try {
const [projectResp, permissionResp] = await Promise.all([
fetchStudyDetail(projectId.value),
fetchProjectRolePermissions(projectId.value),
]);
project.value = projectResp.data;
modules.value = permissionResp.data.modules;
matrix.value = normalizeMatrix(permissionResp.data.roles);
initialSnapshot.value = snapshot(matrix.value);
} catch (error: any) {
ElMessage.error(error?.response?.data?.detail || "加载权限失败");
} finally {
loading.value = false;
}
};
const save = async () => {
if (!projectId.value) return;
saving.value = true;
try {
const payload = { roles: normalizeMatrix(matrix.value) };
const { data } = await updateProjectRolePermissions(projectId.value, payload);
modules.value = data.modules;
matrix.value = normalizeMatrix(data.roles);
initialSnapshot.value = snapshot(matrix.value);
ElMessage.success("权限已保存");
} catch (error: any) {
ElMessage.error(error?.response?.data?.detail || "保存权限失败");
} finally {
saving.value = false;
}
};
onMounted(load);
</script>
<style scoped>
.permission-page {
display: flex;
flex-direction: column;
}
.permission-shell {
background: transparent;
}
.permission-header {
display: grid;
grid-template-columns: minmax(220px, 1fr) auto minmax(220px, 1fr);
align-items: center;
justify-content: space-between;
min-height: 52px;
padding-top: 10px;
padding-bottom: 10px;
}
.permission-title {
display: flex;
align-items: center;
gap: 10px;
}
.title-icon {
display: grid;
place-items: center;
width: 34px;
height: 34px;
border-radius: 8px;
color: #0f766e;
background: #e7f8f5;
border: 1px solid #b9ebe2;
}
.permission-title h2 {
margin: 0;
font-size: 18px;
line-height: 1.2;
color: #172033;
}
.permission-project-meta {
display: flex;
align-items: center;
gap: 14px;
max-width: min(720px, 48vw);
color: #172033;
white-space: nowrap;
justify-self: center;
}
.meta-item {
display: inline-flex;
align-items: center;
gap: 8px;
min-width: 0;
}
.meta-item--name strong {
overflow: hidden;
text-overflow: ellipsis;
}
.meta-label {
color: #64748b;
font-size: 12px;
font-weight: 600;
}
.meta-item strong {
min-width: 0;
font-size: 14px;
font-weight: 800;
}
.meta-separator {
width: 1px;
height: 18px;
background: #dbe3ee;
}
.permission-actions {
display: flex;
align-items: center;
gap: 8px;
margin-left: auto;
justify-content: flex-end;
justify-self: end;
}
.permission-actions :deep(.el-button) {
height: 30px;
padding: 0 12px;
font-size: 12px;
}
.permission-matrix {
padding: 0;
overflow: hidden;
}
.matrix-scroll {
overflow-x: auto;
}
.matrix-grid {
--module-count: 6;
display: grid;
grid-template-columns: 108px repeat(var(--module-count), minmax(82px, 1fr));
min-width: 1320px;
border-top: 1px solid #e6ebf2;
border-left: 1px solid #e6ebf2;
}
.matrix-head,
.role-cell,
.permission-cell {
border-right: 1px solid #e6ebf2;
border-bottom: 1px solid #e6ebf2;
background: #fff;
}
.matrix-head {
min-height: 46px;
padding: 8px 10px;
background: #f8fafc;
color: #334155;
font-weight: 700;
font-size: 13px;
}
.matrix-head.is-admin-module {
position: relative;
background: #fff7ed;
color: #9a3412;
}
.matrix-head.is-admin-module::before {
content: "";
position: absolute;
left: 0;
top: 0;
width: 100%;
height: 3px;
background: #f97316;
}
.matrix-role-head {
display: flex;
align-items: center;
}
.module-head {
display: flex;
flex-direction: column;
justify-content: center;
}
.role-cell {
display: flex;
align-items: center;
padding: 8px 10px;
}
.permission-cell {
display: flex;
flex-direction: column;
align-items: center;
justify-content: center;
gap: 6px;
padding: 7px 8px;
}
.permission-cell.is-admin-module {
background: #fffaf3;
}
.role-badge {
display: inline-flex;
align-items: center;
justify-content: center;
min-width: 68px;
padding: 4px 10px;
border-radius: 999px;
font-weight: 700;
font-size: 12px;
}
.role-badge--admin {
color: #1d4ed8;
background: #dbeafe;
}
.role-badge--pm {
color: #047857;
background: #d1fae5;
}
.role-badge--cra {
color: #7c3aed;
background: #ede9fe;
}
.role-badge--pv {
color: #be123c;
background: #ffe4e6;
}
.role-badge--imp {
color: #b45309;
background: #fef3c7;
}
.role-badge--qa {
color: #475569;
background: #e2e8f0;
}
.perm-check {
position: relative;
display: inline-flex;
align-items: center;
gap: 5px;
min-width: 48px;
color: #64748b;
font-weight: 700;
font-size: 12px;
cursor: pointer;
user-select: none;
}
.perm-check input {
position: absolute;
opacity: 0;
pointer-events: none;
}
.check-box {
width: 15px;
height: 15px;
border-radius: 5px;
border: 1.5px solid #cbd5e1;
background: #fff;
box-shadow: inset 0 0 0 1.5px #fff;
}
.perm-check.is-checked {
color: #1d4ed8;
}
.perm-check.is-checked .check-box {
border-color: #2563eb;
background: #2563eb;
}
.perm-check.is-checked .check-box::after {
content: "";
display: block;
width: 6px;
height: 3px;
margin: 3px auto 0;
border-left: 1.8px solid #fff;
border-bottom: 1.8px solid #fff;
transform: rotate(-45deg);
}
.perm-check.is-disabled {
cursor: not-allowed;
opacity: 0.58;
}
@media (max-width: 860px) {
.permission-header,
.permission-title,
.permission-actions {
align-items: stretch;
}
.permission-header {
flex-direction: column;
gap: 14px;
}
.permission-project-meta {
max-width: none;
white-space: normal;
}
.permission-actions {
margin-left: 0;
}
}
</style>
frontend/src/views/admin/Projects.vue
+27 -11
View File
@@ -30,12 +30,15 @@
<el-tag v-else type="success" effect="plain" round>未锁定</el-tag>
</template>
</el-table-column>
<el-table-column :label="TEXT.common.labels.actions" width="240" align="center">
<el-table-column :label="TEXT.common.labels.actions" width="176" align="center">
<template #default="scope">
<div class="action-row">
<el-tooltip :content="TEXT.modules.adminProjects.members" placement="top">
<el-button link type="primary" :icon="User" class="action-btn" @click="goMembers(scope.row)" />
</el-tooltip>
<el-tooltip content="权限管理" placement="top">
<el-button link type="primary" :icon="Key" class="action-btn" @click="goPermissions(scope.row)" />
</el-tooltip>
<el-tooltip :content="TEXT.modules.adminProjects.sites" placement="top">
<el-button link type="primary" :icon="OfficeBuilding" class="action-btn" @click="goSites(scope.row)" />
</el-tooltip>
@@ -68,7 +71,7 @@
import { onMounted, ref } from "vue";
import { useRouter } from "vue-router";
import { ElMessage, ElMessageBox } from "element-plus";
import { User, OfficeBuilding, ArrowRight, Delete, Lock } from "@element-plus/icons-vue";
import { User, OfficeBuilding, ArrowRight, Delete, Lock, Key } from "@element-plus/icons-vue";
import { fetchStudies, deleteStudy, lockStudy } from "../../api/studies";
import type { Study } from "../../types/api";
import ProjectForm from "./ProjectForm.vue";
@@ -108,6 +111,10 @@ const goSites = (row: Study) => {
router.push(`/admin/projects/${row.id}/sites`);
};
const goPermissions = (row: Study) => {
router.push(`/admin/projects/${row.id}/permissions`);
};
const handleDelete = async (study: Study) => {
try {
// 第一次确认
@@ -197,8 +204,9 @@ const handleLockToggle = async (study: Study) => {
}
};
const enterStudy = (row: Study) => {
const enterStudy = async (row: Study) => {
studyStore.setCurrentStudy(row);
await studyStore.loadCurrentStudyPermissions().catch(() => {});
router.push("/project/overview");
};
@@ -244,7 +252,8 @@ onMounted(() => {
.action-row {
display: inline-flex;
align-items: center;
gap: 10px;
gap: 4px;
justify-content: center;
white-space: nowrap;
}
@@ -263,20 +272,27 @@ onMounted(() => {
}
.action-btn {
font-size: 18px;
padding: 4px;
margin: 0 2px;
transition: all 0.3s;
width: 28px;
height: 28px;
min-height: 28px;
font-size: 16px;
padding: 0;
margin: 0;
border-radius: 4px;
transition: background-color 0.2s, color 0.2s, transform 0.2s;
}
.action-row :deep(.el-button + .el-button) {
margin-left: 0;
}
.action-btn:hover {
transform: scale(1.1);
transform: translateY(-1px);
background-color: #f3f4f6;
border-radius: 4px;
}
.enter-btn {
font-size: 18px;
font-size: 16px;
font-weight: bold;
}
</style>
frontend/src/views/ia/KnowledgeNotes.vue
+5 -1
View File
@@ -24,7 +24,7 @@
<el-button @click="resetFilters">{{ TEXT.common.actions.reset }}</el-button>
</div>
<div class="filter-spacer"></div>
<el-button type="primary" @click="goNew">
<el-button v-if="canWriteSharedLibrary" type="primary" @click="goNew">
{{ TEXT.modules.knowledgeNotes.newTitle }}
</el-button>
</el-form>
@@ -48,6 +48,7 @@
<el-table-column :label="TEXT.common.labels.actions" width="120">
<template #default="scope">
<el-button
v-if="canWriteSharedLibrary"
link
type="danger"
size="small"
@@ -75,10 +76,12 @@ import { useStudyStore } from "../../store/study";
import { listKnowledgeNotes, deleteKnowledgeNote } from "../../api/knowledgeNotes";
import { fetchSites } from "../../api/sites";
import { displayDateTime } from "../../utils/display";
import { usePermission } from "../../utils/permission";
import { TEXT } from "../../locales";
const router = useRouter();
const study = useStudyStore();
const { can } = usePermission();
const loading = ref(false);
const items = ref<any[]>([]);
const sites = ref<any[]>([]);
@@ -109,6 +112,7 @@ const filteredItems = computed(() => {
const sortedItems = computed(() =>
[...filteredItems.value].sort((a, b) => Number(isInactiveSite(a?.site_name)) - Number(isInactiveSite(b?.site_name)))
);
const canWriteSharedLibrary = computed(() => can("shared.library.write"));
const loadSites = async () => {
const studyId = study.currentStudy?.id;
frontend/src/views/knowledge/NoteDetail.vue
+5 -2
View File
@@ -38,11 +38,13 @@ import { useStudyStore } from "../../store/study";
import { getKnowledgeNote } from "../../api/knowledgeNotes";
import { fetchSites } from "../../api/sites";
import AttachmentList from "../../components/attachments/AttachmentList.vue";
import { usePermission } from "../../utils/permission";
import { TEXT } from "../../locales";
const route = useRoute();
const router = useRouter();
const study = useStudyStore();
const { can } = usePermission();
const loading = ref(false);
const noteId = route.params.noteId as string;
const studyId = study.currentStudy?.id || "";
@@ -62,7 +64,8 @@ const siteActiveMap = computed(() => {
});
return map;
});
const isReadOnly = computed(() => !!detail.site_name && siteActiveMap.value[detail.site_name] === false);
const canWriteSharedLibrary = computed(() => can("shared.library.write"));
const isReadOnly = computed(() => !canWriteSharedLibrary.value || (!!detail.site_name && siteActiveMap.value[detail.site_name] === false));
const loadSites = async () => {
if (!studyId) return;
@@ -89,7 +92,7 @@ const load = async () => {
const goEdit = () => {
if (isReadOnly.value) {
ElMessage.warning("中心已停用");
ElMessage.warning(canWriteSharedLibrary.value ? "中心已停用" : "权限不足");
return;
}
router.push(`/knowledge/notes/${noteId}/edit`);
frontend/src/views/knowledge/NoteForm.vue
+5 -2
View File
@@ -51,11 +51,13 @@ import { createKnowledgeNote, getKnowledgeNote, updateKnowledgeNote } from "../.
import { fetchSites } from "../../api/sites";
import AttachmentList from "../../components/attachments/AttachmentList.vue";
import StateEmpty from "../../components/StateEmpty.vue";
import { usePermission } from "../../utils/permission";
import { TEXT } from "../../locales";
const route = useRoute();
const router = useRouter();
const study = useStudyStore();
const { can } = usePermission();
const saving = ref(false);
const sites = ref<any[]>([]);
@@ -77,7 +79,8 @@ const siteActiveMap = computed(() => {
});
return map;
});
const isReadOnly = computed(() => isEdit.value && !!form.site_name && siteActiveMap.value[form.site_name] === false);
const canWriteSharedLibrary = computed(() => can("shared.library.write"));
const isReadOnly = computed(() => !canWriteSharedLibrary.value || (isEdit.value && !!form.site_name && siteActiveMap.value[form.site_name] === false));
const loadSites = async () => {
if (!studyId.value) return;
@@ -107,7 +110,7 @@ const load = async () => {
const submit = async () => {
if (!studyId.value) return;
if (isReadOnly.value) {
ElMessage.warning("中心已停用");
ElMessage.warning(canWriteSharedLibrary.value ? "中心已停用" : "权限不足");
return;
}
if (!form.site_name) {
frontend/src/views/workbench/MyWorkbench.test.ts
+6 -2
View File
@@ -14,7 +14,11 @@ describe("workbench project role context", () => {
expect(source).toContain("study.currentStudyRole");
expect(source).not.toContain('const role = computed(() => auth.user?.role || "")');
expect(source).not.toContain("role_in_study || auth.user?.role");
expect(source).toContain('projectRole.value === "PM"');
expect(source).toContain('projectRole.value === "CRA"');
expect(source).toContain('const isCraWorkbench = computed(() => projectRole.value === "CRA")');
expect(source).toContain("const craRequests = isCraWorkbench.value");
expect(source).not.toContain('projectRole.value === "PM"');
expect(source).not.toContain('projectRole.value === "PV"');
expect(source).toContain("quickActionCandidates");
expect(source).toContain("canAccessProjectPath(action.path)");
});
});
frontend/src/views/workbench/MyWorkbench.vue
+23 -24
View File
@@ -22,7 +22,7 @@
<template v-if="currentStudyId">
<!-- 汇总框 -->
<CenterSummary :data="centerSummaryData" :loading="loading" />
<CenterSummary v-if="isCraWorkbench" :data="centerSummaryData" :loading="loading" />
<!-- 核心看板层 -->
<div class="stats-row">
@@ -128,6 +128,7 @@ import { Right, Timer, Warning, Money, Collection, RefreshRight, ArrowRight } fr
import StateEmpty from "../../components/StateEmpty.vue";
import { displayEnum } from "../../utils/display";
import { getProjectRole, isSystemAdmin } from "../../utils/roles";
import { getProjectRoutePermission, hasProjectPermission } from "../../utils/projectRoutePermissions";
import { TEXT } from "../../locales";
import type { NotificationItem } from "../../types/notifications";
import type { VisitLostItem } from "../../types/visits";
@@ -161,25 +162,23 @@ const projectRole = computed(() => {
});
const roleLabel = computed(() => displayEnum(TEXT.enums.userRole, projectRole.value));
const emptyText = TEXT.modules.workbench.quickEmpty;
const isCraWorkbench = computed(() => projectRole.value === "CRA");
const canAccessProjectPath = (path: string) =>
hasProjectPermission(study.currentPermissions?.roles, projectRole.value, getProjectRoutePermission(path), isSystemAdmin(auth.user));
const quickActionCandidates = [
{ label: TEXT.modules.workbench.feasibilityEthics, path: "/startup/feasibility-ethics", icon: Timer },
{ label: TEXT.modules.workbench.aeList, path: "/subjects", icon: Warning },
{ label: TEXT.modules.workbench.contractList, path: "/finance/contracts", icon: Money },
{ label: TEXT.modules.workbench.medicalConsult, path: "/knowledge/medical-consult", icon: Collection },
];
const quickActions = computed(() => {
if (!currentStudyId.value) return [];
if (projectRole.value === "CRA")
return [
{ label: TEXT.modules.workbench.feasibilityEthics, path: "/startup/feasibility-ethics", icon: Timer },
{ label: TEXT.modules.workbench.aeList, path: "/subjects", icon: Warning },
];
if (projectRole.value === "PM")
return [
{ label: TEXT.modules.workbench.feasibilityEthics, path: "/startup/feasibility-ethics", icon: Timer },
{ label: TEXT.modules.workbench.contractList, path: "/finance/contracts", icon: Money },
{ label: TEXT.modules.workbench.medicalConsult, path: "/knowledge/medical-consult", icon: Collection },
];
if (projectRole.value === "PV") return [{ label: TEXT.modules.workbench.aeList, path: "/subjects", icon: Warning }];
return [{ label: TEXT.modules.workbench.feasibilityEthics, path: "/startup/feasibility-ethics", icon: Timer }];
return quickActionCandidates.filter((action) => canAccessProjectPath(action.path));
});
const todayMorePath = computed(() => "/subjects");
const overdueMorePath = computed(() => "/subjects");
const canReadRiskIssues = computed(() => canAccessProjectPath("/risk-issues/sae"));
const isOverdue = (d?: string | null) => {
if (!d) return false;
@@ -207,14 +206,17 @@ const loadData = async () => {
loading.value = true;
try {
const studyId = currentStudyId.value;
const aesReq = fetchAes(studyId, { status: "NEW", limit: 50 });
const overdueReq = fetchAes(studyId, { overdue: true, limit: 50 });
const shouldLoadAes = canReadRiskIssues.value;
const craRequests = isCraWorkbench.value;
const emptyListResponse = { data: { items: [] } } as any;
const aesReq = shouldLoadAes ? fetchAes(studyId, { status: "NEW", limit: 50 }) : Promise.resolve(emptyListResponse);
const overdueReq = shouldLoadAes ? fetchAes(studyId, { overdue: true, limit: 50 }) : Promise.resolve(emptyListResponse);
const [aesRes, overdueRes, noticeRes, lostRes, centerRes] = await Promise.allSettled([
aesReq,
overdueReq,
listNotifications(studyId, { limit: 5 }),
fetchLostVisits(studyId, { limit: 20 }),
fetchCenterSummary(studyId),
craRequests ? fetchLostVisits(studyId, { limit: 20 }) : Promise.resolve({ data: [] }),
craRequests ? fetchCenterSummary(studyId) : Promise.resolve({ data: [] }),
]);
const aes = aesRes.status === "fulfilled" ? (aesRes.value.data.items || aesRes.value.data || []) : [];
const overdueAes = overdueRes.status === "fulfilled" ? (overdueRes.value.data.items || overdueRes.value.data || []) : [];
@@ -237,16 +239,13 @@ const buildSections = (aes: any[], overdueAes: any[], lost: VisitLostItem[]) =>
const openAes = aes.filter((a) => a.status !== "CLOSED");
const lostVisitItems = lost.map(toLostVisitItem);
if (projectRole.value === "CRA") {
if (isCraWorkbench.value) {
todayList.value = openAes.slice(0, 5).map(toAeItem);
overdueList.value = [...lostVisitItems, ...overdueAes.map(toAeItem)].slice(0, 5);
} else if (projectRole.value === "PM" || projectRole.value === "ADMIN") {
todayList.value = openAes.slice(0, 5).map(toAeItem);
overdueList.value = [...lostVisitItems, ...overdueAes.map(toAeItem)].slice(0, 5);
} else if (projectRole.value === "PV") {
} else if (canReadRiskIssues.value) {
const aeOpen = aes.filter((a) => a.status !== "CLOSED");
todayList.value = aeOpen.slice(0, 5).map(toAeItem);
overdueList.value = [...lostVisitItems, ...overdueAes.map(toAeItem)].slice(0, 5);
overdueList.value = overdueAes.map(toAeItem).slice(0, 5);
}
};