权限管理：接入项目级权限矩阵

新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。
2026-05-13 08:58:03 +08:00
parent 77e842637d
commit 939fc70532
63 changed files with 1952 additions and 387 deletions
@@ -0,0 +1,57 @@
+"""add study role permissions
+
+Revision ID: 20260512_03
+Revises: 20260512_02
+Create Date: 2026-05-12 10:45:00.000000
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+
+revision: str = "20260512_03"
+down_revision: Union[str, None] = "20260512_02"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def _table_exists(inspector: sa.Inspector, table_name: str) -> bool:
+    return table_name in inspector.get_table_names()
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if _table_exists(inspector, "study_role_permissions"):
+        return
+
+    op.create_table(
+        "study_role_permissions",
+        sa.Column("id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("study_id", postgresql.UUID(as_uuid=True), nullable=False),
+        sa.Column("role", sa.String(length=20), nullable=False),
+        sa.Column("module", sa.String(length=80), nullable=False),
+        sa.Column("can_read", sa.Boolean(), server_default="false", nullable=False),
+        sa.Column("can_write", sa.Boolean(), server_default="false", nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.ForeignKeyConstraint(["study_id"], ["studies.id"]),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("study_id", "role", "module", name="uq_study_role_permissions_study_role_module"),
+    )
+    op.create_index("ix_study_role_permissions_study_id", "study_role_permissions", ["study_id"])
+    op.create_index("ix_study_role_permissions_role", "study_role_permissions", ["role"])
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    inspector = sa.inspect(bind)
+    if not _table_exists(inspector, "study_role_permissions"):
+        return
+
+    op.drop_index("ix_study_role_permissions_role", table_name="study_role_permissions")
+    op.drop_index("ix_study_role_permissions_study_id", table_name="study_role_permissions")
+    op.drop_table("study_role_permissions")