zhouchengcheng/ctms
1
1
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

权限管理：接入项目级权限矩阵

Browse Source 
新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。

后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。

前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。

补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。
This commit is contained in:
Cheng Zhou
2026-05-13 08:58:03 +08:00
parent 77e842637d
commit 939fc70532
63 changed files with 1952 additions and 387 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/api/v1/aes.py
+6 -33
View File
@@ -5,7 +5,7 @@ from datetime import date
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import ae as ae_crud
from app.crud import audit as audit_crud
from app.crud import member as member_crud
@@ -16,9 +16,6 @@ from app.schemas.ae import AECreate, AERead, AEUpdate
router = APIRouter()
ALLOWED_CREATE_ROLES = {"PM", "CRA", "PV"}
ALLOWED_UPDATE_ROLES = {"PM", "PV", "CRA"}
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
study = await study_crud.get(db, study_id)
@@ -43,11 +40,6 @@ async def _ensure_ae_visible(db: AsyncSession, study_id: uuid.UUID, ae: AERead |
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
async def _get_member_role(db: AsyncSession, study_id: uuid.UUID, user_id: uuid.UUID) -> str | None:
member = await member_crud.get_member(db, study_id, user_id)
return member.role_in_study if member else None
def _is_overdue(ae: AERead) -> bool:
return bool(ae.report_due_date and date.today() > ae.report_due_date and ae.status != "CLOSED")
@@ -56,7 +48,7 @@ def _is_overdue(ae: AERead) -> bool:
"/",
response_model=AERead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def create_ae(
study_id: uuid.UUID,
@@ -75,9 +67,6 @@ async def create_ae(
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if ae_in.onset_date and ae_in.onset_date > date.today():
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="发生日期不能晚于今天")
member_role = await _get_member_role(db, study_id, current_user.id)
if current_user.role != "ADMIN" and member_role not in ALLOWED_CREATE_ROLES:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
try:
ae = await ae_crud.create_ae(db, study_id, ae_in, created_by=current_user.id)
except ValueError as exc:
@@ -100,7 +89,7 @@ async def create_ae(
@router.get(
"/",
response_model=list[AERead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("risk_issues", "read"))],
)
async def list_ae(
study_id: uuid.UUID,
@@ -138,7 +127,7 @@ async def list_ae(
@router.get(
"/{ae_id}",
response_model=AERead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("risk_issues", "read"))],
)
async def get_ae(
study_id: uuid.UUID,
@@ -166,7 +155,7 @@ async def get_ae(
@router.patch(
"/{ae_id}",
response_model=AERead,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def update_ae(
study_id: uuid.UUID,
@@ -183,19 +172,6 @@ async def update_ae(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
await _ensure_ae_visible(db, study_id, AERead.model_validate(ae))
member_role = await _get_member_role(db, study_id, current_user.id)
if current_user.role == "ADMIN":
pass
elif member_role in ALLOWED_UPDATE_ROLES:
pass
elif member_role == "CRA":
if ae.created_by != current_user.id:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="仅创建人可更新 AE")
if ae_in.status == "CLOSED":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="CRA 无法关闭 AE")
else:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
old_status = ae.status
detail_before = {
"event": ae.term,
@@ -234,7 +210,7 @@ async def update_ae(
@router.delete(
"/{ae_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def delete_ae(
study_id: uuid.UUID,
@@ -247,9 +223,6 @@ async def delete_ae(
if not ae or ae.study_id != study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="AE 不存在")
await _ensure_ae_visible(db, study_id, AERead.model_validate(ae))
member_role = await _get_member_role(db, study_id, current_user.id)
if current_user.role != "ADMIN" and member_role not in {"PM", "PV"}:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
await ae_crud.delete_ae(db, ae)
await audit_crud.log_action(
db,
backend/app/api/v1/attachments.py
+79 -9
View File
@@ -8,7 +8,8 @@ from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status,
from fastapi.responses import FileResponse
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, get_study_member, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, get_study_member, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.crud import attachment as attachment_crud
from app.crud import audit as audit_crud
from app.crud import study as study_crud
@@ -22,6 +23,9 @@ router = APIRouter()
global_router = APIRouter()
UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
ATTACHMENT_PERMISSION_MODULE_BY_ENTITY = {
"knowledge_note": "shared_library",
}
def _content_disposition(filename: str, disposition: str = "inline") -> str:
@@ -37,11 +41,39 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
return study
def _permission_module_for_entity(entity_type: str) -> str:
return ATTACHMENT_PERMISSION_MODULE_BY_ENTITY.get(entity_type, "file_versions")
async def _ensure_attachment_permission(
db: AsyncSession,
study_id: uuid.UUID,
current_user,
entity_type: str,
action: str,
) -> None:
role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
if role_value == "ADMIN":
return
membership = await member_crud.get_member(db, study_id, current_user.id)
if not membership or not membership.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
allowed = await role_has_project_permission(
db,
study_id,
membership.role_in_study,
_permission_module_for_entity(entity_type),
action,
)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
@router.post(
"/",
response_model=AttachmentRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_not_locked())],
)
async def upload_attachment(
study_id: uuid.UUID,
@@ -52,6 +84,7 @@ async def upload_attachment(
current_user=Depends(get_current_user),
) -> AttachmentRead:
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "write")
dest_dir = UPLOAD_ROOT / f"study_{study_id}" / f"{entity_type}_{entity_id}"
dest_dir.mkdir(parents=True, exist_ok=True)
unique_name = f"{uuid.uuid4()}{Path(file.filename).suffix}"
@@ -96,15 +129,16 @@ async def upload_attachment(
@router.get(
"/",
response_model=list[AttachmentRead],
dependencies=[Depends(require_study_member())],
)
async def list_attachments(
study_id: uuid.UUID,
entity_type: str,
entity_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> list[AttachmentRead]:
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
attachments = await attachment_crud.list_attachments(db, study_id, entity_type, entity_id)
user_ids = {a.uploaded_by for a in attachments if a.uploaded_by}
users_map = await user_crud.get_users_by_ids(db, user_ids)
@@ -127,7 +161,6 @@ async def list_attachments(
@router.get(
"/{attachment_id}/download",
dependencies=[Depends(require_study_member())],
)
async def download_attachment(
study_id: uuid.UUID,
@@ -135,8 +168,10 @@ async def download_attachment(
entity_id: uuid.UUID,
attachment_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> FileResponse:
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
attachment = await attachment_crud.get_attachment(db, attachment_id)
if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -152,7 +187,6 @@ async def download_attachment(
@router.get(
"/{attachment_id}/preview",
dependencies=[Depends(require_study_member())],
)
async def preview_attachment(
study_id: uuid.UUID,
@@ -160,8 +194,10 @@ async def preview_attachment(
entity_id: uuid.UUID,
attachment_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> FileResponse:
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "read")
attachment = await attachment_crud.get_attachment(db, attachment_id)
if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
@@ -210,6 +246,19 @@ async def global_download_attachment(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
await _ensure_study_exists(db, attachment.study_id)
user, _ = await _authorize_global(request, db, attachment.study_id)
membership = None
if user.role != "ADMIN":
membership = await get_study_member(attachment.study_id, current_user=user, db=db)
if user.role != "ADMIN":
allowed = await role_has_project_permission(
db,
attachment.study_id,
membership.role_in_study if membership else None,
_permission_module_for_entity(attachment.entity_type),
"read",
)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if not os.path.exists(attachment.file_path):
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
return FileResponse(
@@ -233,7 +282,17 @@ async def global_preview_attachment(
if not attachment:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
await _ensure_study_exists(db, attachment.study_id)
await _authorize_global(request, db, attachment.study_id)
user, membership = await _authorize_global(request, db, attachment.study_id)
if user.role != "ADMIN":
allowed = await role_has_project_permission(
db,
attachment.study_id,
membership.role_in_study if membership else None,
_permission_module_for_entity(attachment.entity_type),
"read",
)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if not os.path.exists(attachment.file_path):
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
return FileResponse(
@@ -258,10 +317,20 @@ async def global_delete_attachment(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
await _ensure_study_exists(db, attachment.study_id)
user, membership = await _authorize_global(request, db, attachment.study_id)
if user.role != "ADMIN":
allowed = await role_has_project_permission(
db,
attachment.study_id,
membership.role_in_study if membership else None,
_permission_module_for_entity(attachment.entity_type),
"write",
)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
can_delete = (
user.role == "ADMIN"
or attachment.uploaded_by == user.id
or (membership and getattr(membership, "role_in_study", None) == "PM")
or membership is not None
)
if not can_delete:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
@@ -281,7 +350,7 @@ async def global_delete_attachment(
@router.delete(
"/{attachment_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member()), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_not_locked())],
)
async def delete_attachment(
study_id: uuid.UUID,
@@ -292,6 +361,7 @@ async def delete_attachment(
current_user=Depends(get_current_user),
):
await _ensure_study_exists(db, study_id)
await _ensure_attachment_permission(db, study_id, current_user, entity_type, "write")
attachment = await attachment_crud.get_attachment(db, attachment_id)
if (
not attachment
@@ -309,7 +379,7 @@ async def delete_attachment(
can_delete = (
current_user.role == "ADMIN"
or attachment.uploaded_by == current_user.id
or (membership and getattr(membership, "role_in_study", None) == "PM")
or membership is not None
)
if not can_delete:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
backend/app/api/v1/audit_logs.py
+2 -2
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member
from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member, require_study_permission
from app.crud import audit as audit_crud
from app.schemas.audit import AuditEventCreate, AuditLogRead
@@ -13,7 +13,7 @@ router = APIRouter()
@router.get(
"/",
response_model=list[AuditLogRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("audit_export", "read"))],
)
async def list_audit_logs(
study_id: uuid.UUID,
backend/app/api/v1/dashboard.py
+8 -4
View File
@@ -4,6 +4,7 @@ from sqlalchemy import func, select
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member
from app.core.project_permissions import role_has_project_permission
from app.crud import member as member_crud
from app.models.milestone import Milestone
from app.schemas.progress import StudyProgressRead
@@ -74,12 +75,15 @@ async def get_center_summary(
current_user=Depends(get_current_user),
) -> list[CenterSummaryItem]:
role_value = _role_value(current_user)
member_role = None
membership = None
if role_value != "ADMIN":
membership = await member_crud.get_member(db, study_id, current_user.id)
member_role = membership.role_in_study if membership and membership.is_active else None
if role_value != "ADMIN" and member_role not in {"PM", "CRA"}:
return []
if not membership or not membership.is_active:
return []
can_read_sites = await role_has_project_permission(db, study_id, membership.role_in_study, "sites", "read")
can_read_subjects = await role_has_project_permission(db, study_id, membership.role_in_study, "subjects", "read")
if not (can_read_sites or can_read_subjects):
return []
cra_scope = await get_cra_site_scope(db, study_id, current_user)
scope_ids = cra_scope[0] if cra_scope else None
scope_id_strs = {str(cid) for cid in scope_ids} if scope_ids is not None else None
backend/app/api/v1/drug_shipments.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import drug_shipment as shipment_crud
from app.crud import site as site_crud
@@ -33,7 +33,7 @@ async def _ensure_center_active(db: AsyncSession, study_id: uuid.UUID, center_id
"/shipments",
response_model=DrugShipmentRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def create_shipment(
study_id: uuid.UUID,
@@ -64,7 +64,7 @@ async def create_shipment(
@router.get(
"/shipments",
response_model=list[DrugShipmentRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("materials", "read"))],
)
async def list_shipments(
study_id: uuid.UUID,
@@ -101,7 +101,7 @@ async def list_shipments(
@router.get(
"/shipments/{shipment_id}",
response_model=DrugShipmentRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("materials", "read"))],
)
async def get_shipment(
study_id: uuid.UUID,
@@ -122,7 +122,7 @@ async def get_shipment(
@router.patch(
"/shipments/{shipment_id}",
response_model=DrugShipmentRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def update_shipment(
study_id: uuid.UUID,
@@ -160,7 +160,7 @@ async def update_shipment(
@router.delete(
"/shipments/{shipment_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def delete_shipment(
study_id: uuid.UUID,
backend/app/api/v1/faq_categories.py
+25 -23
View File
@@ -4,6 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.crud import audit as audit_crud
from app.crud import faq_category as category_crud
from app.crud import faq_item as item_crud
@@ -15,9 +16,21 @@ from app.utils.pagination import paginate
router = APIRouter()
def _check_permission_for_scope(study_id: uuid.UUID, current_user, member_role: str | None):
if current_user.role != "ADMIN" and member_role != "PM":
def _is_system_admin(current_user) -> bool:
role = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
return role == "ADMIN"
async def _require_category_permission(db: AsyncSession, study_id: uuid.UUID, current_user, action: str):
if _is_system_admin(current_user):
return None
member = await member_crud.get_member(db, study_id, current_user.id)
if not member or not member.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
allowed = await role_has_project_permission(db, study_id, member.role_in_study, "faq", action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
return member
@router.post(
@@ -25,7 +38,7 @@ def _check_permission_for_scope(study_id: uuid.UUID, current_user, member_role:
response_model=CategoryRead,
status_code=status.HTTP_201_CREATED,
summary="创建 FAQ 分类",
description="创建全局或项目内 FAQ 分类，项目 PM/ADMIN 可用，全局仅 ADMIN。",
description="创建项目内 FAQ 分类，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def create_category(
@@ -38,12 +51,7 @@ async def create_category(
existing = await category_crud.get_category_by_name(db, payload.study_id, payload.name)
if existing:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类名称已存在")
member_role = None
member = await member_crud.get_member(db, payload.study_id, current_user.id)
if not member and current_user.role != "ADMIN":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
member_role = member.role_in_study if member else None
_check_permission_for_scope(payload.study_id, current_user, member_role)
await _require_category_permission(db, payload.study_id, current_user, "write")
category = await category_crud.create_category(db, payload)
await audit_crud.log_action(
db,
@@ -73,9 +81,7 @@ async def list_categories(
if not study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
if study_id:
member = await member_crud.get_member(db, study_id, current_user.id)
if not member and current_user.role != "ADMIN":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
await _require_category_permission(db, study_id, current_user, "read")
categories = await category_crud.list_categories(db, study_id, include_global=False, is_active=is_active)
return paginate([CategoryRead.model_validate(c) for c in categories], total=len(categories))
@@ -84,7 +90,7 @@ async def list_categories(
"/{category_id}",
response_model=CategoryRead,
summary="更新 FAQ 分类",
description="更新分类名称或启停状态，项目 PM/ADMIN 或全局 ADMIN。",
description="更新分类名称或启停状态，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def update_category(
@@ -96,22 +102,17 @@ async def update_category(
category = await category_crud.get_category(db, category_id)
if not category:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="分类不存在")
member_role = None
update_data = payload.model_dump(exclude_unset=True)
target_study_id = update_data.get("study_id", category.study_id)
target_name = update_data.get("name", category.name)
if "study_id" in update_data and update_data["study_id"] != category.study_id and current_user.role != "ADMIN":
if "study_id" in update_data and update_data["study_id"] != category.study_id and not _is_system_admin(current_user):
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="仅管理员可修改分类范围")
existing = await category_crud.get_category_by_name(db, target_study_id, target_name)
if existing and existing.id != category.id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类名称已存在")
if not target_study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
member = await member_crud.get_member(db, target_study_id, current_user.id)
member_role = member.role_in_study if member else None
if not member and current_user.role != "ADMIN":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
_check_permission_for_scope(target_study_id, current_user, member_role)
await _require_category_permission(db, target_study_id, current_user, "write")
updated = await category_crud.update_category(db, category, payload)
await audit_crud.log_action(
db,
@@ -130,7 +131,7 @@ async def update_category(
"/{category_id}",
status_code=status.HTTP_204_NO_CONTENT,
summary="删除 FAQ 分类",
description="仅 ADMIN 可删除分类，分类下存在 FAQ 时不可删除。",
description="删除分类，权限由项目级权限矩阵控制；分类下存在 FAQ 时不可删除。",
dependencies=[Depends(require_study_not_locked())],
)
async def delete_category(
@@ -141,8 +142,9 @@ async def delete_category(
category = await category_crud.get_category(db, category_id)
if not category:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="分类不存在")
if current_user.role != "ADMIN":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="仅管理员可删除 FAQ 分类")
if not category.study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
await _require_category_permission(db, category.study_id, current_user, "write")
item_count = await item_crud.count_items_by_category(db, category_id)
if item_count > 0:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类下存在 FAQ，无法删除")
backend/app/api/v1/faqs.py
+52 -77
View File
@@ -4,6 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.crud import audit as audit_crud
from app.crud import faq_category as category_crud
from app.crud import faq_item as faq_crud
@@ -25,14 +26,28 @@ from app.utils.pagination import paginate
router = APIRouter()
def _check_write_permission(study_id: uuid.UUID, current_user, member_role: str | None):
if current_user.role != "ADMIN" and member_role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
def _is_system_admin(current_user) -> bool:
role = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
return role == "ADMIN"
def _check_create_permission(current_user, is_member: bool):
if current_user.role != "ADMIN" and not is_member:
async def _require_project_permission(
db: AsyncSession,
study_id: uuid.UUID | None,
current_user,
action: str,
):
if not study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if _is_system_admin(current_user):
return None
member = await member_crud.get_member(db, study_id, current_user.id)
if not member or not member.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
allowed = await role_has_project_permission(db, study_id, member.role_in_study, "faq", action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
return member
@router.post(
@@ -40,7 +55,7 @@ def _check_create_permission(current_user, is_member: bool):
response_model=FaqRead,
status_code=status.HTTP_201_CREATED,
summary="创建 FAQ",
description="创建全局或项目内 FAQ，项目 FAQ 需项目 PM/ADMIN 权限。",
description="创建项目内 FAQ，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def create_faq(
@@ -55,12 +70,7 @@ async def create_faq(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="分类不存在")
if cat.study_id != payload.study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="分类范围不匹配")
member_role = None
is_member = False
member = await member_crud.get_member(db, payload.study_id, current_user.id)
member_role = member.role_in_study if member else None
is_member = member is not None
_check_create_permission(current_user, is_member)
await _require_project_permission(db, payload.study_id, current_user, "write")
try:
item = await faq_crud.create_item(db, payload, created_by=current_user.id)
except ValueError as exc:
@@ -106,22 +116,14 @@ async def list_faqs(
async def _get_member_role(sid: uuid.UUID) -> str | None:
if sid in membership_cache:
return membership_cache[sid]
member = await member_crud.get_member(db, sid, current_user.id)
role = member.role_in_study if member else None
member = await _require_project_permission(db, sid, current_user, "read")
role = member.role_in_study if member else "ADMIN"
membership_cache[sid] = role
return role
if not study_id:
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="必须提供项目 ID")
if current_user.role != "ADMIN":
role = await _get_member_role(study_id)
if not role:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
if is_active is False and current_user.role != "ADMIN":
role = await _get_member_role(study_id)
if role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
await _require_project_permission(db, study_id, current_user, "write" if is_active is False else "read")
items = await faq_crud.list_items(
db,
@@ -134,13 +136,13 @@ async def list_faqs(
visible: list[FaqRead] = []
for it in items:
if current_user.role != "ADMIN":
if not _is_system_admin(current_user):
role = await _get_member_role(it.study_id)
if not role:
continue
if not it.is_active and current_user.role != "ADMIN":
role = await _get_member_role(it.study_id)
if role != "PM":
if not it.is_active and not _is_system_admin(current_user):
allowed = await role_has_project_permission(db, it.study_id, role, "faq", "write")
if not allowed:
continue
visible.append(FaqRead.model_validate(it))
return paginate(visible, total=len(visible))
@@ -150,7 +152,7 @@ async def list_faqs(
"/{item_id}",
response_model=FaqRead,
summary="FAQ 详情",
description="获取单条 FAQ，非 PM 不能查看停用 FAQ。",
description="获取单条 FAQ，停用 FAQ 需项目级写权限。",
)
async def get_faq(
item_id: uuid.UUID,
@@ -162,15 +164,7 @@ async def get_faq(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if not item.study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if current_user.role != "ADMIN":
member = await member_crud.get_member(db, item.study_id, current_user.id)
if not member:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
if not item.is_active and current_user.role not in {"ADMIN"}:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
if member_role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="FAQ 已停用")
await _require_project_permission(db, item.study_id, current_user, "write" if not item.is_active else "read")
return FaqRead.model_validate(item)
@@ -178,7 +172,7 @@ async def get_faq(
"/{item_id}",
response_model=FaqRead,
summary="更新 FAQ",
description="更新 FAQ 内容或启停状态，项目内需 PM/ADMIN 权限。",
description="更新 FAQ 内容或启停状态，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def update_faq(
@@ -191,11 +185,9 @@ async def update_faq(
if not item:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if item.created_by != current_user.id:
member_role = None
if item.study_id:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
_check_write_permission(item.study_id, current_user, member_role)
await _require_project_permission(db, item.study_id, current_user, "write")
else:
await _require_project_permission(db, item.study_id, current_user, "write")
old_active = item.is_active
updated = await faq_crud.update_item(db, item, payload)
action = "UPDATE_FAQ_ITEM"
@@ -220,7 +212,7 @@ async def update_faq(
"/{item_id}/status",
response_model=FaqRead,
summary="更新 FAQ 状态",
description="提问者或项目 PM/ADMIN 可确认已解决。",
description="提问者或具备项目级写权限的成员可确认已解决。",
dependencies=[Depends(require_study_not_locked())],
)
async def update_faq_status(
@@ -234,13 +226,10 @@ async def update_faq_status(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if payload.status != "RESOLVED":
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="仅允许设置为已解决")
if item.created_by != current_user.id and current_user.role != "ADMIN":
member_role = None
if item.study_id:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
if member_role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if item.created_by != current_user.id:
await _require_project_permission(db, item.study_id, current_user, "write")
else:
await _require_project_permission(db, item.study_id, current_user, "read")
await faq_crud.set_status(db, item.id, "RESOLVED", resolved_by_confirm=True)
updated = await faq_crud.get_item(db, item_id)
return FaqRead.model_validate(updated)
@@ -264,10 +253,7 @@ async def set_best_reply(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if not item.study_id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
is_member = False
member = await member_crud.get_member(db, item.study_id, current_user.id)
is_member = member is not None
_check_create_permission(current_user, is_member)
await _require_project_permission(db, item.study_id, current_user, "write")
if payload.best_reply_id:
reply = await reply_crud.get_reply(db, payload.best_reply_id)
if not reply or reply.faq_id != item.id:
@@ -304,10 +290,7 @@ async def list_replies(
item = await faq_crud.get_item(db, item_id)
if not item:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if item.study_id and current_user.role != "ADMIN":
member = await member_crud.get_member(db, item.study_id, current_user.id)
if not member:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是该项目成员")
await _require_project_permission(db, item.study_id, current_user, "read")
replies = await reply_crud.list_replies(db, item_id)
reply_map = {r.id: r for r in replies}
result: list[FaqReplyRead] = []
@@ -349,10 +332,7 @@ async def create_reply(
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if not payload.content.strip():
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="回复内容不能为空")
is_member = False
member = await member_crud.get_member(db, item.study_id, current_user.id)
is_member = member is not None
_check_create_permission(current_user, is_member)
await _require_project_permission(db, item.study_id, current_user, "write")
quote = None
if payload.quote_reply_id:
quote = await reply_crud.get_reply(db, payload.quote_reply_id)
@@ -396,7 +376,7 @@ async def create_reply(
"/{item_id}",
status_code=status.HTTP_204_NO_CONTENT,
summary="删除 FAQ",
description="删除 FAQ，项目内需 PM/ADMIN 权限，全局仅 ADMIN。",
description="删除 FAQ，权限由项目级权限矩阵控制。",
dependencies=[Depends(require_study_not_locked())],
)
async def delete_faq(
@@ -408,11 +388,9 @@ async def delete_faq(
if not item:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ 不存在")
if item.created_by != current_user.id:
member_role = None
if item.study_id:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
_check_write_permission(item.study_id, current_user, member_role)
await _require_project_permission(db, item.study_id, current_user, "write")
else:
await _require_project_permission(db, item.study_id, current_user, "write")
await reply_crud.delete_replies_by_faq_id(db, item.id)
await db.delete(item)
await db.commit()
@@ -432,7 +410,7 @@ async def delete_faq(
"/{item_id}/replies/{reply_id}",
status_code=status.HTTP_204_NO_CONTENT,
summary="删除 FAQ 回复",
description="删除 FAQ 回复，管理员、项目 PM 或回复者可删除。",
description="删除 FAQ 回复，回复者或具备项目级写权限的成员可删除。",
dependencies=[Depends(require_study_not_locked())],
)
async def delete_reply(
@@ -447,13 +425,10 @@ async def delete_reply(
reply = await reply_crud.get_reply(db, reply_id)
if not reply or reply.faq_id != item.id:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="回复不存在")
if reply.created_by != current_user.id and current_user.role != "ADMIN":
member_role = None
if item.study_id:
member = await member_crud.get_member(db, item.study_id, current_user.id)
member_role = member.role_in_study if member else None
if member_role != "PM":
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
if reply.created_by != current_user.id:
await _require_project_permission(db, item.study_id, current_user, "write")
else:
await _require_project_permission(db, item.study_id, current_user, "read")
if item.best_reply_id == reply.id:
await faq_crud.set_best_reply(db, item.id, None)
ref_count = await reply_crud.count_quote_references(db, reply.id)
backend/app/api/v1/fees_attachments.py
+5 -2
View File
@@ -8,6 +8,7 @@ from fastapi.responses import FileResponse
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.core.security import decode_token
from app.crud import audit as audit_crud
from app.crud import contract_fee as contract_fee_crud
@@ -54,7 +55,9 @@ async def _ensure_project_access(db: AsyncSession, project_id: uuid.UUID, curren
membership = await member_crud.get_member(db, project_id, current_user.id)
if not membership or not membership.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
if write and membership.role_in_study not in {"ADMIN", "PM"}:
action = "write" if write else "read"
allowed = await role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
return membership
@@ -230,7 +233,7 @@ async def delete_fee_attachment(
can_delete = (
role_value == "ADMIN"
or attachment.uploaded_by == current_user.id
or (membership and getattr(membership, "role_in_study", None) == "PM")
or membership is not None
)
if not can_delete:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
backend/app/api/v1/fees_contracts.py
+4 -1
View File
@@ -7,6 +7,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked
from app.core.project_permissions import role_has_project_permission
from app.crud import audit as audit_crud
from app.crud import contract_fee as contract_fee_crud
from app.crud import contract_fee_payment as payment_crud
@@ -38,7 +39,9 @@ async def _ensure_project_access(db: AsyncSession, project_id: uuid.UUID, curren
membership = await member_crud.get_member(db, project_id, current_user.id)
if not membership or not membership.is_active:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
if write and membership.role_in_study not in {"ADMIN", "PM"}:
action = "write" if write else "read"
allowed = await role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)
if not allowed:
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
return membership
backend/app/api/v1/finance_contracts.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import finance_contract as contract_crud
from app.crud import site as site_crud
@@ -32,7 +32,7 @@ async def _ensure_site_name_active(db: AsyncSession, study_id: uuid.UUID, site_n
"/contracts",
response_model=FinanceContractRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("fees", "write"))],
)
async def create_contract(
study_id: uuid.UUID,
@@ -62,7 +62,7 @@ async def create_contract(
@router.get(
"/contracts",
response_model=list[FinanceContractRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("fees", "read"))],
)
async def list_contracts(
study_id: uuid.UUID,
@@ -93,7 +93,7 @@ async def list_contracts(
@router.get(
"/contracts/{contract_id}",
response_model=FinanceContractRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("fees", "read"))],
)
async def get_contract(
study_id: uuid.UUID,
@@ -114,7 +114,7 @@ async def get_contract(
@router.patch(
"/contracts/{contract_id}",
response_model=FinanceContractRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("fees", "write"))],
)
async def update_contract(
study_id: uuid.UUID,
@@ -148,7 +148,7 @@ async def update_contract(
@router.delete(
"/contracts/{contract_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("fees", "write"))],
)
async def delete_contract(
study_id: uuid.UUID,
backend/app/api/v1/knowledge_notes.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import knowledge_note as note_crud
from app.crud import site as site_crud
@@ -32,7 +32,7 @@ async def _ensure_site_name_active(db: AsyncSession, study_id: uuid.UUID, site_n
"/notes",
response_model=KnowledgeNoteRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("shared_library", "write"))],
)
async def create_note(
study_id: uuid.UUID,
@@ -59,7 +59,7 @@ async def create_note(
@router.get(
"/notes",
response_model=list[KnowledgeNoteRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("shared_library", "read"))],
)
async def list_notes(
study_id: uuid.UUID,
@@ -77,7 +77,7 @@ async def list_notes(
@router.get(
"/notes/{note_id}",
response_model=KnowledgeNoteRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("shared_library", "read"))],
)
async def get_note(
study_id: uuid.UUID,
@@ -94,7 +94,7 @@ async def get_note(
@router.patch(
"/notes/{note_id}",
response_model=KnowledgeNoteRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("shared_library", "write"))],
)
async def update_note(
study_id: uuid.UUID,
@@ -125,7 +125,7 @@ async def update_note(
@router.delete(
"/notes/{note_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("shared_library", "write"))],
)
async def delete_note(
study_id: uuid.UUID,
backend/app/api/v1/material_equipments.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_not_locked, require_study_roles
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import material_equipment as equipment_crud
from app.crud import study as study_crud
@@ -28,7 +28,7 @@ def _validate_calibration(need_calibration: bool, calibration_cycle_days: int |
"/equipment",
response_model=MaterialEquipmentRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def create_equipment(
study_id: uuid.UUID,
@@ -57,7 +57,7 @@ async def create_equipment(
@router.get(
"/equipment",
response_model=list[MaterialEquipmentRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("materials", "read"))],
)
async def list_equipments(
study_id: uuid.UUID,
@@ -74,7 +74,7 @@ async def list_equipments(
@router.get(
"/equipment/{equipment_id}",
response_model=MaterialEquipmentRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("materials", "read"))],
)
async def get_equipment(
study_id: uuid.UUID,
@@ -91,7 +91,7 @@ async def get_equipment(
@router.patch(
"/equipment/{equipment_id}",
response_model=MaterialEquipmentRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def update_equipment(
study_id: uuid.UUID,
@@ -128,7 +128,7 @@ async def update_equipment(
@router.delete(
"/equipment/{equipment_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("materials", "write")), Depends(require_study_not_locked())],
)
async def delete_equipment(
study_id: uuid.UUID,
backend/app/api/v1/members.py
+4 -4
View File
@@ -4,7 +4,7 @@ import json
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_permission, require_study_not_locked
from app.crud import audit as audit_crud
from app.crud import member as member_crud
from app.crud import study as study_crud
@@ -26,7 +26,7 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
"/",
response_model=StudyMemberRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
)
async def add_member(
study_id: uuid.UUID,
@@ -115,7 +115,7 @@ async def list_members(
@router.patch(
"/{member_id}",
response_model=StudyMemberRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
)
async def update_member(
study_id: uuid.UUID,
@@ -147,7 +147,7 @@ async def update_member(
@router.delete(
"/{member_id}",
response_model=StudyMemberRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("project_members", "write")), Depends(require_study_not_locked())],
)
async def remove_member(
study_id: uuid.UUID,
backend/app/api/v1/monitoring_visit_issues.py
+8 -8
View File
@@ -11,7 +11,7 @@ from openpyxl import Workbook, load_workbook
from sqlalchemy.exc import IntegrityError
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_not_locked, require_study_roles
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import monitoring_visit_issue as issue_crud
from app.crud import site as site_crud
@@ -332,7 +332,7 @@ def _normalize_file_rows(filename: str, content: bytes) -> list[dict[str, object
@router.get(
"/issues",
response_model=list[MonitoringVisitIssueRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("monitoring_audit", "read"))],
)
async def list_monitoring_visit_issues(
study_id: uuid.UUID,
@@ -382,7 +382,7 @@ async def list_monitoring_visit_issues(
"/issues",
response_model=MonitoringVisitIssueRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("monitoring_audit", "write")), Depends(require_study_not_locked())],
)
async def create_monitoring_visit_issue(
study_id: uuid.UUID,
@@ -421,7 +421,7 @@ async def create_monitoring_visit_issue(
@router.get(
"/issues/export",
response_class=StreamingResponse,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("monitoring_audit", "read"))],
)
async def export_monitoring_visit_issues(
study_id: uuid.UUID,
@@ -553,7 +553,7 @@ async def export_monitoring_visit_issues(
@router.get(
"/issues/{issue_id}",
response_model=MonitoringVisitIssueRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("monitoring_audit", "read"))],
)
async def get_monitoring_visit_issue(
study_id: uuid.UUID,
@@ -570,7 +570,7 @@ async def get_monitoring_visit_issue(
@router.patch(
"/issues/{issue_id}",
response_model=MonitoringVisitIssueRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("monitoring_audit", "write")), Depends(require_study_not_locked())],
)
async def update_monitoring_visit_issue(
study_id: uuid.UUID,
@@ -625,7 +625,7 @@ async def update_monitoring_visit_issue(
@router.delete(
"/issues/{issue_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("monitoring_audit", "write")), Depends(require_study_not_locked())],
)
async def delete_monitoring_visit_issue(
study_id: uuid.UUID,
@@ -655,7 +655,7 @@ async def delete_monitoring_visit_issue(
@router.post(
"/issues/import",
response_model=MonitoringVisitIssueImportSummary,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("monitoring_audit", "write")), Depends(require_study_not_locked())],
)
async def import_monitoring_visit_issues(
study_id: uuid.UUID,
backend/app/api/v1/overview.py
+2 -2
View File
@@ -4,7 +4,7 @@ import uuid
from fastapi import APIRouter, Depends
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_db_session, require_study_member
from app.core.deps import get_db_session, require_study_permission
from app.crud import overview as overview_crud
from app.schemas.overview import ProjectOverviewResponse
@@ -14,7 +14,7 @@ router = APIRouter()
@router.get(
"/overview",
response_model=ProjectOverviewResponse,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("project_overview", "read"))],
)
async def get_project_overview(
study_id: uuid.UUID,
backend/app/api/v1/project_milestones.py
+3 -3
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_not_locked, require_study_roles
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import project_milestone as milestone_crud
from app.crud import study as study_crud
@@ -29,7 +29,7 @@ def _validate_date_range(start, end, label: str):
@router.get(
"/milestones",
response_model=list[ProjectMilestoneRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("project_milestones", "read"))],
)
async def list_project_milestones(
study_id: uuid.UUID,
@@ -43,7 +43,7 @@ async def list_project_milestones(
@router.patch(
"/milestones/{milestone_id}",
response_model=ProjectMilestoneRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("project_milestones", "write")), Depends(require_study_not_locked())],
)
async def update_project_milestone(
study_id: uuid.UUID,
backend/app/api/v1/project_permissions.py
+66
View File
@@ -0,0 +1,66 @@
from __future__ import annotations
import json
import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_roles, require_study_member
from app.core.project_permissions import PROJECT_PERMISSION_MODULES, get_project_role_permissions, replace_project_role_permissions
from app.crud import audit as audit_crud
from app.crud import study as study_crud
from app.schemas.project_permission import ProjectPermissionModule, ProjectRolePermissionsRead, ProjectRolePermissionsUpdate
router = APIRouter()
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
study = await study_crud.get(db, study_id)
if not study:
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在")
return study
@router.get("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_study_member())])
async def get_permissions(
study_id: uuid.UUID,
db: AsyncSession = Depends(get_db_session),
) -> ProjectRolePermissionsRead:
await _ensure_study_exists(db, study_id)
roles = await get_project_role_permissions(db, study_id)
modules = [ProjectPermissionModule(**item) for item in PROJECT_PERMISSION_MODULES]
return ProjectRolePermissionsRead(modules=modules, roles=roles)
@router.put("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_roles(["ADMIN"]))])
async def update_permissions(
study_id: uuid.UUID,
payload: ProjectRolePermissionsUpdate,
db: AsyncSession = Depends(get_db_session),
current_user=Depends(get_current_user),
) -> ProjectRolePermissionsRead:
await _ensure_study_exists(db, study_id)
roles = await replace_project_role_permissions(
db,
study_id,
{
role: {
module: actions.model_dump()
for module, actions in modules.items()
}
for role, modules in payload.roles.items()
},
)
await audit_crud.log_action(
db,
study_id=study_id,
entity_type="project_permissions",
entity_id=study_id,
action="PROJECT_PERMISSIONS_UPDATED",
detail=json.dumps({"targetName": "项目权限", "after": roles}, ensure_ascii=False),
operator_id=current_user.id,
operator_role=current_user.role,
)
modules = [ProjectPermissionModule(**item) for item in PROJECT_PERMISSION_MODULES]
return ProjectRolePermissionsRead(modules=modules, roles=roles)
backend/app/api/v1/router.py
+2 -1
View File
@@ -1,6 +1,6 @@
from fastapi import APIRouter
from app.api.v1 import auth, users, admin_users, studies, sites, members, attachments, audit_logs, dashboard, subjects, visits, aes, finance_dashboard, finance_contracts, fees_contracts, fees_attachments, drug_shipments, material_equipments, project_milestones, startup, knowledge_notes, subject_histories, subject_pds, study_subject_pds, faq_categories, faqs, documents, overview, notifications, monitoring_visit_issues
from app.api.v1 import auth, users, admin_users, studies, sites, members, attachments, audit_logs, dashboard, subjects, visits, aes, finance_dashboard, finance_contracts, fees_contracts, fees_attachments, drug_shipments, material_equipments, project_milestones, startup, knowledge_notes, subject_histories, subject_pds, study_subject_pds, faq_categories, faqs, documents, overview, notifications, monitoring_visit_issues, project_permissions
api_router = APIRouter()
@@ -12,6 +12,7 @@ api_router.include_router(overview.router, prefix="/studies/{study_id}", tags=["
api_router.include_router(notifications.router, prefix="/studies/{study_id}", tags=["notifications"])
api_router.include_router(sites.router, prefix="/studies/{study_id}/sites", tags=["sites"])
api_router.include_router(members.router, prefix="/studies/{study_id}/members", tags=["study-members"])
api_router.include_router(project_permissions.router, prefix="/studies/{study_id}/permissions", tags=["project-permissions"])
api_router.include_router(attachments.router, prefix="/studies/{study_id}/{entity_type}/{entity_id}/attachments", tags=["attachments"])
api_router.include_router(attachments.global_router, prefix="/attachments", tags=["attachments"])
api_router.include_router(audit_logs.router, prefix="/studies/{study_id}/audit-logs", tags=["audit-logs"])
backend/app/api/v1/sites.py
+3 -3
View File
@@ -4,7 +4,7 @@ import json
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_permission, require_study_not_locked
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import startup as startup_crud
@@ -26,7 +26,7 @@ async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
"/",
response_model=SiteRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("sites", "write")), Depends(require_study_not_locked())],
)
async def create_site(
study_id: uuid.UUID,
@@ -91,7 +91,7 @@ async def list_sites(
@router.patch(
"/{site_id}",
response_model=SiteRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("sites", "write")), Depends(require_study_not_locked())],
)
async def update_site(
study_id: uuid.UUID,
backend/app/api/v1/startup.py
+20 -20
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_permission
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import startup as startup_crud
@@ -53,7 +53,7 @@ async def _ensure_site_active(db: AsyncSession, site_id: uuid.UUID | None):
"/feasibility",
response_model=StartupFeasibilityRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def create_feasibility(
study_id: uuid.UUID,
@@ -83,7 +83,7 @@ async def create_feasibility(
@router.get(
"/feasibility",
response_model=list[StartupFeasibilityRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "read"))],
)
async def list_feasibilities(
study_id: uuid.UUID,
@@ -102,7 +102,7 @@ async def list_feasibilities(
@router.get(
"/feasibility/{record_id}",
response_model=StartupFeasibilityRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "read"))],
)
async def get_feasibility(
study_id: uuid.UUID,
@@ -123,7 +123,7 @@ async def get_feasibility(
@router.patch(
"/feasibility/{record_id}",
response_model=StartupFeasibilityRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def update_feasibility(
study_id: uuid.UUID,
@@ -157,7 +157,7 @@ async def update_feasibility(
@router.delete(
"/feasibility/{record_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def delete_feasibility(
study_id: uuid.UUID,
@@ -190,7 +190,7 @@ async def delete_feasibility(
"/ethics",
response_model=StartupEthicsRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def create_ethics(
study_id: uuid.UUID,
@@ -220,7 +220,7 @@ async def create_ethics(
@router.get(
"/ethics",
response_model=list[StartupEthicsRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "read"))],
)
async def list_ethics(
study_id: uuid.UUID,
@@ -239,7 +239,7 @@ async def list_ethics(
@router.get(
"/ethics/{record_id}",
response_model=StartupEthicsRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "read"))],
)
async def get_ethics(
study_id: uuid.UUID,
@@ -260,7 +260,7 @@ async def get_ethics(
@router.patch(
"/ethics/{record_id}",
response_model=StartupEthicsRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def update_ethics(
study_id: uuid.UUID,
@@ -294,7 +294,7 @@ async def update_ethics(
@router.delete(
"/ethics/{record_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_ethics", "write"))],
)
async def delete_ethics(
study_id: uuid.UUID,
@@ -327,7 +327,7 @@ async def delete_ethics(
"/kickoff",
response_model=KickoffMeetingRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def create_kickoff(
study_id: uuid.UUID,
@@ -357,7 +357,7 @@ async def create_kickoff(
@router.get(
"/kickoff",
response_model=list[KickoffMeetingRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "read"))],
)
async def list_kickoffs(
study_id: uuid.UUID,
@@ -376,7 +376,7 @@ async def list_kickoffs(
@router.get(
"/kickoff/{meeting_id}",
response_model=KickoffMeetingRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "read"))],
)
async def get_kickoff(
study_id: uuid.UUID,
@@ -397,7 +397,7 @@ async def get_kickoff(
@router.patch(
"/kickoff/{meeting_id}",
response_model=KickoffMeetingRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def update_kickoff(
study_id: uuid.UUID,
@@ -432,7 +432,7 @@ async def update_kickoff(
"/training-authorizations",
response_model=TrainingAuthorizationRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def create_training_authorization(
study_id: uuid.UUID,
@@ -462,7 +462,7 @@ async def create_training_authorization(
@router.get(
"/training-authorizations",
response_model=list[TrainingAuthorizationRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "read"))],
)
async def list_training_authorizations(
study_id: uuid.UUID,
@@ -481,7 +481,7 @@ async def list_training_authorizations(
@router.get(
"/training-authorizations/{record_id}",
response_model=TrainingAuthorizationRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "read"))],
)
async def get_training_authorization(
study_id: uuid.UUID,
@@ -502,7 +502,7 @@ async def get_training_authorization(
@router.patch(
"/training-authorizations/{record_id}",
response_model=TrainingAuthorizationRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def update_training_authorization(
study_id: uuid.UUID,
@@ -536,7 +536,7 @@ async def update_training_authorization(
@router.delete(
"/training-authorizations/{record_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("startup_auth", "write"))],
)
async def delete_training_authorization(
study_id: uuid.UUID,
backend/app/api/v1/studies.py
+9 -9
View File
@@ -813,7 +813,7 @@ async def get_study(
@router.patch(
"/{study_id}",
response_model=StudyRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"]))],
dependencies=[Depends(require_roles(["ADMIN"]))],
)
async def update_study(
study_id: uuid.UUID,
@@ -990,7 +990,7 @@ async def get_study_setup_config(
@router.put(
"/{study_id}/setup-config",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def upsert_study_setup_config(
study_id: uuid.UUID,
@@ -1068,7 +1068,7 @@ async def upsert_study_setup_config(
@router.post(
"/{study_id}/setup-config/publish",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def publish_study_setup_config(
study_id: uuid.UUID,
@@ -1221,7 +1221,7 @@ async def list_study_setup_config_versions(
@router.post(
"/{study_id}/setup-config/rollback",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def rollback_study_setup_config(
study_id: uuid.UUID,
@@ -1279,7 +1279,7 @@ async def rollback_study_setup_config(
@router.post(
"/{study_id}/setup-config/draft/checkout-branch",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def checkout_study_setup_config_branch_draft(
study_id: uuid.UUID,
@@ -1338,7 +1338,7 @@ async def checkout_study_setup_config_branch_draft(
@router.post(
"/{study_id}/setup-config/draft/clear",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def clear_study_setup_config_draft(
study_id: uuid.UUID,
@@ -1390,7 +1390,7 @@ async def clear_study_setup_config_draft(
@router.post(
"/{study_id}/setup-config/draft/refill",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def refill_study_setup_config_draft(
study_id: uuid.UUID,
@@ -1444,7 +1444,7 @@ async def refill_study_setup_config_draft(
@router.post(
"/{study_id}/setup-config/merge-main",
response_model=StudySetupConfigRead,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def merge_study_setup_config_to_main(
study_id: uuid.UUID,
@@ -1539,7 +1539,7 @@ async def merge_study_setup_config_to_main(
@router.delete(
"/{study_id}/setup-config/versions/{target_version}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["ADMIN", "PM"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_roles(["ADMIN"])), Depends(require_study_not_locked())],
)
async def delete_study_setup_config_version(
study_id: uuid.UUID,
backend/app/api/v1/subject_histories.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import subject as subject_crud
@@ -33,7 +33,7 @@ async def _ensure_subject_active(db: AsyncSession, subject) -> None:
"/histories",
response_model=SubjectHistoryRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("subjects", "write"))],
)
async def create_history(
study_id: uuid.UUID,
@@ -66,7 +66,7 @@ async def create_history(
@router.get(
"/histories",
response_model=list[SubjectHistoryRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def list_histories(
study_id: uuid.UUID,
@@ -86,7 +86,7 @@ async def list_histories(
@router.get(
"/histories/{history_id}",
response_model=SubjectHistoryRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def get_history(
study_id: uuid.UUID,
@@ -107,7 +107,7 @@ async def get_history(
@router.patch(
"/histories/{history_id}",
response_model=SubjectHistoryRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("subjects", "write"))],
)
async def update_history(
study_id: uuid.UUID,
@@ -141,7 +141,7 @@ async def update_history(
@router.delete(
"/histories/{history_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"]))],
dependencies=[Depends(require_study_permission("subjects", "write"))],
)
async def delete_history(
study_id: uuid.UUID,
backend/app/api/v1/subject_pds.py
+5 -6
View File
@@ -6,9 +6,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import (
get_current_user,
get_db_session,
require_study_member,
require_study_not_locked,
require_study_roles,
require_study_permission,
)
from app.crud import audit as audit_crud
from app.crud import site as site_crud
@@ -65,7 +64,7 @@ def _normalize_choice(value: str | None, allowed: set[str], field_name: str) ->
@router.get(
"/pds",
response_model=list[SubjectPdRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("risk_issues", "read"))],
)
async def list_subject_pds(
study_id: uuid.UUID,
@@ -84,7 +83,7 @@ async def list_subject_pds(
"/pds",
response_model=SubjectPdRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def create_subject_pd(
study_id: uuid.UUID,
@@ -129,7 +128,7 @@ async def create_subject_pd(
@router.patch(
"/pds/{pd_id}",
response_model=SubjectPdRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def update_subject_pd(
study_id: uuid.UUID,
@@ -176,7 +175,7 @@ async def update_subject_pd(
@router.delete(
"/pds/{pd_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def delete_subject_pd(
study_id: uuid.UUID,
backend/app/api/v1/subjects.py
+6 -6
View File
@@ -4,7 +4,7 @@ from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy import select
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import subject as subject_crud
@@ -34,7 +34,7 @@ async def _ensure_subject_active(db: AsyncSession, subject) -> None:
"/",
response_model=SubjectRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def create_subject(
study_id: uuid.UUID,
@@ -66,7 +66,7 @@ async def create_subject(
@router.get(
"/",
response_model=list[SubjectRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def list_subjects(
study_id: uuid.UUID,
@@ -115,7 +115,7 @@ async def list_subjects(
@router.get(
"/{subject_id}",
response_model=SubjectRead,
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def get_subject(
study_id: uuid.UUID,
@@ -154,7 +154,7 @@ async def get_subject(
@router.patch(
"/{subject_id}",
response_model=SubjectRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def update_subject(
study_id: uuid.UUID,
@@ -195,7 +195,7 @@ async def update_subject(
@router.delete(
"/{subject_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def delete_subject(
study_id: uuid.UUID,
backend/app/api/v1/visits.py
+6 -6
View File
@@ -3,7 +3,7 @@ import uuid
from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles, require_study_not_locked
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_study_permission
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import subject as subject_crud
@@ -33,7 +33,7 @@ async def _ensure_subject_active(db: AsyncSession, subject) -> None:
@router.get(
"/",
response_model=list[VisitRead],
dependencies=[Depends(require_study_member())],
dependencies=[Depends(require_study_permission("subjects", "read"))],
)
async def list_visits(
study_id: uuid.UUID,
@@ -50,7 +50,7 @@ async def list_visits(
"/",
response_model=VisitRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def create_visit(
study_id: uuid.UUID,
@@ -115,7 +115,7 @@ async def create_visit(
"/early-termination",
response_model=VisitRead,
status_code=status.HTTP_201_CREATED,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def create_early_termination(
study_id: uuid.UUID,
@@ -168,7 +168,7 @@ async def create_early_termination(
@router.patch(
"/{visit_id}",
response_model=VisitRead,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def update_visit(
study_id: uuid.UUID,
@@ -211,7 +211,7 @@ async def update_visit(
@router.delete(
"/{visit_id}",
status_code=status.HTTP_204_NO_CONTENT,
dependencies=[Depends(require_study_roles(["PM", "CRA"])), Depends(require_study_not_locked())],
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
)
async def delete_visit(
study_id: uuid.UUID,