Step 5：里程碑与任务（伦理/启动会进度）

backend/app/api/v1/dashboard.py

@@ -0,0 +1,51 @@
+import uuid
+from datetime import date
+
+from fastapi import APIRouter, Depends
+from sqlalchemy import func, select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_db_session, require_study_member
+from app.models.milestone import Milestone
+from app.models.task import Task
+from app.schemas.progress import StudyProgressRead
+
+router = APIRouter()
+
+
+@router.get("/progress", response_model=StudyProgressRead, dependencies=[Depends(require_study_member())])
+async def get_progress(
+    study_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+) -> StudyProgressRead:
+    # Milestones
+    milestone_total_stmt = select(func.count()).select_from(Milestone).where(Milestone.study_id == study_id)
+    milestone_done_stmt = select(func.count()).select_from(Milestone).where(
+        Milestone.study_id == study_id, Milestone.status == "DONE"
+    )
+    task_total_stmt = select(func.count()).select_from(Task).where(Task.study_id == study_id)
+    task_done_stmt = select(func.count()).select_from(Task).where(Task.study_id == study_id, Task.status == "DONE")
+    task_overdue_stmt = select(func.count()).select_from(Task).where(
+        Task.study_id == study_id,
+        Task.due_date < date.today(),
+        Task.status != "DONE",
+    )
+
+    milestone_total = (await db.execute(milestone_total_stmt)).scalar_one()
+    milestone_done = (await db.execute(milestone_done_stmt)).scalar_one()
+    task_total = (await db.execute(task_total_stmt)).scalar_one()
+    task_done = (await db.execute(task_done_stmt)).scalar_one()
+    task_overdue = (await db.execute(task_overdue_stmt)).scalar_one()
+
+    total_items = milestone_total + task_total
+    done_items = milestone_done + task_done
+    completion_rate = float(done_items / total_items) if total_items else 0.0
+
+    return StudyProgressRead(
+        milestones_total=milestone_total,
+        milestones_done=milestone_done,
+        tasks_total=task_total,
+        tasks_done=task_done,
+        tasks_overdue=task_overdue,
+        completion_rate=completion_rate,
+    )

backend/app/api/v1/milestones.py

@@ -0,0 +1,94 @@
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles
+from app.crud import audit as audit_crud
+from app.crud import milestone as milestone_crud
+from app.crud import study as study_crud
+from app.schemas.milestone import MilestoneCreate, MilestoneRead, MilestoneUpdate
+
+router = APIRouter()
+
+
+async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
+    study = await study_crud.get(db, study_id)
+    if not study:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Study not found")
+    return study
+
+
+@router.post(
+    "/",
+    response_model=MilestoneRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_study_roles(["PM"]))],
+)
+async def create_milestone(
+    study_id: uuid.UUID,
+    milestone_in: MilestoneCreate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> MilestoneRead:
+    await _ensure_study_exists(db, study_id)
+    milestone = await milestone_crud.create(db, study_id, milestone_in)
+    await audit_crud.log_action(
+        db,
+        study_id=study_id,
+        entity_type="milestone",
+        entity_id=milestone.id,
+        action="CREATE_MILESTONE",
+        detail=f"Milestone {milestone.id} created",
+        operator_id=current_user.id,
+        operator_role=current_user.role,
+    )
+    return milestone
+
+
+@router.get(
+    "/",
+    response_model=list[MilestoneRead],
+    dependencies=[Depends(require_study_member())],
+)
+async def list_milestones(
+    study_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+) -> list[MilestoneRead]:
+    await _ensure_study_exists(db, study_id)
+    milestones = await milestone_crud.list_milestones(db, study_id)
+    return list(milestones)
+
+
+@router.patch(
+    "/{milestone_id}",
+    response_model=MilestoneRead,
+    dependencies=[Depends(require_study_roles(["PM"]))],
+)
+async def update_milestone(
+    study_id: uuid.UUID,
+    milestone_id: uuid.UUID,
+    milestone_in: MilestoneUpdate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> MilestoneRead:
+    await _ensure_study_exists(db, study_id)
+    milestone = await milestone_crud.get(db, milestone_id)
+    if not milestone or milestone.study_id != study_id:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Milestone not found")
+    old_status = milestone.status
+    updated = await milestone_crud.update(db, milestone, milestone_in)
+    detail = None
+    if milestone_in.status and milestone_in.status != old_status:
+        detail = f"milestone {milestone_id} status {old_status} -> {milestone_in.status}"
+    await audit_crud.log_action(
+        db,
+        study_id=study_id,
+        entity_type="milestone",
+        entity_id=milestone_id,
+        action="UPDATE_MILESTONE",
+        detail=detail or "Milestone updated",
+        operator_id=current_user.id,
+        operator_role=current_user.role,
+    )
+    return updated

backend/app/api/v1/router.py

@@ -1,6 +1,6 @@
 from fastapi import APIRouter
 
-from app.api.v1 import auth, users, studies, sites, members, comments, attachments, audit_logs
+from app.api.v1 import auth, users, studies, sites, members, comments, attachments, audit_logs, milestones, tasks, dashboard
 
 api_router = APIRouter()
 api_router.include_router(auth.router, prefix="/auth", tags=["auth"])
@@ -11,3 +11,6 @@ api_router.include_router(members.router, prefix="/studies/{study_id}/members",
 api_router.include_router(comments.router, prefix="/studies/{study_id}/{entity_type}/{entity_id}/comments", tags=["comments"])
 api_router.include_router(attachments.router, prefix="/studies/{study_id}/{entity_type}/{entity_id}/attachments", tags=["attachments"])
 api_router.include_router(audit_logs.router, prefix="/studies/{study_id}/audit-logs", tags=["audit-logs"])
+api_router.include_router(milestones.router, prefix="/studies/{study_id}/milestones", tags=["milestones"])
+api_router.include_router(tasks.router, prefix="/studies/{study_id}/tasks", tags=["tasks"])
+api_router.include_router(dashboard.router, prefix="/studies/{study_id}/dashboard", tags=["dashboard"])

backend/app/api/v1/tasks.py

@@ -0,0 +1,114 @@
+import uuid
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles
+from app.crud import audit as audit_crud
+from app.crud import milestone as milestone_crud
+from app.crud import study as study_crud
+from app.crud import task as task_crud
+from app.schemas.task import TaskCreate, TaskRead, TaskUpdate
+
+router = APIRouter()
+
+ALLOW_ASSIGNEE_UPDATE_STATUS = False
+
+
+async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
+    study = await study_crud.get(db, study_id)
+    if not study:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Study not found")
+    return study
+
+
+async def _validate_milestone(db: AsyncSession, study_id: uuid.UUID, milestone_id: uuid.UUID | None):
+    if milestone_id is None:
+        return
+    milestone = await milestone_crud.get(db, milestone_id)
+    if not milestone:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Milestone not found")
+    if milestone.study_id != study_id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Milestone does not belong to study")
+
+
+@router.post(
+    "/",
+    response_model=TaskRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_study_roles(["PM"]))],
+)
+async def create_task(
+    study_id: uuid.UUID,
+    task_in: TaskCreate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> TaskRead:
+    await _ensure_study_exists(db, study_id)
+    await _validate_milestone(db, study_id, task_in.milestone_id)
+    task = await task_crud.create(db, study_id, task_in, created_by=current_user.id)
+    await audit_crud.log_action(
+        db,
+        study_id=study_id,
+        entity_type="task",
+        entity_id=task.id,
+        action="CREATE_TASK",
+        detail=f"Task {task.id} created",
+        operator_id=current_user.id,
+        operator_role=current_user.role,
+    )
+    return task
+
+
+@router.get(
+    "/",
+    response_model=list[TaskRead],
+    dependencies=[Depends(require_study_member())],
+)
+async def list_tasks(
+    study_id: uuid.UUID,
+    milestone_id: uuid.UUID | None = None,
+    assignee_id: uuid.UUID | None = None,
+    status: str | None = None,
+    db: AsyncSession = Depends(get_db_session),
+) -> list[TaskRead]:
+    await _ensure_study_exists(db, study_id)
+    tasks = await task_crud.list_tasks(db, study_id, milestone_id=milestone_id, assignee_id=assignee_id, status=status)
+    return list(tasks)
+
+
+@router.patch(
+    "/{task_id}",
+    response_model=TaskRead,
+    dependencies=[Depends(require_study_roles(["PM"]))],
+)
+async def update_task(
+    study_id: uuid.UUID,
+    task_id: uuid.UUID,
+    task_in: TaskUpdate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> TaskRead:
+    await _ensure_study_exists(db, study_id)
+    task = await task_crud.get(db, task_id)
+    if not task or task.study_id != study_id:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Task not found")
+    if task_in.milestone_id:
+        await _validate_milestone(db, study_id, task_in.milestone_id)
+
+    old_status = task.status
+    updated = await task_crud.update(db, task, task_in)
+    detail = None
+    if task_in.status and task_in.status != old_status:
+        detail = f"task {task_id} status {old_status} -> {task_in.status}"
+    await audit_crud.log_action(
+        db,
+        study_id=study_id,
+        entity_type="task",
+        entity_id=task_id,
+        action="UPDATE_TASK" if not detail else "TASK_STATUS_CHANGE",
+        detail=detail or "Task updated",
+        operator_id=current_user.id,
+        operator_role=current_user.role,
+    )
+    return updated