From d6452e3f9d2084fe48475ac6bac2b8a14f3665ed Mon Sep 17 00:00:00 2001 From: Cheng Zhou Date: Thu, 4 Jun 2026 16:29:44 +0800 Subject: [PATCH] =?UTF-8?q?=E5=AE=8C=E5=96=84=E9=A1=B9=E7=9B=AE=E6=9D=83?= =?UTF-8?q?=E9=99=90=E5=89=8D=E7=BD=AE=E4=BE=9D=E8=B5=96=E4=BF=9D=E5=AD=98?= =?UTF-8?q?=E6=A0=A1=E9=AA=8C?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 以接口权限定义中的 prerequisite_permissions 作为前置依赖单一事实源，生成运行时前置权限映射\n- 保存项目角色权限前预检缺失前置权限与受影响下游权限，未确认时返回 409 调整详情\n- 确认保存时自动合并补齐前置权限与取消下游权限，并提供有效权限矩阵读取接口\n- 前端角色权限编辑改为保存时执行依赖校验，弹窗展示需补充前置权限和受影响下游权限\n- 新增编辑权限取消按钮，清理权限选择即时确认弹窗残留\n- 补充后端接口测试、前端权限编辑测试与优化设计文档 --- backend/app/api/v1/api_permissions.py | 22 +- backend/app/core/api_permissions.py | 94 ++- backend/app/core/project_permissions.py | 169 ++++- backend/tests/test_api_permissions.py | 19 +- .../tests/test_api_permissions_endpoints.py | 85 ++- ...ission-prerequisite-optimization-design.md | 25 + frontend/src/api/projectPermissions.ts | 13 +- .../components/ApiEndpointPermissions.test.ts | 12 +- .../PermissionTemplateSelector.test.ts | 10 + .../components/PermissionTemplateSelector.vue | 15 +- frontend/src/types/api.ts | 10 + .../views/admin/PermissionManagement.test.ts | 77 +++ .../src/views/admin/PermissionManagement.vue | 618 +++++++++++++++++- 13 files changed, 1089 insertions(+), 80 deletions(-) create mode 100644 docs/plans/2026-06-04-permission-prerequisite-optimization-design.md diff --git a/backend/app/api/v1/api_permissions.py b/backend/app/api/v1/api_permissions.py index a849684c..5658f4bd 100644 --- a/backend/app/api/v1/api_permissions.py +++ b/backend/app/api/v1/api_permissions.py @@ -12,6 +12,8 @@ from sqlalchemy.ext.asyncio import AsyncSession from app.core.deps import get_current_user, get_db_session, is_system_admin, require_study_member, require_system_permission from app.core.project_permissions import ( get_api_endpoint_permissions, + get_effective_api_endpoint_permissions, + PrerequisitePermissionConfirmationRequired, replace_api_endpoint_permissions, get_missing_prerequisites, ) @@ -173,7 +175,7 @@ async def get_my_study_api_permissions( membership = await member_crud.get_member(db, study_id, current_user.id) role = membership.role_in_study if membership and membership.is_active else "" - permissions = await get_api_endpoint_permissions(db, study_id) + permissions = await get_effective_api_endpoint_permissions(db, study_id) role_permissions = permissions.get(role, {}) return { role: { @@ -232,6 +234,7 @@ async def get_study_api_permissions( async def update_study_api_permissions( study_id: uuid.UUID, payload: dict[str, dict[str, bool]], + confirm_prerequisite_adjustments: bool = False, _=Depends(require_system_permission("system:permissions:project_config")), current_user=Depends(get_current_user), db: Annotated[AsyncSession, Depends(get_db_session)] = None, @@ -259,7 +262,22 @@ async def update_study_api_permissions( ) # 替换权限配置 - await replace_api_endpoint_permissions(db, study_id, payload) + try: + await replace_api_endpoint_permissions( + db, + study_id, + payload, + confirm_prerequisite_adjustments=confirm_prerequisite_adjustments, + ) + except PrerequisitePermissionConfirmationRequired as exc: + raise HTTPException( + status_code=status.HTTP_409_CONFLICT, + detail={ + "code": "PREREQUISITE_PERMISSION_CONFIRMATION_REQUIRED", + "message": "需要确认前置权限调整", + "adjustments": exc.adjustments, + }, + ) from exc # 返回更新后的权限矩阵 permissions = await get_api_endpoint_permissions(db, study_id) diff --git a/backend/app/core/api_permissions.py b/backend/app/core/api_permissions.py index f2c57897..25859c0f 100644 --- a/backend/app/core/api_permissions.py +++ b/backend/app/core/api_permissions.py @@ -36,7 +36,7 @@ API_ENDPOINT_PERMISSIONS = { "action": "write", "description": "创建参与者", "default_roles": ["PM", "CRA"], - "prerequisite_permissions": ["sites:read"], + "prerequisite_permissions": ["subjects:read", "sites:read"], }, "subjects:read": { "module": "subjects", @@ -50,14 +50,14 @@ API_ENDPOINT_PERMISSIONS = { "action": "write", "description": "更新参与者", "default_roles": ["PM", "CRA"], - "prerequisite_permissions": ["sites:read"], + "prerequisite_permissions": ["subjects:read", "sites:read"], }, "subjects:delete": { "module": "subjects", "action": "write", "description": "删除参与者", "default_roles": ["PM"], - "prerequisite_permissions": ["sites:read"], + "prerequisite_permissions": ["subjects:read", "sites:read"], }, # 访视管理 (visits) "visits:create": { @@ -94,7 +94,7 @@ API_ENDPOINT_PERMISSIONS = { "action": "write", "description": "创建参与者AE", "default_roles": ["PM", "CRA", "PV", "QA"], - "prerequisite_permissions": ["subjects:read", "sites:read"], + "prerequisite_permissions": ["subject_aes:read", "subjects:read", "sites:read"], }, "subject_aes:read": { "module": "subjects", @@ -123,7 +123,7 @@ API_ENDPOINT_PERMISSIONS = { "action": "write", "description": "创建合同费用", "default_roles": ["PM"], - "prerequisite_permissions": ["sites:read"], + "prerequisite_permissions": ["fees_contracts:read", "sites:read"], }, "fees_contracts:read": { "module": "fees", @@ -137,14 +137,14 @@ API_ENDPOINT_PERMISSIONS = { "action": "write", "description": "更新合同费用", "default_roles": ["PM"], - "prerequisite_permissions": ["sites:read"], + "prerequisite_permissions": ["fees_contracts:read", "sites:read"], }, "fees_contracts:delete": { "module": "fees", "action": "write", "description": "删除合同费用", "default_roles": ["PM"], - "prerequisite_permissions": ["sites:read"], + "prerequisite_permissions": ["fees_contracts:read", "sites:read"], }, # 项目成员管理 "project_members:create": { @@ -384,30 +384,35 @@ API_ENDPOINT_PERMISSIONS = { "action": "read", "description": "查询立项配置", "default_roles": ["PM", "CRA", "PV", "QA", "CTA"], + "prerequisite_permissions": [], }, "setup_config:update": { "module": "setup_config", "action": "write", "description": "保存立项配置草稿", "default_roles": ["PM"], + "prerequisite_permissions": ["setup_config:read"], }, "setup_config:publish": { "module": "setup_config", "action": "write", "description": "发布立项配置", "default_roles": ["PM"], + "prerequisite_permissions": ["setup_config:read"], }, "setup_config:rollback": { "module": "setup_config", "action": "write", "description": "回滚立项配置版本", "default_roles": ["PM"], + "prerequisite_permissions": ["setup_config:read"], }, "setup_config:delete_version": { "module": "setup_config", "action": "delete", "description": "删除立项配置版本", "default_roles": ["PM"], + "prerequisite_permissions": ["setup_config:read"], }, # 项目里程碑管理 "project_milestones:read": { @@ -640,6 +645,36 @@ API_ENDPOINT_PERMISSIONS = { }, } +def _operation_read_candidates(operation_key: str) -> list[str]: + prefix = operation_key.split(":", 1)[0] + candidates = [] + for read_key in (f"{prefix}:read", f"{prefix}:list"): + canonical_key = canonical_permission_key(read_key) + if canonical_key in API_ENDPOINT_PERMISSIONS and canonical_key not in candidates: + candidates.append(canonical_key) + return candidates + + +def _normalized_prerequisite_permissions(operation_key: str, config: dict) -> list[str]: + prerequisites = [ + canonical_permission_key(key) + for key in config.get("prerequisite_permissions", []) + ] + verb = operation_key.split(":")[-1] + if verb in {"create", "update", "delete", "export", "publish", "rollback", "delete_version"}: + for read_key in _operation_read_candidates(operation_key): + if read_key != operation_key and read_key not in prerequisites: + prerequisites.insert(0, read_key) + return list(dict.fromkeys(prerequisites)) + + +for _operation_key, _operation_config in API_ENDPOINT_PERMISSIONS.items(): + _operation_config["prerequisite_permissions"] = _normalized_prerequisite_permissions( + _operation_key, + _operation_config, + ) + + # 向后兼容：业务操作名到接口级权限的映射 # 用于在接口级权限未配置时，回退到模块级权限 OPERATION_TO_ENDPOINTS: dict[str, dict[str, list[str]]] = { @@ -830,48 +865,11 @@ OPERATION_TO_ENDPOINTS: dict[str, dict[str, list[str]]] = { # 项目级权限角色列表 PROJECT_PERMISSION_ROLES = ["PM", "CRA", "PV", "QA", "CTA"] -# 前置权限映射表（用于权限检查） -# 定义每个操作需要的前置权限 +# 前置权限映射表（用于权限检查），由权限定义生成，避免展示与运行时不一致。 OPERATION_PREREQUISITES: dict[str, list[str]] = { - # 参与者管理 - "subjects:create": ["sites:read"], - "subjects:update": ["sites:read"], - "subjects:delete": ["sites:read"], - - # 访视管理 - "visits:create": ["subjects:read", "sites:read"], - "visits:update": ["subjects:read", "sites:read"], - "visits:delete": ["subjects:read", "sites:read"], - - # 参与者AE - "subject_aes:create": ["subjects:read", "sites:read"], - "subject_aes:update": ["subject_aes:read", "subjects:read", "sites:read"], - "subject_aes:delete": ["subject_aes:read", "subjects:read", "sites:read"], - - # 合同费用 - "fees_contracts:create": ["sites:read"], - "fees_contracts:update": ["sites:read"], - "fees_contracts:delete": ["sites:read"], - - # 药物发货 - "drug_shipments:create": ["sites:read"], - "drug_shipments:update": ["sites:read"], - "drug_shipments:delete": ["sites:read"], - - # 参与者PD - "subject_pds:create": ["subjects:read", "sites:read"], - "subject_pds:update": ["subject_pds:list", "subjects:read", "sites:read"], - "subject_pds:delete": ["subject_pds:list", "subjects:read", "sites:read"], - - # 病史记录 - "subject_histories:create": ["subjects:read"], - "subject_histories:update": ["subjects:read"], - "subject_histories:delete": ["subjects:read"], - - # 监查访视问题 - "monitoring_issues:create": ["sites:read"], - "monitoring_issues:update": ["sites:read"], - "monitoring_issues:delete": ["sites:read"], + key: config["prerequisite_permissions"] + for key, config in API_ENDPOINT_PERMISSIONS.items() + if config["prerequisite_permissions"] } # 系统级权限定义 diff --git a/backend/app/core/project_permissions.py b/backend/app/core/project_permissions.py index 0779a8e2..b51434e4 100644 --- a/backend/app/core/project_permissions.py +++ b/backend/app/core/project_permissions.py @@ -16,6 +16,14 @@ from app.core.api_permissions import ( from app.core.permission_cache import get_permission_cache +class PrerequisitePermissionConfirmationRequired(ValueError): + """权限调整需要授权人确认。""" + + def __init__(self, adjustments: dict): + super().__init__("需要确认前置权限调整") + self.adjustments = adjustments + + async def _get_project_permission_overrides( db: AsyncSession, study_id: uuid.UUID, @@ -48,6 +56,126 @@ async def _get_project_permission_overrides( return permissions +def _empty_role_adjustment() -> dict[str, dict[str, list[str]]]: + return {"add": {}, "remove": {}} + + +def _flatten_role_permissions( + matrix: dict[str, dict[str, dict[str, bool]]], + role: str, +) -> dict[str, bool]: + permissions: dict[str, bool] = { + endpoint_key: False + for endpoint_key in API_ENDPOINT_PERMISSIONS.keys() + } + if role in matrix: + for endpoint_key, value in matrix[role].items(): + endpoint_key = canonical_permission_key(endpoint_key) + if endpoint_key not in API_ENDPOINT_PERMISSIONS: + continue + permissions[endpoint_key] = bool(value["allowed"] if isinstance(value, dict) else value) + return permissions + + +def _canonicalize_payload(payload: dict[str, dict[str, bool]]) -> dict[str, dict[str, bool]]: + normalized: dict[str, dict[str, bool]] = {} + for role, endpoints in payload.items(): + normalized[role] = {} + for endpoint_key, allowed in endpoints.items(): + endpoint_key = canonical_permission_key(endpoint_key) + if endpoint_key not in API_ENDPOINT_PERMISSIONS: + continue + normalized[role][endpoint_key] = bool(allowed) + return normalized + + +def _add_adjustment(target: dict[str, list[str]], key: str, value: str) -> None: + values = target.setdefault(key, []) + if value not in values: + values.append(value) + + +async def preview_api_permission_prerequisite_adjustments( + db: AsyncSession, + study_id: uuid.UUID, + payload: dict[str, dict[str, bool]], +) -> dict: + """预检权限草稿需要授权人确认的前置补齐和下游消除项。""" + normalized_payload = _canonicalize_payload(payload) + matrix = await get_api_endpoint_permissions(db, study_id) + roles: dict[str, dict[str, dict[str, list[str]]]] = {} + + for role, endpoints in normalized_payload.items(): + if role in ("ADMIN", "PM"): + continue + + candidate = _flatten_role_permissions(matrix, role) + explicitly_denied = { + endpoint_key + for endpoint_key, allowed in endpoints.items() + if not allowed + } + for endpoint_key, allowed in endpoints.items(): + candidate[endpoint_key] = allowed + + role_adjustment = _empty_role_adjustment() + denied_sources = set(explicitly_denied) + + changed = True + while changed: + changed = False + for endpoint_key, allowed in list(candidate.items()): + if not allowed or endpoint_key in denied_sources: + continue + for prereq in OPERATION_PREREQUISITES.get(endpoint_key, []): + prereq = canonical_permission_key(prereq) + if prereq in denied_sources: + _add_adjustment(role_adjustment["remove"], prereq, endpoint_key) + candidate[endpoint_key] = False + denied_sources.add(endpoint_key) + changed = True + break + + changed = True + while changed: + changed = False + for endpoint_key, allowed in list(candidate.items()): + if not allowed: + continue + for prereq in OPERATION_PREREQUISITES.get(endpoint_key, []): + prereq = canonical_permission_key(prereq) + if candidate.get(prereq, False): + continue + _add_adjustment(role_adjustment["add"], endpoint_key, prereq) + candidate[prereq] = True + changed = True + + if role_adjustment["add"] or role_adjustment["remove"]: + roles[role] = role_adjustment + + return { + "requires_confirmation": bool(roles), + "roles": roles, + } + + +def apply_prerequisite_adjustments_to_payload( + payload: dict[str, dict[str, bool]], + adjustments: dict, +) -> dict[str, dict[str, bool]]: + """把已确认的补齐和消除项合并到待保存 payload。""" + normalized = _canonicalize_payload(payload) + for role, role_adjustment in adjustments.get("roles", {}).items(): + role_payload = normalized.setdefault(role, {}) + for prerequisites in role_adjustment.get("add", {}).values(): + for prereq in prerequisites: + role_payload[canonical_permission_key(prereq)] = True + for dependents in role_adjustment.get("remove", {}).values(): + for dependent in dependents: + role_payload[canonical_permission_key(dependent)] = False + return normalized + + async def role_has_api_permission( db: AsyncSession, study_id: uuid.UUID, @@ -150,21 +278,58 @@ async def get_api_endpoint_permissions( return matrix +async def get_effective_api_endpoint_permissions( + db: AsyncSession, + study_id: uuid.UUID, +) -> dict[str, dict[str, dict[str, bool]]]: + """获取考虑前置权限后的有效权限矩阵。""" + matrix = await get_api_endpoint_permissions(db, study_id) + effective: dict[str, dict[str, dict[str, bool]]] = {} + for role, endpoints in matrix.items(): + effective[role] = {} + for endpoint_key in endpoints.keys(): + effective[role][endpoint_key] = { + "allowed": await role_has_api_permission( + db, + study_id, + role, + endpoint_key, + check_prerequisites=True, + ) + } + return effective + + async def replace_api_endpoint_permissions( db: AsyncSession, study_id: uuid.UUID, payload: dict[str, dict[str, bool]], + *, + confirm_prerequisite_adjustments: bool = False, ) -> dict[str, dict[str, dict[str, bool]]]: """更新 payload 中指定的角色权限项。未提交的权限项保持不变。 ADMIN 与 PM 权限不会被持久化：ADMIN 始终拥有全部权限，PM 默认拥有 全部项目权限，应当通过专门的渠道而不是项目权限矩阵调整。 """ - for role, endpoints in payload.items(): + normalized_payload = _canonicalize_payload(payload) + adjustments = await preview_api_permission_prerequisite_adjustments( + db, + study_id, + normalized_payload, + ) + if adjustments["requires_confirmation"]: + if not confirm_prerequisite_adjustments: + raise PrerequisitePermissionConfirmationRequired(adjustments) + normalized_payload = apply_prerequisite_adjustments_to_payload( + normalized_payload, + adjustments, + ) + + for role, endpoints in normalized_payload.items(): if role in ("ADMIN", "PM"): continue for endpoint_key, allowed in endpoints.items(): - endpoint_key = canonical_permission_key(endpoint_key) if endpoint_key not in API_ENDPOINT_PERMISSIONS: continue result = await db.execute( diff --git a/backend/tests/test_api_permissions.py b/backend/tests/test_api_permissions.py index 30693351..5d312ec3 100644 --- a/backend/tests/test_api_permissions.py +++ b/backend/tests/test_api_permissions.py @@ -99,6 +99,15 @@ def test_read_permissions_do_not_duplicate_list_and_detail_entries(): assert expected_read_keys <= set(API_ENDPOINT_PERMISSIONS) +def test_site_contact_display_source_permissions_cover_non_pm_roles(): + """负责人展示名来自中心列表，读取角色不应局限于 PM。""" + sites_read_roles = set(API_ENDPOINT_PERMISSIONS["sites:read"]["default_roles"]) + startup_auth_read_roles = set(API_ENDPOINT_PERMISSIONS["startup_auth:read"]["default_roles"]) + + assert {"PM", "CRA", "PV", "QA", "CTA"} <= sites_read_roles + assert {"PM", "CRA", "PV", "CTA"} <= startup_auth_read_roles + + @pytest.mark.asyncio async def test_legacy_read_permission_overrides_are_folded_into_canonical_read_key(db_session: AsyncSession): """历史项目权限中的列表读取 key 应继续作用到合并后的读取权限。""" @@ -623,10 +632,16 @@ async def test_full_permission_matrix_round_trips_to_backend_checks(db_session: for role_index, role in enumerate(configurable_roles) } - matrix = await replace_api_endpoint_permissions(db_session, study_id, payload) + matrix = await replace_api_endpoint_permissions( + db_session, + study_id, + payload, + confirm_prerequisite_adjustments=True, + ) for role in configurable_roles: - for endpoint_key, expected in payload[role].items(): + for endpoint_key in payload[role].keys(): + expected = matrix[role][endpoint_key]["allowed"] assert matrix[role][endpoint_key]["allowed"] is expected allowed = await role_has_api_permission( db_session, diff --git a/backend/tests/test_api_permissions_endpoints.py b/backend/tests/test_api_permissions_endpoints.py index bd5cc805..46926597 100644 --- a/backend/tests/test_api_permissions_endpoints.py +++ b/backend/tests/test_api_permissions_endpoints.py @@ -5,7 +5,11 @@ import uuid from fastapi.testclient import TestClient from sqlalchemy.ext.asyncio import AsyncSession -from app.core.project_permissions import get_api_endpoint_permissions, replace_api_endpoint_permissions +from app.core.project_permissions import ( + get_api_endpoint_permissions, + preview_api_permission_prerequisite_adjustments, + replace_api_endpoint_permissions, +) from app.models.api_endpoint_permission import ApiEndpointPermission @@ -105,6 +109,7 @@ async def test_replace_api_endpoint_permissions_accepts_legacy_read_alias_denial "subjects:list": False, } }, + confirm_prerequisite_adjustments=True, ) assert "subjects:list" not in result["CRA"] @@ -314,6 +319,84 @@ async def test_replace_api_endpoint_permissions_preserves_unsubmitted_roles(db_s assert result["PV"]["subjects:create"]["allowed"] is True +@pytest.mark.asyncio +async def test_preview_reports_prerequisites_to_add_for_custom_role(db_session: AsyncSession): + """授权子权限前应提示需要补齐的前置权限。""" + study_id = uuid.uuid4() + + preview = await preview_api_permission_prerequisite_adjustments( + db_session, + study_id, + {"DATA_MANAGER": {"subjects:create": True}}, + ) + + assert preview["requires_confirmation"] is True + assert preview["roles"]["DATA_MANAGER"]["add"] == { + "subjects:create": ["subjects:read", "sites:read"], + } + assert preview["roles"]["DATA_MANAGER"]["remove"] == {} + + +@pytest.mark.asyncio +async def test_replace_rejects_unconfirmed_missing_prerequisites(db_session: AsyncSession): + """未确认时不应保存缺失前置权限的授权组合。""" + study_id = uuid.uuid4() + + with pytest.raises(ValueError, match="需要确认前置权限调整"): + await replace_api_endpoint_permissions( + db_session, + study_id, + {"DATA_MANAGER": {"subjects:create": True}}, + ) + + +@pytest.mark.asyncio +async def test_replace_confirmed_adds_missing_prerequisites(db_session: AsyncSession): + """确认后应补齐授权子权限需要的前置权限。""" + study_id = uuid.uuid4() + + result = await replace_api_endpoint_permissions( + db_session, + study_id, + {"DATA_MANAGER": {"subjects:create": True}}, + confirm_prerequisite_adjustments=True, + ) + + assert result["DATA_MANAGER"]["subjects:create"]["allowed"] is True + assert result["DATA_MANAGER"]["subjects:read"]["allowed"] is True + assert result["DATA_MANAGER"]["sites:read"]["allowed"] is True + + +@pytest.mark.asyncio +async def test_replace_confirmed_removes_dependents_when_prerequisite_denied(db_session: AsyncSession): + """确认取消前置权限时，应消除依赖它的下游权限。""" + study_id = uuid.uuid4() + + await replace_api_endpoint_permissions( + db_session, + study_id, + { + "DATA_MANAGER": { + "subjects:read": True, + "sites:read": True, + "subjects:create": True, + } + }, + confirm_prerequisite_adjustments=True, + ) + + result = await replace_api_endpoint_permissions( + db_session, + study_id, + {"DATA_MANAGER": {"sites:read": False}}, + confirm_prerequisite_adjustments=True, + ) + + assert result["DATA_MANAGER"]["sites:read"]["allowed"] is False + assert result["DATA_MANAGER"]["subjects:create"]["allowed"] is False + assert result["DATA_MANAGER"]["subjects:read"]["allowed"] is True + + @pytest.mark.asyncio async def test_get_api_endpoint_permissions_structure(db_session: AsyncSession): """测试权限矩阵的结构""" diff --git a/docs/plans/2026-06-04-permission-prerequisite-optimization-design.md b/docs/plans/2026-06-04-permission-prerequisite-optimization-design.md new file mode 100644 index 00000000..7b338b1c --- /dev/null +++ b/docs/plans/2026-06-04-permission-prerequisite-optimization-design.md @@ -0,0 +1,25 @@ +# 项目权限前置审查优化设计 + +## 目标 + +项目权限保存时必须先审查前置权限。授权子权限缺少前置权限时，系统提示授权人确认补齐；取消前置权限影响下游权限时，系统提示授权人确认消除。未经确认的不一致权限组合不能落库。 + +## 方案 + +- `API_ENDPOINT_PERMISSIONS[*].prerequisite_permissions` 作为前置权限单一事实源，运行时映射由它生成。 +- 后端保存权限前合并当前矩阵和提交草稿，计算缺失前置权限与受影响下游权限。 +- 未确认时如存在补齐或消除项，接口返回 `409 Conflict` 和调整详情。 +- 确认后后端应用调整：授权子权限时补齐前置权限，取消前置权限时消除受影响下游权限。 +- `/me` 返回有效权限，避免前端菜单或按钮展示运行时不可用的授权。 +- 前端角色编辑器保存前本地预检，弹窗展示补齐/消除项，授权人确认后再提交确认标记。 + +## 测试范围 + +- 后端：预检结果、未确认拒绝、确认补齐、确认消除、有效权限矩阵。 +- 前端：操作元数据包含前置权限、保存前提示确认、确认后提交确认标记。 + +## 约束 + +- 不做 git 分支、提交或推送。 +- 不引入新权限抽象表，保持 KISS。 +- 不静默修改授权人的草稿，所有补齐/消除必须经过确认。 diff --git a/frontend/src/api/projectPermissions.ts b/frontend/src/api/projectPermissions.ts index 5f9d2d46..21e6d195 100644 --- a/frontend/src/api/projectPermissions.ts +++ b/frontend/src/api/projectPermissions.ts @@ -2,6 +2,7 @@ import { apiGet, apiPut, apiPost, apiDelete, type ApiRequestConfig } from "./axi import type { ApiEndpointPermissionsResponse, ApiEndpointPermissionsUpdate, + ApiOperation, PermissionMetricsResponse, CacheStatsResponse, AlertsResponse, @@ -21,11 +22,17 @@ export const fetchApiEndpointPermissions = (studyId: string, config?: ApiRequest export const fetchMyApiEndpointPermissions = (studyId: string, config?: ApiRequestConfig) => apiGet(`/api/v1/studies/${studyId}/api-permissions/me`, config); -export const updateApiEndpointPermissions = (studyId: string, payload: ApiEndpointPermissionsUpdate) => - apiPut(`/api/v1/studies/${studyId}/api-permissions`, payload); +export const updateApiEndpointPermissions = ( + studyId: string, + payload: ApiEndpointPermissionsUpdate, + options?: { confirm_prerequisite_adjustments?: boolean }, +) => + apiPut(`/api/v1/studies/${studyId}/api-permissions`, payload, { + params: options?.confirm_prerequisite_adjustments ? { confirm_prerequisite_adjustments: true } : undefined, + }); export const fetchApiOperations = () => - apiGet<{ operations: Array<{ operation_key: string; module: string; action: string; description: string; default_roles: string[] }> }>(`/api/v1/api-permissions/operations`); + apiGet<{ operations: ApiOperation[] }>(`/api/v1/api-permissions/operations`); // 权限系统监控API export const fetchPermissionMetrics = () => diff --git a/frontend/src/components/ApiEndpointPermissions.test.ts b/frontend/src/components/ApiEndpointPermissions.test.ts index a45b36ef..44842edc 100644 --- a/frontend/src/components/ApiEndpointPermissions.test.ts +++ b/frontend/src/components/ApiEndpointPermissions.test.ts @@ -10,11 +10,11 @@ vi.mock("@/api/projectPermissions", () => ({ fetchApiOperations: vi.fn().mockResolvedValue({ data: { operations: [] } }), fetchPermissionTemplates: vi.fn().mockResolvedValue({ data: [ - { category: "PM", name: "PM", description: "项目负责人，统筹项目全局，协调进度、资源与关键决策。" }, - { category: "CRA", name: "CRA", description: "负责各中心临床监查执行，跟进现场质量、数据和问题闭环。" }, - { category: "CTA", name: "CTA", description: "负责合同、药品及相关项目事务管理，保障执行支持与物资协同。" }, - { category: "QA", name: "QA", description: "负责医学审核与稽查，关注质量风险、合规性和医学一致性。" }, { category: "PV", name: "PV", description: "负责药物警戒相关工作，跟踪安全性事件并支持风险评估。" }, + { category: "QA", name: "QA", description: "负责医学审核与稽查，关注质量风险、合规性和医学一致性。" }, + { category: "CTA", name: "CTA", description: "负责合同、药品及相关项目事务管理，保障执行支持与物资协同。" }, + { category: "CRA", name: "CRA", description: "负责各中心临床监查执行，跟进现场质量、数据和问题闭环。" }, + { category: "PM", name: "PM", description: "项目负责人，统筹项目全局，协调进度、资源与关键决策。" }, ], }), })); @@ -96,7 +96,7 @@ describe("ApiEndpointPermissions.vue", () => { expect(source).not.toContain(':label="role"'); }); - it("sorts matrix role columns with the role list order", async () => { + it("pins PM first in matrix role columns even when templates return PM last", async () => { const wrapper = mount(ApiEndpointPermissions, { props: { project: { id: "test-id", name: "Test Project" }, @@ -117,7 +117,7 @@ describe("ApiEndpointPermissions.vue", () => { }); await vi.dynamicImportSettled(); - expect((wrapper.vm as any).roles).toEqual(["PM", "CRA", "CTA", "QA", "PV"]); + expect((wrapper.vm as any).roles).toEqual(["PM", "PV", "QA", "CTA", "CRA"]); }); it("sorts project permission modules by sidebar menu order", async () => { diff --git a/frontend/src/components/PermissionTemplateSelector.test.ts b/frontend/src/components/PermissionTemplateSelector.test.ts index 6b8d9335..17a3268c 100644 --- a/frontend/src/components/PermissionTemplateSelector.test.ts +++ b/frontend/src/components/PermissionTemplateSelector.test.ts @@ -20,6 +20,7 @@ describe("PermissionTemplateSelector", () => { it("reads current project permissions by role key, not by role label", () => { const source = readSource(); + expect(source).toContain('v-for="template in sortedTemplates"'); expect(source).toContain('{{ template.name }}'); expect(source).toContain("refreshKey?: number;"); expect(source).toContain("watch(() => props.refreshKey, loadTemplates);"); @@ -32,6 +33,15 @@ describe("PermissionTemplateSelector", () => { expect(source).toContain("emit('edit-role', template.category!)"); }); + it("sorts role cards with the shared role template order", () => { + const source = readSource(); + + expect(source).toContain("useRoleTemplateMeta"); + expect(source).toContain("compareRolesByTemplateOrder"); + expect(source).toContain("const sortedTemplates = computed"); + expect(source).toContain("compareRolesByTemplateOrder(a.category, b.category)"); + }); + it("does not keep hard-coded preset role labels or icons", () => { const source = readSource(); diff --git a/frontend/src/components/PermissionTemplateSelector.vue b/frontend/src/components/PermissionTemplateSelector.vue index 18dc226f..e7428e8d 100644 --- a/frontend/src/components/PermissionTemplateSelector.vue +++ b/frontend/src/components/PermissionTemplateSelector.vue @@ -9,7 +9,7 @@