完善项目权限前置依赖保存校验
- 以接口权限定义中的 prerequisite_permissions 作为前置依赖单一事实源，生成运行时前置权限映射\n- 保存项目角色权限前预检缺失前置权限与受影响下游权限，未确认时返回 409 调整详情\n- 确认保存时自动合并补齐前置权限与取消下游权限，并提供有效权限矩阵读取接口\n- 前端角色权限编辑改为保存时执行依赖校验，弹窗展示需补充前置权限和受影响下游权限\n- 新增编辑权限取消按钮，清理权限选择即时确认弹窗残留\n- 补充后端接口测试、前端权限编辑测试与优化设计文档
This commit is contained in:
Cheng Zhou
@@ -36,7 +36,7 @@ API_ENDPOINT_PERMISSIONS = {
|
||||
"action": "write",
|
||||
"description": "创建参与者",
|
||||
"default_roles": ["PM", "CRA"],
|
||||
"prerequisite_permissions": ["sites:read"],
|
||||
"prerequisite_permissions": ["subjects:read", "sites:read"],
|
||||
},
|
||||
"subjects:read": {
|
||||
"module": "subjects",
|
||||
@@ -50,14 +50,14 @@ API_ENDPOINT_PERMISSIONS = {
|
||||
"action": "write",
|
||||
"description": "更新参与者",
|
||||
"default_roles": ["PM", "CRA"],
|
||||
"prerequisite_permissions": ["sites:read"],
|
||||
"prerequisite_permissions": ["subjects:read", "sites:read"],
|
||||
},
|
||||
"subjects:delete": {
|
||||
"module": "subjects",
|
||||
"action": "write",
|
||||
"description": "删除参与者",
|
||||
"default_roles": ["PM"],
|
||||
"prerequisite_permissions": ["sites:read"],
|
||||
"prerequisite_permissions": ["subjects:read", "sites:read"],
|
||||
},
|
||||
# 访视管理 (visits)
|
||||
"visits:create": {
|
||||
@@ -94,7 +94,7 @@ API_ENDPOINT_PERMISSIONS = {
|
||||
"action": "write",
|
||||
"description": "创建参与者AE",
|
||||
"default_roles": ["PM", "CRA", "PV", "QA"],
|
||||
"prerequisite_permissions": ["subjects:read", "sites:read"],
|
||||
"prerequisite_permissions": ["subject_aes:read", "subjects:read", "sites:read"],
|
||||
},
|
||||
"subject_aes:read": {
|
||||
"module": "subjects",
|
||||
@@ -123,7 +123,7 @@ API_ENDPOINT_PERMISSIONS = {
|
||||
"action": "write",
|
||||
"description": "创建合同费用",
|
||||
"default_roles": ["PM"],
|
||||
"prerequisite_permissions": ["sites:read"],
|
||||
"prerequisite_permissions": ["fees_contracts:read", "sites:read"],
|
||||
},
|
||||
"fees_contracts:read": {
|
||||
"module": "fees",
|
||||
@@ -137,14 +137,14 @@ API_ENDPOINT_PERMISSIONS = {
|
||||
"action": "write",
|
||||
"description": "更新合同费用",
|
||||
"default_roles": ["PM"],
|
||||
"prerequisite_permissions": ["sites:read"],
|
||||
"prerequisite_permissions": ["fees_contracts:read", "sites:read"],
|
||||
},
|
||||
"fees_contracts:delete": {
|
||||
"module": "fees",
|
||||
"action": "write",
|
||||
"description": "删除合同费用",
|
||||
"default_roles": ["PM"],
|
||||
"prerequisite_permissions": ["sites:read"],
|
||||
"prerequisite_permissions": ["fees_contracts:read", "sites:read"],
|
||||
},
|
||||
# 项目成员管理
|
||||
"project_members:create": {
|
||||
@@ -384,30 +384,35 @@ API_ENDPOINT_PERMISSIONS = {
|
||||
"action": "read",
|
||||
"description": "查询立项配置",
|
||||
"default_roles": ["PM", "CRA", "PV", "QA", "CTA"],
|
||||
"prerequisite_permissions": [],
|
||||
},
|
||||
"setup_config:update": {
|
||||
"module": "setup_config",
|
||||
"action": "write",
|
||||
"description": "保存立项配置草稿",
|
||||
"default_roles": ["PM"],
|
||||
"prerequisite_permissions": ["setup_config:read"],
|
||||
},
|
||||
"setup_config:publish": {
|
||||
"module": "setup_config",
|
||||
"action": "write",
|
||||
"description": "发布立项配置",
|
||||
"default_roles": ["PM"],
|
||||
"prerequisite_permissions": ["setup_config:read"],
|
||||
},
|
||||
"setup_config:rollback": {
|
||||
"module": "setup_config",
|
||||
"action": "write",
|
||||
"description": "回滚立项配置版本",
|
||||
"default_roles": ["PM"],
|
||||
"prerequisite_permissions": ["setup_config:read"],
|
||||
},
|
||||
"setup_config:delete_version": {
|
||||
"module": "setup_config",
|
||||
"action": "delete",
|
||||
"description": "删除立项配置版本",
|
||||
"default_roles": ["PM"],
|
||||
"prerequisite_permissions": ["setup_config:read"],
|
||||
},
|
||||
# 项目里程碑管理
|
||||
"project_milestones:read": {
|
||||
@@ -640,6 +645,36 @@ API_ENDPOINT_PERMISSIONS = {
|
||||
},
|
||||
}
|
||||
|
||||
def _operation_read_candidates(operation_key: str) -> list[str]:
|
||||
prefix = operation_key.split(":", 1)[0]
|
||||
candidates = []
|
||||
for read_key in (f"{prefix}:read", f"{prefix}:list"):
|
||||
canonical_key = canonical_permission_key(read_key)
|
||||
if canonical_key in API_ENDPOINT_PERMISSIONS and canonical_key not in candidates:
|
||||
candidates.append(canonical_key)
|
||||
return candidates
|
||||
|
||||
|
||||
def _normalized_prerequisite_permissions(operation_key: str, config: dict) -> list[str]:
|
||||
prerequisites = [
|
||||
canonical_permission_key(key)
|
||||
for key in config.get("prerequisite_permissions", [])
|
||||
]
|
||||
verb = operation_key.split(":")[-1]
|
||||
if verb in {"create", "update", "delete", "export", "publish", "rollback", "delete_version"}:
|
||||
for read_key in _operation_read_candidates(operation_key):
|
||||
if read_key != operation_key and read_key not in prerequisites:
|
||||
prerequisites.insert(0, read_key)
|
||||
return list(dict.fromkeys(prerequisites))
|
||||
|
||||
|
||||
for _operation_key, _operation_config in API_ENDPOINT_PERMISSIONS.items():
|
||||
_operation_config["prerequisite_permissions"] = _normalized_prerequisite_permissions(
|
||||
_operation_key,
|
||||
_operation_config,
|
||||
)
|
||||
|
||||
|
||||
# 向后兼容：业务操作名到接口级权限的映射
|
||||
# 用于在接口级权限未配置时，回退到模块级权限
|
||||
OPERATION_TO_ENDPOINTS: dict[str, dict[str, list[str]]] = {
|
||||
@@ -830,48 +865,11 @@ OPERATION_TO_ENDPOINTS: dict[str, dict[str, list[str]]] = {
|
||||
# 项目级权限角色列表
|
||||
PROJECT_PERMISSION_ROLES = ["PM", "CRA", "PV", "QA", "CTA"]
|
||||
|
||||
# 前置权限映射表（用于权限检查）
|
||||
# 定义每个操作需要的前置权限
|
||||
# 前置权限映射表（用于权限检查），由权限定义生成，避免展示与运行时不一致。
|
||||
OPERATION_PREREQUISITES: dict[str, list[str]] = {
|
||||
# 参与者管理
|
||||
"subjects:create": ["sites:read"],
|
||||
"subjects:update": ["sites:read"],
|
||||
"subjects:delete": ["sites:read"],
|
||||
|
||||
# 访视管理
|
||||
"visits:create": ["subjects:read", "sites:read"],
|
||||
"visits:update": ["subjects:read", "sites:read"],
|
||||
"visits:delete": ["subjects:read", "sites:read"],
|
||||
|
||||
# 参与者AE
|
||||
"subject_aes:create": ["subjects:read", "sites:read"],
|
||||
"subject_aes:update": ["subject_aes:read", "subjects:read", "sites:read"],
|
||||
"subject_aes:delete": ["subject_aes:read", "subjects:read", "sites:read"],
|
||||
|
||||
# 合同费用
|
||||
"fees_contracts:create": ["sites:read"],
|
||||
"fees_contracts:update": ["sites:read"],
|
||||
"fees_contracts:delete": ["sites:read"],
|
||||
|
||||
# 药物发货
|
||||
"drug_shipments:create": ["sites:read"],
|
||||
"drug_shipments:update": ["sites:read"],
|
||||
"drug_shipments:delete": ["sites:read"],
|
||||
|
||||
# 参与者PD
|
||||
"subject_pds:create": ["subjects:read", "sites:read"],
|
||||
"subject_pds:update": ["subject_pds:list", "subjects:read", "sites:read"],
|
||||
"subject_pds:delete": ["subject_pds:list", "subjects:read", "sites:read"],
|
||||
|
||||
# 病史记录
|
||||
"subject_histories:create": ["subjects:read"],
|
||||
"subject_histories:update": ["subjects:read"],
|
||||
"subject_histories:delete": ["subjects:read"],
|
||||
|
||||
# 监查访视问题
|
||||
"monitoring_issues:create": ["sites:read"],
|
||||
"monitoring_issues:update": ["sites:read"],
|
||||
"monitoring_issues:delete": ["sites:read"],
|
||||
key: config["prerequisite_permissions"]
|
||||
for key, config in API_ENDPOINT_PERMISSIONS.items()
|
||||
if config["prerequisite_permissions"]
|
||||
}
|
||||
|
||||
# 系统级权限定义
|
||||
|
||||
Reference in New Issue
Block a user