完善项目权限前置依赖保存校验

- 以接口权限定义中的 prerequisite_permissions 作为前置依赖单一事实源，生成运行时前置权限映射\n- 保存项目角色权限前预检缺失前置权限与受影响下游权限，未确认时返回 409 调整详情\n- 确认保存时自动合并补齐前置权限与取消下游权限，并提供有效权限矩阵读取接口\n- 前端角色权限编辑改为保存时执行依赖校验，弹窗展示需补充前置权限和受影响下游权限\n- 新增编辑权限取消按钮，清理权限选择即时确认弹窗残留\n- 补充后端接口测试、前端权限编辑测试与优化设计文档

backend/tests/test_api_permissions_endpoints.py

@@ -5,7 +5,11 @@ import uuid
 from fastapi.testclient import TestClient
 from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.project_permissions import get_api_endpoint_permissions, replace_api_endpoint_permissions
+from app.core.project_permissions import (
+    get_api_endpoint_permissions,
+    preview_api_permission_prerequisite_adjustments,
+    replace_api_endpoint_permissions,
+)
 from app.models.api_endpoint_permission import ApiEndpointPermission
 
 
@@ -105,6 +109,7 @@ async def test_replace_api_endpoint_permissions_accepts_legacy_read_alias_denial
                 "subjects:list": False,
             }
         },
+        confirm_prerequisite_adjustments=True,
     )
 
     assert "subjects:list" not in result["CRA"]
@@ -314,6 +319,84 @@ async def test_replace_api_endpoint_permissions_preserves_unsubmitted_roles(db_s
     assert result["PV"]["subjects:create"]["allowed"] is True
 
 
+@pytest.mark.asyncio
+async def test_preview_reports_prerequisites_to_add_for_custom_role(db_session: AsyncSession):
+    """授权子权限前应提示需要补齐的前置权限。"""
+    study_id = uuid.uuid4()
+
+    preview = await preview_api_permission_prerequisite_adjustments(
+        db_session,
+        study_id,
+        {"DATA_MANAGER": {"subjects:create": True}},
+    )
+
+    assert preview["requires_confirmation"] is True
+    assert preview["roles"]["DATA_MANAGER"]["add"] == {
+        "subjects:create": ["subjects:read", "sites:read"],
+    }
+    assert preview["roles"]["DATA_MANAGER"]["remove"] == {}
+
+
+@pytest.mark.asyncio
+async def test_replace_rejects_unconfirmed_missing_prerequisites(db_session: AsyncSession):
+    """未确认时不应保存缺失前置权限的授权组合。"""
+    study_id = uuid.uuid4()
+
+    with pytest.raises(ValueError, match="需要确认前置权限调整"):
+        await replace_api_endpoint_permissions(
+            db_session,
+            study_id,
+            {"DATA_MANAGER": {"subjects:create": True}},
+        )
+
+
+@pytest.mark.asyncio
+async def test_replace_confirmed_adds_missing_prerequisites(db_session: AsyncSession):
+    """确认后应补齐授权子权限需要的前置权限。"""
+    study_id = uuid.uuid4()
+
+    result = await replace_api_endpoint_permissions(
+        db_session,
+        study_id,
+        {"DATA_MANAGER": {"subjects:create": True}},
+        confirm_prerequisite_adjustments=True,
+    )
+
+    assert result["DATA_MANAGER"]["subjects:create"]["allowed"] is True
+    assert result["DATA_MANAGER"]["subjects:read"]["allowed"] is True
+    assert result["DATA_MANAGER"]["sites:read"]["allowed"] is True
+
+
+@pytest.mark.asyncio
+async def test_replace_confirmed_removes_dependents_when_prerequisite_denied(db_session: AsyncSession):
+    """确认取消前置权限时，应消除依赖它的下游权限。"""
+    study_id = uuid.uuid4()
+
+    await replace_api_endpoint_permissions(
+        db_session,
+        study_id,
+        {
+            "DATA_MANAGER": {
+                "subjects:read": True,
+                "sites:read": True,
+                "subjects:create": True,
+            }
+        },
+        confirm_prerequisite_adjustments=True,
+    )
+
+    result = await replace_api_endpoint_permissions(
+        db_session,
+        study_id,
+        {"DATA_MANAGER": {"sites:read": False}},
+        confirm_prerequisite_adjustments=True,
+    )
+
+    assert result["DATA_MANAGER"]["sites:read"]["allowed"] is False
+    assert result["DATA_MANAGER"]["subjects:create"]["allowed"] is False
+    assert result["DATA_MANAGER"]["subjects:read"]["allowed"] is True
+
+
 @pytest.mark.asyncio
 async def test_get_api_endpoint_permissions_structure(db_session: AsyncSession):
     """测试权限矩阵的结构"""