完善权限缓存与监控指标

backend/tests/test_api_permissions.py

@@ -2,9 +2,12 @@
 
 import pytest
 import uuid
+from sqlalchemy import delete
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.project_permissions import role_has_api_permission
+from app.core.permission_cache import PermissionCache, set_permission_cache
+from app.core.permission_monitor import PermissionMonitor, set_permission_monitor
 from app.models.api_endpoint_permission import ApiEndpointPermission
 
 
@@ -208,3 +211,75 @@ async def test_api_permission_unknown_endpoint(db_session: AsyncSession):
         db_session, study_id, "CRA", "unknown:endpoint", check_prerequisites=False
     )
     assert result is False
+
+
+@pytest.mark.asyncio
+async def test_api_permission_check_uses_project_permission_cache(db_session: AsyncSession):
+    """测试接口权限检查会复用项目权限缓存并记录命中指标"""
+    cache = PermissionCache()
+    monitor = PermissionMonitor()
+    set_permission_cache(cache)
+    set_permission_monitor(monitor)
+    study_id = uuid.uuid4()
+
+    db_session.add(
+        ApiEndpointPermission(
+            study_id=study_id,
+            role="CRA",
+            endpoint_key="subjects:create",
+            allowed=True,
+        )
+    )
+    await db_session.commit()
+
+    first_result = await role_has_api_permission(
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
+    )
+    await db_session.execute(
+        delete(ApiEndpointPermission).where(ApiEndpointPermission.study_id == study_id)
+    )
+    await db_session.commit()
+    second_result = await role_has_api_permission(
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
+    )
+
+    cache_metrics = monitor.get_metrics()["cache_metrics"]
+    assert first_result is True
+    assert second_result is True
+    assert cache.get_cache_stats()["project_permissions_count"] == 1
+    assert cache_metrics["cache_misses"] == 1
+    assert cache_metrics["cache_hits"] == 1
+
+
+@pytest.mark.asyncio
+async def test_replace_api_endpoint_permissions_invalidates_project_permission_cache(
+    db_session: AsyncSession,
+):
+    """测试替换权限后会失效旧缓存并记录失效指标"""
+    from app.core.project_permissions import replace_api_endpoint_permissions
+
+    cache = PermissionCache()
+    monitor = PermissionMonitor()
+    set_permission_cache(cache)
+    set_permission_monitor(monitor)
+    study_id = uuid.uuid4()
+
+    await replace_api_endpoint_permissions(
+        db_session,
+        study_id,
+        {"CRA": {"subjects:create": True}},
+    )
+    assert cache.get_cache_stats()["project_permissions_count"] == 1
+
+    await replace_api_endpoint_permissions(
+        db_session,
+        study_id,
+        {"CRA": {"subjects:create": False}},
+    )
+
+    result = await role_has_api_permission(
+        db_session, study_id, "CRA", "subjects:create", check_prerequisites=False
+    )
+    cache_metrics = monitor.get_metrics()["cache_metrics"]
+    assert result is False
+    assert cache_metrics["cache_invalidations"] == 2