Step 7：AE + 风险/问题管理（PV）

backend/app/api/v1/issues.py

@@ -0,0 +1,156 @@
+import uuid
+from datetime import date
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.deps import get_current_user, get_db_session, require_study_member
+from app.crud import audit as audit_crud
+from app.crud import issue as issue_crud
+from app.crud import member as member_crud
+from app.crud import study as study_crud
+from app.schemas.issue import IssueCreate, IssueRead, IssueUpdate
+
+router = APIRouter()
+
+ALLOWED_EDIT_ROLES = {"PM", "PV"}
+
+
+async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
+    study = await study_crud.get(db, study_id)
+    if not study:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Study not found")
+    return study
+
+
+async def _get_member_role(db: AsyncSession, study_id: uuid.UUID, user_id: uuid.UUID) -> str | None:
+    member = await member_crud.get_member(db, study_id, user_id)
+    return member.role_in_study if member else None
+
+
+def _is_overdue(issue: IssueRead) -> bool:
+    return bool(issue.due_date and date.today() > issue.due_date and issue.status != "CLOSED")
+
+
+@router.post(
+    "/",
+    response_model=IssueRead,
+    status_code=status.HTTP_201_CREATED,
+    dependencies=[Depends(require_study_member())],
+)
+async def create_issue(
+    study_id: uuid.UUID,
+    issue_in: IssueCreate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> IssueRead:
+    await _ensure_study_exists(db, study_id)
+    member_role = await _get_member_role(db, study_id, current_user.id)
+    if current_user.role != "ADMIN" and member_role not in ALLOWED_EDIT_ROLES:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions")
+    try:
+        issue = await issue_crud.create_issue(db, study_id, issue_in, created_by=current_user.id)
+    except ValueError as exc:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
+    await audit_crud.log_action(
+        db,
+        study_id=study_id,
+        entity_type="issue",
+        entity_id=issue.id,
+        action="CREATE_ISSUE",
+        detail=f"Issue {issue.id} created",
+        operator_id=current_user.id,
+        operator_role=current_user.role,
+    )
+    data = IssueRead.model_validate(issue)
+    data.is_overdue = _is_overdue(data)
+    return data
+
+
+@router.get(
+    "/",
+    response_model=list[IssueRead],
+    dependencies=[Depends(require_study_member())],
+)
+async def list_issues(
+    study_id: uuid.UUID,
+    status_filter: str | None = None,
+    level: str | None = None,
+    category: str | None = None,
+    overdue: bool | None = None,
+    db: AsyncSession = Depends(get_db_session),
+) -> list[IssueRead]:
+    await _ensure_study_exists(db, study_id)
+    issues = await issue_crud.list_issues(db, study_id, status=status_filter, level=level, category=category, overdue=overdue)
+    result: list[IssueRead] = []
+    for item in issues:
+        obj = IssueRead.model_validate(item)
+        obj.is_overdue = _is_overdue(obj)
+        result.append(obj)
+    return result
+
+
+@router.get(
+    "/{issue_id}",
+    response_model=IssueRead,
+    dependencies=[Depends(require_study_member())],
+)
+async def get_issue(
+    study_id: uuid.UUID,
+    issue_id: uuid.UUID,
+    db: AsyncSession = Depends(get_db_session),
+) -> IssueRead:
+    await _ensure_study_exists(db, study_id)
+    issue = await issue_crud.get_issue(db, issue_id)
+    if not issue or issue.study_id != study_id:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Issue not found")
+    data = IssueRead.model_validate(issue)
+    data.is_overdue = _is_overdue(data)
+    return data
+
+
+@router.patch(
+    "/{issue_id}",
+    response_model=IssueRead,
+    dependencies=[Depends(require_study_member())],
+)
+async def update_issue(
+    study_id: uuid.UUID,
+    issue_id: uuid.UUID,
+    issue_in: IssueUpdate,
+    db: AsyncSession = Depends(get_db_session),
+    current_user=Depends(get_current_user),
+) -> IssueRead:
+    await _ensure_study_exists(db, study_id)
+    issue = await issue_crud.get_issue(db, issue_id)
+    if not issue or issue.study_id != study_id:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Issue not found")
+
+    member_role = await _get_member_role(db, study_id, current_user.id)
+    if current_user.role != "ADMIN" and member_role not in ALLOWED_EDIT_ROLES:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions")
+
+    old_status = issue.status
+    old_level = issue.level
+    updated = await issue_crud.update_issue(db, issue, issue_in)
+
+    detail = None
+    action = "UPDATE_ISSUE"
+    if issue_in.status and issue_in.status != old_status:
+        detail = f"Issue {issue_id} status {old_status} -> {issue_in.status}"
+        action = "ISSUE_STATUS_CHANGE"
+    elif issue_in.level and issue_in.level != old_level:
+        detail = f"Issue {issue_id} level {old_level} -> {issue_in.level}"
+    await audit_crud.log_action(
+        db,
+        study_id=study_id,
+        entity_type="issue",
+        entity_id=issue_id,
+        action=action,
+        detail=detail or "Issue updated",
+        operator_id=current_user.id,
+        operator_role=current_user.role,
+    )
+    data = IssueRead.model_validate(updated)
+    data.is_overdue = _is_overdue(data)
+    return data