文件版本管理-初步优化

backend/app/core/rbac.py

@@ -0,0 +1,45 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Iterable
+
+
+@dataclass(frozen=True)
+class Scope:
+    trial_id: str | None = None
+    site_id: str | None = None
+    doc_type: str | None = None
+
+
+ROLE_ACTIONS: dict[str, set[str]] = {
+    "ADMIN": {
+        "view",
+        "create_document",
+        "create_version",
+        "submit",
+        "approve",
+        "distribute",
+        "ack",
+        "delete_document",
+    },
+    "QA": {"view", "create_document", "create_version", "submit", "approve", "distribute", "ack"},
+    "PM": {"view", "create_document", "create_version", "submit", "approve", "distribute", "ack", "delete_document"},
+    "CRA": {"view", "create_version", "submit", "ack"},
+    "PV": {"view", "create_version", "submit", "ack"},
+    "IMP": {"view", "create_version", "submit", "ack"},
+}
+
+
+def is_allowed(action: str, user, membership) -> bool:
+    role_value = user.role.value if hasattr(user.role, "value") else str(user.role)
+    allowed = ROLE_ACTIONS.get(role_value, set())
+    if action in allowed:
+        return True
+    member_role = getattr(membership, "role_in_study", None)
+    if member_role:
+        return action in ROLE_ACTIONS.get(member_role, set())
+    return False
+
+
+def is_scope_allowed(action: str, scope: Scope, user, membership) -> bool:
+    return is_allowed(action, user, membership)