import uuid from fastapi import APIRouter, Depends, HTTPException, status from sqlalchemy import select from sqlalchemy.ext.asyncio import AsyncSession from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission from app.crud import audit as audit_crud from app.crud import site as site_crud from app.crud import subject as subject_crud from app.crud import study as study_crud from app.models.ae import AdverseEvent from app.schemas.subject import SubjectCreate, SubjectRead, SubjectUpdate router = APIRouter() async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID): study = await study_crud.get(db, study_id) if not study: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在") return study async def _ensure_subject_active(db: AsyncSession, subject) -> None: if not subject or not subject.site_id: return site = await site_crud.get_site(db, subject.site_id) if not site or not site.is_active: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="中心已停用") @router.post( "/", response_model=SubjectRead, status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())], ) async def create_subject( study_id: uuid.UUID, subject_in: SubjectCreate, db: AsyncSession = Depends(get_db_session), current_user=Depends(get_current_user), ) -> SubjectRead: await _ensure_study_exists(db, study_id) cra_scope = await get_cra_site_scope(db, study_id, current_user) if cra_scope and subject_in.site_id not in cra_scope[0]: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足") try: subject = await subject_crud.create_subject(db, study_id, subject_in) except ValueError as exc: raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc await audit_crud.log_action( db, study_id=study_id, entity_type="subject", entity_id=subject.id, action="CREATE_SUBJECT", detail=f"参与者 {subject.subject_no} 已创建", operator_id=current_user.id, operator_role=current_user.role, ) return subject @router.get( "/", response_model=list[SubjectRead], dependencies=[Depends(require_study_permission("subjects", "read"))], ) async def list_subjects( study_id: uuid.UUID, site_id: uuid.UUID | None = None, db: AsyncSession = Depends(get_db_session), current_user=Depends(get_current_user), ) -> list[SubjectRead]: await _ensure_study_exists(db, study_id) cra_scope = await get_cra_site_scope(db, study_id, current_user) site_ids = cra_scope[0] if cra_scope else None if site_id and site_ids is not None and site_id not in site_ids: return [] subjects = await subject_crud.list_subjects(db, study_id, site_id=site_id, site_ids=site_ids) subject_list = list(subjects) if not subject_list: return [] subject_ids = [subject.id for subject in subject_list] ae_rows = await db.execute( select(AdverseEvent.subject_id, AdverseEvent.is_sae, AdverseEvent.is_susar).where( AdverseEvent.study_id == study_id, AdverseEvent.subject_id.in_(subject_ids), ) ) ae_flags: dict[uuid.UUID, dict[str, bool]] = {} for row in ae_rows.all(): sid = row[0] if not sid: continue if sid not in ae_flags: ae_flags[sid] = {"has_ae": True, "has_sae": False, "has_susar": False} if row[1]: ae_flags[sid]["has_sae"] = True if row[2]: ae_flags[sid]["has_susar"] = True result: list[SubjectRead] = [] for subject in subject_list: data = SubjectRead.model_validate(subject) flags = ae_flags.get(subject.id, {"has_ae": False, "has_sae": False, "has_susar": False}) data.has_ae = flags["has_ae"] data.has_sae = flags["has_sae"] data.has_susar = flags["has_susar"] result.append(data) return result @router.get( "/{subject_id}", response_model=SubjectRead, dependencies=[Depends(require_study_permission("subjects", "read"))], ) async def get_subject( study_id: uuid.UUID, subject_id: uuid.UUID, db: AsyncSession = Depends(get_db_session), current_user=Depends(get_current_user), ) -> SubjectRead: await _ensure_study_exists(db, study_id) subject = await subject_crud.get_subject(db, subject_id) if not subject or subject.study_id != study_id: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="参与者不存在") cra_scope = await get_cra_site_scope(db, study_id, current_user) if cra_scope and subject.site_id not in cra_scope[0]: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足") await _ensure_subject_active(db, subject) data = SubjectRead.model_validate(subject) ae_row = await db.execute( select(AdverseEvent.is_sae, AdverseEvent.is_susar).where( AdverseEvent.study_id == study_id, AdverseEvent.subject_id == subject.id, ) ) ae_flags = {"has_ae": False, "has_sae": False, "has_susar": False} for row in ae_row.all(): ae_flags["has_ae"] = True if row[0]: ae_flags["has_sae"] = True if row[1]: ae_flags["has_susar"] = True data.has_ae = ae_flags["has_ae"] data.has_sae = ae_flags["has_sae"] data.has_susar = ae_flags["has_susar"] return data @router.patch( "/{subject_id}", response_model=SubjectRead, dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())], ) async def update_subject( study_id: uuid.UUID, subject_id: uuid.UUID, subject_in: SubjectUpdate, db: AsyncSession = Depends(get_db_session), current_user=Depends(get_current_user), ) -> SubjectRead: await _ensure_study_exists(db, study_id) subject = await subject_crud.get_subject(db, subject_id) if not subject or subject.study_id != study_id: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="参与者不存在") cra_scope = await get_cra_site_scope(db, study_id, current_user) if cra_scope and subject.site_id not in cra_scope[0]: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足") await _ensure_subject_active(db, subject) old_status = subject.status updated = await subject_crud.update_subject(db, subject, subject_in) # 基线/治疗日期是访视计划的唯一推算基准，不能用入组日期替代。 if updated.baseline_date: await subject_crud.sync_visits_from_baseline(db, updated) detail = None if subject_in.status and subject_in.status != old_status: detail = f"参与者 {updated.subject_no} 状态 {old_status} -> {subject_in.status}" await audit_crud.log_action( db, study_id=study_id, entity_type="subject", entity_id=subject_id, action="SUBJECT_STATUS_CHANGE" if detail else "UPDATE_SUBJECT", detail=detail or "参与者已更新", operator_id=current_user.id, operator_role=current_user.role, ) return updated @router.delete( "/{subject_id}", status_code=status.HTTP_204_NO_CONTENT, dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())], ) async def delete_subject( study_id: uuid.UUID, subject_id: uuid.UUID, db: AsyncSession = Depends(get_db_session), current_user=Depends(get_current_user), ) -> None: await _ensure_study_exists(db, study_id) subject = await subject_crud.get_subject(db, subject_id) if not subject or subject.study_id != study_id: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="参与者不存在") cra_scope = await get_cra_site_scope(db, study_id, current_user) if cra_scope and subject.site_id not in cra_scope[0]: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足") await subject_crud.delete_subject(db, subject) await audit_crud.log_action( db, study_id=study_id, entity_type="subject", entity_id=subject_id, action="DELETE_SUBJECT", detail=f"参与者 {subject_id} 已删除", operator_id=current_user.id, operator_role=current_user.role, )