import uuid from datetime import date from fastapi import APIRouter, Depends, HTTPException, status from sqlalchemy.ext.asyncio import AsyncSession from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_roles from app.crud import audit as audit_crud from app.crud import finance as finance_crud from app.crud import study as study_crud from app.schemas.finance import FinanceCreate, FinanceRead, FinanceStatusUpdate, FinanceUpdate router = APIRouter() async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID): study = await study_crud.get(db, study_id) if not study: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Study not found") return study def _with_month(item: FinanceRead) -> FinanceRead: item.month = item.occur_date.strftime("%Y-%m") return item @router.post( "/items", response_model=FinanceRead, status_code=status.HTTP_201_CREATED, dependencies=[Depends(require_study_roles(["PM", "CRA"]))], ) async def create_finance_item( study_id: uuid.UUID, item_in: FinanceCreate, db: AsyncSession = Depends(get_db_session), current_user=Depends(get_current_user), ) -> FinanceRead: await _ensure_study_exists(db, study_id) try: item = await finance_crud.create_item(db, study_id, item_in, created_by=current_user.id) except ValueError as exc: raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc await audit_crud.log_action( db, study_id=study_id, entity_type="finance", entity_id=item.id, action="CREATE_FINANCE_ITEM", detail=f"Finance {item.id} created", operator_id=current_user.id, operator_role=current_user.role, ) return _with_month(FinanceRead.model_validate(item)) @router.get( "/items", response_model=list[FinanceRead], dependencies=[Depends(require_study_member())], ) async def list_finance_items( study_id: uuid.UUID, status_filter: str | None = None, category: str | None = None, site_id: uuid.UUID | None = None, subject_id: uuid.UUID | None = None, date_from: date | None = None, date_to: date | None = None, skip: int = 0, limit: int = 100, db: AsyncSession = Depends(get_db_session), ) -> list[FinanceRead]: await _ensure_study_exists(db, study_id) items = await finance_crud.list_items( db, study_id, status=status_filter, category=category, site_id=site_id, subject_id=subject_id, date_from=date_from, date_to=date_to, skip=skip, limit=limit, ) return [_with_month(FinanceRead.model_validate(i)) for i in items] @router.get( "/items/{item_id}", response_model=FinanceRead, dependencies=[Depends(require_study_member())], ) async def get_finance_item( study_id: uuid.UUID, item_id: uuid.UUID, db: AsyncSession = Depends(get_db_session), ) -> FinanceRead: await _ensure_study_exists(db, study_id) item = await finance_crud.get_item(db, item_id) if not item or item.study_id != study_id: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Finance item not found") return _with_month(FinanceRead.model_validate(item)) @router.patch( "/items/{item_id}", response_model=FinanceRead, dependencies=[Depends(require_study_roles(["PM", "CRA"]))], ) async def update_finance_item( study_id: uuid.UUID, item_id: uuid.UUID, item_in: FinanceUpdate, db: AsyncSession = Depends(get_db_session), current_user=Depends(get_current_user), ) -> FinanceRead: await _ensure_study_exists(db, study_id) item = await finance_crud.get_item(db, item_id) if not item or item.study_id != study_id: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Finance item not found") try: updated = await finance_crud.update_item_draft(db, item, item_in) except ValueError as exc: raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc await audit_crud.log_action( db, study_id=study_id, entity_type="finance", entity_id=item_id, action="UPDATE_FINANCE_ITEM", detail=f"Finance {item_id} updated", operator_id=current_user.id, operator_role=current_user.role, ) return _with_month(FinanceRead.model_validate(updated)) @router.post( "/items/{item_id}/status", response_model=FinanceRead, dependencies=[Depends(require_study_member())], ) async def change_finance_status( study_id: uuid.UUID, item_id: uuid.UUID, status_in: FinanceStatusUpdate, db: AsyncSession = Depends(get_db_session), current_user=Depends(get_current_user), ) -> FinanceRead: await _ensure_study_exists(db, study_id) item = await finance_crud.get_item(db, item_id) if not item or item.study_id != study_id: raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Finance item not found") # permission by status target from app.crud import member as member_crud member = await member_crud.get_member(db, study_id, current_user.id) member_role = member.role_in_study if member else None target = status_in.status if target in {"SUBMITTED"}: if current_user.role != "ADMIN" and member_role not in {"PM", "CRA"}: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions") elif target in {"APPROVED", "REJECTED", "PAID"}: if current_user.role != "ADMIN" and member_role not in {"PM"}: raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions") else: raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Unsupported status") old_status = item.status try: updated = await finance_crud.change_status(db, item, status_in, operator_id=current_user.id) except ValueError as exc: raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc detail = f"Finance {item_id} {old_status} -> {status_in.status}" action = "FINANCE_STATUS_CHANGE" await audit_crud.log_action( db, study_id=study_id, entity_type="finance", entity_id=item_id, action=action, detail=detail, operator_id=current_user.id, operator_role=current_user.role, ) return _with_month(FinanceRead.model_validate(updated))