ctms/backend/tests/test_migrated_endpoints.py

"""集成测试：已迁移端点的权限检查"""

import pytest
import uuid
from fastapi.testclient import TestClient
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.project_permissions import role_has_api_permission
from app.models.api_endpoint_permission import ApiEndpointPermission


@pytest.mark.asyncio
async def test_create_subject_with_api_permission(db_session: AsyncSession):
    """测试创建参与者 - 使用接口级权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="subjects:create",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "CRA", "subjects:create"
    )
    assert result is True


@pytest.mark.asyncio
async def test_create_subject_without_permission(db_session: AsyncSession):
    """测试创建参与者 - 权限不足"""
    study_id = uuid.uuid4()

    # 创建权限（拒绝）
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PV",
        endpoint_key="subjects:create",
        allowed=False,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "PV", "subjects:create"
    )
    assert result is False


@pytest.mark.asyncio
async def test_list_subjects_with_permission(db_session: AsyncSession):
    """测试查询参与者列表 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="subjects:list",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "CRA", "subjects:list"
    )
    assert result is True


@pytest.mark.asyncio
async def test_get_subject_detail_with_permission(db_session: AsyncSession):
    """测试查询参与者详情 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PV",
        endpoint_key="subjects:read",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "PV", "subjects:read"
    )
    assert result is True


@pytest.mark.asyncio
async def test_update_subject_with_permission(db_session: AsyncSession):
    """测试更新参与者 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="subjects:update",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "CRA", "subjects:update"
    )
    assert result is True


@pytest.mark.asyncio
async def test_delete_subject_with_permission(db_session: AsyncSession):
    """测试删除参与者 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="subjects:delete",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "PM", "subjects:delete"
    )
    assert result is True


@pytest.mark.asyncio
async def test_create_subject_ae_with_permission(db_session: AsyncSession):
    """测试创建参与者AE - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="subject_aes:create",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "CRA", "subject_aes:create"
    )
    assert result is True


@pytest.mark.asyncio
async def test_list_subject_aes_with_permission(db_session: AsyncSession):
    """测试查询参与者AE列表 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PV",
        endpoint_key="subject_aes:list",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "PV", "subject_aes:list"
    )
    assert result is True


@pytest.mark.asyncio
async def test_get_subject_ae_detail_with_permission(db_session: AsyncSession):
    """测试查询参与者AE详情 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="QA",
        endpoint_key="subject_aes:read",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "QA", "subject_aes:read"
    )
    assert result is True


@pytest.mark.asyncio
async def test_create_fee_contract_with_permission(db_session: AsyncSession):
    """测试创建合同费用 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="fees_contracts:create",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "PM", "fees_contracts:create"
    )
    assert result is True


@pytest.mark.asyncio
async def test_list_fee_contracts_with_permission(db_session: AsyncSession):
    """测试查询合同费用列表 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="fees_contracts:list",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "CRA", "fees_contracts:list"
    )
    assert result is True


@pytest.mark.asyncio
async def test_get_fee_contract_detail_with_permission(db_session: AsyncSession):
    """测试查询合同费用详情 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CTA",
        endpoint_key="fees_contracts:read",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "CTA", "fees_contracts:read"
    )
    assert result is True


@pytest.mark.asyncio
async def test_update_fee_contract_with_permission(db_session: AsyncSession):
    """测试更新合同费用 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="fees_contracts:update",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "PM", "fees_contracts:update"
    )
    assert result is True


@pytest.mark.asyncio
async def test_delete_fee_contract_with_permission(db_session: AsyncSession):
    """测试删除合同费用 - 有权限"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="fees_contracts:delete",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限
    result = await role_has_api_permission(
        db_session, study_id, "PM", "fees_contracts:delete"
    )
    assert result is True