Cheng Zhou
a17f4cc522
- 新增项目成员候选用户接口，避免 PM 读取全局用户列表 - 按项目角色和权限矩阵控制项目管理、成员、中心与审计入口 - 合并侧边栏管理后台入口，统一从项目管理进入成员等模块 - 加强成员管理安全约束，禁止 PM 修改自己、系统管理员或更高权限角色 - 修复多项目角色缓存串用问题，并补充前后端回归测试
67 lines
2.6 KiB
Python
67 lines
2.6 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
import uuid
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.deps import get_current_user, get_db_session, require_study_member, require_study_permission
|
|
from app.core.project_permissions import PROJECT_PERMISSION_MODULES, get_project_role_permissions, replace_project_role_permissions
|
|
from app.crud import audit as audit_crud
|
|
from app.crud import study as study_crud
|
|
from app.schemas.project_permission import ProjectPermissionModule, ProjectRolePermissionsRead, ProjectRolePermissionsUpdate
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
|
|
study = await study_crud.get(db, study_id)
|
|
if not study:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在")
|
|
return study
|
|
|
|
|
|
@router.get("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_study_member())])
|
|
async def get_permissions(
|
|
study_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
) -> ProjectRolePermissionsRead:
|
|
await _ensure_study_exists(db, study_id)
|
|
roles = await get_project_role_permissions(db, study_id)
|
|
modules = [ProjectPermissionModule(**item) for item in PROJECT_PERMISSION_MODULES]
|
|
return ProjectRolePermissionsRead(modules=modules, roles=roles)
|
|
|
|
|
|
@router.put("/", response_model=ProjectRolePermissionsRead, dependencies=[Depends(require_study_permission("project_members", "write"))])
|
|
async def update_permissions(
|
|
study_id: uuid.UUID,
|
|
payload: ProjectRolePermissionsUpdate,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> ProjectRolePermissionsRead:
|
|
await _ensure_study_exists(db, study_id)
|
|
roles = await replace_project_role_permissions(
|
|
db,
|
|
study_id,
|
|
{
|
|
role: {
|
|
module: actions.model_dump()
|
|
for module, actions in modules.items()
|
|
}
|
|
for role, modules in payload.roles.items()
|
|
},
|
|
)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type="project_permissions",
|
|
entity_id=study_id,
|
|
action="PROJECT_PERMISSIONS_UPDATED",
|
|
detail=json.dumps({"targetName": "项目权限", "after": roles}, ensure_ascii=False),
|
|
operator_id=current_user.id,
|
|
operator_role=current_user.role,
|
|
)
|
|
modules = [ProjectPermissionModule(**item) for item in PROJECT_PERMISSION_MODULES]
|
|
return ProjectRolePermissionsRead(modules=modules, roles=roles)
|