ctms/backend/tests/test_migrated_endpoints_batch2.py

"""
第2批模块迁移测试：members 和 sites 模块
测试接口级权限系统在 members 和 sites 模块中的应用
"""

import uuid
import pytest
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.project_permissions import role_has_api_permission
from app.models.api_endpoint_permission import ApiEndpointPermission


@pytest.mark.asyncio
async def test_add_member_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以添加项目成员"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="project_members:create",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "project_members:create")
    assert allowed is True


@pytest.mark.asyncio
async def test_add_member_without_permission(db_session: AsyncSession):
    """验证无权限的CRA无法添加项目成员"""
    study_id = uuid.uuid4()

    # 创建权限（拒绝）
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="project_members:create",
        allowed=False,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "CRA", "project_members:create")
    assert allowed is False


@pytest.mark.asyncio
async def test_list_members_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以查询项目成员列表"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="project_members:list",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "project_members:list")
    assert allowed is True


@pytest.mark.asyncio
async def test_update_member_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以更新项目成员"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="project_members:update",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "project_members:update")
    assert allowed is True


@pytest.mark.asyncio
async def test_delete_member_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以删除项目成员"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="project_members:delete",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "project_members:delete")
    assert allowed is True


@pytest.mark.asyncio
async def test_list_member_candidates_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以查询项目成员候选人"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="project_members:candidates",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "project_members:candidates")
    assert allowed is True


@pytest.mark.asyncio
async def test_create_site_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以创建中心"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="sites:create",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "sites:create")
    assert allowed is True


@pytest.mark.asyncio
async def test_list_sites_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以查询中心列表"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="sites:list",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "sites:list")
    assert allowed is True


@pytest.mark.asyncio
async def test_list_sites_cra_with_permission(db_session: AsyncSession):
    """验证有权限的CRA可以查询中心列表"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="sites:list",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "CRA", "sites:list")
    assert allowed is True


@pytest.mark.asyncio
async def test_update_site_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以更新中心"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="sites:update",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "sites:update")
    assert allowed is True


@pytest.mark.asyncio
async def test_delete_site_with_permission(db_session: AsyncSession):
    """验证有权限的PM可以删除中心"""
    study_id = uuid.uuid4()

    # 创建权限
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="PM",
        endpoint_key="sites:delete",
        allowed=True,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "PM", "sites:delete")
    assert allowed is True


@pytest.mark.asyncio
async def test_members_permission_denied_for_cra(db_session: AsyncSession):
    """验证CRA无法执行成员管理操作"""
    study_id = uuid.uuid4()

    # 创建权限（拒绝）
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="project_members:create",
        allowed=False,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "CRA", "project_members:create")
    assert allowed is False


@pytest.mark.asyncio
async def test_sites_permission_denied_for_cra_write(db_session: AsyncSession):
    """验证CRA无法执行中心写操作"""
    study_id = uuid.uuid4()

    # 创建权限（拒绝）
    perm = ApiEndpointPermission(
        study_id=study_id,
        role="CRA",
        endpoint_key="sites:create",
        allowed=False,
    )
    db_session.add(perm)
    await db_session.commit()

    # 验证权限检查
    allowed = await role_has_api_permission(db_session, study_id, "CRA", "sites:create")
    assert allowed is False