Cheng Zhou
3630b9000f
## 核心改进
- 完全迁移到接口级权限（68个API端点）
- 实现前置权限检查机制，解决跨模块数据访问权限问题
- 添加权限管理API端点，支持前置权限查询
## 关键变更
1. 权限配置系统
- 添加OPERATION_PREREQUISITES映射表
- 所有操作配置前置权限依赖
2. 权限检查函数
- role_has_api_permission()支持前置权限检查
- get_missing_prerequisites()获取缺失权限列表
3. 权限管理API
- GET /api-permissions/operations - 获取所有操作及前置权限
- GET /api-permissions/operations/prerequisites - 获取前置权限依赖
- GET /api-permissions/{endpoint_key}/prerequisites - 检查缺失权限
4. API端点迁移
- 第1批：subjects, visits, aes, monitoring_visit_issues (23个)
- 第2批：members, sites, project_milestones (11个)
- 第3批：finance_contracts, fees_contracts, drug_shipments (15个)
- 第4批：startup endpoints (19个)
## 测试验证
- 单元测试：24个测试全部通过
- 集成测试：22个迁移端点测试通过
- 前置权限测试：12个测试全部通过
- 总计：46个测试全部通过
## 向后兼容性
- 模块级权限表保留用于历史数据
- 接口级权限未配置时自动回退到模块级权限
- 现有权限配置继续有效
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
75 lines
2.9 KiB
Python
75 lines
2.9 KiB
Python
import uuid
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.deps import get_current_user, get_db_session, require_study_not_locked, require_api_permission
|
|
from app.crud import audit as audit_crud
|
|
from app.crud import project_milestone as milestone_crud
|
|
from app.crud import study as study_crud
|
|
from app.schemas.project_milestone import ProjectMilestoneRead, ProjectMilestoneUpdate
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
|
|
study = await study_crud.get(db, study_id)
|
|
if not study:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在")
|
|
return study
|
|
|
|
|
|
def _validate_date_range(start, end, label: str):
|
|
if (start and not end) or (not start and end):
|
|
raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=f"{label}开始和结束日期需同时填写")
|
|
if start and end and end < start:
|
|
raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=f"{label}结束日期不能早于开始日期")
|
|
|
|
|
|
@router.get(
|
|
"/milestones",
|
|
response_model=list[ProjectMilestoneRead],
|
|
dependencies=[Depends(require_api_permission("project_milestones:read"))],
|
|
)
|
|
async def list_project_milestones(
|
|
study_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
) -> list[ProjectMilestoneRead]:
|
|
await _ensure_study_exists(db, study_id)
|
|
rows = await milestone_crud.list_project_milestones(db, study_id)
|
|
return [ProjectMilestoneRead.model_validate(item) for item in rows]
|
|
|
|
|
|
@router.patch(
|
|
"/milestones/{milestone_id}",
|
|
response_model=ProjectMilestoneRead,
|
|
dependencies=[Depends(require_api_permission("project_milestones:update")), Depends(require_study_not_locked())],
|
|
)
|
|
async def update_project_milestone(
|
|
study_id: uuid.UUID,
|
|
milestone_id: uuid.UUID,
|
|
payload: ProjectMilestoneUpdate,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> ProjectMilestoneRead:
|
|
await _ensure_study_exists(db, study_id)
|
|
row = await milestone_crud.get_project_milestone(db, study_id, milestone_id)
|
|
if not row:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目里程碑不存在")
|
|
|
|
_validate_date_range(payload.adjusted_start_date, payload.adjusted_end_date, "调整计划时间")
|
|
_validate_date_range(payload.actual_start_date, payload.actual_end_date, "实际时间")
|
|
|
|
item = await milestone_crud.update_project_milestone(db, row, payload)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type="milestone",
|
|
entity_id=milestone_id,
|
|
action="UPDATE_PROJECT_MILESTONE",
|
|
detail=f"项目里程碑 {milestone_id} 已更新",
|
|
operator_id=current_user.id,
|
|
operator_role=current_user.role,
|
|
)
|
|
return ProjectMilestoneRead.model_validate(item)
|