Files
ctms/backend/tests/conftest.py
T
Cheng Zhou 747dd55225 feat(perm): 项目 PM 共管接口权限与监控并细化 PM 写权限边界
- deps 新增 list_active_pm_study_ids、is_active_project_pm 与
  require_admin_or_any_project_pm 依赖,用于把 PM 项目范围带进鉴权与
  监控。get_cra_site_scope 内部延后导入 site CRUD,避免循环依赖。
- system_permissions API 改用 PM/ADMIN 双角色入口,permissions/monitoring
  系统级权限新增 PM 配额,并细化访问日志、告警、监控指标的可见范围。
- members API 调整:项目 PM 仅可管理低于 PM 的项目角色,禁止互相
  改写或授予 PM。
- api_permissions API 增加 GET /api-permissions/me,返回当前用户在该
  项目的有效权限矩阵;保存权限矩阵时校验 PM 行为不被篡改。
- core/api_permissions:新增立项配置接口键、PM 默认拥有的监控/权限
  系统级条目,并在权限元信息中标注 PM 共享角色。
- core/project_permissions:role_has_api_permission 命中默认角色矩阵;
  replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。
- studies setup-config 各端点改用接口级权限装饰器,与新的 setup_config
  权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。
- 测试:新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和
  成员管理边界;conftest 兼容 SA_UUID 列;权限相关用例同步移除已失效
  的 module_permission 链路。

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-25 12:38:07 +08:00

136 lines
4.1 KiB
Python

from __future__ import annotations
"""Pytest configuration and fixtures for tests."""
import asyncio
import uuid
from typing import AsyncGenerator
import pytest
import pytest_asyncio
from sqlalchemy import UUID as SA_UUID, text, event, String, TypeDecorator
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
from sqlalchemy.dialects.postgresql import UUID as PG_UUID
class GUID(TypeDecorator):
"""Platform-independent GUID type that uses CHAR(36) on SQLite."""
impl = String
cache_ok = True
def load_dialect_impl(self, dialect):
if dialect.name == 'sqlite':
return dialect.type_descriptor(String(36))
return dialect.type_descriptor(PG_UUID(as_uuid=True))
def process_bind_param(self, value, dialect):
if value is None:
return None
if dialect.name == 'sqlite':
if isinstance(value, uuid.UUID):
return str(value)
return value
return value
def process_result_value(self, value, dialect):
if value is None:
return None
if dialect.name == 'sqlite':
if isinstance(value, str):
return uuid.UUID(value)
return value
return value
@pytest.fixture(scope="session")
def event_loop():
"""Create an instance of the default event loop for the test session."""
loop = asyncio.new_event_loop()
yield loop
loop.close()
@pytest.fixture(scope="session")
def test_engine(event_loop):
"""Create a test database engine."""
# Use SQLite in-memory database for testing
engine = event_loop.run_until_complete(
_create_test_engine()
)
yield engine
event_loop.run_until_complete(engine.dispose())
async def _create_test_engine():
"""Helper to create and initialize test engine."""
engine = create_async_engine(
"sqlite+aiosqlite:///:memory:",
future=True,
echo=False,
connect_args={"check_same_thread": False},
)
# Import all models to register them with Base metadata
from app.db.base_class import Base
import app.models.study
import app.models.api_endpoint_permission
import app.models.api_endpoint_registry
import app.models.user
import app.models.study_member
import app.models.subject
import app.models.visit
import app.models.ae
import app.models.monitoring_visit_issue
import app.models.site
import app.models.permission_template
import app.models.permission_access_log
import app.models.permission_metric_snapshot
import app.models.security_access_log
# Replace PostgreSQL UUID type with custom GUID type for SQLite
for table in Base.metadata.tables.values():
for column in table.columns:
if isinstance(column.type, (PG_UUID, SA_UUID)):
column.type = GUID()
# Create all tables
async with engine.begin() as conn:
await conn.run_sync(Base.metadata.create_all)
return engine
@pytest_asyncio.fixture
async def db_session(test_engine) -> AsyncGenerator[AsyncSession, None]:
"""Create a test database session."""
async_session = async_sessionmaker(
bind=test_engine,
class_=AsyncSession,
expire_on_commit=False,
)
async with async_session() as session:
# Create a test study for foreign key references with unique code
study_code = f"TEST-STUDY-{uuid.uuid4().hex[:8]}"
await session.execute(
text("""
INSERT INTO studies (id, code, name, status, is_locked, visit_schedule, active_roles)
VALUES (:id, :code, :name, :status, :is_locked, :visit_schedule, :active_roles)
"""),
{
"id": str(uuid.uuid4()),
"code": study_code,
"name": "Test Study",
"status": "ACTIVE",
"is_locked": False,
"visit_schedule": "[]",
"active_roles": "[]",
}
)
await session.commit()
yield session
# Clean up after test
await session.rollback()