Cheng Zhou
747dd55225
- deps 新增 list_active_pm_study_ids、is_active_project_pm 与 require_admin_or_any_project_pm 依赖，用于把 PM 项目范围带进鉴权与 监控。get_cra_site_scope 内部延后导入 site CRUD，避免循环依赖。 - system_permissions API 改用 PM/ADMIN 双角色入口，permissions/monitoring 系统级权限新增 PM 配额，并细化访问日志、告警、监控指标的可见范围。 - members API 调整：项目 PM 仅可管理低于 PM 的项目角色，禁止互相 改写或授予 PM。 - api_permissions API 增加 GET /api-permissions/me，返回当前用户在该 项目的有效权限矩阵；保存权限矩阵时校验 PM 行为不被篡改。 - core/api_permissions：新增立项配置接口键、PM 默认拥有的监控/权限 系统级条目，并在权限元信息中标注 PM 共享角色。 - core/project_permissions：role_has_api_permission 命中默认角色矩阵； replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。 - studies setup-config 各端点改用接口级权限装饰器，与新的 setup_config 权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。 - 测试：新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和 成员管理边界；conftest 兼容 SA_UUID 列；权限相关用例同步移除已失效 的 module_permission 链路。 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
67 lines
2.3 KiB
Python
67 lines
2.3 KiB
Python
from __future__ import annotations
|
|
|
|
import uuid
|
|
from typing import Sequence
|
|
|
|
from sqlalchemy import delete, select, update
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.models.study_member import StudyMember
|
|
from app.schemas.member import StudyMemberCreate, StudyMemberUpdate
|
|
|
|
|
|
async def get_member(db: AsyncSession, study_id: uuid.UUID, user_id: uuid.UUID) -> StudyMember | None:
|
|
result = await db.execute(
|
|
select(StudyMember).where(StudyMember.study_id == study_id, StudyMember.user_id == user_id)
|
|
)
|
|
return result.scalar_one_or_none()
|
|
|
|
|
|
async def get_member_by_id(db: AsyncSession, member_id: uuid.UUID) -> StudyMember | None:
|
|
result = await db.execute(select(StudyMember).where(StudyMember.id == member_id))
|
|
return result.scalar_one_or_none()
|
|
|
|
|
|
async def add_member(db: AsyncSession, study_id: uuid.UUID, member_in: StudyMemberCreate) -> StudyMember:
|
|
member = StudyMember(
|
|
study_id=study_id,
|
|
user_id=member_in.user_id,
|
|
role_in_study=member_in.role_in_study,
|
|
is_active=member_in.is_active,
|
|
)
|
|
db.add(member)
|
|
await db.commit()
|
|
await db.refresh(member)
|
|
return member
|
|
|
|
|
|
async def list_members(db: AsyncSession, study_id: uuid.UUID, skip: int = 0, limit: int = 100) -> Sequence[StudyMember]:
|
|
result = await db.execute(
|
|
select(StudyMember).where(StudyMember.study_id == study_id).offset(skip).limit(limit)
|
|
)
|
|
return result.scalars().all()
|
|
|
|
|
|
async def update_member(db: AsyncSession, member: StudyMember, member_in: StudyMemberUpdate) -> StudyMember:
|
|
update_data = {k: v for k, v in member_in.model_dump(exclude_unset=True).items() if v is not None}
|
|
if update_data:
|
|
await db.execute(
|
|
update(StudyMember)
|
|
.where(StudyMember.id == member.id)
|
|
.values(**update_data)
|
|
)
|
|
await db.commit()
|
|
await db.refresh(member)
|
|
return member
|
|
|
|
|
|
async def remove_member(db: AsyncSession, member: StudyMember) -> StudyMember:
|
|
await db.execute(delete(StudyMember).where(StudyMember.id == member.id))
|
|
await db.commit()
|
|
return member
|
|
|
|
|
|
async def user_has_memberships(db: AsyncSession, user_id: uuid.UUID) -> bool:
|
|
result = await db.execute(select(StudyMember.id).where(StudyMember.user_id == user_id))
|
|
return result.first() is not None
|