ctms/backend/app/core/api_permissions.py

"""接口级权限配置

定义系统中所有API端点的权限配置，支持细粒度的接口级权限控制。
"""

from __future__ import annotations

# 接口级权限配置
# 格式: "业务操作名": {配置信息}
API_ENDPOINT_PERMISSIONS = {
    # 参与者管理 (subjects)
    "subjects:create": {
        "module": "subjects",
        "action": "write",
        "description": "创建参与者",
        "default_roles": ["PM", "CRA"],
        "prerequisite_permissions": ["sites:read"],
    },
    "subjects:list": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "subjects:read": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "subjects:update": {
        "module": "subjects",
        "action": "write",
        "description": "更新参与者",
        "default_roles": ["PM", "CRA"],
        "prerequisite_permissions": ["sites:read"],
    },
    "subjects:delete": {
        "module": "subjects",
        "action": "write",
        "description": "删除参与者",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    # 访视管理 (visits)
    "visits:create": {
        "module": "subjects",
        "action": "write",
        "description": "创建访视",
        "default_roles": ["PM", "CRA"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "visits:list": {
        "module": "subjects",
        "action": "read",
        "description": "查询访视列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "visits:read": {
        "module": "subjects",
        "action": "read",
        "description": "查询访视详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "visits:update": {
        "module": "subjects",
        "action": "write",
        "description": "更新访视",
        "default_roles": ["PM", "CRA"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "visits:delete": {
        "module": "subjects",
        "action": "write",
        "description": "删除访视",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    # 不良事件 (risk_issues)
    "risk_issues:create": {
        "module": "risk_issues",
        "action": "write",
        "description": "创建不良事件",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "risk_issues:list": {
        "module": "risk_issues",
        "action": "read",
        "description": "查询不良事件列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "risk_issues:read": {
        "module": "risk_issues",
        "action": "read",
        "description": "查询不良事件详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "risk_issues:update": {
        "module": "risk_issues",
        "action": "write",
        "description": "更新不良事件",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "risk_issues:delete": {
        "module": "risk_issues",
        "action": "write",
        "description": "删除不良事件",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    # 财务合同管理 (finance_contracts)
    "finance_contracts:create": {
        "module": "fees",
        "action": "write",
        "description": "创建财务合同",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    "finance_contracts:list": {
        "module": "fees",
        "action": "read",
        "description": "查询财务合同列表",
        "default_roles": ["PM", "CRA", "IMP"],
        "prerequisite_permissions": [],
    },
    "finance_contracts:read": {
        "module": "fees",
        "action": "read",
        "description": "查询财务合同详情",
        "default_roles": ["PM", "CRA", "IMP"],
        "prerequisite_permissions": [],
    },
    "finance_contracts:update": {
        "module": "fees",
        "action": "write",
        "description": "更新财务合同",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    "finance_contracts:delete": {
        "module": "fees",
        "action": "write",
        "description": "删除财务合同",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    # 费用合同管理 (fees_contracts)
    "fees_contracts:create": {
        "module": "fees",
        "action": "write",
        "description": "创建费用合同",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    "fees_contracts:list": {
        "module": "fees",
        "action": "read",
        "description": "查询费用合同列表",
        "default_roles": ["PM", "CRA", "IMP"],
        "prerequisite_permissions": [],
    },
    "fees_contracts:read": {
        "module": "fees",
        "action": "read",
        "description": "查询费用合同详情",
        "default_roles": ["PM", "CRA", "IMP"],
        "prerequisite_permissions": [],
    },
    "fees_contracts:update": {
        "module": "fees",
        "action": "write",
        "description": "更新费用合同",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    "fees_contracts:delete": {
        "module": "fees",
        "action": "write",
        "description": "删除费用合同",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    "fees_payments:create": {
        "module": "fees",
        "action": "write",
        "description": "创建费用分期",
        "default_roles": ["PM"],
        "prerequisite_permissions": [],
    },
    "fees_payments:update": {
        "module": "fees",
        "action": "write",
        "description": "更新费用分期",
        "default_roles": ["PM"],
        "prerequisite_permissions": [],
    },
    "fees_payments:delete": {
        "module": "fees",
        "action": "write",
        "description": "删除费用分期",
        "default_roles": ["PM"],
        "prerequisite_permissions": [],
    },
    # 项目成员管理
    "project_members:create": {
        "module": "project_members",
        "action": "write",
        "description": "添加项目成员",
        "default_roles": ["PM"],
    },
    "project_members:list": {
        "module": "project_members",
        "action": "read",
        "description": "查询项目成员列表",
        "default_roles": ["PM"],
    },
    "project_members:candidates": {
        "module": "project_members",
        "action": "read",
        "description": "查询项目成员候选人",
        "default_roles": ["PM"],
    },
    "project_members:update": {
        "module": "project_members",
        "action": "write",
        "description": "更新项目成员",
        "default_roles": ["PM"],
    },
    "project_members:delete": {
        "module": "project_members",
        "action": "write",
        "description": "删除项目成员",
        "default_roles": ["PM"],
    },
    # 中心管理
    "sites:create": {
        "module": "sites",
        "action": "write",
        "description": "创建中心",
        "default_roles": ["PM"],
    },
    "sites:list": {
        "module": "sites",
        "action": "read",
        "description": "查询中心列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "sites:read": {
        "module": "sites",
        "action": "read",
        "description": "查询中心详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "sites:update": {
        "module": "sites",
        "action": "write",
        "description": "更新中心",
        "default_roles": ["PM"],
    },
    "sites:delete": {
        "module": "sites",
        "action": "write",
        "description": "删除中心",
        "default_roles": ["PM"],
    },
    # 伦理审批管理
    "ethics:create": {
        "module": "startup_ethics",
        "action": "write",
        "description": "创建伦理审批",
        "default_roles": ["PM"],
    },
    "ethics:list": {
        "module": "startup_ethics",
        "action": "read",
        "description": "查询伦理审批列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "ethics:read": {
        "module": "startup_ethics",
        "action": "read",
        "description": "查询伦理审批详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "ethics:update": {
        "module": "startup_ethics",
        "action": "write",
        "description": "更新伦理审批",
        "default_roles": ["PM"],
    },
    "ethics:delete": {
        "module": "startup_ethics",
        "action": "write",
        "description": "删除伦理审批",
        "default_roles": ["PM"],
    },
    # 可行性评估管理
    "feasibility:create": {
        "module": "startup_ethics",
        "action": "write",
        "description": "创建可行性评估",
        "default_roles": ["PM"],
    },
    "feasibility:list": {
        "module": "startup_ethics",
        "action": "read",
        "description": "查询可行性评估列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "feasibility:read": {
        "module": "startup_ethics",
        "action": "read",
        "description": "查询可行性评估详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "feasibility:update": {
        "module": "startup_ethics",
        "action": "write",
        "description": "更新可行性评估",
        "default_roles": ["PM"],
    },
    "feasibility:delete": {
        "module": "startup_ethics",
        "action": "write",
        "description": "删除可行性评估",
        "default_roles": ["PM"],
    },
    # 预算评估管理
    "budget:create": {
        "module": "startup_auth",
        "action": "write",
        "description": "创建预算评估",
        "default_roles": ["PM"],
    },
    "budget:list": {
        "module": "startup_auth",
        "action": "read",
        "description": "查询预算评估列表",
        "default_roles": ["PM", "CRA", "IMP"],
    },
    "budget:read": {
        "module": "startup_auth",
        "action": "read",
        "description": "查询预算评估详情",
        "default_roles": ["PM", "CRA", "IMP"],
    },
    "budget:update": {
        "module": "startup_auth",
        "action": "write",
        "description": "更新预算评估",
        "default_roles": ["PM"],
    },
    "budget:delete": {
        "module": "startup_auth",
        "action": "write",
        "description": "删除预算评估",
        "default_roles": ["PM"],
    },
    # 时间表管理
    "timeline:create": {
        "module": "startup_auth",
        "action": "write",
        "description": "创建时间表",
        "default_roles": ["PM"],
    },
    "timeline:list": {
        "module": "startup_auth",
        "action": "read",
        "description": "查询时间表列表",
        "default_roles": ["PM", "CRA", "PV"],
    },
    "timeline:read": {
        "module": "startup_auth",
        "action": "read",
        "description": "查询时间表详情",
        "default_roles": ["PM", "CRA", "PV"],
    },
    "timeline:update": {
        "module": "startup_auth",
        "action": "write",
        "description": "更新时间表",
        "default_roles": ["PM"],
    },
    "timeline:delete": {
        "module": "startup_auth",
        "action": "write",
        "description": "删除时间表",
        "default_roles": ["PM"],
    },
    # 项目权限管理
    "permissions:read": {
        "module": "project_members",
        "action": "read",
        "description": "查询项目权限矩阵",
        "default_roles": ["PM"],
    },
    "permissions:update": {
        "module": "project_members",
        "action": "write",
        "description": "更新项目权限矩阵",
        "default_roles": ["PM"],
    },
    # 项目概览
    "project_overview:read": {
        "module": "project_overview",
        "action": "read",
        "description": "查询项目概览",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    # 监查问题管理
    "monitoring_issues:create": {
        "module": "monitoring_audit",
        "action": "write",
        "description": "创建监查问题",
        "default_roles": ["PM", "CRA"],
    },
    "monitoring_issues:list": {
        "module": "monitoring_audit",
        "action": "read",
        "description": "查询监查问题列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "monitoring_issues:read": {
        "module": "monitoring_audit",
        "action": "read",
        "description": "查询监查问题详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "monitoring_issues:update": {
        "module": "monitoring_audit",
        "action": "write",
        "description": "更新监查问题",
        "default_roles": ["PM", "CRA"],
    },
    "monitoring_issues:delete": {
        "module": "monitoring_audit",
        "action": "write",
        "description": "删除监查问题",
        "default_roles": ["PM"],
    },
    "monitoring_issues:close": {
        "module": "monitoring_audit",
        "action": "write",
        "description": "关闭监查问题",
        "default_roles": ["PM", "CRA"],
    },
    "monitoring_issues:history": {
        "module": "monitoring_audit",
        "action": "read",
        "description": "查询监查问题历史",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    # 监查访视问题管理
    "monitoring_audit:create": {
        "module": "monitoring_audit",
        "action": "write",
        "description": "创建监查访视问题",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
        "prerequisite_permissions": ["sites:read"],
    },
    "monitoring_audit:read": {
        "module": "monitoring_audit",
        "action": "read",
        "description": "查询监查访视问题",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "QA"],
        "prerequisite_permissions": [],
    },
    "monitoring_audit:update": {
        "module": "monitoring_audit",
        "action": "write",
        "description": "更新监查访视问题",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
        "prerequisite_permissions": ["sites:read"],
    },
    "monitoring_audit:delete": {
        "module": "monitoring_audit",
        "action": "write",
        "description": "删除监查访视问题",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    # 药物发货管理
    "drug_shipments:create": {
        "module": "materials",
        "action": "write",
        "description": "创建药物发货",
        "default_roles": ["PM", "IMP"],
        "prerequisite_permissions": ["sites:read"],
    },
    "drug_shipments:list": {
        "module": "materials",
        "action": "read",
        "description": "查询药物发货列表",
        "default_roles": ["PM", "CRA", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "drug_shipments:read": {
        "module": "materials",
        "action": "read",
        "description": "查询药物发货详情",
        "default_roles": ["PM", "CRA", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "drug_shipments:update": {
        "module": "materials",
        "action": "write",
        "description": "更新药物发货",
        "default_roles": ["PM", "IMP"],
        "prerequisite_permissions": ["sites:read"],
    },
    "drug_shipments:delete": {
        "module": "materials",
        "action": "write",
        "description": "删除药物发货",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["sites:read"],
    },
    # 物资管理
    "materials:create": {
        "module": "materials",
        "action": "write",
        "description": "创建物资",
        "default_roles": ["PM", "IMP"],
    },
    "materials:list": {
        "module": "materials",
        "action": "read",
        "description": "查询物资列表",
        "default_roles": ["PM", "CRA", "IMP", "QA"],
    },
    "materials:read": {
        "module": "materials",
        "action": "read",
        "description": "查询物资详情",
        "default_roles": ["PM", "CRA", "IMP", "QA"],
    },
    "materials:update": {
        "module": "materials",
        "action": "write",
        "description": "更新物资",
        "default_roles": ["PM", "IMP"],
    },
    "materials:delete": {
        "module": "materials",
        "action": "write",
        "description": "删除物资",
        "default_roles": ["PM"],
    },
    # 参与者PDS管理
    "subject_pds:create": {
        "module": "subjects",
        "action": "write",
        "description": "创建参与者PDS",
        "default_roles": ["PM", "CRA"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "subject_pds:list": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者PDS列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
        "prerequisite_permissions": [],
    },
    "subject_pds:read": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者PDS详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
        "prerequisite_permissions": [],
    },
    "subject_pds:update": {
        "module": "subjects",
        "action": "write",
        "description": "更新参与者PDS",
        "default_roles": ["PM", "CRA"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    "subject_pds:delete": {
        "module": "subjects",
        "action": "write",
        "description": "删除参与者PDS",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["subjects:read", "sites:read"],
    },
    # 审计日志管理
    "audit_logs:list": {
        "module": "audit_export",
        "action": "read",
        "description": "查询审计日志列表",
        "default_roles": ["PM", "QA"],
    },
    "audit_logs:read": {
        "module": "audit_export",
        "action": "read",
        "description": "查询审计日志详情",
        "default_roles": ["PM", "QA"],
    },
    "audit_logs:export": {
        "module": "audit_export",
        "action": "read",
        "description": "导出审计日志",
        "default_roles": ["PM", "QA"],
    },
    # 知识库笔记管理
    "knowledge_notes:create": {
        "module": "shared_library",
        "action": "write",
        "description": "创建知识库笔记",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "knowledge_notes:list": {
        "module": "shared_library",
        "action": "read",
        "description": "查询知识库笔记列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "knowledge_notes:read": {
        "module": "shared_library",
        "action": "read",
        "description": "查询知识库笔记详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "knowledge_notes:update": {
        "module": "shared_library",
        "action": "write",
        "description": "更新知识库笔记",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "knowledge_notes:delete": {
        "module": "shared_library",
        "action": "write",
        "description": "删除知识库笔记",
        "default_roles": ["PM"],
    },
    # 参与者历史管理
    "subject_history:list": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者历史列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "subject_history:read": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者历史详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "subject_history:timeline": {
        "module": "subjects",
        "action": "read",
        "description": "查询参与者历史时间线",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "subject_history:export": {
        "module": "subjects",
        "action": "read",
        "description": "导出参与者历史",
        "default_roles": ["PM", "CRA"],
    },
    "subject_history:search": {
        "module": "subjects",
        "action": "read",
        "description": "搜索参与者历史",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    # 立项配置管理
    "setup_config:read": {
        "module": "setup_config",
        "action": "read",
        "description": "查询立项配置",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "setup_config:update": {
        "module": "setup_config",
        "action": "write",
        "description": "保存立项配置草稿",
        "default_roles": ["PM"],
    },
    "setup_config:publish": {
        "module": "setup_config",
        "action": "write",
        "description": "发布立项配置",
        "default_roles": ["PM"],
    },
    "setup_config:rollback": {
        "module": "setup_config",
        "action": "write",
        "description": "回滚立项配置版本",
        "default_roles": ["PM"],
    },
    "setup_config:delete_version": {
        "module": "setup_config",
        "action": "write",
        "description": "删除立项配置版本",
        "default_roles": ["PM"],
    },
    # 项目里程碑管理
    "project_milestones:read": {
        "module": "project_milestones",
        "action": "read",
        "description": "查询项目里程碑列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "project_milestones:update": {
        "module": "project_milestones",
        "action": "write",
        "description": "更新项目里程碑",
        "default_roles": ["PM"],
    },
    # 启动与授权
    "startup_auth:create": {
        "module": "startup_auth",
        "action": "write",
        "description": "创建启动会或培训授权",
        "default_roles": ["PM"],
    },
    "startup_auth:read": {
        "module": "startup_auth",
        "action": "read",
        "description": "查询启动会或培训授权",
        "default_roles": ["PM", "CRA", "PV", "IMP"],
    },
    "startup_auth:update": {
        "module": "startup_auth",
        "action": "write",
        "description": "更新启动会或培训授权",
        "default_roles": ["PM"],
    },
    "startup_auth:delete": {
        "module": "startup_auth",
        "action": "write",
        "description": "删除培训授权",
        "default_roles": ["PM"],
    },
    # 附件管理
    "attachments:create": {
        "module": "attachments",
        "action": "write",
        "description": "创建附件",
        "default_roles": ["PM", "CRA", "PV"],
    },
    "attachments:read": {
        "module": "attachments",
        "action": "read",
        "description": "查询附件",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "attachments:update": {
        "module": "attachments",
        "action": "write",
        "description": "更新附件",
        "default_roles": ["PM", "CRA"],
    },
    "attachments:delete": {
        "module": "attachments",
        "action": "write",
        "description": "删除附件",
        "default_roles": ["PM", "CRA"],
    },
    # 费用附件管理
    "fees_attachments:create": {
        "module": "fees",
        "action": "write",
        "description": "创建费用附件",
        "default_roles": ["PM", "CRA"],
    },
    "fees_attachments:read": {
        "module": "fees",
        "action": "read",
        "description": "查询费用附件",
        "default_roles": ["PM", "CRA", "PV"],
    },
    "fees_attachments:delete": {
        "module": "fees",
        "action": "write",
        "description": "删除费用附件",
        "default_roles": ["PM", "CRA"],
    },
    # FAQ管理
    "faq:create": {
        "module": "faq",
        "action": "write",
        "description": "创建FAQ",
        "default_roles": ["PM"],
    },
    "faq:read": {
        "module": "faq",
        "action": "read",
        "description": "查询FAQ",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "faq:update": {
        "module": "faq",
        "action": "write",
        "description": "更新FAQ",
        "default_roles": ["PM"],
    },
    "faq:delete": {
        "module": "faq",
        "action": "write",
        "description": "删除FAQ",
        "default_roles": ["PM"],
    },
    # FAQ分类管理
    "faq_category:create": {
        "module": "faq",
        "action": "write",
        "description": "创建FAQ分类",
        "default_roles": ["PM"],
    },
    "faq_category:read": {
        "module": "faq",
        "action": "read",
        "description": "查询FAQ分类",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "faq_category:update": {
        "module": "faq",
        "action": "write",
        "description": "更新FAQ分类",
        "default_roles": ["PM"],
    },
    "faq_category:delete": {
        "module": "faq",
        "action": "write",
        "description": "删除FAQ分类",
        "default_roles": ["PM"],
    },
    # FAQ回复管理
    "faq_reply:create": {
        "module": "faq",
        "action": "write",
        "description": "创建FAQ回复",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW"],
    },
    "faq_reply:delete": {
        "module": "faq",
        "action": "write",
        "description": "删除FAQ回复",
        "default_roles": ["PM"],
    },
    # 仪表板管理
    "dashboard:read": {
        "module": "dashboard",
        "action": "read",
        "description": "查询仪表板",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": ["sites:read", "subjects:read"],
    },
    # 参与者历史管理
    "subject_histories:create": {
        "module": "subject_histories",
        "action": "write",
        "description": "创建参与者历史",
        "default_roles": ["PM", "CRA"],
        "prerequisite_permissions": ["subjects:read"],
    },
    "subject_histories:list": {
        "module": "subject_histories",
        "action": "read",
        "description": "查询参与者历史列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "subject_histories:read": {
        "module": "subject_histories",
        "action": "read",
        "description": "查询参与者历史详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
        "prerequisite_permissions": [],
    },
    "subject_histories:update": {
        "module": "subject_histories",
        "action": "write",
        "description": "更新参与者历史",
        "default_roles": ["PM", "CRA"],
        "prerequisite_permissions": ["subjects:read"],
    },
    "subject_histories:delete": {
        "module": "subject_histories",
        "action": "write",
        "description": "删除参与者历史",
        "default_roles": ["PM"],
        "prerequisite_permissions": ["subjects:read"],
    },
    # 物资设备管理
    "material_equipments:create": {
        "module": "material_equipments",
        "action": "write",
        "description": "创建物资设备",
        "default_roles": ["PM", "CRA"],
    },
    "material_equipments:list": {
        "module": "material_equipments",
        "action": "read",
        "description": "查询物资设备列表",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "material_equipments:read": {
        "module": "material_equipments",
        "action": "read",
        "description": "查询物资设备详情",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "material_equipments:update": {
        "module": "material_equipments",
        "action": "write",
        "description": "更新物资设备",
        "default_roles": ["PM", "CRA"],
    },
    "material_equipments:delete": {
        "module": "material_equipments",
        "action": "write",
        "description": "删除物资设备",
        "default_roles": ["PM"],
    },
    # 文档管理
    "documents:create": {
        "module": "documents",
        "action": "write",
        "description": "创建文档",
        "default_roles": ["PM", "CRA"],
    },
    "documents:read": {
        "module": "documents",
        "action": "read",
        "description": "查询文档",
        "default_roles": ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"],
    },
    "documents:update": {
        "module": "documents",
        "action": "write",
        "description": "更新文档",
        "default_roles": ["PM", "CRA"],
    },
    "documents:delete": {
        "module": "documents",
        "action": "write",
        "description": "删除文档",
        "default_roles": ["PM"],
    },
}

# 向后兼容：业务操作名到接口级权限的映射
# 用于在接口级权限未配置时，回退到模块级权限
OPERATION_TO_ENDPOINTS: dict[str, dict[str, list[str]]] = {
    "subjects": {
        "read": [
            "subjects:list",
            "subjects:read",
        ],
        "write": [
            "subjects:create",
            "subjects:update",
            "subjects:delete",
        ],
    },
    "visits": {
        "read": [
            "visits:list",
            "visits:read",
        ],
        "write": [
            "visits:create",
            "visits:update",
            "visits:delete",
        ],
    },
    "risk_issues": {
        "read": [
            "risk_issues:list",
            "risk_issues:read",
        ],
        "write": [
            "risk_issues:create",
            "risk_issues:update",
            "risk_issues:delete",
        ],
    },
    "fees": {
        "read": [
            "fees_contracts:list",
            "fees_contracts:read",
            "finance_contracts:list",
            "finance_contracts:read",
        ],
        "write": [
            "fees_contracts:create",
            "fees_contracts:update",
            "fees_contracts:delete",
            "fees_payments:create",
            "fees_payments:update",
            "fees_payments:delete",
            "finance_contracts:create",
            "finance_contracts:update",
            "finance_contracts:delete",
        ],
    },
    "project_members": {
        "read": [
            "project_members:list",
            "project_members:candidates",
        ],
        "write": [
            "project_members:create",
            "project_members:update",
            "project_members:delete",
        ],
    },
    "sites": {
        "read": [
            "sites:list",
            "sites:read",
        ],
        "write": [
            "sites:create",
            "sites:update",
            "sites:delete",
        ],
    },
    "startup_ethics": {
        "read": [
            "ethics:list",
            "ethics:read",
            "feasibility:list",
            "feasibility:read",
        ],
        "write": [
            "ethics:create",
            "ethics:update",
            "ethics:delete",
            "feasibility:create",
            "feasibility:update",
            "feasibility:delete",
        ],
    },
    "startup_auth": {
        "read": [
            "startup_auth:read",
            "budget:list",
            "budget:read",
            "timeline:list",
            "timeline:read",
        ],
        "write": [
            "startup_auth:create",
            "startup_auth:update",
            "startup_auth:delete",
            "budget:create",
            "budget:update",
            "budget:delete",
            "timeline:create",
            "timeline:update",
            "timeline:delete",
        ],
    },
    "project_overview": {
        "read": [
            "project_overview:read",
        ],
        "write": [],
    },
    "monitoring_audit": {
        "read": [
            "monitoring_issues:list",
            "monitoring_issues:read",
            "monitoring_issues:history",
        ],
        "write": [
            "monitoring_issues:create",
            "monitoring_issues:update",
            "monitoring_issues:delete",
            "monitoring_issues:close",
        ],
    },
    "materials": {
        "read": [
            "drug_shipments:list",
            "drug_shipments:read",
            "materials:list",
            "materials:read",
        ],
        "write": [
            "drug_shipments:create",
            "drug_shipments:update",
            "drug_shipments:delete",
            "materials:create",
            "materials:update",
            "materials:delete",
        ],
    },
    "audit_export": {
        "read": [
            "audit_logs:list",
            "audit_logs:read",
            "audit_logs:export",
        ],
        "write": [],
    },
    "shared_library": {
        "read": [
            "knowledge_notes:list",
            "knowledge_notes:read",
        ],
        "write": [
            "knowledge_notes:create",
            "knowledge_notes:update",
            "knowledge_notes:delete",
        ],
    },
    "subject_histories": {
        "read": [
            "subject_histories:list",
            "subject_histories:read",
        ],
        "write": [
            "subject_histories:create",
            "subject_histories:update",
            "subject_histories:delete",
        ],
    },
    "material_equipments": {
        "read": [
            "material_equipments:list",
            "material_equipments:read",
        ],
        "write": [
            "material_equipments:create",
            "material_equipments:update",
            "material_equipments:delete",
        ],
    },
    "documents": {
        "read": [
            "documents:read",
        ],
        "write": [
            "documents:create",
            "documents:update",
            "documents:delete",
        ],
    },
    "project_milestones": {
        "read": [
            "project_milestones:read",
        ],
        "write": [
            "project_milestones:update",
        ],
    },
    "setup_config": {
        "read": [
            "setup_config:read",
        ],
        "write": [
            "setup_config:update",
            "setup_config:publish",
            "setup_config:rollback",
            "setup_config:delete_version",
        ],
    },
}

# 项目级权限角色列表
PROJECT_PERMISSION_ROLES = ["PM", "CRA", "PV", "MEDICAL_REVIEW", "IMP", "QA"]

# 前置权限映射表（用于权限检查）
# 定义每个操作需要的前置权限
OPERATION_PREREQUISITES: dict[str, list[str]] = {
    # 参与者管理
    "subjects:create": ["sites:read"],
    "subjects:update": ["sites:read"],
    "subjects:delete": ["sites:read"],

    # 访视管理
    "visits:create": ["subjects:read", "sites:read"],
    "visits:update": ["subjects:read", "sites:read"],
    "visits:delete": ["subjects:read", "sites:read"],

    # 不良事件
    "risk_issues:create": ["subjects:read", "sites:read"],
    "risk_issues:update": ["subjects:read", "sites:read"],
    "risk_issues:delete": ["subjects:read", "sites:read"],

    # 财务合同
    "finance_contracts:create": ["sites:read"],
    "finance_contracts:update": ["sites:read"],
    "finance_contracts:delete": ["sites:read"],

    # 费用合同
    "fees_contracts:create": ["sites:read"],
    "fees_contracts:update": ["sites:read"],
    "fees_contracts:delete": ["sites:read"],

    # 药物发货
    "drug_shipments:create": ["sites:read"],
    "drug_shipments:update": ["sites:read"],
    "drug_shipments:delete": ["sites:read"],

    # 参与者PDS
    "subject_pds:create": ["subjects:read", "sites:read"],
    "subject_pds:update": ["subjects:read", "sites:read"],

    # 参与者历史
    "subject_histories:create": ["subjects:read"],
    "subject_histories:update": ["subjects:read"],
    "subject_histories:delete": ["subjects:read"],

    # 监查访视问题
    "monitoring_audit:create": ["sites:read"],
    "monitoring_audit:update": ["sites:read"],
    "monitoring_audit:delete": ["sites:read"],
}

# 系统级权限定义
# 描述管理后台各模块操作的权限归属
# PM 角色的系统级权限限定在其所负责的项目范围内
SYSTEM_PERMISSIONS: dict[str, dict] = {
    # 账号管理
    "system:users:list": {
        "module": "system_users",
        "action": "read",
        "description": "查看用户列表",
        "roles": ["ADMIN"],
    },
    "system:users:create": {
        "module": "system_users",
        "action": "create",
        "description": "创建用户",
        "roles": ["ADMIN"],
    },
    "system:users:update": {
        "module": "system_users",
        "action": "update",
        "description": "编辑用户",
        "roles": ["ADMIN"],
    },
    "system:users:disable": {
        "module": "system_users",
        "action": "update",
        "description": "禁用/启用用户",
        "roles": ["ADMIN"],
    },
    "system:users:approve": {
        "module": "system_users",
        "action": "update",
        "description": "审核用户注册",
        "roles": ["ADMIN"],
    },
    # 项目管理
    "system:projects:list": {
        "module": "system_projects",
        "action": "read",
        "description": "查看项目列表",
        "roles": ["ADMIN"],
    },
    "system:projects:create": {
        "module": "system_projects",
        "action": "create",
        "description": "创建项目",
        "roles": ["ADMIN"],
    },
    "system:projects:update": {
        "module": "system_projects",
        "action": "update",
        "description": "编辑项目",
        "roles": ["ADMIN"],
    },
    "system:projects:delete": {
        "module": "system_projects",
        "action": "delete",
        "description": "删除项目",
        "roles": ["ADMIN"],
    },
    "system:projects:lock": {
        "module": "system_projects",
        "action": "update",
        "description": "锁定/解锁项目",
        "roles": ["ADMIN"],
    },
    "system:projects:members": {
        "module": "system_projects",
        "action": "update",
        "description": "管理项目成员",
        "roles": ["ADMIN"],
    },
    "system:projects:sites": {
        "module": "system_projects",
        "action": "update",
        "description": "管理项目中心",
        "roles": ["ADMIN"],
    },
    # 权限管理
    "system:permissions:read": {
        "module": "system_permissions",
        "action": "read",
        "description": "查看系统级权限定义",
        "roles": ["ADMIN", "PM"],
    },
    "system:permissions:project_config": {
        "module": "system_permissions",
        "action": "update",
        "description": "配置项目接口权限",
        "roles": ["ADMIN", "PM"],
    },
    "system:permissions:templates": {
        "module": "system_permissions",
        "action": "update",
        "description": "管理权限模板",
        "roles": ["ADMIN"],
    },
    # 权限监控
    "system:monitoring:metrics": {
        "module": "system_monitoring",
        "action": "read",
        "description": "查看权限监控指标",
        "roles": ["ADMIN", "PM"],
    },
    "system:monitoring:cache_stats": {
        "module": "system_monitoring",
        "action": "read",
        "description": "查看缓存统计",
        "roles": ["ADMIN", "PM"],
    },
    "system:monitoring:alerts": {
        "module": "system_monitoring",
        "action": "read",
        "description": "查看权限告警",
        "roles": ["ADMIN", "PM"],
    },
    "system:monitoring:health": {
        "module": "system_monitoring",
        "action": "read",
        "description": "查看权限系统健康状态",
        "roles": ["ADMIN", "PM"],
    },
    "system:monitoring:access_logs": {
        "module": "system_monitoring",
        "action": "read",
        "description": "查看权限访问日志",
        "roles": ["ADMIN", "PM"],
    },
    "system:monitoring:trends": {
        "module": "system_monitoring",
        "action": "read",
        "description": "查看权限趋势数据",
        "roles": ["ADMIN", "PM"],
    },
    "system:monitoring:reset_metrics": {
        "module": "system_monitoring",
        "action": "update",
        "description": "重置监控指标",
        "roles": ["ADMIN", "PM"],
    },
    "system:monitoring:clear_alerts": {
        "module": "system_monitoring",
        "action": "update",
        "description": "清除告警",
        "roles": ["ADMIN", "PM"],
    },
    "system:monitoring:security_logs": {
        "module": "system_monitoring",
        "action": "read",
        "description": "查看安全访问日志",
        "roles": ["ADMIN"],
    },
    # 审计日志
    "system:audit_logs:read": {
        "module": "system_audit",
        "action": "read",
        "description": "查看审计日志",
        "roles": ["ADMIN"],
    },
    "system:audit_logs:export": {
        "module": "system_audit",
        "action": "export",
        "description": "导出审计日志",
        "roles": ["ADMIN"],
    },
}

# 系统级权限模块标签
SYSTEM_MODULE_LABELS: dict[str, str] = {
    "system_users": "账号管理",
    "system_projects": "项目管理",
    "system_permissions": "权限管理",
    "system_monitoring": "权限监控",
    "system_audit": "审计日志",
}