0cc87210af
## 主要完成内容
### 1. 接口级权限系统实现
- 新增 ApiEndpointPermission 模型:存储接口级权限配置
- 新增 ApiEndpointRegistry 模型:注册系统中所有API端点
- 实现权限检查优先级:接口级 > 模块级(向后兼容)
- 支持细粒度权限控制(METHOD:/path 格式)
### 2. 权限配置系统
- 创建 api_permissions.py:集中管理接口权限配置
- 定义 API_ENDPOINT_PERMISSIONS:所有端点的权限映射
- 定义 MODULE_TO_ENDPOINTS:模块到接口的映射(向后兼容)
- 支持默认角色配置和权限继承
### 3. 权限检查依赖注入
- 新增 require_api_permission():基于接口的权限检查
- 新增 @register_api_endpoint 装饰器:端点元数据注册
- 集成 FastAPI 依赖注入系统
- 支持权限拒绝时返回 403 Forbidden
### 4. API端点迁移(第1批)
- 迁移 subjects 模块:5个端点
- 迁移 risk_issues 模块:3个端点
- 迁移 fees 模块:8个端点
- 迁移 finance_contracts 模块:5个端点
- 共计 21 个端点完成迁移
### 5. 权限管理API
- GET /studies/{study_id}/api-permissions:获取权限矩阵
- PUT /studies/{study_id}/api-permissions:更新权限矩阵
- 支持权限配置的查询和修改
### 6. 测试与验证
- 单元测试:12 个测试用例,全部通过
- 集成测试:11 个权限管理API测试,全部通过
- 端点测试:22 个已迁移端点测试,全部通过
- 代码覆盖率:87%(超过 80% 目标)
- 总计:45 个测试用例,全部通过
### 7. 文档
- TESTING_SUMMARY.md:详细的测试结果总结
- IMPLEMENTATION_SUMMARY.md:实现细节文档
- TESTING_GUIDE.md:测试指南
## 技术亮点
1. **向后兼容性**:保留模块级权限,接口级权限优先
2. **灵活的权限配置**:支持默认角色和自定义权限
3. **细粒度控制**:支持跨模块数据访问权限
4. **完整的测试覆盖**:单元测试、集成测试、端点测试
5. **清晰的权限检查流程**:接口级 → 模块级 → 拒绝
## 下一步工作
- [ ] 第7阶段:迁移第2批模块(members, sites)
- [ ] 第8阶段:迁移第3批模块
- [ ] 第9阶段:安全审计
- [ ] 第10阶段:性能测试
- [ ] 第11阶段:文档更新
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
132 lines
3.9 KiB
Python
132 lines
3.9 KiB
Python
from __future__ import annotations
|
|
|
|
"""Pytest configuration and fixtures for tests."""
|
|
|
|
import asyncio
|
|
import uuid
|
|
from typing import AsyncGenerator
|
|
|
|
import pytest
|
|
import pytest_asyncio
|
|
from sqlalchemy import text, event, String, TypeDecorator
|
|
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
|
|
from sqlalchemy.dialects.postgresql import UUID as PG_UUID
|
|
|
|
|
|
class GUID(TypeDecorator):
|
|
"""Platform-independent GUID type that uses CHAR(36) on SQLite."""
|
|
impl = String
|
|
cache_ok = True
|
|
|
|
def load_dialect_impl(self, dialect):
|
|
if dialect.name == 'sqlite':
|
|
return dialect.type_descriptor(String(36))
|
|
return dialect.type_descriptor(PG_UUID(as_uuid=True))
|
|
|
|
def process_bind_param(self, value, dialect):
|
|
if value is None:
|
|
return None
|
|
if dialect.name == 'sqlite':
|
|
if isinstance(value, uuid.UUID):
|
|
return str(value)
|
|
return value
|
|
return value
|
|
|
|
def process_result_value(self, value, dialect):
|
|
if value is None:
|
|
return None
|
|
if dialect.name == 'sqlite':
|
|
if isinstance(value, str):
|
|
return uuid.UUID(value)
|
|
return value
|
|
return value
|
|
|
|
|
|
@pytest.fixture(scope="session")
|
|
def event_loop():
|
|
"""Create an instance of the default event loop for the test session."""
|
|
loop = asyncio.new_event_loop()
|
|
yield loop
|
|
loop.close()
|
|
|
|
|
|
@pytest.fixture(scope="session")
|
|
def test_engine(event_loop):
|
|
"""Create a test database engine."""
|
|
# Use SQLite in-memory database for testing
|
|
engine = event_loop.run_until_complete(
|
|
_create_test_engine()
|
|
)
|
|
yield engine
|
|
event_loop.run_until_complete(engine.dispose())
|
|
|
|
|
|
async def _create_test_engine():
|
|
"""Helper to create and initialize test engine."""
|
|
engine = create_async_engine(
|
|
"sqlite+aiosqlite:///:memory:",
|
|
future=True,
|
|
echo=False,
|
|
connect_args={"check_same_thread": False},
|
|
)
|
|
|
|
# Import all models to register them with Base metadata
|
|
from app.db.base_class import Base
|
|
import app.models.study
|
|
import app.models.study_role_permission
|
|
import app.models.api_endpoint_permission
|
|
import app.models.api_endpoint_registry
|
|
import app.models.user
|
|
import app.models.study_member
|
|
import app.models.subject
|
|
import app.models.visit
|
|
import app.models.ae
|
|
import app.models.monitoring_visit_issue
|
|
import app.models.site
|
|
|
|
# Replace PostgreSQL UUID type with custom GUID type for SQLite
|
|
for table in Base.metadata.tables.values():
|
|
for column in table.columns:
|
|
if isinstance(column.type, PG_UUID):
|
|
column.type = GUID()
|
|
|
|
# Create all tables
|
|
async with engine.begin() as conn:
|
|
await conn.run_sync(Base.metadata.create_all)
|
|
|
|
return engine
|
|
|
|
|
|
@pytest_asyncio.fixture
|
|
async def db_session(test_engine) -> AsyncGenerator[AsyncSession, None]:
|
|
"""Create a test database session."""
|
|
async_session = async_sessionmaker(
|
|
bind=test_engine,
|
|
class_=AsyncSession,
|
|
expire_on_commit=False,
|
|
)
|
|
|
|
async with async_session() as session:
|
|
# Create a test study for foreign key references with unique code
|
|
study_code = f"TEST-STUDY-{uuid.uuid4().hex[:8]}"
|
|
await session.execute(
|
|
text("""
|
|
INSERT INTO studies (id, code, name, status, is_locked, visit_schedule)
|
|
VALUES (:id, :code, :name, :status, :is_locked, :visit_schedule)
|
|
"""),
|
|
{
|
|
"id": str(uuid.uuid4()),
|
|
"code": study_code,
|
|
"name": "Test Study",
|
|
"status": "ACTIVE",
|
|
"is_locked": False,
|
|
"visit_schedule": "[]",
|
|
}
|
|
)
|
|
await session.commit()
|
|
|
|
yield session
|
|
|
|
# Clean up after test
|
|
await session.rollback()
|