Cheng Zhou
939fc70532
新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。 后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。 前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。 补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。
224 lines
8.4 KiB
Python
224 lines
8.4 KiB
Python
import uuid
|
|
|
|
from fastapi import APIRouter, Depends, HTTPException, status
|
|
from sqlalchemy import select
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.deps import get_cra_site_scope, get_current_user, get_db_session, require_study_not_locked, require_study_permission
|
|
from app.crud import audit as audit_crud
|
|
from app.crud import site as site_crud
|
|
from app.crud import subject as subject_crud
|
|
from app.crud import study as study_crud
|
|
from app.models.ae import AdverseEvent
|
|
from app.schemas.subject import SubjectCreate, SubjectRead, SubjectUpdate
|
|
|
|
router = APIRouter()
|
|
|
|
|
|
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
|
|
study = await study_crud.get(db, study_id)
|
|
if not study:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在")
|
|
return study
|
|
|
|
|
|
async def _ensure_subject_active(db: AsyncSession, subject) -> None:
|
|
if not subject or not subject.site_id:
|
|
return
|
|
site = await site_crud.get_site(db, subject.site_id)
|
|
if not site or not site.is_active:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="中心已停用")
|
|
|
|
|
|
@router.post(
|
|
"/",
|
|
response_model=SubjectRead,
|
|
status_code=status.HTTP_201_CREATED,
|
|
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
|
|
)
|
|
async def create_subject(
|
|
study_id: uuid.UUID,
|
|
subject_in: SubjectCreate,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> SubjectRead:
|
|
await _ensure_study_exists(db, study_id)
|
|
cra_scope = await get_cra_site_scope(db, study_id, current_user)
|
|
if cra_scope and subject_in.site_id not in cra_scope[0]:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
|
|
try:
|
|
subject = await subject_crud.create_subject(db, study_id, subject_in)
|
|
except ValueError as exc:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type="subject",
|
|
entity_id=subject.id,
|
|
action="CREATE_SUBJECT",
|
|
detail=f"参与者 {subject.subject_no} 已创建",
|
|
operator_id=current_user.id,
|
|
operator_role=current_user.role,
|
|
)
|
|
return subject
|
|
|
|
|
|
@router.get(
|
|
"/",
|
|
response_model=list[SubjectRead],
|
|
dependencies=[Depends(require_study_permission("subjects", "read"))],
|
|
)
|
|
async def list_subjects(
|
|
study_id: uuid.UUID,
|
|
site_id: uuid.UUID | None = None,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> list[SubjectRead]:
|
|
await _ensure_study_exists(db, study_id)
|
|
cra_scope = await get_cra_site_scope(db, study_id, current_user)
|
|
site_ids = cra_scope[0] if cra_scope else None
|
|
if site_id and site_ids is not None and site_id not in site_ids:
|
|
return []
|
|
subjects = await subject_crud.list_subjects(db, study_id, site_id=site_id, site_ids=site_ids)
|
|
subject_list = list(subjects)
|
|
if not subject_list:
|
|
return []
|
|
subject_ids = [subject.id for subject in subject_list]
|
|
ae_rows = await db.execute(
|
|
select(AdverseEvent.subject_id, AdverseEvent.is_sae, AdverseEvent.is_susar).where(
|
|
AdverseEvent.study_id == study_id,
|
|
AdverseEvent.subject_id.in_(subject_ids),
|
|
)
|
|
)
|
|
ae_flags: dict[uuid.UUID, dict[str, bool]] = {}
|
|
for row in ae_rows.all():
|
|
sid = row[0]
|
|
if not sid:
|
|
continue
|
|
if sid not in ae_flags:
|
|
ae_flags[sid] = {"has_ae": True, "has_sae": False, "has_susar": False}
|
|
if row[1]:
|
|
ae_flags[sid]["has_sae"] = True
|
|
if row[2]:
|
|
ae_flags[sid]["has_susar"] = True
|
|
result: list[SubjectRead] = []
|
|
for subject in subject_list:
|
|
data = SubjectRead.model_validate(subject)
|
|
flags = ae_flags.get(subject.id, {"has_ae": False, "has_sae": False, "has_susar": False})
|
|
data.has_ae = flags["has_ae"]
|
|
data.has_sae = flags["has_sae"]
|
|
data.has_susar = flags["has_susar"]
|
|
result.append(data)
|
|
return result
|
|
|
|
|
|
@router.get(
|
|
"/{subject_id}",
|
|
response_model=SubjectRead,
|
|
dependencies=[Depends(require_study_permission("subjects", "read"))],
|
|
)
|
|
async def get_subject(
|
|
study_id: uuid.UUID,
|
|
subject_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> SubjectRead:
|
|
await _ensure_study_exists(db, study_id)
|
|
subject = await subject_crud.get_subject(db, subject_id)
|
|
if not subject or subject.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="参与者不存在")
|
|
cra_scope = await get_cra_site_scope(db, study_id, current_user)
|
|
if cra_scope and subject.site_id not in cra_scope[0]:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
|
|
await _ensure_subject_active(db, subject)
|
|
data = SubjectRead.model_validate(subject)
|
|
ae_row = await db.execute(
|
|
select(AdverseEvent.is_sae, AdverseEvent.is_susar).where(
|
|
AdverseEvent.study_id == study_id,
|
|
AdverseEvent.subject_id == subject.id,
|
|
)
|
|
)
|
|
ae_flags = {"has_ae": False, "has_sae": False, "has_susar": False}
|
|
for row in ae_row.all():
|
|
ae_flags["has_ae"] = True
|
|
if row[0]:
|
|
ae_flags["has_sae"] = True
|
|
if row[1]:
|
|
ae_flags["has_susar"] = True
|
|
data.has_ae = ae_flags["has_ae"]
|
|
data.has_sae = ae_flags["has_sae"]
|
|
data.has_susar = ae_flags["has_susar"]
|
|
return data
|
|
|
|
|
|
@router.patch(
|
|
"/{subject_id}",
|
|
response_model=SubjectRead,
|
|
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
|
|
)
|
|
async def update_subject(
|
|
study_id: uuid.UUID,
|
|
subject_id: uuid.UUID,
|
|
subject_in: SubjectUpdate,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> SubjectRead:
|
|
await _ensure_study_exists(db, study_id)
|
|
subject = await subject_crud.get_subject(db, subject_id)
|
|
if not subject or subject.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="参与者不存在")
|
|
cra_scope = await get_cra_site_scope(db, study_id, current_user)
|
|
if cra_scope and subject.site_id not in cra_scope[0]:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
|
|
await _ensure_subject_active(db, subject)
|
|
old_status = subject.status
|
|
updated = await subject_crud.update_subject(db, subject, subject_in)
|
|
# 基线/治疗日期是访视计划的唯一推算基准，不能用入组日期替代。
|
|
if updated.baseline_date:
|
|
await subject_crud.sync_visits_from_baseline(db, updated)
|
|
detail = None
|
|
if subject_in.status and subject_in.status != old_status:
|
|
detail = f"参与者 {updated.subject_no} 状态 {old_status} -> {subject_in.status}"
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type="subject",
|
|
entity_id=subject_id,
|
|
action="SUBJECT_STATUS_CHANGE" if detail else "UPDATE_SUBJECT",
|
|
detail=detail or "参与者已更新",
|
|
operator_id=current_user.id,
|
|
operator_role=current_user.role,
|
|
)
|
|
return updated
|
|
|
|
|
|
@router.delete(
|
|
"/{subject_id}",
|
|
status_code=status.HTTP_204_NO_CONTENT,
|
|
dependencies=[Depends(require_study_permission("subjects", "write")), Depends(require_study_not_locked())],
|
|
)
|
|
async def delete_subject(
|
|
study_id: uuid.UUID,
|
|
subject_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> None:
|
|
await _ensure_study_exists(db, study_id)
|
|
subject = await subject_crud.get_subject(db, subject_id)
|
|
if not subject or subject.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="参与者不存在")
|
|
cra_scope = await get_cra_site_scope(db, study_id, current_user)
|
|
if cra_scope and subject.site_id not in cra_scope[0]:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="权限不足")
|
|
await subject_crud.delete_subject(db, subject)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type="subject",
|
|
entity_id=subject_id,
|
|
action="DELETE_SUBJECT",
|
|
detail=f"参与者 {subject_id} 已删除",
|
|
operator_id=current_user.id,
|
|
operator_role=current_user.role,
|
|
)
|