Cheng Zhou
939fc70532
新增项目级角色权限矩阵，覆盖 PM、CRA、PV、IMP、QA 等项目角色，并通过迁移表持久化各业务模块的读写权限。 后端将参与者、合同费用、物资、启动、里程碑、风险问题、监查稽查、FAQ、共享库、文件版本等接口接入矩阵校验，修复审计日志导出权限和登录 502 的依赖导入问题。 前端新增权限管理页面和项目路由权限映射，按矩阵控制导航显示、直接访问拦截、操作按钮启停，并限制管理后台仅 admin 和授权 PM 可进入。 补充后端权限归一化与接口静态测试、前端路由/权限工具/权限管理页面/工作台等回归测试。
135 lines
5.6 KiB
Python
135 lines
5.6 KiB
Python
from pathlib import Path
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_project_setup_routes_keep_project_admin_and_pm_defaults():
|
|
source = (ROOT / "app/api/v1/studies.py").read_text(encoding="utf-8")
|
|
|
|
assert 'require_study_roles(["PM"])' not in source
|
|
assert 'require_study_roles(["ADMIN", "PM"])' not in source
|
|
assert 'require_roles(["ADMIN"])' in source
|
|
|
|
|
|
def test_project_permission_routes_are_registered():
|
|
source = (ROOT / "app/api/v1/router.py").read_text(encoding="utf-8")
|
|
|
|
assert "project_permissions" in source
|
|
assert 'prefix="/studies/{study_id}/permissions"' in source
|
|
|
|
|
|
def test_project_member_writes_use_saved_permission_matrix():
|
|
source = (ROOT / "app/api/v1/members.py").read_text(encoding="utf-8")
|
|
|
|
assert 'require_study_permission("project_members", "write")' in source
|
|
assert 'require_study_roles(["ADMIN", "PM"])' not in source
|
|
|
|
|
|
def test_business_modules_use_saved_permission_matrix():
|
|
expected = {
|
|
"overview.py": [
|
|
'require_study_permission("project_overview", "read")',
|
|
],
|
|
"project_milestones.py": [
|
|
'require_study_permission("project_milestones", "read")',
|
|
'require_study_permission("project_milestones", "write")',
|
|
],
|
|
"subjects.py": [
|
|
'require_study_permission("subjects", "read")',
|
|
'require_study_permission("subjects", "write")',
|
|
],
|
|
"material_equipments.py": [
|
|
'require_study_permission("materials", "read")',
|
|
'require_study_permission("materials", "write")',
|
|
],
|
|
"startup.py": [
|
|
'require_study_permission("startup_ethics", "read")',
|
|
'require_study_permission("startup_ethics", "write")',
|
|
'require_study_permission("startup_auth", "read")',
|
|
'require_study_permission("startup_auth", "write")',
|
|
],
|
|
"aes.py": [
|
|
'require_study_permission("risk_issues", "read")',
|
|
'require_study_permission("risk_issues", "write")',
|
|
],
|
|
"monitoring_visit_issues.py": [
|
|
'require_study_permission("monitoring_audit", "read")',
|
|
'require_study_permission("monitoring_audit", "write")',
|
|
],
|
|
}
|
|
|
|
for filename, checks in expected.items():
|
|
source = (ROOT / f"app/api/v1/{filename}").read_text(encoding="utf-8")
|
|
for check in checks:
|
|
assert check in source
|
|
|
|
ae_source = (ROOT / "app/api/v1/aes.py").read_text(encoding="utf-8")
|
|
assert "ALLOWED_CREATE_ROLES" not in ae_source
|
|
assert "ALLOWED_UPDATE_ROLES" not in ae_source
|
|
assert 'member_role not in {"PM", "PV"}' not in ae_source
|
|
|
|
|
|
def test_fee_contracts_use_saved_permission_matrix():
|
|
source = (ROOT / "app/api/v1/fees_contracts.py").read_text(encoding="utf-8")
|
|
|
|
assert 'role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)' in source
|
|
assert 'if write and membership.role_in_study not in {"ADMIN", "PM"}' not in source
|
|
|
|
|
|
def test_attachment_deletes_use_saved_permission_matrix():
|
|
source = (ROOT / "app/api/v1/attachments.py").read_text(encoding="utf-8")
|
|
fees_source = (ROOT / "app/api/v1/fees_attachments.py").read_text(encoding="utf-8")
|
|
|
|
assert "_permission_module_for_entity(entity_type)" in source
|
|
assert '"knowledge_note": "shared_library"' in source
|
|
assert "_permission_module_for_entity(attachment.entity_type)" in source
|
|
assert 'getattr(membership, "role_in_study", None) == "PM"' not in source
|
|
assert 'role_has_project_permission(db, project_id, membership.role_in_study, "fees", action)' in fees_source
|
|
assert 'getattr(membership, "role_in_study", None) == "PM"' not in fees_source
|
|
|
|
|
|
def test_faq_uses_dedicated_permission_matrix():
|
|
source = (ROOT / "app/api/v1/faqs.py").read_text(encoding="utf-8")
|
|
category_source = (ROOT / "app/api/v1/faq_categories.py").read_text(encoding="utf-8")
|
|
|
|
assert 'role_has_project_permission(db, study_id, member.role_in_study, "faq", action)' in source
|
|
assert 'role_has_project_permission(db, study_id, member.role_in_study, "faq", action)' in category_source
|
|
assert '"etmf"' not in source
|
|
assert '"etmf"' not in category_source
|
|
assert 'member_role != "PM"' not in source
|
|
assert 'member_role != "PM"' not in category_source
|
|
|
|
|
|
def test_audit_logs_use_saved_permission_matrix():
|
|
source = (ROOT / "app/api/v1/audit_logs.py").read_text(encoding="utf-8")
|
|
get_block = source[source.index("@router.get("):source.index("@router.delete(")]
|
|
|
|
assert 'require_study_permission("audit_export", "read")' in get_block
|
|
assert 'require_study_member()' not in get_block
|
|
|
|
|
|
def test_document_service_uses_saved_permission_matrix():
|
|
source = (ROOT / "app/services/document_service.py").read_text(encoding="utf-8")
|
|
|
|
assert 'role_has_project_permission' in source
|
|
assert '"file_versions"' in source
|
|
assert 'rbac.is_allowed' not in source
|
|
|
|
|
|
def test_remaining_business_reads_use_saved_permission_matrix():
|
|
expected = {
|
|
"finance_contracts.py": ['require_study_permission("fees", "read")'],
|
|
"drug_shipments.py": ['require_study_permission("materials", "read")'],
|
|
"knowledge_notes.py": ['require_study_permission("shared_library", "read")'],
|
|
"subject_histories.py": ['require_study_permission("subjects", "read")'],
|
|
"subject_pds.py": ['require_study_permission("risk_issues", "read")'],
|
|
"visits.py": ['require_study_permission("subjects", "read")'],
|
|
"attachments.py": ['_permission_module_for_entity(entity_type)'],
|
|
}
|
|
|
|
for filename, checks in expected.items():
|
|
source = (ROOT / f"app/api/v1/{filename}").read_text(encoding="utf-8")
|
|
for check in checks:
|
|
assert check in source
|