ctms/backend/app/core/deps.py

from typing import Annotated, AsyncGenerator, Callable, Iterable
import uuid

from fastapi import Depends, HTTPException, status
from pydantic import ValidationError
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.exceptions import AppException
from app.core.security import decode_token, oauth2_scheme
from app.crud import user as user_crud
from app.crud import member as member_crud
from app.crud import site as site_crud
from app.db.session import SessionLocal
from app.schemas.user import TokenPayload


async def get_db_session() -> AsyncGenerator[AsyncSession, None]:
    async with SessionLocal() as session:
        yield session


async def get_current_user(
    token: Annotated[str, Depends(oauth2_scheme)],
    db: Annotated[AsyncSession, Depends(get_db_session)],
):
    payload = decode_token(token)
    try:
        token_data = TokenPayload(**payload)
    except ValidationError as exc:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="无法验证登录凭据",
            headers={"WWW-Authenticate": "Bearer"},
        ) from exc

    user = await user_crud.get_by_id(db, uuid.UUID(str(token_data.sub)))
    if not user:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="账号不存在",
            headers={"WWW-Authenticate": "Bearer"},
        )
    if not user.is_active:
        raise HTTPException(
            status_code=status.HTTP_403_FORBIDDEN,
            detail="账号已停用",
        )
    return user


def require_roles(roles: Iterable[str]) -> Callable:
    roles_set = set(roles)

    async def dependency(current_user=Depends(get_current_user)):
        current_role = current_user.role.value if hasattr(current_user.role, "value") else str(current_user.role)
        if current_role not in roles_set:
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail="权限不足",
            )
        return current_user

    return dependency


async def get_study_member(
    study_id: uuid.UUID,
    current_user=Depends(get_current_user),
    db: AsyncSession = Depends(get_db_session),
):
    role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
    if role_value == "ADMIN":
        return None
    return await member_crud.get_member(db, study_id, current_user.id)


def require_study_member():
    async def dependency(
        study_id: uuid.UUID,
        current_user=Depends(get_current_user),
        db: AsyncSession = Depends(get_db_session),
    ):
        role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
        if role_value == "ADMIN":
            return current_user
        membership = await member_crud.get_member(db, study_id, current_user.id)
        if not membership or not membership.is_active:
            raise AppException(
                code="FORBIDDEN",
                message="不是该项目成员",
                status_code=status.HTTP_403_FORBIDDEN,
            )
        return current_user

    return dependency


def require_study_roles(roles: Iterable[str]):
    roles_set = set(roles)

    async def dependency(
        study_id: uuid.UUID,
        current_user=Depends(get_current_user),
        db: AsyncSession = Depends(get_db_session),
    ):
        role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
        if role_value == "ADMIN":
            return current_user
        membership = await member_crud.get_member(db, study_id, current_user.id)
        if not membership or not membership.is_active or membership.role_in_study not in roles_set:
            raise AppException(
                code="FORBIDDEN",
                message="项目权限不足",
                status_code=status.HTTP_403_FORBIDDEN,
            )
        return current_user

    return dependency


async def get_cra_site_scope(
    db: AsyncSession,
    study_id: uuid.UUID,
    current_user,
) -> tuple[set[uuid.UUID], set[str]] | None:
    role_value = current_user.role.value if hasattr(current_user.role, "value") else current_user.role
    if role_value == "ADMIN":
        return None
    membership = await member_crud.get_member(db, study_id, current_user.id)
    if not membership or not membership.is_active:
        return None
    if membership.role_in_study != "CRA":
        return None
    site_ids = await site_crud.list_ids_by_contact_user(db, study_id, current_user.id)
    site_names = await site_crud.list_names_by_contact_user(db, study_id, current_user.id)
    return site_ids, site_names


def require_study_not_locked():
    """检查项目是否被锁定，如果锁定则拒绝所有修改请求"""
    from app.crud import study as study_crud
    
    async def dependency(
        study_id: uuid.UUID,
        db: AsyncSession = Depends(get_db_session),
    ):
        study = await study_crud.get(db, study_id)
        if not study:
            raise HTTPException(
                status_code=status.HTTP_404_NOT_FOUND,
                detail="项目不存在",
            )
        if study.is_locked:
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail="项目已锁定，无法进行任何修改操作",
            )
        return study

    return dependency