Cheng Zhou
b491b6a146
Client Quality Gates / Shared client and Web (push) Has been cancelled
Client Quality Gates / macOS Desktop (push) Has been cancelled
Storage Persistence Guard / storage-persistence-audit (push) Has been cancelled
Client Quality Gates / Shared client and Web (pull_request) Has been cancelled
Client Quality Gates / macOS Desktop (pull_request) Has been cancelled
Storage Persistence Guard / storage-persistence-audit (pull_request) Has been cancelled
507 lines
20 KiB
Python
507 lines
20 KiB
Python
import os
|
|
import uuid
|
|
from pathlib import Path
|
|
from urllib.parse import quote
|
|
|
|
import aiofiles
|
|
from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status, Request
|
|
from fastapi.responses import FileResponse
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.deps import get_current_user, get_db_session, get_operator_role_label, get_study_member, is_system_admin, require_study_not_locked
|
|
from app.core.project_permissions import role_has_api_permission
|
|
from app.crud import attachment as attachment_crud
|
|
from app.crud import audit as audit_crud
|
|
from app.crud import contract_fee as contract_fee_crud
|
|
from app.crud import drug_shipment as drug_shipment_crud
|
|
from app.crud import faq_reply as faq_reply_crud
|
|
from app.crud import material_equipment as material_equipment_crud
|
|
from app.crud import precaution as precaution_crud
|
|
from app.crud import study as study_crud
|
|
from app.crud import startup as startup_crud
|
|
from app.crud import user as user_crud
|
|
from app.crud import member as member_crud
|
|
from app.core.security import decode_token
|
|
from app.schemas.attachment import AttachmentRead
|
|
from app.schemas.user import UserDisplay
|
|
|
|
router = APIRouter()
|
|
global_router = APIRouter()
|
|
|
|
UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
|
|
FEE_ATTACHMENT_ENTITY_TYPES = {
|
|
"contract_fee_contract",
|
|
"contract_fee_voucher",
|
|
"contract_fee_invoice",
|
|
}
|
|
FEE_ATTACHMENT_PERMISSION_BY_ACTION = {
|
|
"create": "fees_contracts:create",
|
|
"read": "fees_contracts:read",
|
|
"delete": "fees_contracts_attachments:delete",
|
|
}
|
|
STARTUP_INITIATION_ATTACHMENT_PERMISSION_BY_ACTION = {
|
|
"create": "startup_initiation:create",
|
|
"read": "startup_initiation:read",
|
|
"delete": "startup_initiation_attachments:delete",
|
|
}
|
|
STARTUP_ETHICS_ATTACHMENT_PERMISSION_BY_ACTION = {
|
|
"create": "startup_ethics:create",
|
|
"read": "startup_ethics:read",
|
|
"delete": "startup_ethics_attachments:delete",
|
|
}
|
|
STARTUP_AUTH_ATTACHMENT_PERMISSION_BY_ACTION = {
|
|
"create": "startup_auth:create",
|
|
"read": "startup_auth:read",
|
|
"delete": "startup_auth_attachments:delete",
|
|
}
|
|
DRUG_SHIPMENT_ATTACHMENT_PERMISSION_BY_ACTION = {
|
|
"create": "drug_shipments:create",
|
|
"read": "drug_shipments:read",
|
|
"delete": "drug_shipments_attachments:delete",
|
|
}
|
|
MATERIAL_EQUIPMENT_ATTACHMENT_ENTITY_TYPES = {
|
|
"material_equipment",
|
|
}
|
|
MATERIAL_EQUIPMENT_ATTACHMENT_PERMISSION_BY_ACTION = {
|
|
"create": "material_equipments:update",
|
|
"read": "material_equipments:read",
|
|
"delete": "material_equipments_attachments:delete",
|
|
}
|
|
PRECAUTION_ATTACHMENT_PERMISSION_BY_ACTION = {
|
|
"create": "precautions:create",
|
|
"read": "precautions:read",
|
|
"delete": "precautions_attachments:delete",
|
|
}
|
|
FAQ_REPLY_ATTACHMENT_PERMISSION_BY_ACTION = {
|
|
"create": "faq_reply:create",
|
|
"read": "faq:read",
|
|
"delete": "faq_attachments:delete",
|
|
}
|
|
STARTUP_AUTH_ATTACHMENT_ENTITY_TYPES = {
|
|
"startup_kickoff",
|
|
"startup_kickoff_minutes",
|
|
"startup_kickoff_signin",
|
|
"startup_kickoff_ppt",
|
|
"training_authorization",
|
|
}
|
|
|
|
def _content_disposition(filename: str, disposition: str = "inline") -> str:
|
|
fallback = "".join((ch if ord(ch) < 128 else "_") for ch in filename) or "download"
|
|
quoted = quote(filename, safe="")
|
|
return f"{disposition}; filename=\"{fallback}\"; filename*=UTF-8''{quoted}"
|
|
|
|
|
|
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
|
|
study = await study_crud.get(db, study_id)
|
|
if not study:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在")
|
|
return study
|
|
|
|
|
|
def _attachment_operation(action: str) -> str:
|
|
if action in {"create", "read", "delete"}:
|
|
return action
|
|
return "read" if action == "read" else "create"
|
|
|
|
|
|
async def _resolve_attachment_parent_permission(
|
|
db: AsyncSession,
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
action: str,
|
|
) -> str | None:
|
|
operation = _attachment_operation(action)
|
|
|
|
if entity_type in FEE_ATTACHMENT_ENTITY_TYPES:
|
|
contract = await contract_fee_crud.get_contract_fee(db, entity_id)
|
|
if not contract or contract.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="合同费用不存在")
|
|
return FEE_ATTACHMENT_PERMISSION_BY_ACTION[operation]
|
|
|
|
if entity_type == "startup_feasibility":
|
|
record = await startup_crud.get_feasibility(db, entity_id)
|
|
if not record or record.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="立项记录不存在")
|
|
return STARTUP_INITIATION_ATTACHMENT_PERMISSION_BY_ACTION[operation]
|
|
|
|
if entity_type == "startup_ethics":
|
|
record = await startup_crud.get_ethics(db, entity_id)
|
|
if not record or record.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="伦理记录不存在")
|
|
return STARTUP_ETHICS_ATTACHMENT_PERMISSION_BY_ACTION[operation]
|
|
|
|
if entity_type in STARTUP_AUTH_ATTACHMENT_ENTITY_TYPES:
|
|
if entity_type == "training_authorization":
|
|
record = await startup_crud.get_training_authorization(db, entity_id)
|
|
missing_detail = "培训授权不存在"
|
|
else:
|
|
record = await startup_crud.get_kickoff(db, entity_id)
|
|
missing_detail = "启动会不存在"
|
|
if not record or record.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=missing_detail)
|
|
return STARTUP_AUTH_ATTACHMENT_PERMISSION_BY_ACTION[operation]
|
|
|
|
if entity_type == "drug_shipment":
|
|
shipment = await drug_shipment_crud.get_shipment(db, entity_id)
|
|
if not shipment or shipment.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="药物发货不存在")
|
|
return DRUG_SHIPMENT_ATTACHMENT_PERMISSION_BY_ACTION[operation]
|
|
|
|
if entity_type in MATERIAL_EQUIPMENT_ATTACHMENT_ENTITY_TYPES:
|
|
equipment = await material_equipment_crud.get_equipment(db, entity_id)
|
|
if not equipment or equipment.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="设备记录不存在")
|
|
return MATERIAL_EQUIPMENT_ATTACHMENT_PERMISSION_BY_ACTION[operation]
|
|
|
|
if entity_type == "precaution":
|
|
precaution = await precaution_crud.get_precaution(db, entity_id)
|
|
if not precaution or precaution.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="注意事项不存在")
|
|
return PRECAUTION_ATTACHMENT_PERMISSION_BY_ACTION[operation]
|
|
|
|
if entity_type == "faq_replies":
|
|
reply = await faq_reply_crud.get_reply(db, entity_id)
|
|
if not reply or reply.study_id != study_id:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="FAQ回复不存在")
|
|
return FAQ_REPLY_ATTACHMENT_PERMISSION_BY_ACTION[operation]
|
|
|
|
return None
|
|
|
|
|
|
async def _ensure_attachment_permission(
|
|
db: AsyncSession,
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
action: str,
|
|
current_user,
|
|
membership=None,
|
|
) -> None:
|
|
parent_permission = await _resolve_attachment_parent_permission(db, study_id, entity_type, entity_id, action)
|
|
if is_system_admin(current_user):
|
|
return
|
|
|
|
if membership is None:
|
|
membership = await member_crud.get_member(db, study_id, current_user.id)
|
|
if not membership or not membership.is_active:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
|
|
|
|
if not parent_permission:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="附件类型未配置权限")
|
|
|
|
allowed = await role_has_api_permission(
|
|
db,
|
|
study_id,
|
|
membership.role_in_study,
|
|
parent_permission,
|
|
check_prerequisites=False,
|
|
)
|
|
if not allowed:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="项目权限不足")
|
|
|
|
|
|
@router.post(
|
|
"/",
|
|
response_model=AttachmentRead,
|
|
status_code=status.HTTP_201_CREATED,
|
|
dependencies=[
|
|
Depends(require_study_not_locked())
|
|
],
|
|
)
|
|
async def upload_attachment(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
file: UploadFile = File(...),
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> AttachmentRead:
|
|
await _ensure_study_exists(db, study_id)
|
|
await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "create", current_user)
|
|
dest_dir = UPLOAD_ROOT / f"study_{study_id}" / f"{entity_type}_{entity_id}"
|
|
dest_dir.mkdir(parents=True, exist_ok=True)
|
|
unique_name = f"{uuid.uuid4()}{Path(file.filename).suffix}"
|
|
dest_path = dest_dir / unique_name
|
|
|
|
content = await file.read()
|
|
async with aiofiles.open(dest_path, "wb") as out_file:
|
|
await out_file.write(content)
|
|
|
|
attachment = await attachment_crud.create_attachment(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type=entity_type,
|
|
entity_id=entity_id,
|
|
filename=file.filename,
|
|
file_path=str(dest_path),
|
|
file_size=len(content),
|
|
content_type=file.content_type,
|
|
uploaded_by=current_user.id,
|
|
)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type=entity_type,
|
|
entity_id=entity_id,
|
|
action="UPLOAD_FILE",
|
|
detail=f"文件已上传：{file.filename}",
|
|
operator_id=current_user.id,
|
|
operator_role=await get_operator_role_label(db, study_id, current_user),
|
|
)
|
|
return AttachmentRead(
|
|
id=attachment.id,
|
|
filename=attachment.filename,
|
|
file_size=attachment.file_size,
|
|
content_type=attachment.content_type,
|
|
uploaded_by=UserDisplay.model_validate(current_user) if current_user else None,
|
|
uploaded_by_id=attachment.uploaded_by,
|
|
uploaded_at=attachment.uploaded_at,
|
|
)
|
|
|
|
|
|
@router.get(
|
|
"/",
|
|
response_model=list[AttachmentRead],
|
|
)
|
|
async def list_attachments(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> list[AttachmentRead]:
|
|
await _ensure_study_exists(db, study_id)
|
|
await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "read", current_user)
|
|
attachments = await attachment_crud.list_attachments(db, study_id, entity_type, entity_id)
|
|
user_ids = {a.uploaded_by for a in attachments if a.uploaded_by}
|
|
users_map = await user_crud.get_users_by_ids(db, user_ids)
|
|
result: list[AttachmentRead] = []
|
|
for a in attachments:
|
|
user = users_map.get(a.uploaded_by)
|
|
result.append(
|
|
AttachmentRead(
|
|
id=a.id,
|
|
filename=a.filename,
|
|
file_size=a.file_size,
|
|
content_type=a.content_type,
|
|
uploaded_by=UserDisplay.model_validate(user) if user else None,
|
|
uploaded_by_id=a.uploaded_by,
|
|
uploaded_at=a.uploaded_at,
|
|
)
|
|
)
|
|
return result
|
|
|
|
|
|
@router.get(
|
|
"/{attachment_id}/download",
|
|
)
|
|
async def download_attachment(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
attachment_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> FileResponse:
|
|
await _ensure_study_exists(db, study_id)
|
|
await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "read", current_user)
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
if not os.path.exists(attachment.file_path):
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
|
|
return FileResponse(
|
|
path=attachment.file_path,
|
|
filename=attachment.filename,
|
|
media_type=attachment.content_type or "application/octet-stream",
|
|
headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="attachment")},
|
|
)
|
|
|
|
|
|
@router.get(
|
|
"/{attachment_id}/preview",
|
|
)
|
|
async def preview_attachment(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
attachment_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> FileResponse:
|
|
await _ensure_study_exists(db, study_id)
|
|
await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "read", current_user)
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
if not os.path.exists(attachment.file_path):
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
|
|
return FileResponse(
|
|
path=attachment.file_path,
|
|
filename=attachment.filename,
|
|
media_type=attachment.content_type or "application/octet-stream",
|
|
headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="inline")},
|
|
)
|
|
|
|
|
|
async def _authorize_global(request: Request, db: AsyncSession, study_id: uuid.UUID):
|
|
auth_header = request.headers.get("Authorization")
|
|
if auth_header and auth_header.lower().startswith("bearer "):
|
|
token = auth_header.split(" ", 1)[1]
|
|
else:
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="未登录")
|
|
payload = decode_token(token)
|
|
user = await user_crud.get_by_id(db, uuid.UUID(str(payload.get("sub"))))
|
|
if not user or not user.is_active:
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="账号不存在或已停用")
|
|
if is_system_admin(user):
|
|
return user, None
|
|
membership = await member_crud.get_member(db, study_id, user.id)
|
|
if not membership or not membership.is_active:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
|
|
return user, membership
|
|
|
|
|
|
@global_router.get(
|
|
"/{attachment_id}/download",
|
|
response_class=FileResponse,
|
|
)
|
|
async def global_download_attachment(
|
|
attachment_id: uuid.UUID,
|
|
request: Request,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
):
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if not attachment:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
await _ensure_study_exists(db, attachment.study_id)
|
|
user, membership = await _authorize_global(request, db, attachment.study_id)
|
|
await _ensure_attachment_permission(
|
|
db, attachment.study_id, attachment.entity_type, attachment.entity_id, "read", user, membership
|
|
)
|
|
if not os.path.exists(attachment.file_path):
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
|
|
return FileResponse(
|
|
path=attachment.file_path,
|
|
filename=attachment.filename,
|
|
media_type=attachment.content_type or "application/octet-stream",
|
|
headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="attachment")},
|
|
)
|
|
|
|
|
|
@global_router.get(
|
|
"/{attachment_id}/preview",
|
|
response_class=FileResponse,
|
|
)
|
|
async def global_preview_attachment(
|
|
attachment_id: uuid.UUID,
|
|
request: Request,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
):
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if not attachment:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
await _ensure_study_exists(db, attachment.study_id)
|
|
user, membership = await _authorize_global(request, db, attachment.study_id)
|
|
await _ensure_attachment_permission(
|
|
db, attachment.study_id, attachment.entity_type, attachment.entity_id, "read", user, membership
|
|
)
|
|
if not os.path.exists(attachment.file_path):
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
|
|
return FileResponse(
|
|
path=attachment.file_path,
|
|
filename=attachment.filename,
|
|
media_type=attachment.content_type or "application/octet-stream",
|
|
headers={"Content-Disposition": _content_disposition(attachment.filename, disposition="inline")},
|
|
)
|
|
|
|
|
|
@global_router.delete(
|
|
"/{attachment_id}",
|
|
status_code=status.HTTP_204_NO_CONTENT,
|
|
)
|
|
async def global_delete_attachment(
|
|
attachment_id: uuid.UUID,
|
|
request: Request,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
):
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if not attachment:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
await _ensure_study_exists(db, attachment.study_id)
|
|
user, membership = await _authorize_global(request, db, attachment.study_id)
|
|
await _ensure_attachment_permission(
|
|
db, attachment.study_id, attachment.entity_type, attachment.entity_id, "delete", user, membership
|
|
)
|
|
can_delete = (
|
|
is_system_admin(user)
|
|
or attachment.uploaded_by == user.id
|
|
or membership is not None
|
|
)
|
|
if not can_delete:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
|
|
await attachment_crud.soft_delete_attachment(db, attachment)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=attachment.study_id,
|
|
entity_type=attachment.entity_type,
|
|
entity_id=attachment.entity_id,
|
|
action="DELETE_ATTACHMENT",
|
|
detail=f"文件已删除：{attachment.filename}",
|
|
operator_id=user.id,
|
|
operator_role=await get_operator_role_label(db, attachment.study_id, user),
|
|
)
|
|
|
|
|
|
@router.delete(
|
|
"/{attachment_id}",
|
|
status_code=status.HTTP_204_NO_CONTENT,
|
|
dependencies=[
|
|
Depends(require_study_not_locked())
|
|
],
|
|
)
|
|
async def delete_attachment(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
attachment_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
):
|
|
await _ensure_study_exists(db, study_id)
|
|
await _ensure_attachment_permission(db, study_id, entity_type, entity_id, "delete", current_user)
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if (
|
|
not attachment
|
|
or attachment.study_id != study_id
|
|
or attachment.entity_id != entity_id
|
|
or attachment.entity_type != entity_type
|
|
or attachment.is_deleted
|
|
):
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
|
|
membership = None
|
|
if not is_system_admin(current_user):
|
|
membership = await get_study_member(study_id, current_user=current_user, db=db)
|
|
|
|
can_delete = (
|
|
is_system_admin(current_user)
|
|
or attachment.uploaded_by == current_user.id
|
|
or membership is not None
|
|
)
|
|
if not can_delete:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
|
|
|
|
await attachment_crud.soft_delete_attachment(db, attachment)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type=entity_type,
|
|
entity_id=entity_id,
|
|
action="DELETE_ATTACHMENT",
|
|
detail=f"文件已删除：{attachment.filename}",
|
|
operator_id=current_user.id,
|
|
operator_role=await get_operator_role_label(db, study_id, current_user),
|
|
)
|