ctms/backend/app/api/v1/subject_pds.py

import uuid

from fastapi import APIRouter, Depends, HTTPException, status
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.deps import (
    get_current_user,
    get_db_session,
    require_study_not_locked,
    require_study_permission,
)
from app.crud import audit as audit_crud
from app.crud import site as site_crud
from app.crud import study as study_crud
from app.crud import subject as subject_crud
from app.crud import subject_pd as subject_pd_crud
from app.schemas.subject_pd import SubjectPdCreate, SubjectPdRead, SubjectPdUpdate

router = APIRouter()

ALLOWED_PD_LEVELS = {"GENERAL", "MAJOR", "CRITICAL"}
ALLOWED_APPROVAL_STATUS = {"DRAFT", "SUBMITTED", "APPROVED", "REJECTED"}
ALLOWED_PD_STATUS = {"OPEN", "CLOSED"}


async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
    study = await study_crud.get(db, study_id)
    if not study:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在")
    return study


async def _ensure_subject(db: AsyncSession, study_id: uuid.UUID, subject_id: uuid.UUID):
    subject = await subject_crud.get_subject(db, subject_id)
    if not subject or subject.study_id != study_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="参与者不存在")
    return subject


async def _ensure_subject_active(db: AsyncSession, subject) -> None:
    if not subject or not subject.site_id:
        return
    site = await site_crud.get_site(db, subject.site_id)
    if not site or not site.is_active:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="中心已停用")


def _normalize_pd_type(value: str) -> str:
    normalized = str(value or "").strip()
    if not normalized:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="PD类型不能为空")
    return normalized


def _normalize_choice(value: str | None, allowed: set[str], field_name: str) -> str:
    if value is None:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=f"{field_name}不能为空")
    normalized = str(value).strip().upper()
    if normalized not in allowed:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=f"{field_name}取值无效")
    return normalized


@router.get(
    "/pds",
    response_model=list[SubjectPdRead],
    dependencies=[Depends(require_study_permission("risk_issues", "read"))],
)
async def list_subject_pds(
    study_id: uuid.UUID,
    subject_id: uuid.UUID,
    skip: int = 0,
    limit: int = 200,
    db: AsyncSession = Depends(get_db_session),
) -> list[SubjectPdRead]:
    await _ensure_study_exists(db, study_id)
    await _ensure_subject(db, study_id, subject_id)
    items = await subject_pd_crud.list_subject_pds(db, study_id, subject_id, skip=skip, limit=limit)
    return [SubjectPdRead.model_validate(item) for item in items]


@router.post(
    "/pds",
    response_model=SubjectPdRead,
    status_code=status.HTTP_201_CREATED,
    dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def create_subject_pd(
    study_id: uuid.UUID,
    subject_id: uuid.UUID,
    pd_in: SubjectPdCreate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> SubjectPdRead:
    await _ensure_study_exists(db, study_id)
    subject = await _ensure_subject(db, study_id, subject_id)
    await _ensure_subject_active(db, subject)
    if pd_in.subject_id != subject_id:
        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="参与者不匹配")

    payload = pd_in.model_dump()
    payload["pd_type"] = _normalize_pd_type(payload.get("pd_type") or "")
    payload["pd_level"] = _normalize_choice(payload.get("pd_level") or "GENERAL", ALLOWED_PD_LEVELS, "PD分级")
    payload["approval_status"] = _normalize_choice(
        payload.get("approval_status") or "DRAFT", ALLOWED_APPROVAL_STATUS, "审批状态"
    )
    payload["status"] = _normalize_choice(payload.get("status") or "OPEN", ALLOWED_PD_STATUS, "状态")

    item = await subject_pd_crud.create_subject_pd(
        db,
        study_id,
        SubjectPdCreate(**payload),
        created_by=current_user.id,
    )
    await audit_crud.log_action(
        db,
        study_id=study_id,
        entity_type="subject_pd",
        entity_id=item.id,
        action="CREATE_SUBJECT_PD",
        detail=f"PD记录 {item.pd_no} 已创建",
        operator_id=current_user.id,
        operator_role=current_user.role,
    )
    return SubjectPdRead.model_validate(item)


@router.patch(
    "/pds/{pd_id}",
    response_model=SubjectPdRead,
    dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def update_subject_pd(
    study_id: uuid.UUID,
    subject_id: uuid.UUID,
    pd_id: uuid.UUID,
    pd_in: SubjectPdUpdate,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> SubjectPdRead:
    await _ensure_study_exists(db, study_id)
    subject = await _ensure_subject(db, study_id, subject_id)
    await _ensure_subject_active(db, subject)

    item = await subject_pd_crud.get_subject_pd(db, pd_id)
    if not item or item.study_id != study_id or item.subject_id != subject_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="PD记录不存在")

    update_payload = pd_in.model_dump(exclude_unset=True)
    if "pd_type" in update_payload:
        update_payload["pd_type"] = _normalize_pd_type(update_payload["pd_type"])
    if "pd_level" in update_payload:
        update_payload["pd_level"] = _normalize_choice(update_payload["pd_level"], ALLOWED_PD_LEVELS, "PD分级")
    if "approval_status" in update_payload:
        update_payload["approval_status"] = _normalize_choice(
            update_payload["approval_status"], ALLOWED_APPROVAL_STATUS, "审批状态"
        )
    if "status" in update_payload:
        update_payload["status"] = _normalize_choice(update_payload["status"], ALLOWED_PD_STATUS, "状态")

    updated = await subject_pd_crud.update_subject_pd(db, item, SubjectPdUpdate(**update_payload))
    await audit_crud.log_action(
        db,
        study_id=study_id,
        entity_type="subject_pd",
        entity_id=pd_id,
        action="UPDATE_SUBJECT_PD",
        detail=f"PD记录 {updated.pd_no} 已更新",
        operator_id=current_user.id,
        operator_role=current_user.role,
    )
    return SubjectPdRead.model_validate(updated)


@router.delete(
    "/pds/{pd_id}",
    status_code=status.HTTP_204_NO_CONTENT,
    dependencies=[Depends(require_study_permission("risk_issues", "write")), Depends(require_study_not_locked())],
)
async def delete_subject_pd(
    study_id: uuid.UUID,
    subject_id: uuid.UUID,
    pd_id: uuid.UUID,
    db: AsyncSession = Depends(get_db_session),
    current_user=Depends(get_current_user),
) -> None:
    await _ensure_study_exists(db, study_id)
    subject = await _ensure_subject(db, study_id, subject_id)
    await _ensure_subject_active(db, subject)

    item = await subject_pd_crud.get_subject_pd(db, pd_id)
    if not item or item.study_id != study_id or item.subject_id != subject_id:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="PD记录不存在")

    await subject_pd_crud.delete_subject_pd(db, item)
    await audit_crud.log_action(
        db,
        study_id=study_id,
        entity_type="subject_pd",
        entity_id=pd_id,
        action="DELETE_SUBJECT_PD",
        detail=f"PD记录 {item.pd_no} 已删除",
        operator_id=current_user.id,
        operator_role=current_user.role,
    )