Cheng Zhou
747dd55225
- deps 新增 list_active_pm_study_ids、is_active_project_pm 与 require_admin_or_any_project_pm 依赖，用于把 PM 项目范围带进鉴权与 监控。get_cra_site_scope 内部延后导入 site CRUD，避免循环依赖。 - system_permissions API 改用 PM/ADMIN 双角色入口，permissions/monitoring 系统级权限新增 PM 配额，并细化访问日志、告警、监控指标的可见范围。 - members API 调整：项目 PM 仅可管理低于 PM 的项目角色，禁止互相 改写或授予 PM。 - api_permissions API 增加 GET /api-permissions/me，返回当前用户在该 项目的有效权限矩阵；保存权限矩阵时校验 PM 行为不被篡改。 - core/api_permissions：新增立项配置接口键、PM 默认拥有的监控/权限 系统级条目，并在权限元信息中标注 PM 共享角色。 - core/project_permissions：role_has_api_permission 命中默认角色矩阵； replace_api_endpoint_permissions 改为部分更新且永不持久化 ADMIN/PM。 - studies setup-config 各端点改用接口级权限装饰器，与新的 setup_config 权限键对齐。permission_monitor 新增 get_metrics 摘要供 PM 视图调用。 - 测试：新增 test_admin_pm_permissions 覆盖 PM 系统级权限、监控范围和 成员管理边界；conftest 兼容 SA_UUID 列；权限相关用例同步移除已失效 的 module_permission 链路。 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
76 lines
2.1 KiB
Python
76 lines
2.1 KiB
Python
import uuid
|
|
from datetime import datetime, timezone
|
|
|
|
import pytest
|
|
|
|
from app.api.v1 import studies as studies_api
|
|
from app.models.study import Study
|
|
from app.models.study_member import StudyMember
|
|
from app.models.user import User, UserRole, UserStatus
|
|
|
|
|
|
def _make_user(role: UserRole = UserRole.CRA) -> User:
|
|
return User(
|
|
id=uuid.uuid4(),
|
|
email="cra-pm@test.com",
|
|
password_hash="hashed",
|
|
full_name="CRA PM",
|
|
clinical_department="Clinical",
|
|
role=role,
|
|
status=UserStatus.ACTIVE,
|
|
)
|
|
|
|
|
|
def _make_study() -> Study:
|
|
return Study(
|
|
id=uuid.uuid4(),
|
|
code="STUDY-001",
|
|
name="测试项目",
|
|
status="ACTIVE",
|
|
is_locked=False,
|
|
visit_schedule=[],
|
|
active_roles=[],
|
|
created_at=datetime.now(timezone.utc),
|
|
)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_list_studies_returns_project_role_for_non_admin(monkeypatch):
|
|
current_user = _make_user(UserRole.CRA)
|
|
study = _make_study()
|
|
member = StudyMember(
|
|
id=uuid.uuid4(),
|
|
study_id=study.id,
|
|
user_id=current_user.id,
|
|
role_in_study="PM",
|
|
is_active=True,
|
|
)
|
|
|
|
async def fake_list_studies_for_user(_db, _user_id, skip=0, limit=100):
|
|
return [study]
|
|
|
|
async def fake_get_member(_db, _study_id, _user_id):
|
|
return member
|
|
|
|
monkeypatch.setattr(studies_api.study_crud, "list_studies_for_user", fake_list_studies_for_user)
|
|
monkeypatch.setattr(studies_api.member_crud, "get_member", fake_get_member)
|
|
|
|
result = await studies_api.list_studies(db=object(), current_user=current_user)
|
|
|
|
assert result["items"][0].role_in_study == "PM"
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_list_studies_does_not_map_system_admin_to_project_admin(monkeypatch):
|
|
current_user = _make_user(UserRole.ADMIN)
|
|
study = _make_study()
|
|
|
|
async def fake_list_studies(_db, skip=0, limit=100):
|
|
return [study]
|
|
|
|
monkeypatch.setattr(studies_api.study_crud, "list_studies", fake_list_studies)
|
|
|
|
result = await studies_api.list_studies(db=object(), current_user=current_user)
|
|
|
|
assert result["items"][0].role_in_study is None
|