Cheng Zhou
270 lines
9.6 KiB
Python
270 lines
9.6 KiB
Python
import os
|
|
import uuid
|
|
from pathlib import Path
|
|
|
|
import aiofiles
|
|
from fastapi import APIRouter, Depends, File, HTTPException, UploadFile, status, Request
|
|
from fastapi.responses import FileResponse
|
|
from sqlalchemy.ext.asyncio import AsyncSession
|
|
|
|
from app.core.deps import get_current_user, get_db_session, require_study_member, get_study_member
|
|
from app.crud import attachment as attachment_crud
|
|
from app.crud import audit as audit_crud
|
|
from app.crud import study as study_crud
|
|
from app.crud import user as user_crud
|
|
from app.crud import member as member_crud
|
|
from app.core.security import decode_token
|
|
from app.schemas.attachment import AttachmentRead
|
|
from app.schemas.user import UserDisplay
|
|
|
|
router = APIRouter()
|
|
global_router = APIRouter()
|
|
|
|
UPLOAD_ROOT = Path(__file__).resolve().parent.parent.parent / "uploads"
|
|
|
|
|
|
async def _ensure_study_exists(db: AsyncSession, study_id: uuid.UUID):
|
|
study = await study_crud.get(db, study_id)
|
|
if not study:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="项目不存在")
|
|
return study
|
|
|
|
|
|
@router.post(
|
|
"/",
|
|
response_model=AttachmentRead,
|
|
status_code=status.HTTP_201_CREATED,
|
|
dependencies=[Depends(require_study_member())],
|
|
)
|
|
async def upload_attachment(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
file: UploadFile = File(...),
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
) -> AttachmentRead:
|
|
await _ensure_study_exists(db, study_id)
|
|
dest_dir = UPLOAD_ROOT / f"study_{study_id}" / f"{entity_type}_{entity_id}"
|
|
dest_dir.mkdir(parents=True, exist_ok=True)
|
|
unique_name = f"{uuid.uuid4()}{Path(file.filename).suffix}"
|
|
dest_path = dest_dir / unique_name
|
|
|
|
content = await file.read()
|
|
async with aiofiles.open(dest_path, "wb") as out_file:
|
|
await out_file.write(content)
|
|
|
|
attachment = await attachment_crud.create_attachment(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type=entity_type,
|
|
entity_id=entity_id,
|
|
filename=file.filename,
|
|
file_path=str(dest_path),
|
|
file_size=len(content),
|
|
content_type=file.content_type,
|
|
uploaded_by=current_user.id,
|
|
)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type=entity_type,
|
|
entity_id=entity_id,
|
|
action="UPLOAD_FILE",
|
|
detail=f"文件已上传：{file.filename}",
|
|
operator_id=current_user.id,
|
|
operator_role=current_user.role,
|
|
)
|
|
return AttachmentRead(
|
|
id=attachment.id,
|
|
filename=attachment.filename,
|
|
file_size=attachment.file_size,
|
|
uploaded_by=UserDisplay.model_validate(current_user) if current_user else None,
|
|
uploaded_by_id=attachment.uploaded_by,
|
|
uploaded_at=attachment.uploaded_at,
|
|
)
|
|
|
|
|
|
@router.get(
|
|
"/",
|
|
response_model=list[AttachmentRead],
|
|
dependencies=[Depends(require_study_member())],
|
|
)
|
|
async def list_attachments(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
) -> list[AttachmentRead]:
|
|
await _ensure_study_exists(db, study_id)
|
|
attachments = await attachment_crud.list_attachments(db, study_id, entity_type, entity_id)
|
|
user_ids = {a.uploaded_by for a in attachments if a.uploaded_by}
|
|
users_map = await user_crud.get_users_by_ids(db, user_ids)
|
|
result: list[AttachmentRead] = []
|
|
for a in attachments:
|
|
user = users_map.get(a.uploaded_by)
|
|
result.append(
|
|
AttachmentRead(
|
|
id=a.id,
|
|
filename=a.filename,
|
|
file_size=a.file_size,
|
|
uploaded_by=UserDisplay.model_validate(user) if user else None,
|
|
uploaded_by_id=a.uploaded_by,
|
|
uploaded_at=a.uploaded_at,
|
|
)
|
|
)
|
|
return result
|
|
|
|
|
|
@router.get(
|
|
"/{attachment_id}/download",
|
|
dependencies=[Depends(require_study_member())],
|
|
)
|
|
async def download_attachment(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
attachment_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
) -> FileResponse:
|
|
await _ensure_study_exists(db, study_id)
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if not attachment or attachment.study_id != study_id or attachment.entity_id != entity_id or attachment.entity_type != entity_type:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
if not os.path.exists(attachment.file_path):
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
|
|
return FileResponse(
|
|
path=attachment.file_path,
|
|
filename=attachment.filename,
|
|
media_type=attachment.content_type or "application/octet-stream",
|
|
headers={"Content-Disposition": f'inline; filename="{attachment.filename}"'},
|
|
)
|
|
|
|
|
|
async def _authorize_global(request: Request, db: AsyncSession, study_id: uuid.UUID):
|
|
token = None
|
|
auth_header = request.headers.get("Authorization")
|
|
if auth_header and auth_header.lower().startswith("bearer "):
|
|
token = auth_header.split(" ", 1)[1]
|
|
if not token:
|
|
token = request.query_params.get("token")
|
|
if not token:
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="未登录")
|
|
payload = decode_token(token)
|
|
user = await user_crud.get_by_id(db, uuid.UUID(str(payload.get("sub"))))
|
|
if not user or not user.is_active:
|
|
raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="账号不存在或已停用")
|
|
if user.role == "ADMIN":
|
|
return user, None
|
|
membership = await member_crud.get_member(db, study_id, user.id)
|
|
if not membership or not membership.is_active:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="不是项目成员")
|
|
return user, membership
|
|
|
|
|
|
@global_router.get(
|
|
"/{attachment_id}/download",
|
|
response_class=FileResponse,
|
|
)
|
|
async def global_download_attachment(
|
|
attachment_id: uuid.UUID,
|
|
request: Request,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
):
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if not attachment:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
await _ensure_study_exists(db, attachment.study_id)
|
|
user, _ = await _authorize_global(request, db, attachment.study_id)
|
|
if not os.path.exists(attachment.file_path):
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="服务器未找到文件")
|
|
return FileResponse(
|
|
path=attachment.file_path,
|
|
filename=attachment.filename,
|
|
media_type=attachment.content_type or "application/octet-stream",
|
|
headers={"Content-Disposition": f'inline; filename="{attachment.filename}"'},
|
|
)
|
|
|
|
|
|
@global_router.delete(
|
|
"/{attachment_id}",
|
|
status_code=status.HTTP_204_NO_CONTENT,
|
|
)
|
|
async def global_delete_attachment(
|
|
attachment_id: uuid.UUID,
|
|
request: Request,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
):
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if not attachment:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
await _ensure_study_exists(db, attachment.study_id)
|
|
user, membership = await _authorize_global(request, db, attachment.study_id)
|
|
can_delete = (
|
|
user.role == "ADMIN"
|
|
or attachment.uploaded_by == user.id
|
|
or (membership and getattr(membership, "role_in_study", None) == "PM")
|
|
)
|
|
if not can_delete:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
|
|
await attachment_crud.soft_delete_attachment(db, attachment)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=attachment.study_id,
|
|
entity_type=attachment.entity_type,
|
|
entity_id=attachment.entity_id,
|
|
action="DELETE_ATTACHMENT",
|
|
detail=f"文件已删除：{attachment.filename}",
|
|
operator_id=user.id,
|
|
operator_role=user.role,
|
|
)
|
|
|
|
|
|
@router.delete(
|
|
"/{attachment_id}",
|
|
status_code=status.HTTP_204_NO_CONTENT,
|
|
dependencies=[Depends(require_study_member())],
|
|
)
|
|
async def delete_attachment(
|
|
study_id: uuid.UUID,
|
|
entity_type: str,
|
|
entity_id: uuid.UUID,
|
|
attachment_id: uuid.UUID,
|
|
db: AsyncSession = Depends(get_db_session),
|
|
current_user=Depends(get_current_user),
|
|
):
|
|
await _ensure_study_exists(db, study_id)
|
|
attachment = await attachment_crud.get_attachment(db, attachment_id)
|
|
if (
|
|
not attachment
|
|
or attachment.study_id != study_id
|
|
or attachment.entity_id != entity_id
|
|
or attachment.entity_type != entity_type
|
|
or attachment.is_deleted
|
|
):
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="附件不存在")
|
|
|
|
membership = None
|
|
if current_user.role != "ADMIN":
|
|
membership = await get_study_member(study_id, current_user=current_user, db=db)
|
|
|
|
can_delete = (
|
|
current_user.role == "ADMIN"
|
|
or attachment.uploaded_by == current_user.id
|
|
or (membership and getattr(membership, "role_in_study", None) == "PM")
|
|
)
|
|
if not can_delete:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限删除附件")
|
|
|
|
await attachment_crud.soft_delete_attachment(db, attachment)
|
|
await audit_crud.log_action(
|
|
db,
|
|
study_id=study_id,
|
|
entity_type=entity_type,
|
|
entity_id=entity_id,
|
|
action="DELETE_ATTACHMENT",
|
|
detail=f"文件已删除：{attachment.filename}",
|
|
operator_id=current_user.id,
|
|
operator_role=current_user.role,
|
|
)
|