[cg8-5712]

• expose GET /api/cases/{case_id}/places for case members
• filter places by viewer role, review status, visibility, and ownership
• return 404 for users who are not case members
• document the endpoint in API and OpenAPI specifications
• add authentication, visibility, and OpenAPI contract coverage

Close #27

Summary by CodeRabbit

• 新功能
  • 新增获取案件关键地点列表的接口（GET /api/cases/{case_id}/places）。
  • 按案件角色与地点审核/可见性状态返回过滤结果：家属仅见本人提交及已确认且非内部地点；志愿者仅见已确认公开地点；指挥可见更全面的内部地点。
  • 非案件成员访问返回失败（如 404）。
• 文档
  • 补充并更正地点列表接口的鉴权、可见性语义与 OpenAPI 契约。
• 测试
  • 新增鉴权拦截、角色可见性过滤及 OpenAPI 顺序/字段契约的覆盖测试。

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d2d74cc-ec0a-413b-9dd1-f1e9312d1d8f

📥 Commits

Reviewing files that changed from the base of the PR and between ec6a623 and c90c6b9.

📒 Files selected for processing (1)

• tests/api/case_resources_post.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• tests/api/case_resources_post.rs

---

📝 Walkthrough

Walkthrough

新增案件地点列表 GET 接口，按案件角色、地点可见性和审核状态裁剪返回数据，并补充路由、OpenAPI 文档、认证测试及集成测试。

Changes

案件地点列表

Layer / File(s)	Summary
地点可见性裁剪 src/application/services/case_resource_service.rs	家属可见本人提交地点，以及已确认且非内部的地点。
地点列表端点与接口契约 src/api/routes/cases.rs, docs/openapi.yaml, docs/API.md	新增 GET /api/cases/{case_id}/places，校验案件角色并返回地点 JSON，同时更新接口说明与 OpenAPI 定义。
地点列表行为验证 tests/api/case_resources_post.rs, tests/api/authentication_guards.rs, tests/api/openapi_intake_contract.rs	验证各角色地点裁剪、非成员返回 404、无效令牌返回 401，以及 OpenAPI 契约字段。

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant list_places
  participant case_service
  participant case_resource_service
  Client->>list_places: GET /api/cases/{case_id}/places
  list_places->>case_service: 校验案件角色
  case_service-->>list_places: 返回授权结果
  list_places->>case_resource_service: 查询可见地点
  case_resource_service-->>list_places: 返回角色裁剪后的地点
  list_places-->>Client: 200 JSON CasePlace[]

Loading

Possibly related PRs

• AG-Angui/Angui#117：同样修改 visible_places 的家属角色可见性过滤逻辑。
• AG-Angui/Angui#134：引入相关地点可见性实现，本 PR 的路由和测试依赖该逻辑。
• AG-Angui/Angui#94：采用相同的 OpenAPI 认证、角色约束与数据可见性契约。

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	标题准确概括了新增按角色过滤的案件地点列表接口。
Linked Issues check	✅ Passed	实现了案件地点按角色裁剪列表、非成员 404 和服务端可见性控制，与 #27 的核心要求一致。
Out of Scope Changes check	✅ Passed	变更集中在地点列表接口、文档和测试，没有明显无关改动。
Docstring Coverage	✅ Passed	Docstring coverage is 85.71% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/issue-27-role-filtered-places

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/application/services/case_resource_service.rs (1)

227-229: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

按任务分配收窄志愿者地点查询。

当前查询只限制为 public 和 confirmed，没有任何任务分配条件；因此任意案件志愿者都能读取案件全部已确认公开地点，违反“志愿者仅见其已分配任务所需地点”的服务端访问控制目标。

• src/application/services/case_resource_service.rs#L227-L229: 为志愿者查询加入与当前用户任务分配关联的服务端过滤条件。
• docs/openapi.yaml#L789-L789: 将志愿者可见范围改为仅限其已分配任务所需地点。
• docs/API.md#L195-L195: 同步修正志愿者可见性说明。
• tests/api/case_resources_post.rs#L194-L199: 创建已分配与未分配的地点夹具，并断言志愿者只能读取前者。

As per path instructions, src/** 必须审查认证、授权和隐私风险。

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/application/services/case_resource_service.rs` around lines 227 - 229, 收窄
CaseRole::Volunteer 的查询：在现有 public 和 confirmed
条件之外，加入基于当前认证用户任务分配关联的服务端授权过滤，仅返回其已分配任务所需的地点。同步更新 docs/openapi.yaml:789-789 和
docs/API.md:195-195 的志愿者可见范围说明；在 tests/api/case_resources_post.rs:194-199
创建已分配及未分配地点夹具，并断言志愿者只能读取已分配地点。

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/api/case_resources_post.rs`:
- Around line 110-159: 在现有夹具初始化和家属查询断言中，新增一个 visibility 为 confirmed、已审核且非内部的
place，并通过 mark_place_confirmed 标记；补充断言家属可见该记录，同时保留 public、unreviewed 和 internal
记录的正向/负向断言，确保覆盖 confirmed 与 public 的可见性边界。

---

Outside diff comments:
In `@src/application/services/case_resource_service.rs`:
- Around line 227-229: 收窄 CaseRole::Volunteer 的查询：在现有 public 和 confirmed
条件之外，加入基于当前认证用户任务分配关联的服务端授权过滤，仅返回其已分配任务所需的地点。同步更新 docs/openapi.yaml:789-789 和
docs/API.md:195-195 的志愿者可见范围说明；在 tests/api/case_resources_post.rs:194-199
创建已分配及未分配地点夹具，并断言志愿者只能读取已分配地点。

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bbfe3054-b26f-4a41-a796-83bb59180d89

📥 Commits

Reviewing files that changed from the base of the PR and between f3731b3 and ec6a623.

📒 Files selected for processing (7)

• docs/API.md
• docs/openapi.yaml
• src/api/routes/cases.rs
• src/application/services/case_resource_service.rs
• tests/api/authentication_guards.rs
• tests/api/case_resources_post.rs
• tests/api/openapi_intake_contract.rs