fix: 系统性预防角色测试高频问题（5 方案落地）
P0 — 默认拒绝 + 强制守卫: - 创建 routeConfig.ts 作为前端路由权限的单一真相源 - TypeScript 强制每个路由声明非空权限数组，不可能遗漏 - 自动生成 ROUTE_PERMISSIONS 和 FROZEN_ROUTES - 修正 3 个前端权限码不匹配后端 P0 — CI 权限扫描: - 新增 tools/check_permissions.py 校验脚本 - 发现并修复 tenant.manage 未注册问题 P1 — 聚合接口容错: - erp-core 新增 safe_aggregate 工具函数 - 仪表盘统计 handler 重构 P1 — 状态机一致性自检: - validation.rs 新增 3 个自检测试 fix: lint-staged eslint Windows 兼容性
This commit is contained in:
iven
@@ -8,6 +8,7 @@ import { ErrorBoundary } from './components/ErrorBoundary';
|
||||
import { useAuthStore } from './stores/auth';
|
||||
import { useAppStore } from './stores/app';
|
||||
import type { ThemeName } from './stores/app';
|
||||
import { ROUTE_PERMISSIONS, FROZEN_ROUTES } from './routeConfig';
|
||||
|
||||
const Home = lazy(() => import('./pages/Home'));
|
||||
const Users = lazy(() => import('./pages/Users'));
|
||||
@@ -71,15 +72,6 @@ const ArticleEditor = lazy(() => import('./pages/health/ArticleEditor'));
|
||||
const ArticleCategoryManage = lazy(() => import('./pages/health/ArticleCategoryManage'));
|
||||
const ArticleTagManage = lazy(() => import('./pages/health/ArticleTagManage'));
|
||||
|
||||
const FROZEN_ROUTES = [
|
||||
'/health/care-plans',
|
||||
'/health/shifts',
|
||||
'/health/family-proxy',
|
||||
'/health/medications',
|
||||
'/health/dialysis',
|
||||
'/health/schedules',
|
||||
];
|
||||
|
||||
function FrozenRoute() {
|
||||
return <Result status="info" title="功能暂未开放" subTitle="该功能正在优化中，敬请期待" />;
|
||||
}
|
||||
@@ -98,49 +90,6 @@ function ForbiddenPage() {
|
||||
);
|
||||
}
|
||||
|
||||
const ROUTE_PERMISSIONS: Record<string, string[]> = {
|
||||
'/users': ['user.list', 'user.manage'],
|
||||
'/roles': ['role.list', 'role.manage'],
|
||||
'/organizations': ['organization.list', 'organization.manage'],
|
||||
'/workflow': ['workflow.list', 'workflow.read'],
|
||||
'/messages': ['message.list'],
|
||||
'/settings': ['config.settings.list', 'config.settings.manage'],
|
||||
'/plugins/admin': ['plugin.list', 'plugin.manage'],
|
||||
'/plugins/market': ['plugin.list', 'plugin.manage'],
|
||||
'/health/patients': ['health.patient.list', 'health.patient.manage'],
|
||||
'/health/doctors': ['health.doctor.list', 'health.doctor.manage'],
|
||||
'/health/appointments': ['health.appointment.list', 'health.appointment.manage'],
|
||||
'/health/follow-up-tasks': ['health.follow-up.list', 'health.follow-up.manage'],
|
||||
'/health/follow-up-records': ['health.follow-up.list', 'health.follow-up.manage'],
|
||||
'/health/consultations': ['health.consultation.list', 'health.consultation.manage'],
|
||||
'/health/action-inbox': ['health.action-inbox.list', 'health.action-inbox.manage'],
|
||||
'/health/follow-up-templates': ['health.follow-up-templates.list', 'health.follow-up-templates.manage'],
|
||||
'/health/diagnoses': ['health.health-data.list', 'health.health-data.manage'],
|
||||
'/health/consents': ['health.consent.list', 'health.consent.manage'],
|
||||
'/health/realtime-monitor': ['health.device-readings.list', 'health.device-readings.manage'],
|
||||
'/health/alert-dashboard': ['health.alerts.list', 'health.alerts.manage'],
|
||||
'/health/alerts': ['health.alerts.list', 'health.alerts.manage'],
|
||||
'/health/devices': ['health.devices.list', 'health.devices.manage'],
|
||||
'/health/ble-gateways': ['health.ble-gateways.list', 'health.ble-gateways.manage'],
|
||||
'/health/critical-value-thresholds': ['health.critical-value-thresholds.list', 'health.critical-value-thresholds.manage'],
|
||||
'/health/articles': ['health.articles.list', 'health.articles.manage'],
|
||||
'/health/article-categories': ['health.articles.list', 'health.articles.manage'],
|
||||
'/health/article-tags': ['health.articles.list', 'health.articles.manage'],
|
||||
'/health/points-rules': ['health.points.list', 'health.points.manage'],
|
||||
'/health/points-products': ['health.points.list', 'health.points.manage'],
|
||||
'/health/points-orders': ['health.points.list', 'health.points.manage'],
|
||||
'/health/offline-events': ['health.points.list', 'health.points.manage'],
|
||||
'/health/ai-prompts': ['ai.prompt.list', 'ai.prompt.manage'],
|
||||
'/health/ai-analysis': ['ai.analysis.list', 'ai.analysis.manage'],
|
||||
'/health/ai-usage': ['ai.usage.list'],
|
||||
'/health/oauth-clients': ['health.oauth.list', 'health.oauth.manage'],
|
||||
'/health/statistics': ['health.health-data.list', 'health.dashboard.manage'],
|
||||
'/health/tags': ['health.patient.list', 'health.patient.manage'],
|
||||
'/health/daily-monitoring': ['health.device-readings.list', 'health.device-readings.manage'],
|
||||
'/health/alert-rules': ['health.alert-rules.list', 'health.alert-rules.manage'],
|
||||
'/health/medication-records': ['health.medication-records.manage'],
|
||||
};
|
||||
|
||||
function PrivateRoute({ children }: { children: React.ReactNode }) {
|
||||
const isAuthenticated = useAuthStore((s) => s.isAuthenticated);
|
||||
const permissions = useAuthStore((s) => s.permissions);
|
||||
|
||||
109
apps/web/src/routeConfig.ts
Normal file
109
apps/web/src/routeConfig.ts
Normal file
@@ -0,0 +1,109 @@
|
||||
/**
|
||||
* 路由权限配置 — 权限声明的单一真相源
|
||||
*
|
||||
* 规则：
|
||||
* 1. 每个受保护路由必须在此声明至少一个权限码（TypeScript 强制非空数组）
|
||||
* 2. 子路由（如 /health/patients/:id）通过前缀匹配自动继承父路由权限，无需重复声明
|
||||
* 3. 新增路由必须在此添加对应条目，否则 PrivateRoute 默认 403
|
||||
* 4. 冻结路由标记 frozen: true，自动归入 FROZEN_ROUTES
|
||||
*
|
||||
* 排列规则：精确路径优先于前缀路径（如 /plugins/admin 在 /plugins 之前）
|
||||
*/
|
||||
|
||||
// 非空数组类型 — 确保每个路由至少有一个权限码
|
||||
type Permissions = [string, ...string[]];
|
||||
|
||||
interface RoutePermissionEntry {
|
||||
path: string;
|
||||
permissions: Permissions;
|
||||
frozen?: boolean;
|
||||
}
|
||||
|
||||
const ENTRIES: RoutePermissionEntry[] = [
|
||||
// ===== 基础模块 =====
|
||||
{ path: '/users', permissions: ['user.list', 'user.update'] },
|
||||
{ path: '/roles', permissions: ['role.list', 'role.update'] },
|
||||
{ path: '/organizations', permissions: ['organization.list', 'organization.update'] },
|
||||
{ path: '/workflow', permissions: ['workflow.list', 'workflow.read'] },
|
||||
{ path: '/messages', permissions: ['message.list'] },
|
||||
{ path: '/settings', permissions: ['setting.read', 'setting.update'] },
|
||||
|
||||
// ===== 插件模块（精确路径优先于前缀通配） =====
|
||||
{ path: '/plugins/admin', permissions: ['plugin.admin'] },
|
||||
{ path: '/plugins/market', permissions: ['plugin.admin'] },
|
||||
// 动态路由 catch-all: /plugins/:pluginId/:entityName 等
|
||||
{ path: '/plugins', permissions: ['plugin.list', 'plugin.admin'] },
|
||||
|
||||
// ===== 健康管理 — 患者与医生 =====
|
||||
{ path: '/health/patients', permissions: ['health.patient.list', 'health.patient.manage'] },
|
||||
{ path: '/health/tags', permissions: ['health.patient.list', 'health.patient.manage'] },
|
||||
{ path: '/health/doctors', permissions: ['health.doctor.list', 'health.doctor.manage'] },
|
||||
{ path: '/health/appointments', permissions: ['health.appointment.list', 'health.appointment.manage'] },
|
||||
|
||||
// ===== 健康管理 — 随访与咨询 =====
|
||||
{ path: '/health/follow-up-tasks', permissions: ['health.follow-up.list', 'health.follow-up.manage'] },
|
||||
{ path: '/health/follow-up-records', permissions: ['health.follow-up.list', 'health.follow-up.manage'] },
|
||||
{ path: '/health/follow-up-templates', permissions: ['health.follow-up-templates.list', 'health.follow-up-templates.manage'] },
|
||||
{ path: '/health/consultations', permissions: ['health.consultation.list', 'health.consultation.manage'] },
|
||||
{ path: '/health/action-inbox', permissions: ['health.action-inbox.list', 'health.action-inbox.manage'] },
|
||||
|
||||
// ===== 健康管理 — 告警与设备 =====
|
||||
{ path: '/health/alerts', permissions: ['health.alerts.list', 'health.alerts.manage'] },
|
||||
{ path: '/health/alert-dashboard', permissions: ['health.alerts.list', 'health.alerts.manage'] },
|
||||
{ path: '/health/alert-rules', permissions: ['health.alert-rules.list', 'health.alert-rules.manage'] },
|
||||
{ path: '/health/devices', permissions: ['health.devices.list', 'health.devices.manage'] },
|
||||
{ path: '/health/realtime-monitor', permissions: ['health.device-readings.list', 'health.device-readings.manage'] },
|
||||
{ path: '/health/ble-gateways', permissions: ['health.ble-gateways.list', 'health.ble-gateways.manage'] },
|
||||
{ path: '/health/critical-value-thresholds', permissions: ['health.critical-value-thresholds.list', 'health.critical-value-thresholds.manage'] },
|
||||
{ path: '/health/daily-monitoring', permissions: ['health.device-readings.list', 'health.device-readings.manage'] },
|
||||
|
||||
// ===== 健康管理 — 诊断与知情同意 =====
|
||||
{ path: '/health/diagnoses', permissions: ['health.health-data.list', 'health.health-data.manage'] },
|
||||
{ path: '/health/consents', permissions: ['health.consent.list', 'health.consent.manage'] },
|
||||
|
||||
// ===== 健康管理 — AI 模块 =====
|
||||
{ path: '/health/ai-prompts', permissions: ['ai.prompt.list', 'ai.prompt.manage'] },
|
||||
{ path: '/health/ai-analysis', permissions: ['ai.analysis.list', 'ai.analysis.manage'] },
|
||||
{ path: '/health/ai-usage', permissions: ['ai.usage.list'] },
|
||||
|
||||
// ===== 健康管理 — 积分商城 =====
|
||||
{ path: '/health/points-rules', permissions: ['health.points.list', 'health.points.manage'] },
|
||||
{ path: '/health/points-products', permissions: ['health.points.list', 'health.points.manage'] },
|
||||
{ path: '/health/points-orders', permissions: ['health.points.list', 'health.points.manage'] },
|
||||
{ path: '/health/offline-events', permissions: ['health.points.list', 'health.points.manage'] },
|
||||
|
||||
// ===== 健康管理 — 内容管理 =====
|
||||
{ path: '/health/articles', permissions: ['health.articles.list', 'health.articles.manage'] },
|
||||
{ path: '/health/article-categories', permissions: ['health.articles.list', 'health.articles.manage'] },
|
||||
{ path: '/health/article-tags', permissions: ['health.articles.list', 'health.articles.manage'] },
|
||||
|
||||
// ===== 健康管理 — 其他 =====
|
||||
{ path: '/health/oauth-clients', permissions: ['health.oauth.list', 'health.oauth.manage'] },
|
||||
{ path: '/health/statistics', permissions: ['health.health-data.list', 'health.dashboard.manage'] },
|
||||
{ path: '/health/medication-records', permissions: ['health.medication-records.manage'] },
|
||||
|
||||
// ===== 冻结路由 =====
|
||||
{ path: '/health/care-plans', permissions: ['health.care-plan.list', 'health.care-plan.manage'], frozen: true },
|
||||
{ path: '/health/shifts', permissions: ['health.shifts.list', 'health.shifts.manage'], frozen: true },
|
||||
{ path: '/health/family-proxy', permissions: ['health.family-proxy.list', 'health.family-proxy.manage'], frozen: true },
|
||||
{ path: '/health/medications', permissions: ['health.medication-records.list', 'health.medication-records.manage'], frozen: true },
|
||||
{ path: '/health/dialysis', permissions: ['health.dialysis.list', 'health.dialysis.manage'], frozen: true },
|
||||
{ path: '/health/schedules', permissions: ['health.appointment.list', 'health.appointment.manage'], frozen: true },
|
||||
];
|
||||
|
||||
/** 活跃路由的权限映射 — 自动从配置生成，供 PrivateRoute 使用 */
|
||||
export const ROUTE_PERMISSIONS: Record<string, string[]> = Object.fromEntries(
|
||||
ENTRIES.filter((e) => !e.frozen).map((e) => [e.path, [...e.permissions]]),
|
||||
);
|
||||
|
||||
/** 冻结路由路径列表 — 自动从配置生成 */
|
||||
export const FROZEN_ROUTES: string[] = ENTRIES.filter((e) => e.frozen).map((e) => e.path);
|
||||
|
||||
/** 开发模式下校验：检查是否有路由路径重复 */
|
||||
if (import.meta.env.DEV) {
|
||||
const paths = ENTRIES.map((e) => e.path);
|
||||
const dupes = paths.filter((p, i) => paths.indexOf(p) !== i);
|
||||
if (dupes.length > 0) {
|
||||
console.error('[routeConfig] 检测到重复路径:', dupes);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user