iven
c82f7bda1d
fix: 系统性预防角色测试高频问题（5 方案落地）
...
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
P0 — 默认拒绝 + 强制守卫:
- 创建 routeConfig.ts 作为前端路由权限的单一真相源
- TypeScript 强制每个路由声明非空权限数组，不可能遗漏
- 自动生成 ROUTE_PERMISSIONS 和 FROZEN_ROUTES
- 修正 3 个前端权限码不匹配后端
P0 — CI 权限扫描:
- 新增 tools/check_permissions.py 校验脚本
- 发现并修复 tenant.manage 未注册问题
P1 — 聚合接口容错:
- erp-core 新增 safe_aggregate 工具函数
- 仪表盘统计 handler 重构
P1 — 状态机一致性自检:
- validation.rs 新增 3 个自检测试
fix: lint-staged eslint Windows 兼容性
2026-05-08 08:52:16 +08:00
iven
6d5a711d2c
fix: 修复测试发现的 7 个问题 + 全 workspace clippy 清零
...
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
功能修复：
1. 患者创建空名称验证：后端添加 name.trim().is_empty() 检查
2. 仪表盘统计容错：单个查询失败返回零值而非 500
3. FHIR 路由修复：从 /fhir 移到 /api/v1/fhir 保持一致
4. 冻结模块后端中间件：新增 frozen_module_middleware 拦截冻结路径
5. 积分端点权限码：health.health-data.list → health.points.list
6. 角色权限迁移：护士补充 devices.list，运营补充 points.list/manage
7. 测试结果文档：R01-R05 角色测试 + T00/T10 结果归档
Clippy 全 workspace 清零（14→0 errors）：
- erp-core: 修复 empty doc line、collapsible if、redundant closure 等 9 处
- erp-health: 修复 too_many_arguments、unused var、unnecessary parens 等 58 处
- erp-ai: 修复 dead_code、unused import 等 11 处
- erp-plugin: 修复 too_many_arguments、wildcard pattern 等 11 处
- erp-server-migration: 修复 enum_variant_names 5 处
- erp-auth/config/workflow/message: 各 1-3 处
工程改进：
- lint-staged 配置迁移到 .lintstagedrc.js（函数式避免文件列表传给 clippy）
- cargo fmt 统一格式化
2026-05-07 23:43:14 +08:00
iven
f05ca00c75
feat(auth+config+workflow+message+plugin): 为 5 个基础模块添加 permissions() 声明
...
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
- erp-auth: 23 个权限码（用户/角色/权限/组织/部门/岗位）
- erp-config: 18 个权限码（字典/菜单/配置/编号/主题/语言）
- erp-workflow: 8 个权限码（流程定义/实例/任务）
- erp-message: 5 个权限码（消息/模板），补充缺失的 message.template.manage
- erp-plugin: 2 个权限码（插件管理/查看）
- 同步更新 seed.rs 的 READ_PERM_INDICES 索引和权限计数
使得 sync_module_permissions() 可以动态注册这些权限，与 erp-health/erp-dialysis/erp-ai 模式一致。
2026-04-30 22:41:26 +08:00
iven
62eea3d20d
feat(auth,plugin): Q3 行级数据权限 — user_departments 表 + JWT 注入 department_ids + data_scope 接线
...
- 新增 user_departments 关联表（migration + entity）
- JWT 中间件查询用户部门并注入 TenantContext.department_ids
- role_permission entity 添加 data_scope 字段
- data_handler 接线行级数据权限过滤（list/count/aggregate）
- DataScopeParams + build_scope_sql + merge_scope_condition 实现全链路
2026-04-17 21:42:40 +08:00
iven
ff352a4c24
feat(plugin): 集成 WASM 插件系统到主服务并修复链路问题
...
- 新增 erp-plugin crate：插件管理、WASM 运行时、动态表、数据 CRUD
- 新增前端插件管理页面（PluginAdmin/PluginCRUDPage）和 API 层
- 新增插件数据迁移（plugins/plugin_entities/plugin_event_subscriptions）
- 新增权限补充迁移（为已有租户补充 plugin.admin/plugin.list 权限）
- 修复 PluginAdmin 页面 InstallOutlined 图标不存在的崩溃问题
- 修复 settings 唯一索引迁移顺序错误（先去重再建索引）
- 更新 wiki 和 CLAUDE.md 反映插件系统集成状态
- 新增 dev.ps1 一键启动脚本
2026-04-15 23:32:02 +08:00
iven
9568dd7875
chore: apply cargo fmt across workspace and update docs
...
- Run cargo fmt on all Rust crates for consistent formatting
- Update CLAUDE.md with WASM plugin commands and dev.ps1 instructions
- Update wiki: add WASM plugin architecture, rewrite dev environment docs
- Minor frontend cleanup (unused imports)
2026-04-15 00:49:20 +08:00
iven
0d7d3af0a8
fix(auth): standardize permission codes to dot notation and add missing permissions
...
- Change all permission codes from colon (`:`) to dot (`.`) separator
to match handler require_permission() calls consistently
- Add missing user.list, role.list, permission.list, organization.list,
department.list, position.list permissions (handlers check for .list
but seeds only had :read)
- Add missing message module permissions (message.list, message.send,
message.template.list, message.template.create)
- Add missing setting.delete, numbering.delete permissions
- Fix workflow handlers: workflow: → workflow.
- Fix message handlers: message: → message.
- Update viewer role READ_PERM_INDICES for new permission list
This fixes a critical runtime bug where ALL permission checks in
erp-auth and erp-config handlers would return 403 Forbidden because
the seed data used colon separators but handlers checked for dots.
2026-04-11 14:30:47 +08:00
iven
184034ff6b
feat(config): add missing dictionary item CRUD, setting delete, and numbering delete routes
...
- Dictionary items: POST/PUT/DELETE endpoints under /config/dictionaries/{dict_id}/items
- Settings: DELETE /config/settings/{key}
- Numbering rules: DELETE /config/numbering-rules/{id}
- Fix workflow Entities: add deleted_at and version_field to process_definition,
add standard fields to token and process_variable entities
- Update seed data for expanded permissions
2026-04-11 12:52:29 +08:00
iven
91ecaa3ed7
feat(workflow): add workflow engine module (Phase 4)
...
Implement complete workflow engine with BPMN subset support:
Backend (erp-workflow crate):
- Token-driven execution engine with exclusive/parallel gateway support
- BPMN parser with flow graph validation
- Expression evaluator for conditional branching
- Process definition CRUD with draft/publish lifecycle
- Process instance management (start, suspend, terminate)
- Task service (pending, complete, delegate)
- PostgreSQL advisory locks for concurrent safety
- 5 database tables: process_definitions, process_instances,
tokens, tasks, process_variables
- 13 API endpoints with RBAC protection
- Timeout checker framework (placeholder)
Frontend:
- Workflow page with 4 tabs (definitions, pending, completed, monitor)
- React Flow visual process designer (@xyflow/react)
- Process viewer with active node highlighting
- 3 API client modules for workflow endpoints
- Sidebar menu integration
2026-04-11 09:54:02 +08:00
iven
0baaf5f7ee
feat(config): add system configuration module (Phase 3)
...
Implement the complete erp-config crate with:
- Data dictionaries (CRUD + items management)
- Dynamic menus (tree structure with role filtering)
- System settings (hierarchical: platform > tenant > org > user)
- Numbering rules (concurrency-safe via PostgreSQL advisory_lock)
- Theme and language configuration (via settings store)
- 6 database migrations (dictionaries, menus, settings, numbering_rules)
- Frontend Settings page with 5 tabs (dictionary, menu, numbering, settings, theme)
Refactor: move RBAC functions (require_permission) from erp-auth to erp-core
to avoid cross-module dependencies.
Add 20 new seed permissions for config module operations.
2026-04-11 08:09:19 +08:00
iven
a7cdf67d17
feat(auth): add tenant seed data and bootstrap logic
...
- seed.rs: creates 21 permissions, admin+viewer roles, admin user with Argon2 password
- AuthConfig added to server config with default password Admin@2026
- Server startup: auto-creates default tenant and seeds auth data if not exists
- Idempotent: checks for existing tenant before seeding
2026-04-11 03:28:19 +08:00
