4 Commits

Author	SHA1	Message	Date
iven	5d6e1dc394	feat(core): implement optimistic locking across all entities ... Add VersionMismatch error variant and check_version() helper to erp-core. All 13 mutable entities now enforce version checking on update/delete: - erp-auth: user, role, organization, department, position - erp-config: dictionary, dictionary_item, menu, setting, numbering_rule - erp-workflow: process_definition, process_instance, task - erp-message: message, message_subscription Update DTOs to expose version in responses and require version in update requests. HTTP 409 Conflict returned on version mismatch.	2026-04-11 23:25:43 +08:00
iven	184034ff6b	feat(config): add missing dictionary item CRUD, setting delete, and numbering delete routes ... - Dictionary items: POST/PUT/DELETE endpoints under /config/dictionaries/{dict_id}/items - Settings: DELETE /config/settings/{key} - Numbering rules: DELETE /config/numbering-rules/{id} - Fix workflow Entities: add deleted_at and version_field to process_definition, add standard fields to token and process_variable entities - Update seed data for expanded permissions	2026-04-11 12:52:29 +08:00
iven	3a05523d23	fix: address Phase 1-2 audit findings ... - CORS: replace permissive() with configurable whitelist (default.toml) - Auth store: synchronously restore state at creation to eliminate flash-of-login-page on refresh - MainLayout: menu highlight now tracks current route via useLocation - Add extractErrorMessage() utility to reduce repeated error parsing - Fix all clippy warnings across 4 crates (erp-auth, erp-config, erp-workflow, erp-message): remove unnecessary casts, use div_ceil, collapse nested ifs, reduce function arguments with DTOs	2026-04-11 12:36:34 +08:00
iven	0baaf5f7ee	feat(config): add system configuration module (Phase 3) ... Implement the complete erp-config crate with: - Data dictionaries (CRUD + items management) - Dynamic menus (tree structure with role filtering) - System settings (hierarchical: platform > tenant > org > user) - Numbering rules (concurrency-safe via PostgreSQL advisory_lock) - Theme and language configuration (via settings store) - 6 database migrations (dictionaries, menus, settings, numbering_rules) - Frontend Settings page with 5 tabs (dictionary, menu, numbering, settings, theme) Refactor: move RBAC functions (require_permission) from erp-auth to erp-core to avoid cross-module dependencies. Add 20 new seed permissions for config module operations.	2026-04-11 08:09:19 +08:00