iven
209acaa15d
feat(server): 限流 fail-close 统一配置
...
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
- 新增 RateLimitConfig 结构体，支持 config.toml + 环境变量
- apply_rate_limit 统一读取 fail_close 配置，生产环境可设为拒绝请求
- account_lockout_middleware 改为从 AppState.config 读取，不再直接读环境变量
- default.toml 添加 [rate_limit] 配置节
2026-05-03 09:46:02 +08:00
iven
30f2452933
fix(core): 迁移修复 + 配置调整
...
- auth_state: 新增字段
- config/default.toml: 配置更新
- migration 078/082: 修复 SQL 语法
- state/main: 启动逻辑调整
2026-04-28 00:20:11 +08:00
iven
a0b72b0f73
feat: Iteration 1 — 审计日志IP记录、文件上传、医护端API、小程序角色切换
...
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
Iteration 1 六项任务全部完成：
1. 审计日志IP记录 — task_local RequestInfo 自动注入 IP/user_agent
2. 文件上传服务 — multipart 上传 + ServeDir 静态文件服务
3. 医护端后端API — 医生工作台仪表盘 + 患者标签CRUD + 会话已读
4. 小程序角色切换 — 登录后根据角色跳转医护台/患者首页
5. 小程序安全加固 — secure-storage 开发模式警告
6. 讨论记录归档 — docs/discussions/
2026-04-26 13:13:25 +08:00
iven
2e555ca72a
feat(server): erp-ai 模块集成 — Config/State/路由注册
...
- 新增 AiConfig 到 AppConfig
- 新增 FromRef<AppState> for AiState
- 注册 AiModule 到 ModuleRegistry
- 合并 AI protected routes
- 修复 sync_module_permissions 只同步 health.% 的 bug
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com >
2026-04-25 14:01:07 +08:00
iven
945ccd64ba
fix: 全面 QA 审计修复 — 安全加固/代码质量/跨平台一致性/测试覆盖
...
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
Phase 0 安全热修复 (CRITICAL):
- 外部化微信 appid/secret 到 ERP__WECHAT__APPID/SECRET 环境变量
- 正确连接 HealthCrypto 到 ERP__HEALTH__AES_KEY/HMAC_KEY 环境变量
- 外部化小程序加密密钥到 TARO_APP_ENCRYPTION_KEY 环境变量
- 移除小程序 auth store 中的敏感信息 console.log
Phase 1 安全加固:
- 微信自动注册 display_name 添加 sanitize 防止 XSS
- 测试数据库凭据改为从 TEST_DB_URL 环境变量读取
Phase 2 代码质量:
- 提取 useThemeMode hook 消除 22 处重复暗色模式检测
- 提取共享健康常量到 constants/health.ts
- 拆分 patient_service.rs 脱敏函数到 masking.rs
- 移除未使用的 i18next/react-i18next 依赖
- 移除未使用的 api/errors.ts 和 erp-auth/anyhow 依赖
Phase 3 测试覆盖:
- 新增 5 个患者模块集成测试 (CRUD/租户隔离/验证/软删除)
Phase 4 跨平台一致性:
- 统一小程序 Patient.birthday → birth_date 匹配后端
- 统一小程序 Appointment.time_slot → start_time/end_time 匹配后端
Phase 5 架构:
- 微信登录添加多租户 TODO 注释
- 更新 wiki/infrastructure.md 环境变量文档
2026-04-25 10:00:49 +08:00
iven
6c70e2a783
feat(health): 身份证号 AES-256-GCM 加密 + HMAC 索引 + 字段级脱敏
...
- crypto.rs: AES-256-GCM 加密/解密 + HMAC-SHA256 索引
- create/update: id_number 加密存储, id_number_hash 索引
- list: 不返回 id_number, 手机号掩码
- detail: 解密后身份证掩码(前3后4), 手机号掩码
- 搜索: 改用 HMAC 精确匹配(不再模糊搜索加密列)
- 迁移 m000048: 添加 patients.id_number_hash 列
2026-04-25 00:21:49 +08:00
iven
ba132921cc
feat(auth): 添加微信小程序登录支持
...
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
- 新增 wechat_users 表迁移和 SeaORM Entity
- 实现微信登录 Service（code→openid→绑定状态查询）
- 实现手机号绑定 Service（创建/关联 user + 签发 JWT）
- 添加公开路由 POST /auth/wechat/login 和 /auth/wechat/bind-phone
- 新增 WechatConfig 到 AppConfig（appid/secret 通过环境变量配置）
- 添加 reqwest 依赖用于调用微信 jscode2session API
2026-04-24 00:05:43 +08:00
iven
841766b168
fix(用户管理): 修复用户列表页面加载失败问题
...
修复用户列表页面加载失败导致测试超时的问题，确保页面元素正确渲染
2026-04-19 08:46:28 +08:00
iven
eef264c72b
ci: Q2 Chunk 4 — Gitea Actions CI/CD + Docker 生产化
...
- 创建 .gitea/workflows/ci.yml 四 job 并行流水线
(rust-check, rust-test, frontend-build, security-audit)
- Docker Compose 端口不暴露到宿主机（使用 expose）
- Redis 添加 requirepass 密码认证
- 添加容器资源限制 (1 CPU / 512MB)
- Redis URL 格式更新为带密码认证
2026-04-17 19:24:32 +08:00
iven
39a12500e3
fix(security): Q2 Chunk 1 — 密钥外部化与启动强制检查
...
- default.toml 敏感值改为占位符，强制通过环境变量注入
- 启动时拒绝默认 JWT 密钥和数据库 URL
- 移除 super_admin_password 硬编码 fallback
- 移除 From<AppError> for AuthError 反向映射，5 处调用点改为显式 map_err
- .gitignore 添加 .test_token 和测试产物
2026-04-17 17:42:19 +08:00
iven
e16c1a85d7
feat(web): comprehensive frontend performance and UI/UX optimization
...
Performance improvements:
- Vite build: manual chunks, terser minification, optimizeDeps
- API response caching with 5s TTL via axios interceptors
- React.memo for SidebarMenuItem, useCallback for handlers
- CSS classes replacing inline styles to reduce reflows
UI/UX enhancements (inspired by SAP Fiori, Linear, Feishu):
- Dashboard: trend indicators, sparkline charts, CountUp animation on stat cards
- Dashboard: pending tasks section with priority labels
- Dashboard: recent activity timeline
- Design system tokens: trend colors, line-height, dark mode refinements
- Enhanced quick actions with hover animations
Accessibility (Lighthouse 100/100):
- Skip-to-content link, ARIA landmarks, heading hierarchy
- prefers-reduced-motion support, focus-visible states
- Color contrast fixes: all text meets 4.5:1 ratio
- Keyboard navigation for stat cards and task items
SEO: meta theme-color, format-detection, robots.txt
2026-04-13 01:37:55 +08:00
iven
3a05523d23
fix: address Phase 1-2 audit findings
...
- CORS: replace permissive() with configurable whitelist (default.toml)
- Auth store: synchronously restore state at creation to eliminate
flash-of-login-page on refresh
- MainLayout: menu highlight now tracks current route via useLocation
- Add extractErrorMessage() utility to reduce repeated error parsing
- Fix all clippy warnings across 4 crates (erp-auth, erp-config,
erp-workflow, erp-message): remove unnecessary casts, use div_ceil,
collapse nested ifs, reduce function arguments with DTOs
2026-04-11 12:36:34 +08:00
iven
a7cdf67d17
feat(auth): add tenant seed data and bootstrap logic
...
- seed.rs: creates 21 permissions, admin+viewer roles, admin user with Argon2 password
- AuthConfig added to server config with default password Admin@2026
- Server startup: auto-creates default tenant and seeds auth data if not exists
- Idempotent: checks for existing tenant before seeding
2026-04-11 03:28:19 +08:00
iven
eb856b1d73
feat: 初始化ERP平台底座项目结构
...
- 添加基础crate结构(erp-core, erp-common)
- 实现核心模块trait和事件总线
- 配置Docker开发环境(PostgreSQL+Redis)
- 添加Tauri桌面端基础框架
- 设置CI/CD工作流
- 编写项目协作规范文档(CLAUDE.md)
2026-04-10 23:40:38 +08:00
