iven
|
931edc3025
|
fix(security): 补全 XSS sanitize + 修复 sender_id 身份伪造
安全审计修复：
- 补全 6 个 DTO 的 sanitize 方法（diagnosis/consent/alert/medication_record/medication_reminder/follow_up_template）
- 4 个 handler 添加 .sanitize() 调用（diagnosis/consent/alert_rule/medication_record）
- 修复咨询消息 sender_id/sender_role 从客户端提交改为服务端从 JWT 提取
- 修复小程序 AI 报告 markdownToHtml XSS（添加 sanitizeHtml 过滤）
|
2026-04-30 10:21:52 +08:00 |
|
iven
|
7a9054c914
|
feat: 医护仪表盘增强 + 患者端文章分类浏览
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
- DoctorDashboard 增加 pending_dialysis_review/pending_lab_review/today_appointments
- 医护小程序首页增加「健康审核」区块（待审透析/化验/今日预约）
- 患者端文章列表增加分类 tabs 横向滚动筛选
- article service 增加 listCategories + category_id 筛选
|
2026-04-26 14:25:06 +08:00 |
|
iven
|
f0076aa240
|
feat: Iteration 3 — 咨询轮询、统计概览、埋点后端
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
- consultation_service 支持 after_id 增量消息查询
- 小程序咨询详情页 8 秒轮询新消息
- 新增 DashboardStatsResp 综合统计端点 (/statistics/dashboard)
- 新增 /analytics/batch 埋点接收端点（日志记录模式）
|
2026-04-26 13:54:21 +08:00 |
|
iven
|
a0b72b0f73
|
feat: Iteration 1 — 审计日志IP记录、文件上传、医护端API、小程序角色切换
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
Iteration 1 六项任务全部完成：
1. 审计日志IP记录 — task_local RequestInfo 自动注入 IP/user_agent
2. 文件上传服务 — multipart 上传 + ServeDir 静态文件服务
3. 医护端后端API — 医生工作台仪表盘 + 患者标签CRUD + 会话已读
4. 小程序角色切换 — 登录后根据角色跳转医护台/患者首页
5. 小程序安全加固 — secure-storage 开发模式警告
6. 讨论记录归档 — docs/discussions/
|
2026-04-26 13:13:25 +08:00 |
|
iven
|
07f4ba41ba
|
fix(health): 穷尽审计修复 — 权限同步/编译错误/前端bug/审计日志
CI / frontend-build (push) Has been cancelled
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / security-audit (push) Has been cancelled
审计发现并修复的问题：
HIGH:
- H1: ConsultationDetail 使用 getSession(id) 替代错误的列表搜索
- H2: SessionResp 添加 version/updated_at 字段
- H3: 移除 FollowUpRecordList 调用不存在的导出端点
- H4: 新增 articles.ts 前端 API 模块
MEDIUM:
- M1: article delete 添加乐观锁 (expected_version)
- M2: 取消预约排班释放传播错误 (log::warn -> ?)
- M3: FollowUpTaskList 日期格式 Dayjs -> string
- M4: 补充 15 个缺失审计日志
LOW:
- L1: 替换 follow_up_service 中的 .unwrap()
- L2: PatientListItem 添加 version 字段
CRITICAL (新发现):
- 权限未同步: 健康模块 14 个权限从未写入数据库，添加启动时自动同步
- migration 表名错误: patients -> patient
- 编译错误: health_trend entity 未导入, ToPrimitive trait 未导入
- HealthError 缺少 From<AppError> 实现
|
2026-04-25 08:58:58 +08:00 |
|
iven
|
1d1f01df81
|
feat(health): 为所有 DTO 添加 sanitize 防止存储型 XSS
覆盖 patient/health_data/appointment/follow_up/consultation/doctor
6 个 DTO 模块共 14 个请求结构体，在 handler 层统一调用 sanitize。
|
2026-04-25 00:04:25 +08:00 |
|
iven
|
a0ca156e2c
|
fix(health): 精准审计修复 6 个真实问题 — 安全/一致性/性能
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
P0: consultation handler sender_role 从请求体移除，改为服务端推导（防伪造）
P1: 所有软删除操作统一使用 check_version 乐观锁（6个函数）
P1: 修复 health_trend 索引缺少 tenant_id 前导列 + follow_up_record 补 (tenant_id, executed_date) 索引
P2: Decimal->f64 使用 ToPrimitive::to_f64 替代脆弱的 to_string().parse()
P2: 预约取消释放槽位+状态更新包裹进同一事务
|
2026-04-24 08:36:22 +08:00 |
|
iven
|
4867202437
|
fix(health): 四次审计修复 — 6 CRITICAL + 8 HIGH + 4 MEDIUM
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
CRITICAL:
- C-1: consultation sender_id 改为从 JWT ctx.user_id 注入，防伪造
- C-2: consultation session 更新改为 CAS 原子操作，防并发丢失
- C-3: 随访记录创建包裹在事务中，保证记录/任务/后续任务一致性
- C-4/C-5/C-6: 唯一索引改为 partial index WHERE deleted_at IS NULL
HIGH:
- H-1: manage_patient_tags 添加 tag_ids 租户归属校验
- H-2: assign_doctor 添加重复关联检查
- H-3: calendar_view 限制日期范围最多 90 天
- H-4: export_sessions 添加 10000 条上限
- H-5: patient_tag_relation/patient_doctor_relation 添加 version 字段
- H-6: create_schedule 添加医生存在性检查
- H-7: 预约取消排班释放错误改为日志记录
- H-8: follow_up_task.related_appointment_id 添加 FK 约束
MEDIUM:
- M-2: 修复 search LIKE 双重 % 包裹问题
- M-3: article_service 错误类型改为 ArticleNotFound
- M-4: patient.created 事件移除 PII（姓名）
- M-6: lab_report 添加 (tenant_id, report_type) 索引
|
2026-04-24 07:50:14 +08:00 |
|
iven
|
2e9eb55f2c
|
fix(health): 修复审计发现的 10 个 CRITICAL 问题
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
权限与安全:
- 为全部 51 个 handler 端点添加 require_permission 权限检查
- 修复 CAS 预约操作中 doctor_id 为 None 时使用 Uuid::nil() 的问题
状态机修复:
- 预约初始状态从 "scheduled" 改为 "pending"（匹配设计规格）
- 排班状态从 "active" 改为 "enabled"
- 咨询会话添加 waiting→active 自动触发（首条消息时）
- 新增 create_session 端点和 DTO
数据完整性:
- doctor_profile 表添加 name 列（entity + migration + service）
- lab_report/health_trend 的 json 列改为 json_binary（支持 GIN 索引）
- 添加关键索引：patient.id_number UNIQUE、patient_tag UNIQUE、
doctor_schedule 唯一排班槽位、health_trend、doctor_profile.name
- 随访记录完成后自动检查 next_follow_up_date 创建后续任务
事件总线:
- 实现 10 种核心事件发布（patient/appointment/follow_up/consultation/lab_report）
- 实现 workflow.task.completed 和 message.sent 事件订阅框架
种子数据:
- 实现 seed_tenant_health（8 个默认患者标签）
- 实现 soft_delete_tenant_data（16 张表级联软删除）
|
2026-04-23 23:25:53 +08:00 |
|
iven
|
d6678d001e
|
feat(health): Handler 接线 + Doctor Service + DTO 统一
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
- 重写全部 6 个 handler 文件，从占位错误改为调用 service 层
- 删除 handler 内联 DTO，统一使用 dto/ 模块类型
- 新增 dto/doctor_dto.rs 和 dto/follow_up_dto.rs
- 新增 service/doctor_service.rs 实现医护档案 CRUD
- 将 follow_up_service 内联 DTO 迁移到 dto/follow_up_dto.rs
- 修复 consultation_session 列名 type→consultation_type（数据库+entity+迁移同步）
- 全部 51 个 API 端点已验证可用
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-04-23 21:31:42 +08:00 |
|
iven
|
ca50d32f6e
|
feat(health): 添加 erp-health 健康管理模块骨架
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
新建 erp-health 原生 Rust crate，覆盖设计规格中定义的 5 大业务域：
- 16 个 SeaORM Entity（患者/家属/标签/医生/健康档案/体征/化验单/预约/排班/随访/咨询等）
- 16 表数据库迁移（含索引、外键、默认值、可回滚）
- 40+ API 路由骨架（患者管理/健康数据/预约排班/随访/咨询/医生管理）
- 12 个权限声明（health.patient/health-data/appointment/follow-up/consultation/doctor 各 .list/.manage）
- DTO / Service / Handler / Event 四层架构，Service 使用 todo!() 占位
- erp-server 集成：模块注册 + AppState FromRef 桥接 + 路由挂载
同步更新 CLAUDE.md 项目进度、wiki 知识库、设计规格文档。
|
2026-04-23 19:59:22 +08:00 |
|