iven
787e64d9a9
fix: 前端深度审计全量修复 — 安全/功能/代码质量
...
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
严重 BUG 修复:
- 修复 Token 过期后 hash 重定向导致无法跳转登录页
- 修复文章编辑器新建后提交审核使用错误 ID
安全加固:
- HTML 清理函数替换为 ammonia 专业库（替代自定义解析器）
- 文件上传添加 magic bytes 校验（防 Content-Type 伪造）
- 登录添加账户级失败锁定（5次失败→15分钟锁定）
- 审计日志 9 个关键更新操作补充变更前后值（with_changes）
功能缺陷修复:
- 登录/登出时清理 API 缓存（防多账户数据污染）
- 文章编辑器上传改用统一 HTTP 客户端（自动 token 刷新）
- 添加全局 HTTP 错误处理和后端错误消息展示
- PrivateRoute 增加路由级权限检查（系统管理页面）
- 健康数据三个 Tab 添加编辑/删除功能
- 预约创建增加排班可用性校验提示
- 医生详情 API 返回解密后的原始执照号
代码清理:
- 删除未使用的 auth.ts refresh() 函数
- 删除重复的 AuthGuard.tsx 组件
- 删除未使用的 getHealthSummary API
2026-04-26 21:47:26 +08:00
iven
49b8300fdc
feat(core): DEK 缓存 + 密钥轮换管理端点
...
- erp-core/crypto/key_manager: DashMap LRU DEK 缓存 (TTL 5min, 100条)
- DekManager: get_or_create_dek, generate_new_dek, invalidate
- PiiCrypto 集成 DekManager
- POST /api/v1/admin/tenants/:id/rotate-key: 生成新 DEK + 缓存失效
- 权限: tenant.manage (仅超级管理员)
2026-04-26 12:40:25 +08:00
iven
e44d6063be
feat: add utoipa path annotations to all API handlers and wire OpenAPI spec
...
- Add #[utoipa::path] annotations to all 70+ handler functions across
auth, config, workflow, and message modules
- Add IntoParams/ToSchema derives to Pagination, PaginatedResponse, ApiResponse
in erp-core, and MessageQuery/TemplateQuery in erp-message
- Collect all module paths into OpenAPI spec via AuthApiDoc, ConfigApiDoc,
WorkflowApiDoc, MessageApiDoc structs in erp-server main.rs
- Update openapi_spec handler to merge all module specs
- The /docs/openapi.json endpoint now returns complete API documentation
with all endpoints, request/response schemas, and security requirements
2026-04-15 01:23:27 +08:00
iven
3afd732de8
feat(auth): add handlers, JWT middleware, RBAC, and module registration
...
- Auth handlers: login/refresh/logout + user CRUD with tenant isolation
- JWT middleware: Bearer token validation → TenantContext injection
- RBAC helpers: require_permission, require_any_permission, require_role
- AuthModule: implements ErpModule with public/protected route split
- AuthState: FromRef pattern avoids circular deps between erp-auth and erp-server
- Server: public routes (health+login+refresh) + protected routes (JWT middleware)
- ErpModule trait: added as_any() for downcast support
- Workspace: added async-trait, sha2 dependencies
2026-04-11 03:22:04 +08:00
iven
5901ee82f0
feat: complete Phase 1 infrastructure
...
- erp-core: error types, shared types, event bus, ErpModule trait
- erp-server: config loading, database/Redis connections, migrations
- erp-server/migration: tenants table with SeaORM
- apps/web: Vite + React 18 + TypeScript + Ant Design 5 + TailwindCSS
- Web frontend: main layout with sidebar, header, routing
- Docker: PostgreSQL 16 + Redis 7 development environment
- All workspace crates compile successfully (cargo check passes)
2026-04-11 01:07:31 +08:00
iven
eb856b1d73
feat: 初始化ERP平台底座项目结构
...
- 添加基础crate结构(erp-core, erp-common)
- 实现核心模块trait和事件总线
- 配置Docker开发环境(PostgreSQL+Redis)
- 添加Tauri桌面端基础框架
- 设置CI/CD工作流
- 编写项目协作规范文档(CLAUDE.md)
2026-04-10 23:40:38 +08:00
