iven
|
c314093c76
|
fix(miniprogram): auth store restore() 修复 + 开启自动化端口
- restore() 从 Taro.getStorageSync 改为 secureGet 读取加密数据
- 修复 key 不匹配: 'user' → 'user_data', 'user_roles' → 'user_roles'
- login 写入 secureSet('user_data') 但 restore 读 Taro.getStorageSync('user')
- 导致每次 app 重启都无法恢复登录状态
- project.config.json 开启 automationAudits 以支持 miniprogram-automator
|
2026-04-27 08:20:12 +08:00 |
|
iven
|
3424a33b6b
|
fix(miniprogram): 小程序审计修复 — 安全加固+功能链路+输入验证
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
安全修复:
- H1: Token 刷新竞态条件 → Singleton Promise 模式防止并发刷新
- H4: 移除 store 中的 token 明文状态，统一走 secure storage
- H5: 登录/绑定手机号添加 loading 防重复点击保护
- H6: Analytics 改用 request.ts 统一请求层，不再绕过认证
- M1: logout 清理所有残留数据(openid/tenant_id/analytics_queue)
- M2/M7: 敏感数据(user/openid/tenant_id)统一走加密存储
- M3: 移除开发日志中的请求体打印
- M4: secure-storage 解密失败返回 null 而非空串
功能修复:
- F1: 今日体征概览 API 支持 patient_id 查询参数(后端+前端)
- F2: 积分商城对无患者档案用户展示引导 UI
- M6: daily-monitoring 添加 Zod 数值范围验证
清理:
- L4: 移除 devLogin 开发辅助函数
|
2026-04-27 00:41:30 +08:00 |
|
iven
|
a0b72b0f73
|
feat: Iteration 1 — 审计日志IP记录、文件上传、医护端API、小程序角色切换
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
Iteration 1 六项任务全部完成：
1. 审计日志IP记录 — task_local RequestInfo 自动注入 IP/user_agent
2. 文件上传服务 — multipart 上传 + ServeDir 静态文件服务
3. 医护端后端API — 医生工作台仪表盘 + 患者标签CRUD + 会话已读
4. 小程序角色切换 — 登录后根据角色跳转医护台/患者首页
5. 小程序安全加固 — secure-storage 开发模式警告
6. 讨论记录归档 — docs/discussions/
|
2026-04-26 13:13:25 +08:00 |
|
iven
|
945ccd64ba
|
fix: 全面 QA 审计修复 — 安全加固/代码质量/跨平台一致性/测试覆盖
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
Phase 0 安全热修复 (CRITICAL):
- 外部化微信 appid/secret 到 ERP__WECHAT__APPID/SECRET 环境变量
- 正确连接 HealthCrypto 到 ERP__HEALTH__AES_KEY/HMAC_KEY 环境变量
- 外部化小程序加密密钥到 TARO_APP_ENCRYPTION_KEY 环境变量
- 移除小程序 auth store 中的敏感信息 console.log
Phase 1 安全加固:
- 微信自动注册 display_name 添加 sanitize 防止 XSS
- 测试数据库凭据改为从 TEST_DB_URL 环境变量读取
Phase 2 代码质量:
- 提取 useThemeMode hook 消除 22 处重复暗色模式检测
- 提取共享健康常量到 constants/health.ts
- 拆分 patient_service.rs 脱敏函数到 masking.rs
- 移除未使用的 i18next/react-i18next 依赖
- 移除未使用的 api/errors.ts 和 erp-auth/anyhow 依赖
Phase 3 测试覆盖:
- 新增 5 个患者模块集成测试 (CRUD/租户隔离/验证/软删除)
Phase 4 跨平台一致性:
- 统一小程序 Patient.birthday → birth_date 匹配后端
- 统一小程序 Appointment.time_slot → start_time/end_time 匹配后端
Phase 5 架构:
- 微信登录添加多租户 TODO 注释
- 更新 wiki/infrastructure.md 环境变量文档
|
2026-04-25 10:00:49 +08:00 |
|
iven
|
60a8a591a8
|
feat(miniprogram): Token XOR 混淆存储
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
- 新增 secure-storage 工具：XOR + Base64 混淆 token 存储
- request.ts 和 auth.ts 中所有 access_token/refresh_token 存取
均通过 secure-storage，避免明文暴露在 Storage 中
|
2026-04-24 12:52:20 +08:00 |
|
iven
|
a9861a0cde
|
feat(health): 趋势图升级为 ECharts 折线图 + 缓存 TTL 5分钟
|
2026-04-24 12:38:07 +08:00 |
|
iven
|
6bb3babcb9
|
chore(miniprogram): stores 层启用 @/ 路径别名 + webpack alias 配置
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
|
2026-04-24 12:30:02 +08:00 |
|
iven
|
7b7677dfec
|
fix(miniprogram): 审计修复 — P0/P1 共 16 个问题
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
P0 功能阻断:
- 修复 login→bindPhone openid 状态传递断裂
- 首页健康卡片对接 useHealthStore 真实数据
- 血压录入改为收缩压/舒张压双输入
- 快捷服务路径修正（报告→/pages/report、随访→/pages/followup）
P1 类型安全 + 组件:
- 替换所有 <input>/<image>/<textarea> 为 Taro 组件
- service 层 any 类型全部替换（Doctor/DoctorSchedule/IndicatorDetail/FollowUpContent/PatientUpdateInput）
- 预约详情数据传递简化为纯 Storage 缓存
- Article 接口添加 author 字段
|
2026-04-24 01:37:34 +08:00 |
|
iven
|
affb3a5578
|
feat(health+miniprogram): 健康数据录入 + 趋势图
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
后端:
- 新增 GET /health/vital-signs/trend 小程序趋势查询 API
- 通过 JWT user_id 自动关联 patient，支持 range 参数 (7d/30d/90d)
- 新增 MiniTrendQueryParams, MiniTrendResp, DataPoint DTO
前端:
- 实现健康数据首页（今日概览 + 趋势入口 + 录入按钮）
- 实现健康数据录入页（指标选择 + 数值输入 + 提交）
- 实现趋势图页（时间范围切换 + 柱状图 + 数据列表）
- 新增 health service 和 store（趋势缓存 + 今日摘要）
- 修复所有页面相对路径引用问题
|
2026-04-24 00:36:30 +08:00 |
|
iven
|
0f84c881ef
|
feat(miniprogram): 初始化 Taro 4 + React 小程序项目
CI / rust-check (push) Has been cancelled
CI / rust-test (push) Has been cancelled
CI / frontend-build (push) Has been cancelled
CI / security-audit (push) Has been cancelled
- 手动创建 Taro 4.2 + React 18 + TypeScript 项目骨架
- 配置 webpack5 编译、SCSS 样式、医疗清新主题
- 实现 API 请求层（JWT 自动注入 + token 刷新）
- 实现 auth store（微信登录 + 手机号绑定 + 就诊人管理）
- 实现登录页（微信一键登录 + 手机号授权绑定）
- 实现首页（问候栏 + 今日健康卡片 + 快捷服务 + 即将到来）
- 实现我的页面（个人信息 + 功能菜单 + 退出登录）
- 健康/预约/资讯占位页
- TabBar 5 个入口：首页/健康/预约/资讯/我的
|
2026-04-24 00:28:38 +08:00 |
|