sxbh_admin/cma-management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
461 Commits 6 Branches 0 Tags
1da0a74568847b9ce7bbb85f5bf00d21dd9bc8d2
Commit Graph
6 Commits
Author SHA1 Message Date
Hermes CI Fix 6c1ea85d71 fix(alignment): /tree map_id filter via map_objectives.kpis union (v2)
ci/woodpecker/push/main Pipeline failed
Details 
- add missing 'or_' import (NameError on map_id calls)

- union of map_objectives.kpis codes and KPIDefinition.map_id, intersect with entity active KPIs

- cross-entity / unknown map_id -> empty tree (no leak)

- no map_id -> unchanged behaviour
 2026-10-01 21:12:02 +08:00
wecom-fullstack 22ec40052d fix(alignment): /tree accept and apply map_id filter for KPI selection 
GET /api/cma/alignment/tree ignored the map_id query param (FastAPI silently dropped it) so the board always rendered the full active-KPI set of the account. Add map_id: Optional[int] = Query(None) and filter KPIDefinition.map_id when provided; no param keeps the previous behaviour. Entity scoping unchanged (entity_id from token) - cross-account map_id yields an empty tree, no other-account KPI is returned. Only the KPI selection set is filtered; vertical/horizontal/bsc_chain builders untouched.
 2026-10-01 15:58:40 +08:00
wecom-fullstack 0c2e57a4cf fix(cma): 工作台跨实体污染治本 — 全局键拆账套 + 缺列收口 + 预警归属兜底 
任务 dama-workbench-entity-isolation-fullstack-20260922（DAMA 诊断 / 项目Bot batch5 §B / 任总 2026-09-22「都批」）

B1 现金基线拆账套（零 DDL）
- cash_forecast_engine: 键 cash.current_balance → cash.current_balance.<entity_id>；
  读只读本账套键、不做旧键回退；set_* 签名 entity_id 必传（漏传 TypeError）
- cash.py: POST /balance 挂 get_entity_id；网银流水联动写回带账套
B3(a) alignment_config 拆账套（零 DDL）
- alignment.py: GET/POST /config、GET /tree 只读 alignment_config.<entity_id>；未配置=configured:false
B3(b) 预警 KPI 归属兜底
- bot_bridge_v2: 去掉 kpi_id or 1 兜底；本账套无 KPI 定义 → 跳过建预警 + OperationLog 留痕
  （kpi_alerts.kpi_id NOT NULL ⇒ 方案A 置 NULL 不可行，走方案B 跳过+审计）
B2 缺列五表分表处置
- notification_logs: 经 alert_id → kpi_alerts.entity_id join 归属（无父键行不返回）
- notification_channels / okr_templates: 集团共享口径写入 docstring（有意不过滤）
- system_configs: 由 B1/B3(a) 拆键覆盖；kpi_data_quality_logs 沿用 batch5 的 join 收口
P0 语义收敛
- tenant.py: current_tenant 收敛为项目Bot A2A 状态记录，GET 仅 it/ceo；POST 补 operation_logs 审计
证据：新增/改写用例 22 条；全量 1370 passed（基线 1348）
 2026-09-22 11:06:02 +08:00
Hermes CI Fix a2fedd892a fix(cma): isolate KPI alignment tree by entity (project-20260918-alignment-entity-leak) 
GET /api/cma/alignment/tree queried all active KPIs without entity_id filter,

so switching the three alignment modes showed other tenants' KPIs.

Add get_entity_id dependency and filter KPIDefinition by entity_id.

Three mode builders (_build_vertical_tree/_build_horizontal_tree/_build_bsc_chain) unchanged.

Auth semantics unchanged; cross-entity explicit entity_id still returns 403.

Test: tests/test_alignment_entity_isolation_20260918.py (3 modes x both directions, 403, 401).
 2026-09-18 17:18:52 +08:00
fullstack-bot b815b7f623 fix(security): close unauthenticated CMA user API surface + audit tool (cma-api-auth-surface-audit-20260914) 
Root cause: main.py include_router had no global auth dependency; user routers
(products/cost/predict/...) relied on assert_entity_scope, which treats a
missing session token as the Bot service channel and lets the request through.
Result: 46 user endpoints returned data without any token on a public site.

Changes:
- auth_middleware.py: add require_auth_401 (missing Bearer -> 401, delegates to
  require_auth otherwise); 401/403 semantics are explicit.
- router-level Depends(require_auth_401) on products, cost, predict,
  notifications, permissions, tenant, alignment; endpoint-level on
  /auth/roles and /admin/cache/clear.
- deps.py: document that get_entity_id/assert_entity_scope are NOT auth.
- frontend: add the missing Bearer header to 5 tokenless fetch/axios calls that
  hit the newly protected endpoints (KPIAlignment x2, RolePermissions x2,
  Dashboard x1).
- tests: new test_api_auth_surface_20260914.py (58 cases: no-token 401,
  token 200, cross-entity 403, bot channel unchanged); adapt test_predict /
  test_kpi_forecast to send session tokens like production.
- scripts/audit_api_auth_surface.py: reusable FastAPI dependency-graph audit
  (423 endpoints; A bot / B gap / C public), exits 1 when a B-class gap exists.
 2026-09-14 16:41:15 +08:00
Hermes CI Fix 3dddd36866 init: 管理会计OS初始代码 
包含前后端完整代码：
- 前端：Vue3+Vite+ElementPlus
- 后端：FastAPI+SQLAlchemy
- 模块：驾驶舱/KPI/战略地图/预警/预算/成本/预测/改善行动
- 当前版本：v1.0.0
 2026-05-28 17:32:22 +08:00