cma-management

421 Commits 6 Branches 0 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
fullstack-bot	b815b7f623	fix(security): close unauthenticated CMA user API surface + audit tool (cma-api-auth-surface-audit-20260914) Root cause: main.py include_router had no global auth dependency; user routers (products/cost/predict/...) relied on assert_entity_scope, which treats a missing session token as the Bot service channel and lets the request through. Result: 46 user endpoints returned data without any token on a public site. Changes: - auth_middleware.py: add require_auth_401 (missing Bearer -> 401, delegates to require_auth otherwise); 401/403 semantics are explicit. - router-level Depends(require_auth_401) on products, cost, predict, notifications, permissions, tenant, alignment; endpoint-level on /auth/roles and /admin/cache/clear. - deps.py: document that get_entity_id/assert_entity_scope are NOT auth. - frontend: add the missing Bearer header to 5 tokenless fetch/axios calls that hit the newly protected endpoints (KPIAlignment x2, RolePermissions x2, Dashboard x1). - tests: new test_api_auth_surface_20260914.py (58 cases: no-token 401, token 200, cross-entity 403, bot channel unchanged); adapt test_predict / test_kpi_forecast to send session tokens like production. - scripts/audit_api_auth_surface.py: reusable FastAPI dependency-graph audit (423 endpoints; A bot / B gap / C public), exits 1 when a B-class gap exists.	2026-09-14 16:41:15 +08:00
Hermes CI Fix	115a0ec755	fix(security): 4端点补跨租户鉴权 — 实体1会话读实体2数据(200)→403 (cma-cross-entity-endpoints-auth-20260914) 背景（项目Bot 补充复验 §四#2）：以下 4 个只读端点未做会话账套鉴权，用 entity=1(酣客) 会话 token + 显式 entity 参数可读到 entity=2(博海) 数据（HTTP 200）： - GET /data-quality/governance-check?entity_id=2 → 200 score=88（对照 entity1=72） - GET /products/matrix?entity_id=2 → 200 - GET /alerts/risk-matrix?entity=bohai → 200 博海风险矩阵 - GET /action-plans/coso-checklist?entity=bohai → 200 博海 COSO total_score=55 另：risk-matrix / coso-checklist 在非法实体值下静默回落酣客数据，UI 标签与数据不一致。改动： 1. deps.py 新增统一防护入口 assert_entity_scope / assert_entity_slug_scope / get_session_entity / resolve_session_slug（文案对齐 get_entity_id：无权访问企业 entity_id=X（当前账套: Y）） 2. governance-check / products/matrix：entity_id 须等于会话账套，否则 403；缺省按会话账套（governance-check 原缺省 0=全部 → 登录态下按账套收敛） 3. risk-matrix / coso-checklist：entity 须等于会话账套，否则 403；非法值 → 400 显式报错（不再静默回落酣客） 4. P3：POST /auth/switch-entity 加 DEPRECATED 注释（前端已无调用，保留不删） 5. 测试：tests/test_security_multitenant.py 新增 TestCrossEntityEndpointAuth 15 例（跨实体 403 / 同实体 200 / 缺省按账套 / 非法显式报错 / 参照端点行为不变）验证：pytest tests/ -q → 951 passed（10 项失败为改动前既有基线，已 stash 对照确认）；真实后端冒烟 19/19 PASS（entity=1 会话 4 端点跨实体全 403）。	2026-09-14 11:19:05 +08:00
Hermes CI Fix	9de6e522a4	feat: 波士顿产品矩阵 — 四象限分析(明星/现金牛/问题/瘦狗) - 数据层: product_sales表+导入脚本(93条, 酣客1-8月商品销售排行榜) - 后端: GET /api/cma/products/matrix?entity_id&months 横轴=销售趋势(线性回归), 纵轴=加权毛利率, 气泡=销售额 - 前端: ProductMatrix.vue ECharts散点图+象限卡片+明细表, 支持酣客/博海切换 - 验证: API四象限分类正确, 数据联动, 前端路由200, 全部通过	2026-08-25 00:25:11 +08:00

Author

SHA1

Message

Date

fullstack-bot

b815b7f623

fix(security): close unauthenticated CMA user API surface + audit tool (cma-api-auth-surface-audit-20260914)

Root cause: main.py include_router had no global auth dependency; user routers
(products/cost/predict/...) relied on assert_entity_scope, which treats a
missing session token as the Bot service channel and lets the request through.
Result: 46 user endpoints returned data without any token on a public site.

Changes:
- auth_middleware.py: add require_auth_401 (missing Bearer -> 401, delegates to
  require_auth otherwise); 401/403 semantics are explicit.
- router-level Depends(require_auth_401) on products, cost, predict,
  notifications, permissions, tenant, alignment; endpoint-level on
  /auth/roles and /admin/cache/clear.
- deps.py: document that get_entity_id/assert_entity_scope are NOT auth.
- frontend: add the missing Bearer header to 5 tokenless fetch/axios calls that
  hit the newly protected endpoints (KPIAlignment x2, RolePermissions x2,
  Dashboard x1).
- tests: new test_api_auth_surface_20260914.py (58 cases: no-token 401,
  token 200, cross-entity 403, bot channel unchanged); adapt test_predict /
  test_kpi_forecast to send session tokens like production.
- scripts/audit_api_auth_surface.py: reusable FastAPI dependency-graph audit
  (423 endpoints; A bot / B gap / C public), exits 1 when a B-class gap exists.

2026-09-14 16:41:15 +08:00

Hermes CI Fix

115a0ec755

fix(security): 4端点补跨租户鉴权 — 实体1会话读实体2数据(200)→403 (cma-cross-entity-endpoints-auth-20260914)

背景（项目Bot 补充复验 §四#2）：以下 4 个只读端点未做会话账套鉴权，
用 entity=1(酣客) 会话 token + 显式 entity 参数可读到 entity=2(博海) 数据（HTTP 200）：
  - GET /data-quality/governance-check?entity_id=2   → 200 score=88（对照 entity1=72）
  - GET /products/matrix?entity_id=2                 → 200
  - GET /alerts/risk-matrix?entity=bohai             → 200 博海风险矩阵
  - GET /action-plans/coso-checklist?entity=bohai    → 200 博海 COSO total_score=55
另：risk-matrix / coso-checklist 在非法实体值下静默回落酣客数据，UI 标签与数据不一致。

改动：
1. deps.py 新增统一防护入口 assert_entity_scope / assert_entity_slug_scope /
   get_session_entity / resolve_session_slug（文案对齐 get_entity_id：无权访问企业 entity_id=X（当前账套: Y））
2. governance-check / products/matrix：entity_id 须等于会话账套，否则 403；
   缺省按会话账套（governance-check 原缺省 0=全部 → 登录态下按账套收敛）
3. risk-matrix / coso-checklist：entity 须等于会话账套，否则 403；
   非法值 → 400 显式报错（不再静默回落酣客）
4. P3：POST /auth/switch-entity 加 DEPRECATED 注释（前端已无调用，保留不删）
5. 测试：tests/test_security_multitenant.py 新增 TestCrossEntityEndpointAuth 15 例
   （跨实体 403 / 同实体 200 / 缺省按账套 / 非法显式报错 / 参照端点行为不变）

验证：pytest tests/ -q → 951 passed（10 项失败为改动前既有基线，已 stash 对照确认）；
      真实后端冒烟 19/19 PASS（entity=1 会话 4 端点跨实体全 403）。

2026-09-14 11:19:05 +08:00

Hermes CI Fix

9de6e522a4

feat: 波士顿产品矩阵 — 四象限分析(明星/现金牛/问题/瘦狗)

- 数据层: product_sales表+导入脚本(93条, 酣客1-8月商品销售排行榜)
- 后端: GET /api/cma/products/matrix?entity_id&months
  横轴=销售趋势(线性回归), 纵轴=加权毛利率, 气泡=销售额
- 前端: ProductMatrix.vue ECharts散点图+象限卡片+明细表, 支持酣客/博海切换
- 验证: API四象限分类正确, 数据联动, 前端路由200, 全部通过

2026-08-25 00:25:11 +08:00