5 Commits

Include renames

Author	SHA1	Message	Date
wecom-fullstack	f51fc72ac7	style(page-title): B 全站规范——页面内同名标题清零 + 增量副标题弱化 + 标题 emoji 换 Lucide ... - 39+ 页删除与布局标题同名/基本同名的页面内 h1-h4（同屏三标题→两处） - 增量副标题弱化为 14px #64748B 小字：收付款计划/战略回顾/地图版本/会计科目打标 - 标题 emoji 清零，保留标题处改 Lucide 内联 SVG（bar-chart-3/video/scale/clipboard-list/alert-circle/map/history） - KPIListView 增加 hideTitle（仅展示），客户/学习看板隐藏组件内重复页头 - 不动 MainLayout、不改接口/业务逻辑、不碰 MapCanvas.vue	2026-10-18 19:33:11 +08:00
wecom-fullstackandHermes CI Fix	26db15e6d3	fix(ui): 系统级设置归位（KPI对齐/预算模式切换入口收归系统设置）+ 业务页右下浮窗提醒 ... - KPIAlignment.vue: 移除页头切换按钮与模式选择器，去 saveAlignConfig；新增右下浮窗 - BudgetManagement.vue: 预算模式 el-switch -> 只读标签，去 onBudgetModeChange；新增右下浮窗 - RolePermissions.vue: 保留目标对齐正本，新增「预算模式」Tab（系统级切换入口） - 仅 frontend/ 三件；build 通过	2026-10-13 23:04:07 +08:00
Hermes CI Fix	7b74736980	refactor(cma-frontend): route all API calls through shared axios instance (cma-frontend-axios-unify-20260915) ... api/index.ts: add permissionApi.getModules/getConfig/saveConfig + alignmentApi.config/tree. views: replace 13 raw fetch calls and 6 local axios.create instances (each hand-building the Authorization header, without the shared 401 redirect / timeout toast) with the shared instance from api/index.ts. KPIAlignment: fixes a live bug - the header value was the string literal 'Bearer ' + token, so /alignment/tree always returned 401 (reproduced against the production bundle). Unwrap semantics preserved: the shared response interceptor returns response.data, so call sites that used res.data were adjusted accordingly. Verified: scan-frontend-tokenless RAW-TOKENLESS=0; vite build ok; headless A/B (new dist vs production bundle, 8 affected pages, real login) -> identical rendered rows and identical pre-existing error profile, /alignment 401->200. Push not executed: main is ahead 4 with other tickets' gated commits (see cma-main-ahead3-push-gate-notice-20260915).	2026-09-15 22:21:56 +08:00
fullstack-bot	b815b7f623	fix(security): close unauthenticated CMA user API surface + audit tool (cma-api-auth-surface-audit-20260914) ... Root cause: main.py include_router had no global auth dependency; user routers (products/cost/predict/...) relied on assert_entity_scope, which treats a missing session token as the Bot service channel and lets the request through. Result: 46 user endpoints returned data without any token on a public site. Changes: - auth_middleware.py: add require_auth_401 (missing Bearer -> 401, delegates to require_auth otherwise); 401/403 semantics are explicit. - router-level Depends(require_auth_401) on products, cost, predict, notifications, permissions, tenant, alignment; endpoint-level on /auth/roles and /admin/cache/clear. - deps.py: document that get_entity_id/assert_entity_scope are NOT auth. - frontend: add the missing Bearer header to 5 tokenless fetch/axios calls that hit the newly protected endpoints (KPIAlignment x2, RolePermissions x2, Dashboard x1). - tests: new test_api_auth_surface_20260914.py (58 cases: no-token 401, token 200, cross-entity 403, bot channel unchanged); adapt test_predict / test_kpi_forecast to send session tokens like production. - scripts/audit_api_auth_surface.py: reusable FastAPI dependency-graph audit (423 endpoints; A bot / B gap / C public), exits 1 when a B-class gap exists.	2026-09-14 16:41:15 +08:00
Hermes CI Fix	3dddd36866	init: 管理会计OS初始代码 ... 包含前后端完整代码： - 前端：Vue3+Vite+ElementPlus - 后端：FastAPI+SQLAlchemy - 模块：驾驶舱/KPI/战略地图/预警/预算/成本/预测/改善行动 - 当前版本：v1.0.0	2026-05-28 17:32:22 +08:00