sxbh_admin/cma-management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
462 Commits 6 Branches 0 Tags
8631ce718fc5261d6354c9e22e355ac31a651c9f
Commit Graph
41 Commits
Author SHA1 Message Date
wecom-fullstack 467472311d feat(cma): audit write-side entity closure + entity-dimension data dictionary 
task dama-entity-isolation-sweep-20260923 (sections 2-2 4/5, merged by projectBot 2026-09-23 18:2x)

4) operation_logs write side: every audit write carries the account (no DDL, no column added)

   - new app/utils/oplog.py::log_op() single wrapper: sets detail.entity_id; scope=global for

     by-design non-entity writes (platform dict / role-level); scope=batch + OPLOG_BATCH_NO_ENTITY

     sentinel for cross-account batches; no context -> OPLOG_NO_ENTITY sentinel (never guess)

   - 16 remaining construction points converted (data/alert_rules/bi_reports/kpi_causality/

     bot_bridge x2/budget_generate/driver_budget/kpis _log x3/templates _log x2/erp_sync);

     pre-4 state had 20 sites without entity_id, now 0 outside the wrapper

   - read side untouched (knowledge_service still user_id fallback); history not backfilled

5) docs/entity-dimension-data-dictionary.md: 8-table three-state registry

   (kpi_templates/driver_factor_templates/scenario_suggestions/bot_bridge_config = non-entity;

    kpi_subject_map = inherited via kpi_id; analysis_results/subjects = account dimension,

    legacy rows still NULL -> other task; operation_logs = non-entity column + detail.entity_id)

Evidence: RED 2 failed/7 passed (reverted call sites) -> GREEN full 1428 passed; 9 new tests

including two read-back rows; app md5 restore verified identical; no cross-account writes

LOCAL commit only - push is gated (ahead contains the P1 entity-dim batch commit fb4609b)
 2026-09-23 23:08:26 +08:00
wecom-fullstack 477515c453 fix(cma): 隔离扫尾 — kpi_alert_higher_better 拆账套 + tenant/switch 审计收口
ci/woodpecker/push/main Pipeline was canceled
Details 
任务 dama-entity-isolation-sweep-20260923（DAMA 独立回查漏项 / 任总 2026-09-23「按照建议执行」）

① 补漏同源全局键 kpi_alert_higher_better（system_configs，零 DDL）
   - deviation_engine: 新增 higher_better_key(entity_id)；get_higher_better_codes(db, entity_id)
     改为只读本账套键、不回退旧全局键；未配置 → DEFAULT_HIGHER_BETTER（兜底，与原行为逐字一致）
   - budget.py: GET/PUT /alert-direction 挂 get_entity_id，只读写会话账套键；body entity_id 不信
   - scripts/migrate_higher_better_key_entity_20260923.py: --check/--apply/--down + 库名保护 + 幂等
   - 生产实况：库内该键 0 行 ⇒ 无原值可搬运（--apply 走 skip 零写入），e1 行为不变

② kpi_visibility 口径裁定：角色级天然全局 = 非账套维度，不拆（关闭本项）
   - auth_middleware 注释 + docstring 登记「有意不做账套后缀」；口径字典
     docs/global-config-keys-caliber-20260923.md（含 budget_mode/budget_driver_mode 评估结论）

③ tenant/switch 审计收口
   - detail 显式 from_entity_id → to_entity_id + source + operator{id,username,name,role}
   - 审计失败不静默：同事务回滚 + AUDIT_WRITE_FAILED ERROR + HTTP 500（不留「改了但没审计」）
   - GET /current 无写路径不落审计；历史缺口不补写

证据：新增/改写用例 17 条；全量 1397 passed（去新增文件 1380 + 17）；RED 态 8 failed
 2026-09-23 18:29:52 +08:00
fullstack 30fa745135 fix(cma): 工作台跨实体治本 · DAMA 回查收口 — 审计可归属 + 通知日志口径 
DAMA 独立回查 dama-recheck-workbench-entity-isolation-20260922 的 §4b/§5 两处待办：

1. POST /api/cma/tenant/switch 审计行原来不可归属：
   - user_id=None → 改为注入会话用户（user=Depends(require_auth_401)）
   - target_type/target_id 从 system_config/None 对齐为 entity/<entity_id>，
     与 /auth/switch-entity 的 switch_entity 共用目标维度 ⇒ 按账套可过滤，零 DDL
   - action 字面 switch_tenant_state 保留不合并（与会话级 switch_entity 语义不同），
     口径登记 docs/audit-and-notification-caliber-20260922.md

2. /api/cma/notifications/logs 增加 policy/note 口径字段，前端发送记录表
   empty-text 提示同一口径 —— 避免「B2 上线后 e1/e2 均 0 条」被当成页面故障
   （现库 8 行历史记录全为 alert_id IS NULL 的 OKR 复盘提醒，无账套归属）

回归：tests/test_workbench_entity_isolation_20260922.py 22/22；全量 1370 passed；前端 vite build 通过
 2026-09-22 11:21:24 +08:00
Hermes CI Fix 443a779ece fix(cma): DDL 与启动剥离 —— 关闭启动 create_all + 部署链特权迁移步 (cma-create-all-minpriv-rootfix-20260916)
ci/woodpecker/push/main Pipeline failed
Details 
根治 2026-09-16 发布中断（新增模型触发启动 create_all，cma_api 无 CREATE → 崩溃循环）：

- backend/app/database.py: 新增 CMA_AUTO_CREATE 开关（**默认关**），生产启动不再执行 DDL；
  运行库账号因此无需 CREATE（最小权限可保持）
- backend/scripts/db_migrate.py: 特权迁移步（--check/--apply/--rollback/--status）；
  幂等（checkfirst）+ journal 留痕 + 可回滚（dump 失败/表有数据即拒绝，fail-closed）；
  显式拒绝用应用运行账号 cma_api 执行
- deploy.sh: 新增 [4b] 结构迁移（**重启前**执行；失败即中止部署，后端旧码继续服务）
- backend/scripts/tests/db-migrate-sim-e2e.sh: 17 项 scratch 复现/验收（负控制复现 CREATE command denied）
- docs/db-migration-runbook.md: 运行手册（含 cma_api CREATE 回收步骤）

验收：scratch E2E 17/17；pytest 1113 passed/1 xfailed；生产 --check 缺失表 0 / 列级差异 0；
--apply 幂等空跑 created_new=0（journal 留痕）
 2026-09-16 06:53:28 +08:00
Hermes CI Fix 1f7be6b5ae fix(cash): select cash-balance sync targets by explicit kpi_code whitelist 
The voucher-import linkage branch picked write targets by kpi_name LIKE '%cash%' and wrote the monetary-fund ledger balance (yuan) into derived KPIs (F_OP_CFLOW / F_FCF / F_BEP_REVENUE_CASH / F_BEP_COVER_CASH). Replace with an explicit kpi_code whitelist plus a unit/caliber gate that refuses writes on mismatch and reports them via kpi_sync_skipped.

Read-only equivalence probe (real function + intercepted writes + rollback) before/after: before wrote 4 derived KPIs, after writes only F_CASH_SAFETY. tests: +9 new cases; pytest failure set identical to baseline (15/15 same ids).
 2026-09-14 20:37:12 +08:00
Hermes CI Fix 40d522cd34 fix(security): retire default-credential surface (yanxue-20260914-cma-defaultcred-code-fix) 
- Login.vue: no prefilled default creds; no anonymous entity enumeration on mount

- deploy.sh: readiness polling (0.5s/30s cap) replaces fixed sleep 3; login smoke reads same-source 600 secret file, missing file = explicit abort

- 19 verify/check/gen_report scripts: shared _admin_creds() loader (CMA_ADMIN_ENV -> ops .secrets -> profile copy); no hardcoded creds

- tests: single TEST_USER_PASSWORD fixture constant; docs: pointer to 600 secret file; removed 4 legacy .bak + pycache residue
 2026-09-14 17:39:53 +08:00
Hermes CI Fix aac1bd1df1 fix(security): retire check-governance + scope /reports/dupont to session entity 
- data_quality.py: remove GET /check-governance (no caller repo-wide; its
  entity_id param had no session auth -> cross-tenant read; duplicate of
  governance-check) -> the path now returns 404
- reports.py: /reports/dupont resolves the analysis target from the session
  account (assert_entity_slug_scope / resolve_session_slug); explicit
  cross-entity entity param -> 403, illegal value -> 400; the 2026-08-31
  cross-entity exemption is revoked (docstring updated)
- frontend: drop the checkGovernance api definition; DupontAnalysis.vue
  entity radio group -> read-only session entity tag, request without param
- tests: TestCheckGovernanceRetired (404 x2), TestDupontSessionScope (3),
  TestDupont reworked to account-bound tokens (8 tests)
- docs/api-verification-split.md: drop the retired row, note 334/404 -> 333/403

pytest: 10 failed / 957 passed / 1 xfailed vs HEAD baseline 10 failed /
951 passed / 1 xfailed (identical failure set -> zero regression)

(cma-residual-cross-entity-cleanup-20260914)
 2026-09-14 12:09:04 +08:00
wecom-fullstack 53c642b644 chore(docs): cash-plan-alerts 手册回填 F4b commit 哈希 (dama-cashplan-zombie-alert-cleanup-20260913) 2026-09-13 07:39:06 +08:00
Hermes CI Fix 75309ffcaa chore(docs): cash-plan-alerts 手册回填 commit 哈希 (dama-cashplan-alert-engine-fix-20260913) 2026-09-13 00:39:22 +08:00
Hermes CI Fix 59e65a68b9 fix(alerts): cash_plan 到期未收款预警引擎修复 — entity归属/KPI实体感知/余额快照批次/去重刷新/端点鉴权 (dama-cashplan-alert-engine-fix-20260913) 
F1 两处 KPIAlert 显式写 entity_id（列默认 1 → 博海预警错挂酣客）；顺带修 deviation_engine/
   alert_generator/deviation_push/bot_bridge/bot_bridge_v2 同表创建点
F2 KPI 选择实体感知：候选码 ∪ 实体前缀后缀码（_AR_BALANCE/_CASH_BALANCE/_AP_BALANCE）
   + 兜底 ORDER BY id（此前命中 uk_entity_kpi 必中 BH_ADM_EXPENSE 437 管理费用）
F3 去重命中改为刷新 alert_message/等级/suggestion.days_late/归属（此前 continue → 文本冻结首版）
F4 余额快照批次（bohai_*_20260630 / receivables_migrate）开关：默认 skip 不逐户，另备
   aggregate(按批次聚合1条) / per_customer(旧行为)
F5 POST /api/cma/admin/alerts/check 补鉴权（无 token 401）+ 可选 entity_id 只跑指定账套
 2026-09-13 00:37:10 +08:00
Hermes CI Fix bdcfa2500e docs(manuals): 提交手册模板 _template.md（6段结构，随首批手册入库） 2026-09-07 16:08:55 +08:00
Hermes CI Fix b4071fd1c5 docs(manuals): CMA首批3模块操作手册（budget-version/multitenant-isolation/mydashboard 修复后状态） 2026-09-07 16:08:44 +08:00
Hermes CI Fix 1a1be3001d docs(knowledge): 研学评审回执——决策点A-D确认(entity-memory-partition) 2026-09-03 23:06:12 +08:00
Hermes CI Fix e22e1702f8 feat(knowledge): 企业记忆分区——知识三表entity_id多租户隔离 (entity-memory-partition P1) 
- knowledge_events/knowledge_summaries: entity_id NOT NULL DEFAULT 1 + 索引（企业记忆抽屉）
- knowledge_articles: entity_id 可空——NULL=全局共享(CMA教学知识), 有值=企业专属
- knowledge_service 全链路 entity_id: extract_events(KPIAlert直过滤+OperationLog经user_entities归属)/_kpi_snapshot(修跨企业KPI泄漏)/generate_summary/get_last_summary/run_*/sync
- api/knowledge.py 8端点 Depends(get_entity_id) 强制过滤；详情越权404
- api/knowledge_articles.py 全局∪本企业查询；企业专属越权404
- 生产DB三表ALTER+索引已完成; 存量38篇教学文章保持NULL全局共享
- 测试 test_security_knowledge_partition.py 8条(双实体互查越权/生成自动带entity/全局文章双可见)
- 方案文档 docs/knowledge-entity-partition-plan-20260903.md（附评审决策点）
 2026-09-03 23:00:15 +08:00
Hermes CI Fix 9a823e80a6 test(bot-tier): UI实证脚本 SuggestionCenter 默认未应用+类型过滤 (P0-②) 
CDP登录→/ai-suggestions→待批列表默认unapplied且可见Bot建议卡+过滤芯片DOM全命中
临时建议SUG_ID=300已清理(回查0)
 2026-09-03 18:19:58 +08:00
Hermes CI Fix be71c2296e test(bot-tier): M4 生产E2E实证脚本 verify_bot_write_tiering_e2e.py (P0-②) 
全PASS: Bot建议→unapplied→人apply→目标生效+apply_detail before/after→低危kpi-result source_batch落库→audit L2留痕→清理回查=0
 2026-09-03 18:15:47 +08:00
Hermes CI Fix ea2baa098e docs(bot-tier): M2 分层授权审计清单 docs/bot-write-tiering-20260903.md (P0-②) 
逐端点low/high归类+L1-L4正交关系+目标值直写审计结论(收口说明)+P1待办
 2026-09-03 18:08:30 +08:00
Hermes CI Fix 377326eea2 feat(zone): 三区标记M1——router全部业务路由加meta.zone(A/B)+盘点表docs/zone-ownership-20260903.md (three-zone P0-①) 2026-09-03 17:45:21 +08:00
Hermes CI Fix 5e0b09e6b6 feat(cashflow): 按项目任务单复核修正——表名cashflow_statements+DoD兼容路径/菜单C组/角色收敛/术语0+验收脚本入库 
- 表名: ORM+生产库 RENAME cash_flow_structure_values → cashflow_statements (DoD SHOW TABLES LIKE 字面验收)
- 兼容端点: /api/cma/cashflow/statements(GET/POST)+analysis 注册 main.py (DoD 验收路径)
- 菜单: 移入 🟡C 监控与评价 组(与杜邦分析/管理报表平级), roles 收敛 ceo/finance (前端 ROLE_ROUTES/MENU_ITEMS/router meta + 后端 require_role 四处同步)
- 术语: docstring 改写, grep 现金流肖像=0
- 验收脚本: backend/scripts/verify_cashflow_structure.py (14项断言全PASS: type6→type1双向/瀑布5步/alias路径/权限/清理)
 2026-09-03 01:34:13 +08:00
Hermes CI Fix dd6019f096 docs(verification): 现金流量表结构分析验收记录 (cashflow-structure P1) 2026-09-03 01:30:42 +08:00
Hermes CI Fix 0a6320f41f chore(docs): 提交项目级 AGENTS.md 与既有验收记录 (cashflow-structure 部署前置) 2026-09-03 01:22:46 +08:00
Hermes CI Fix df93b635b3 docs: API验证分工表+北极星四层地图（项目Bot产出） 2026-08-31 07:44:27 +08:00
Hermes CI Fix db0f7aa591 chore: token优化检查清单文档 2026-08-30 19:16:33 +08:00
Hermes CI Fix 2da4cfc42d feat(mapcanvas): 田字格2x2布局+拖拽辅助(合法高亮/灰显/吸附)+连接管理面板+zoom transform缩放+连线rAF节流 2026-08-30 17:41:07 +08:00
Hermes CI Fix ad68471b29 feat: 路线图R1决策建议一键落地+R2机会推送+R5预算闭环 
R1(P0): AI建议一键应用到KPI/预算/行动方案
- 新表 ai_suggestions + AISuggestion 模型(init_db自动建)
- /api/cma/ai/suggestions CRUD + /{id}/apply(复用kpis/budget/action_plans) + dismiss
- 应用写 OperationLog(action=ai_suggestion_apply, detail含suggestion_id/before/after)
- 规则驱动建议生成 generate_rule_suggestions(低执行率/高执行率/预算超支/pending预警)
- 幂等: 同entity+type+target_id+title+unapplied不重复建; applied后拒绝重复应用
- 前端: Dashboard AI面板建议卡(应用到/忽略) + 建议中心页 /ai-suggestions

R2(P1): 数据找人扩大-机会类推送
- scripts/opportunity_detector.py: KPI向好(执行率>110%)/预算余量(<70%且actual>0)/预测上行
- scripts/daily_push.py: 异常+机会 每日9:15推企微(8800/send, --dry-run调试)
- crontab: 15 9 * * * (alert_generator 9:00之后)

R5(P0): 预算闭环加固
- auto-decompose批量幂等: 只取年度行(period=YYYY-00)+同KPI多版本取一行
- scripts/closed_loop_check.py: 预算执行率异常→检查现金流/行动同步→缺失提示+报告
- scripts/verify_decompose_idempotent.py: 幂等验证脚本

测试: test_ai_suggestions(10例)+test_roadmap_r2r5(14例); 修test_budget幂等契约适配年度行
全量: 673 passed
 2026-08-30 12:05:36 +08:00
Hermes CI Fix 497f378957 feat: 落地UI动效——表单错误抖动/数字滚动/卡片悬浮 
- 新增styles/transitions.css: 错误shake/按钮状态/弹窗过渡/骨架屏淡入(带prefers-reduced-motion)
- 新增CountUp.vue: KPI数字滚动组件(easeOutCubic+千分位+闪烁提示)
- Dashboard: CEO/IT视图摘要卡片接入CountUp
- main.ts引入全局动效
 2026-08-29 15:38:02 +08:00
Hermes CI Fix 3bc68fa1c6 feat: 网银流水导入模板+现金流联动（财务数据通道P1） 2026-08-28 09:59:07 +08:00
Hermes CI Fix 1a6ea8afae chore: CI流程加固+Schema检查门禁 
- deploy.sh: 提交纪律检查(本地未提交修改→中止) + 冒烟测试(健康/登录/KPI/BOT/Schema)
- .woodpecker: 加前端typecheck+后端pytest测试步骤, backend-deploy加提交纪律检查
- 新增schema_check.py: ORM与数据库表结构一致性检查
- 修复budget_plans表缺3列(source_kpi_id/source_type/calc_logic)
- 附带入库: budget测试+文档
 2026-08-28 07:18:54 +08:00
Hermes CI Fix 6b479bfe7d feat(KR): 行动挂KR完成 — action_plans.kr_id字段+API+前端目标/KR选择+KR中文名自动填+地图krs端点 
- action_plans表加kr_id字段(关联krs.id)，create/update/list支持kr_id读写
- 创建行动选KR时自动继承objective_id；列表附kr_title
- 前端行动方案库加'所属目标/KR'两级联动选择，选中KR自动带出KPI
- OKR详情页KR卡片下显示达成行动列表(O→KR→行动三层)
- MapCanvasDialogs onKpiChange选中KPI自动填kr.name=kpi.kpi_name(中文)
- 编辑回填英文code KR名转中文显示兜底
- maps.py 新增GET /{map_id}/krs端点(MapReview战略回顾会KR进度)
- 数据修复: krs表9条英文code title→中文名(按kpi_definitions映射)
- 数据迁移: 高置信行动挂KR(费用率→kr10,应收→kr14); 地图32空KR清理
- okr list的kr_summary补metric_kpi_id(前端联动用)
- 新增6个kr_id测试(test_action_plans)，全量547通过
 2026-08-27 12:50:30 +08:00
Hermes CI Fix 6af4366a84 chore: 清理worktree验证测试文件 2026-08-26 06:53:25 +08:00
Hermes CI Fix 0daa079b96 fix: 预算数据修正 — 删除v1.0错误分解记录, 修正v2.0 F_REVENUE为真实H2预测(75-120万/月,原367万错误) 
- 删除v1.0 49条(今天'执行分解'基于错误v2.0聚合产生的重复数据)
- 修正v2.0 F_REVENUE: 367万/月→90/75/80/85/95/120万(真实H2预测455万+7月90万)
- 解决预算录入'部分指标重复'问题(同KPI+期间双版本记录)
 2026-08-25 18:19:48 +08:00
Hermes CI Fix 412a302699 feat: OKR模板库P2治理 — owner字段/防重复/校准文档/缺口清单 
- 模型+DB: okr_templates.owner (CMA标准库/行业包/用户自定义)
- API: create同名去重(409) + list/get返回owner + apply透传metric_kpi
- 前端: 模板卡片展示owner标签
- 文档: kpi-dictionary-gap-list.md(33条缺口+建议补KPI) + okr-template-calibration.md(酣客/博海校准表)
- 回归: 模板API验证通过
 2026-08-21 16:49:11 +08:00
Hermes CI Fix 9ccdd0db63 docs: KPI设计规范补充OKR KR权重适配说明(主KR可至40%) 
配合OKR模板库DAMA修复: 权重合规化(34/33/33→35/35/30, 40/30/30保持)
 2026-08-21 16:37:14 +08:00
Hermes CI Fix a9845eb2cf docs: KPI设计规范(五步法/五规则/三路径) — CMA方法论层第2份规范 
- 第2份方法论文档, 与科目≠KPI规范(第1份, 数据层)互引形成双层治理闭环
- 五步法: 职责→客户→需求→成果→五因素(时/量/质/成/险)
- 五规则: ≤6个/权重5%-30%取5%倍数/定量定性/SMART/部门差异化
- 三路径: 自上而下战略分解/自下而上职责提取/BSC四维平衡
- 四层链: 战略地图→O→KPI→科目(呼应本体三支柱)
 2026-08-20 15:39:09 +08:00
Hermes CI Fix a13a080381 test: CMA自动化测试补覆盖 226→452用例, 覆盖率36%→60% 
- 新增8个测试文件(bot_bridge/kpi_causality/cash/predict/reports/tax_compliance/expenses/probe_cost)
- 增强 budget/auth/users + conftest账套模式适配
- 测试驱动修复: bot_bridge导入batch_id→source_batch; cash_forecast extra空dict
- 全量: 451 passed, 1 xfailed; 报告 docs/cma-test-coverage-report.md
 2026-08-20 06:57:24 +08:00
Hermes CI Fix dd53212bcc feat: KPI多粒度目标值补提交 — dashboard API + 前端3视图(目标值月/季/年) 
已上线未提交的历史功能(2026-08-17): kpi_target_by_frequency + target_monthly/quarterly/yearly 字段透传
 2026-08-20 06:57:13 +08:00
Hermes CI Fix bd9c70ea05 本体三支柱: 科目↔KPI↔OKR三层互联 + 追溯链API + OKR详情页签 
- 新表 kpi_subject_map(89映射/24KPI) / objective_kpi(3O×5KPI) / krs(3O×3KR)
- GET /api/cma/ontology/trace?objective_id=N O→KPI→科目逐层追溯
- GET /api/cma/ontology/objectives 三层链路概览
- OkrDetail.vue 新增本体追溯链页签(KR目标/当前值 + KPI→科目标签流)
- 含并发已上线未提交的KPI多粒度列(target_monthly/quarterly/yearly)
- 回归: pytest 409 passed
 2026-08-19 22:58:10 +08:00
Hermes CI Fix d56ba24f31 feat: deps越权防护(query/header与token不一致403) + resolve_entity_for_request + 任务⑥开发规范沉淀 2026-08-11 11:30:08 +08:00
Hermes CI Fix f9e20bc9bc fix: KPI历史数据治理批量修复 — 元数据补全321条+编码规范处理222条 
- 规则2: 补全321条元数据 (formula 207 / data_source 57 / data_owner 57)
  - EXT_科目KPI: formula按财务维度默认'财务指标计算'
  - F_/C_/P_/L_经典KPI: 精确公式(6条) + 数据源按维度(财务系统/业务系统)
  - data_owner优先取负责部门, 否则默认财务部
- 规则3: 审计规则白名单化EXT_前缀(科目余额表导入, 仅限finance维度),
  EXT_编码与dimension保持一致不改动; FB_/BH_ 21条真实前缀冲突
  输出人工确认清单 docs/kpi_governance_human_review.md
- 验证: GET /api/cma/kpi/governance/audit → rule_counts {1:0, 2:0, 3:21, 4:0}
  未改动任何kpi_code及引用表, 评分/地图/KPI列表接口正常
 2026-08-10 23:50:14 +08:00
Hermes CI Fix f730aeb3a1 [docs] add CI方案对比评估报告（推荐Git Hooks方案） 2026-07-12 17:31:09 +08:00
Hermes CI Fix f79db8ccba docs: 项目规范文档+需求文档+CHANGELOG 2026-05-28 17:33:38 +08:00