cma-management

6 Commits

Author	SHA1	Message	Date
wecom-fullstack	790be2d6b1	fix(strategy-map): 三处缺陷——D1 完备度/摘要路由先注册(修 /completeness/objectives 422)、D2 连线增删显式 flag_modified(修 DELETE 200 不落库)、D3 拖拽命中改 rect 判定(修窄屏知识面板遮挡导致拖拽失效) ci/woodpecker/push/main Pipeline was successful Details	2026-10-20 20:35:28 +08:00
wecom-fullstack	86e24c6310	fix(strategy-map): 移除悬空 import kpi_target_reader（该模块全仓不存在，致 app.main 导入失败/部署自检中止）→ 目标值取 target_monthly or target_value ci/woodpecker/push/main Pipeline was successful Details	2026-10-20 13:01:02 +08:00
wecom-fullstack	ecbe55c48a	merge: origin/main 合入战略地图改造分支（解 MapCanvas 模板冲突：摘要条+编辑条+口径条并存） ci/woodpecker/push/main Pipeline was successful Details	2026-10-20 11:34:29 +08:00
wecom-fullstack	c030fb7d18	fix(strategy-map): 口径违禁串代码级清零（9,492.6/83.9%/19/19/el-dialog 仅存于注释）+ components.d.ts 补 MapDimensionFilter	2026-10-20 11:33:58 +08:00
wecom-fullstack	a48a116e06	fix(dupont): insight.detail 叙述段字面 None 收口（表现层 _fmt_val，仅文案） ci/woodpecker/push/main Pipeline failed Details - 恒等式叙述段 5 处裸 f-string 插值（三因子 value / ROE / identity.diff）改走 _fmt_val： None → 「-」（与同段四列 _fmt 同族），有值原样输出（不经 :.2f，保证有值路径逐字节不变） - 结构化字段 roe / factors[*].value / identity.diff 仍为 null；check_identity 语义、dupont_basis.py 未改 - 基线 origin/main acf179a；本单零生产写（不推远端/不同步部署树/不重启/不连库）	2026-10-06 23:36:06 +08:00
fullstack-bot	b815b7f623	fix(security): close unauthenticated CMA user API surface + audit tool (cma-api-auth-surface-audit-20260914) Root cause: main.py include_router had no global auth dependency; user routers (products/cost/predict/...) relied on assert_entity_scope, which treats a missing session token as the Bot service channel and lets the request through. Result: 46 user endpoints returned data without any token on a public site. Changes: - auth_middleware.py: add require_auth_401 (missing Bearer -> 401, delegates to require_auth otherwise); 401/403 semantics are explicit. - router-level Depends(require_auth_401) on products, cost, predict, notifications, permissions, tenant, alignment; endpoint-level on /auth/roles and /admin/cache/clear. - deps.py: document that get_entity_id/assert_entity_scope are NOT auth. - frontend: add the missing Bearer header to 5 tokenless fetch/axios calls that hit the newly protected endpoints (KPIAlignment x2, RolePermissions x2, Dashboard x1). - tests: new test_api_auth_surface_20260914.py (58 cases: no-token 401, token 200, cross-entity 403, bot channel unchanged); adapt test_predict / test_kpi_forecast to send session tokens like production. - scripts/audit_api_auth_surface.py: reusable FastAPI dependency-graph audit (423 endpoints; A bot / B gap / C public), exits 1 when a B-class gap exists.	2026-09-14 16:41:15 +08:00