sxbh_admin/cma-management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
430 Commits 6 Branches 0 Tags
bd4f58aae10bac43b195cd529e8a3d991fc366f0
Commit Graph
9 Commits
Author SHA1 Message Date
Hermes CI Fix d785a22efd fix(alerts): scope check-timeout batch upgrade by KPIAlert.entity_id 
GET /api/cma/alerts/check-timeout picked candidates via the join on KPIDefinition.entity_id, so a session could batch-upgrade (red + processing) alert rows whose own entity_id belongs to another account. Switch the filter to the alert row's own entity_id, drop the now-unneeded join and the unused KPIDefinition import. Write path only; no data change, candidate ids on consistent rows are identical before/after.

Derived from dama-20260919-cma-alert-filter-and-cash-baseline-fix (C1/C2 residual in the write endpoint).
 2026-09-19 08:35:25 +08:00
Hermes CI Fix 4225332aaf fix(cma): scope alert list and alert locate to alert row entity_id; attach cash-balance suffix candidates to forecast baseline 
- alerts list: filter KPIAlert.entity_id (was KPIDefinition.entity_id via join) -> entity2 225->223, rows 589/590 no longer leak into entity2 workspace

- resolve/process/escalate/create-action-plan: same row-level scope (4 sites)

- get_current_cash_balance: pass KPI_CODE_SUFFIXES[cash_balance] -> entity2 hits BH_CASH_BALANCE(434), entity6 hits DEMO_CASH_BALANCE(468)

no data changes; no SystemConfig fallback change; no period ordering change
 2026-09-19 08:06:17 +08:00
Hermes CI Fix d03e322a81 fix(cma): action plan entity_id at the three residual construction sites 
alert-to-plan, deviation-push review topic and AI-suggestion-to-plan built ActionPlan(...) without entity_id, so non-e1 sessions wrote rows with the model default 1 and entity_id stayed untrustworthy on those paths. Write the session entity at all three sites, scope the deviation-push topic dedupe by entity (a foreign same-title topic no longer suppresses the session entity's own topic), and require the applied suggestion to belong to the session entity. Adds 7 regression tests (both directions + cross-entity negative controls + auth floor).
 2026-09-18 20:12:46 +08:00
Hermes CI Fix ad953ac759 fix(cma): entity isolation batch2 (roll-forward/check-timeout/by-id/cost-abc)
ci/woodpecker/push/main Pipeline failed
Details 
Scope: backend/app/api/{alerts,action_plans,budget,cost}.py + tests

Task: 0-P1-project-20260918-entity-isolation-batch2
 2026-09-18 18:15:22 +08:00
Hermes CI Fix 115a0ec755 fix(security): 4端点补跨租户鉴权 — 实体1会话读实体2数据(200)→403 (cma-cross-entity-endpoints-auth-20260914) 
背景（项目Bot 补充复验 §四#2）：以下 4 个只读端点未做会话账套鉴权，
用 entity=1(酣客) 会话 token + 显式 entity 参数可读到 entity=2(博海) 数据（HTTP 200）：
  - GET /data-quality/governance-check?entity_id=2   → 200 score=88（对照 entity1=72）
  - GET /products/matrix?entity_id=2                 → 200
  - GET /alerts/risk-matrix?entity=bohai             → 200 博海风险矩阵
  - GET /action-plans/coso-checklist?entity=bohai    → 200 博海 COSO total_score=55
另：risk-matrix / coso-checklist 在非法实体值下静默回落酣客数据，UI 标签与数据不一致。

改动：
1. deps.py 新增统一防护入口 assert_entity_scope / assert_entity_slug_scope /
   get_session_entity / resolve_session_slug（文案对齐 get_entity_id：无权访问企业 entity_id=X（当前账套: Y））
2. governance-check / products/matrix：entity_id 须等于会话账套，否则 403；
   缺省按会话账套（governance-check 原缺省 0=全部 → 登录态下按账套收敛）
3. risk-matrix / coso-checklist：entity 须等于会话账套，否则 403；
   非法值 → 400 显式报错（不再静默回落酣客）
4. P3：POST /auth/switch-entity 加 DEPRECATED 注释（前端已无调用，保留不删）
5. 测试：tests/test_security_multitenant.py 新增 TestCrossEntityEndpointAuth 15 例
   （跨实体 403 / 同实体 200 / 缺省按账套 / 非法显式报错 / 参照端点行为不变）

验证：pytest tests/ -q → 951 passed（10 项失败为改动前既有基线，已 stash 对照确认）；
      真实后端冒烟 19/19 PASS（entity=1 会话 4 端点跨实体全 403）。
 2026-09-14 11:19:05 +08:00
Hermes CI Fix 50c15ddbf6 fix: 多租户数据隔离P1a+P1b — 工作台/预警/行动计划/因果链按企业过滤 
P1a(有entity表查询补齐):
- kpis get/update/delete/restore 跨企业404校验
- kpis create 强制entity=token企业, update禁止改归属
P1b(无entity表join隔离):
- alerts list/resolve join kpi_definitions 按企业过滤
- action_plans list join过滤 + create校验关联KPI归属
- kpi_causality full-network/list join过滤
- dashboard my_dashboard(用户发现) assigned/preset均按企业隔离
测试: 测试KPI种子entity对齐(2→1), pytest 451 passed
实证: 酣客token 6KPI(无博海id) vs 博海token 1KPI(414) 切换隔离正确
 2026-08-23 17:43:39 +08:00
Hermes CI Fix 2bd66b1e89 fix: 行动方案库统计卡片—补全API+overdue计算 2026-07-27 17:16:01 +08:00
Hermes CI Fix 9eded3e4fe feat: CMA P1+P2 Round2 — 风险矩阵+COSO+预算方法 2026-07-16 17:09:32 +08:00
Hermes CI Fix 3dddd36866 init: 管理会计OS初始代码 
包含前后端完整代码：
- 前端：Vue3+Vite+ElementPlus
- 后端：FastAPI+SQLAlchemy
- 模块：驾驶舱/KPI/战略地图/预警/预算/成本/预测/改善行动
- 当前版本：v1.0.0
 2026-05-28 17:32:22 +08:00