cma-management

512 Commits 6 Branches 0 Tags

3 Commits

Author	SHA1	Message	Date
wecom-fullstack	c030fb7d18	fix(strategy-map): 口径违禁串代码级清零（9,492.6/83.9%/19/19/el-dialog 仅存于注释）+ components.d.ts 补 MapDimensionFilter	2026-10-20 11:33:58 +08:00
wecom-fullstack	a48a116e06	fix(dupont): insight.detail 叙述段字面 None 收口（表现层 _fmt_val，仅文案） ci/woodpecker/push/main Pipeline failed Details - 恒等式叙述段 5 处裸 f-string 插值（三因子 value / ROE / identity.diff）改走 _fmt_val： None → 「-」（与同段四列 _fmt 同族），有值原样输出（不经 :.2f，保证有值路径逐字节不变） - 结构化字段 roe / factors[*].value / identity.diff 仍为 null；check_identity 语义、dupont_basis.py 未改 - 基线 origin/main acf179a；本单零生产写（不推远端/不同步部署树/不重启/不连库）	2026-10-06 23:36:06 +08:00
fullstack-bot	b815b7f623	fix(security): close unauthenticated CMA user API surface + audit tool (cma-api-auth-surface-audit-20260914) Root cause: main.py include_router had no global auth dependency; user routers (products/cost/predict/...) relied on assert_entity_scope, which treats a missing session token as the Bot service channel and lets the request through. Result: 46 user endpoints returned data without any token on a public site. Changes: - auth_middleware.py: add require_auth_401 (missing Bearer -> 401, delegates to require_auth otherwise); 401/403 semantics are explicit. - router-level Depends(require_auth_401) on products, cost, predict, notifications, permissions, tenant, alignment; endpoint-level on /auth/roles and /admin/cache/clear. - deps.py: document that get_entity_id/assert_entity_scope are NOT auth. - frontend: add the missing Bearer header to 5 tokenless fetch/axios calls that hit the newly protected endpoints (KPIAlignment x2, RolePermissions x2, Dashboard x1). - tests: new test_api_auth_surface_20260914.py (58 cases: no-token 401, token 200, cross-entity 403, bot channel unchanged); adapt test_predict / test_kpi_forecast to send session tokens like production. - scripts/audit_api_auth_surface.py: reusable FastAPI dependency-graph audit (423 endpoints; A bot / B gap / C public), exits 1 when a B-class gap exists.	2026-09-14 16:41:15 +08:00

Author

SHA1

Message

Date

wecom-fullstack

c030fb7d18

fix(strategy-map): 口径违禁串代码级清零（9,492.6/83.9%/19/19/el-dialog 仅存于注释）+ components.d.ts 补 MapDimensionFilter

2026-10-20 11:33:58 +08:00

wecom-fullstack

a48a116e06

fix(dupont): insight.detail 叙述段字面 None 收口（表现层 _fmt_val，仅文案）

ci/woodpecker/push/main Pipeline failed

Details

- 恒等式叙述段 5 处裸 f-string 插值（三因子 value / ROE / identity.diff）改走 _fmt_val：
  None → 「-」（与同段四列 _fmt 同族），有值原样输出（不经 :.2f，保证有值路径逐字节不变）
- 结构化字段 roe / factors[*].value / identity.diff 仍为 null；check_identity 语义、dupont_basis.py 未改
- 基线 origin/main acf179a；本单零生产写（不推远端/不同步部署树/不重启/不连库）

2026-10-06 23:36:06 +08:00

fullstack-bot

b815b7f623

fix(security): close unauthenticated CMA user API surface + audit tool (cma-api-auth-surface-audit-20260914)

Root cause: main.py include_router had no global auth dependency; user routers
(products/cost/predict/...) relied on assert_entity_scope, which treats a
missing session token as the Bot service channel and lets the request through.
Result: 46 user endpoints returned data without any token on a public site.

Changes:
- auth_middleware.py: add require_auth_401 (missing Bearer -> 401, delegates to
  require_auth otherwise); 401/403 semantics are explicit.
- router-level Depends(require_auth_401) on products, cost, predict,
  notifications, permissions, tenant, alignment; endpoint-level on
  /auth/roles and /admin/cache/clear.
- deps.py: document that get_entity_id/assert_entity_scope are NOT auth.
- frontend: add the missing Bearer header to 5 tokenless fetch/axios calls that
  hit the newly protected endpoints (KPIAlignment x2, RolePermissions x2,
  Dashboard x1).
- tests: new test_api_auth_surface_20260914.py (58 cases: no-token 401,
  token 200, cross-entity 403, bot channel unchanged); adapt test_predict /
  test_kpi_forecast to send session tokens like production.
- scripts/audit_api_auth_surface.py: reusable FastAPI dependency-graph audit
  (423 endpoints; A bot / B gap / C public), exits 1 when a B-class gap exists.

2026-09-14 16:41:15 +08:00