Hermes CI Fix
b796897f8c
require_auth now uses HTTPBearer(auto_error=False) and raises 401 explicitly when the Authorization header is missing or non-Bearer, matching require_auth_401. Unauthenticated requests are 401 for every user endpoint; authenticated-but-forbidden (cross-entity / role) stays 403. - app/auth_middleware.py: single optional bearer, 401 on missing token (require_auth_401 kept as a compatibility alias) - tests: update 4 pre-existing cases that asserted 403 without a token (test_auth, test_reports, test_kpi_causality, test_expenses, test_api_auth_surface_20260914) - intentional behavior change - add tests/test_auth_401_unification_20260915.py: sample + full sweep (all AUTHED GET routes -> 401), invalid token -> 401, cross-entity and role-denied still 403, bot channel (X-BOT-KEY) and public paths unchanged
管理会计OS
P0/P1/P2全功能已提交，CI/CD自动构建中 CI/CD: Woodpecker自动构建部署 CI验证: Sun Jul 12 05:13:08 PM CST 2026 webhook测试: 17:13:27 CI验证完成 17:15:10 CI最终验证: 17:16:24 CI全链路验证通过 ✅ woodpecker重启验证 gitea重启后验证 CI最终验证 17:19 最终测试 17:20:06 hash验证 Git Hooks自动部署验证 17:32