985e044dd5
fix(代客充值): 页面样式改用bricks主题类(css:card),去掉硬编码暗色(#1E293B/#334155/#F1F5F9/#94A3B8)——跟随pipeline-app的data-theme暗/亮双主题,标题与说明文字颜色继承body
2026-09-08 15:21:23 +08:00
9bfd3fc556
fix(权限): 代客充值授权补owner财务角色——账务管理菜单代客充值入口在is_fin块(含owner财务)但PATHS_PROXY历史仅授reseller,致owner财务看得到菜单却403(实测);权限与菜单门控对齐
2026-09-08 14:05:22 +08:00
20dfdca82a
feat(账务): reseller财务角色三能力(2026-09-08用户定夺)——①修RECHARGE_REVESE拼写bug(白名单漏R致冲正/支付宝退款长期被拒,兼容旧拼写归一)②代客充值加归属校验(reseller只能操作本组织名下客户:organization.parentid或discount_customer_bind,lookup不泄露别家存在性)③新增充值错帐处理三件套(列表按归属过滤+冲正走RECHARGE_REVERSE引擎翻转借贷+orderid=REV:原billid防重复+审计留痕;授FIN_ROLES不含reseller.sale)
2026-09-08 13:51:16 +08:00
6c45f8e798
docs: 补全 README(复式记账引擎/15张表/load_accounting注入清单/记账三步同事务铁律)
2026-09-07 11:42:17 +08:00
411d1017cf
fix(load_path): review修复——单事件循环直连注册(去掉600+次subprocess)，get_accdetail恢复page/sort
2026-08-27 18:17:45 +08:00
89592b9585
security: 财务后台权限收敛到财务角色，堵住全平台余额/账务泄漏
...
- scripts/load_path.py: 按角色分层重写权限矩阵（any/logined/财务角色/分销商角色），
默认先清理 /accounting/ 全部旧授权再重建；财务后台(余额台账/账户/科目/分录/日志/
信用管理/币种汇率)从 logined 收敛到 owner.superuser/admin/account +
reseller.admin/accountant/operator；客户自服务页(已按本机构过滤)保留 logined
- accounting/init.py get_accdetail: 补 account.orgid=当前机构 过滤，堵按 accountid 越权查明细
- wwwroot/get_user_balance.dspy: 改为只查登录用户本人余额(原可按任意 username 查他人余额，
且存在 swait 拼写错误导致 500)
2026-08-27 18:13:15 +08:00
ymq
9b905836f9
fix(openaccount): 开户时初始化 balance=0
...
openAccount 建账户时未传 balance，account.balance 落 NULL，记账 leg_accounting 里
account.balance + balance_amount 报 TypeError NoneType+float。开户即记 0 余额。
2026-08-26 17:52:30 +08:00
ymq
a7c83fadc5
fix(models): 账务表补多币种字段(currency/exchange_rate/base_amount)
...
get_user_currency 查 account.currency 报 Unknown column——migration SQL 给 5 张账务表
加了多币种列但 models json 未同步。逐表对齐 multi_currency_migration.sql：
- account: +currency
- bill: +currency +base_amount
- bill_detail/ledger/acc_detail: +currency +exchange_rate +base_amount
2026-08-26 17:49:31 +08:00
ymq
edb280ad79
feat(models): 补 biz_order/biz_orderdetail 业务订单表
...
记账链路订单载体：product_accounting_generic 写 biz_order(订单)+biz_orderdetail(明细)，
consume_accounting 再基于 orderid 生成 bill 账单。此前这两张表只在 sage 库手工建，
pipeline-app 缺建表定义，导致计费落账时报 table(biz_order) not exist。
表结构对齐 sage.biz_order 实体表。
2026-08-26 17:41:30 +08:00
311753689a
security: fetch_forex_rates.dspy 加 localhost 校验(定时任务入口)
...
该端点授权给 any 且无任何鉴权，会发起外网抓取(BOC 页面)并写 exchange_rate 表，
匿名可反复触发 → 外部请求放大 + 脏数据写入 + DoS。改为仅本机可调(client_ip)。
build.sh 的 crontab 本就是 curl localhost:9090，不影响定时任务。
2026-08-25 15:01:21 +08:00
0a6b1dc2b2
feat(accounting): 账务配置初始化数据 + 规范化
...
- init/data.yaml → init/data.json（修复格式错误，补全字典 balance_side/subjecttype/currency_status）
- 从 tokentest 抽取账务配置：subject(8)/account_config(8)/accounting_config(8)/currency(4)/exchange_rate(3)
- currency_list/exchange_rate_list 去 alias（单表单逻辑）
- 删失效软链 wwwroot/index.ui
2026-08-21 18:57:11 +08:00
863df88fbe
feat: 代客充值接入审计日志(customer_recharge)
2026-08-17 13:55:33 +08:00
11475d31c3
feat(balance): invalidate llmage Redis balance cache after recharge
2026-08-04 18:36:10 +08:00
16fdf90513
fix: billing.ui 查询按钮 urlwidget 传参，修复点击无反应
2026-07-17 17:59:09 +08:00
c0b91ec050
Revert "fix: billing.ui 查询按钮改用 urlwidget 传参，修复点击无反应"
...
This reverts commit ebac31f5877a97166dd13f0bcfd11d009c2b612a.
2026-07-17 17:40:01 +08:00
ebac31f587
fix: billing.ui 查询按钮改用 urlwidget 传参，修复点击无反应
2026-07-17 17:37:33 +08:00
da4b0877c8
fix(accounting): remove date column, sort by timestamp, direction 借/贷
2026-07-17 16:05:05 +08:00
b8541d6730
fix(accounting): remove cheight from Tabular for auto row height
2026-07-17 15:50:43 +08:00
78345c758c
fix(accounting): use relative URL /accounting/billing_download.dspy to avoid Jinja2 escaping
2026-07-17 15:49:49 +08:00
277e0a7aec
fix(accounting): use single quotes in CSS selector to avoid JSON escaping issues
2026-07-17 15:48:44 +08:00
3cbde03d6e
fix(accounting): use DOM querySelector for date values instead of getWidgetById
2026-07-17 15:47:29 +08:00
696c1b9432
fix(accounting): revert acc_dir to raw 0/1 to avoid charset issues
2026-07-17 15:43:53 +08:00
07086034be
perf(accounting): remove summary from billing, fix acc_dir 0=借/1=贷, add DB index
2026-07-17 15:35:03 +08:00
8976ab6d90
fix(accounting): summary shows #shortid only, remove redundant subject prefix
2026-07-17 15:21:37 +08:00
515059db9f
fix(accounting): human-readable summary — subject_name #short_id instead of raw UUIDs
2026-07-17 15:20:37 +08:00
1152e02a27
perf(accounting): single query with window functions instead of two separate scans
2026-07-17 15:17:56 +08:00
6986ade835
fix(accounting): use Text widget instead of Button for download
2026-07-17 15:14:34 +08:00
03cb4049f4
fix(accounting): add padding/borderRadius to download button, remove HBox height constraint
2026-07-17 15:13:08 +08:00
e125f6ab8d
fix(accounting): use bricks-native bgcolor/color instead of css for download button
2026-07-17 15:12:10 +08:00
d4e32a2292
fix(accounting): wire up download button, fix LEFT JOIN in download DSPY
2026-07-17 15:11:16 +08:00
9a6723378b
fix(accounting): billing.dspy — keep page in ns for Tabular paging, extract DictObject correctly
2026-07-17 14:48:07 +08:00
4ef0808004
fix(accounting): billing.dspy — remove 'page' from ns to prevent sor.sqlExe auto-paging return DictObject
2026-07-17 14:44:27 +08:00
31c348878a
fix(accounting): billing.dspy — convert DictObject to list when sor.sqlExe returns non-list
2026-07-17 14:43:27 +08:00
0e750b6d31
debug(accounting): add type logging for billing rows
2026-07-17 14:41:22 +08:00
91609f3606
fix(accounting): billing query uses LEFT JOIN subject to avoid dropping rows with missing subject
2026-07-17 14:39:52 +08:00
950df9a4c2
bugfix
2026-07-16 18:36:12 +08:00
47844253fe
fix(billing): separate ns for stats query, avoid sqlor ns mutation
2026-07-16 17:32:05 +08:00
1ffdda5ffe
fix(billing): add acc_date to aggregate query for sqlor ORDER BY
...
sqlor wraps every sqlExe with row_number() over(order by acc_date desc).
Aggregate queries without acc_date in SELECT fail with:
Unknown column 'acc_date' in 'ORDER BY'
Fix: add min(acc_date) as acc_date to satisfy sqlor wrapper.
2026-07-16 17:30:52 +08:00
fba38804de
fix(billing): submit_text→submit_label, wid→self, fix indentation
...
- submit_label is the correct InlineForm option (not submit_text)
- Use wid:self instead of explicit widget id
- binds was incorrectly indented inside options
2026-07-16 16:59:51 +08:00
f7f9581cd9
fix(billing): InlineForm target can't find sibling Tabular
...
InlineForm and Tabular are siblings in the same VBox. Default
getWidgetById() searches downward from the source widget, missing
siblings. Use 'app.' prefix to resolve from root.
2026-07-16 16:28:25 +08:00
a65422d06b
fix: move fetch_forex_rates to PATHS_ANY for cron access
2026-07-14 10:44:58 +08:00
f9cb644e07
fix: currency/exchange_rate DDL 加 utf8mb4_unicode_ci 防止 collation mismatch
2026-07-10 11:40:03 +08:00
8f09fc43df
fix: remove updated_at from exchange_rate INSERT — column not yet added
2026-07-09 11:49:10 +08:00
5f752a6287
feat: BOC forex rate fetcher — /api/fetch_forex_rates.dspy
2026-07-09 11:46:35 +08:00
898c215f9d
chore: update migration SQL for all 5 DBs + RBAC for currency/exchange_rate CRUD
2026-07-07 17:44:47 +08:00
3f6c71b4d5
feat: multi-currency support — currency/exchange_rate tables + migration
2026-07-07 15:43:01 +08:00
b95a57fd34
fix: submit改用method:render,零JS代码
2026-07-01 11:56:49 +08:00
5b9619c850
fix: InlineForm submit绑定修正,wid+getWidgetById替代this
2026-06-30 17:52:22 +08:00
60e9e3c9b3
fix: Form→InlineForm, type→uitype:date, flex+cheight增大显示
2026-06-30 17:39:20 +08:00
a7d1aa170e
fix: billing.ui用{% set %}变量替代"转义,避免Jinja2报错
2026-06-30 17:24:20 +08:00
