|
|
9bfd3fc556
|
fix(权限): 代客充值授权补owner财务角色——账务管理菜单代客充值入口在is_fin块(含owner财务)但PATHS_PROXY历史仅授reseller,致owner财务看得到菜单却403(实测);权限与菜单门控对齐
|
2026-09-08 14:05:22 +08:00 |
|
|
|
20dfdca82a
|
feat(账务): reseller财务角色三能力(2026-09-08用户定夺)——①修RECHARGE_REVESE拼写bug(白名单漏R致冲正/支付宝退款长期被拒,兼容旧拼写归一)②代客充值加归属校验(reseller只能操作本组织名下客户:organization.parentid或discount_customer_bind,lookup不泄露别家存在性)③新增充值错帐处理三件套(列表按归属过滤+冲正走RECHARGE_REVERSE引擎翻转借贷+orderid=REV:原billid防重复+审计留痕;授FIN_ROLES不含reseller.sale)
|
2026-09-08 13:51:16 +08:00 |
|
|
|
411d1017cf
|
fix(load_path): review修复——单事件循环直连注册(去掉600+次subprocess)，get_accdetail恢复page/sort
|
2026-08-27 18:17:45 +08:00 |
|
|
|
89592b9585
|
security: 财务后台权限收敛到财务角色，堵住全平台余额/账务泄漏
- scripts/load_path.py: 按角色分层重写权限矩阵（any/logined/财务角色/分销商角色），
默认先清理 /accounting/ 全部旧授权再重建；财务后台(余额台账/账户/科目/分录/日志/
信用管理/币种汇率)从 logined 收敛到 owner.superuser/admin/account +
reseller.admin/accountant/operator；客户自服务页(已按本机构过滤)保留 logined
- accounting/init.py get_accdetail: 补 account.orgid=当前机构 过滤，堵按 accountid 越权查明细
- wwwroot/get_user_balance.dspy: 改为只查登录用户本人余额(原可按任意 username 查他人余额，
且存在 swait 拼写错误导致 500)
|
2026-08-27 18:13:15 +08:00 |
|
|
|
a65422d06b
|
fix: move fetch_forex_rates to PATHS_ANY for cron access
|
2026-07-14 10:44:58 +08:00 |
|
|
|
5f752a6287
|
feat: BOC forex rate fetcher — /api/fetch_forex_rates.dspy
|
2026-07-09 11:46:35 +08:00 |
|
|
|
898c215f9d
|
chore: update migration SQL for all 5 DBs + RBAC for currency/exchange_rate CRUD
|
2026-07-07 17:44:47 +08:00 |
|
Hermes Agent
|
56ae61a992
|
fix: 授信表单改为客户名称查找模式 + 代客充值RBAC路径注册
1. 授信表单: accountid改为customer_name文本输入，后端先精确后模糊查找客户
2. 代客充值: load_path.py添加proxy_recharge.ui和proxy_recharge_submit.dspy路径
|
2026-06-22 17:26:03 +08:00 |
|
|
|
c637d76a25
|
fix: replace wildcard patterns with explicit per-file entries in load_path.py
|
2026-06-04 13:03:27 +08:00 |
|
|
|
8f36013ad6
|
refactor: use wildcard % in load_path.py for auto-coverage
|
2026-05-29 00:52:18 +08:00 |
|
|
|
5da6ddd7d5
|
feat: expose credit limit functions via ServerEnv and register RBAC paths
|
2026-05-28 22:39:48 +08:00 |
|
|
|
cb52542567
|
feat: add load_path.py RBAC permission registration script
|
2026-05-27 13:16:01 +08:00 |
|
