From a7d78655d397b6ddcd169ac3f06b19b7939ba426 Mon Sep 17 00:00:00 2001 From: yumoqing Date: Mon, 31 Aug 2026 16:40:05 +0800 Subject: [PATCH] =?UTF-8?q?fix(rbac):=20=E5=88=A0/**=20any=E5=85=A8?= =?UTF-8?q?=E5=B1=80=E9=80=9A=E9=85=8D+=E4=BA=A7=E7=BA=BFshell=E6=94=B9log?= =?UTF-8?q?ined=E2=80=94=E2=80=94any=E4=B8=8D=E5=BA=94=E8=A6=86=E7=9B=96?= =?UTF-8?q?=E4=BA=94=E6=9D=A1=E4=BA=A7=E7=BA=BF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- scripts/load_path.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/scripts/load_path.py b/scripts/load_path.py index 9da528f..f0ce8cf 100644 --- a/scripts/load_path.py +++ b/scripts/load_path.py @@ -51,16 +51,17 @@ PERMS = [ # showcase ("/showcase", "showcase", "logined"), ("/showcase/*", "showcase", "logined"), - # app root (any) - ("/**", "app", "any"), + # app root (any)：仅登录页资产/全局静态资源。 + # 注意：禁止 /** any——会让匿名访问全部路径（含五条产线）。 + # 产线 shell（sdlc/core/ops/dist index.ui）须 logined，产线对匿名不可见。 ("/index.ui", "app", "any"), ("/todo_badge.js", "app", "any"), ("/index_tab.js", "app", "any"), ("/theme_toggle.js", "app", "any"), - ("/pipeline-sdlc/index.ui", "pipeline_sdlc", "any"), - ("/pipeline_core/index.ui", "pipeline_core", "any"), - ("/pipeline_ops/index.ui", "pipeline_ops", "any"), - ("/pipeline_dist/index.ui", "pipeline_dist", "any"), + ("/pipeline-sdlc/index.ui", "pipeline_sdlc", "logined"), + ("/pipeline_core/index.ui", "pipeline_core", "logined"), + ("/pipeline_ops/index.ui", "pipeline_ops", "logined"), + ("/pipeline_dist/index.ui", "pipeline_dist", "logined"), ]