yumoqing/rbac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
294 Commits 2 Branches 0 Tags
Commit Graph

171 Commits

Author SHA1 Message Date
yumoqing
a3b22b679f fix(reset_password): guard admin against resetting own password (use self-service) 2026-09-09 19:06:55 +08:00
yumoqing
c572d4c254 fix(users): replace script handlers with declarative urlwidget binds 
- reset_password: urlwidget + PopupWindow Form (same pattern as userrole),
  hidden userid field from params_kw, password fields with required validation
- clear_login_fail: urlwidget + conform dialog, params_mapping id only
- fixes runtime crash: script bind called bricks.getWidgetById('users_tbl')
  without from_widget context -> TypeError on dom_element
- register /rbac/admin_reset_password.ui in PATHS_ADMIN (admin role only)
- i18n entries for 4 languages
 2026-09-09 18:38:36 +08:00
yumoqing
5712f4091e feat(users): admin reset password + clear login fail count for other users 
- json/users.json: add 2 toolbar tools (selected_row) + script binds,
  same pattern as enable_user/disable_user; reset_password collects new
  password via prompt and POSTs JSON body to admin_reset_password.dspy
- api/admin_reset_password.dspy: orgid ownership check, min length 8,
  cfm match, password_encode (RC4), also resets login_fail counters,
  audit_log(password_reset), new password never logged
- api/clear_login_fail.dspy: ownership check, SET login_fail_count=0
  last_login_fail=NULL, audit_log(login_fail_clear)
- scripts/load_path.py: new PATHS_ADMIN section registered as *.admin
  (NOT logined - sensitive endpoints must not be open to any logged user)
 2026-09-09 16:49:55 +08:00
yumoqing
855057e1d0 fix(login): 登录页文档内登录成功做真实浏览器跳转——dismissed旧bind urlwidget target=window实为in-place渲染进bricks.app(login.ui文档baseURI=/rbac/user/致后续根绝对请求全错→登录窗反复打开,用户报障);桌面shell文档保持原in-place语义(2026-09-08) 2026-09-08 15:35:46 +08:00
ymq
c13770c416 fix(register): sale_id/promo_code_id 传None→空字符串，sale_id列NOT NULL 
对齐 init_free_customers.dspy 写法。修复 (1048, Column 'sale_id' cannot be null)。
 2026-08-27 12:41:54 +08:00
ymq
9b695301ca fix(register): free customer bind 池名硬编码'discount'→get_module_dbname('discount') 
pipeline-app 共库单池，硬编码'discount'导致 dbdesc=None → 'NoneType' object has no attribute 'get'。
租户域名逻辑本身无误：域名未注册→parentid=None→reseller_id='0'平台自营兜底。
改用 get_module_dbname 后 sage(discount独立库)/pipeline-app(共库)双宿主均正确。
 2026-08-27 12:40:47 +08:00
yumoqing
f5b9d697b3 security: 移除 /rbac/add_superuser.dspy 未授权超管创建后门 
该端点被授权给 any 角色且文件内零鉴权：任何未登录者裸调 URL 即可创建
superuser/111111（角色 owner.superuser+admin）→ 登录后完全接管平台
→ 经 agent run_shell/终端可达 RCE。等同奇安信 QVD-2026-57410(DSH 9.8) 危害。

超管初始化改为部署期本地 CLI（宿主应用 scripts/create_superuser.py），
不再经 HTTP 暴露。load_path.py 同步移除该路径注册。
 2026-08-25 14:46:50 +08:00
yumoqing
2a020e17e9 fix(rbac): find_unauth_files 用 ref_real_path 替代 __file__ + seed user_status 字典(init/data.json) 2026-08-21 17:09:51 +08:00
yumoqing
a72d7ef112 feat(rbac): 登录检查refer，非用户点击登录成功后不刷新页面 
- login.ui 密码/手机登录透传 login_source
- up_login 条件化 /index.ui 跳转(仅主动登录刷新)
- code_login 三处登录分支收敛 _login_msg，auto 时不 dispatch
 2026-08-20 14:41:18 +08:00
yumoqing
fe2a3a6ab1 fix(rbac): 固化非促销码注册创建自由客户归属记录(bind_type=3) 2026-08-17 15:51:32 +08:00
yumoqing
2966993088 fix(rbac): 账户锁定场景补 login_fail 审计（result=locked） 
up_login.dspy 锁定分支(fail_count>=3 且 5分钟内)之前直接 return，未写审计。
补 _audit_login(..., 'login_fail', 'locked')，补全失败登录审计三路径：
用户不存在/密码错误/账户锁定。
 2026-08-16 18:28:12 +08:00
yumoqing
15e27968da fix(rbac): user/up_login.dspy 登录审计 + 失败5分钟窗口计数 2026-08-16 17:47:49 +08:00
yumoqing
f398f70142 chore: 从仓库中删除 CRUD 自动生成目录，添加 .gitignore 2026-07-17 14:35:07 +08:00
yumoqing
a4f1ff6a88 fix(rbac): userrole CRUD roleid display — align valueField/textField with data columns 2026-07-16 18:06:20 +08:00
yumoqing
cc245f4721 fix: get_search_roleid return all roles so code uitype resolves display text correctly 2026-07-16 17:34:20 +08:00
yumoqing
be26c6db98 feat: allow same phone number to register multiple users 2026-07-16 16:21:36 +08:00
yumoqing
ed837dcd4e fix(rbac): gen_sms_code.dspy — remove TEST MODE, call sms_engine directly 2026-07-16 15:50:04 +08:00
yumoqing
6c9d127759 fix(rbac): gen_sms_code.dspy falls back to test mode when sms_engine unavailable 2026-07-16 15:43:06 +08:00
yumoqing
bffd8b200d fix(rbac): gen_sms_code.dspy calls real sms_engine.generate_sms_code() instead of TEST MODE stub 2026-07-16 15:40:51 +08:00
yumoqing
e1abe0bb71 fix: role dropdown filter by user org_type, add get_search_roleid.dspy 2026-07-13 11:27:21 +08:00
yumoqing
18913e7064 feat: domain-based reseller binding on registration + test SMS bypass 2026-07-10 11:24:25 +08:00
yumoqing
35750d5938 fix: 改用event.params.text直接取值，不用${text}占位符 2026-07-06 14:04:32 +08:00
yumoqing
a526a2222d fix: newwindow缺referer_widget，改用script+window.open() 2026-07-06 14:03:58 +08:00
yumoqing
4a649aa98f fix: urlwidget+PopupWindow无法替换${text}，改用newwindow+window.open() 2026-07-06 14:00:41 +08:00
yumoqing
190e4e435f fix: $ → ，多余$导致变量未被替换 2026-07-06 13:57:57 +08:00
yumoqing
acdabe4c33 扫码结果改为弹新窗口(PopupWindow)展示，不再替换当前页面 
root.page_center → PopupWindow，扫码后弹出 85% 新窗口打开链接内容
 2026-07-06 13:47:39 +08:00
yumoqing
2c986dca13 fix: CRUD endpoint return format - remove json.dumps, use widgettype format 2026-07-03 14:50:52 +08:00
yumoqing
1e2897d8d4 fix: enable/disable 后自动刷新表格 + 捕获真实错误 
1. record_toolbar 添加 name 字段 (enable_user/disable_user)
2. 新增 binds: script bind 用 fetch 调用 dspy，成功后 render() 刷新
3. api/add_user.dspy + api/update_user.dspy 用 try/except 捕获真实异常
 2026-06-29 15:50:18 +08:00
yumoqing
ad601403cf feat: users CRUD 定制 api — 新增/编辑客制化逻辑 
不修改生成文件，改为 json/users.json 指定 custom URLs:
- new_data_url → /rbac/api/add_user.dspy
- update_data_url → /rbac/api/update_user.dspy

客制化修复:
1. 新增用户: created_at 默认当天日期
2. 新增/编辑: 清除 Tabular 发送的 _text 后缀字段
3. 编辑: 密码为空时不覆盖原密码
 2026-06-29 15:12:33 +08:00
yumoqing
9472c0995f Revert "fix: users CRUD — 三个修复" 
This reverts commit 449a0415a5ffe4237fb118e17bcc38b1bba51876.
 2026-06-29 15:10:17 +08:00
yumoqing
449a0415a5 fix: users CRUD — 三个修复 
1. add_users.dspy: 新增用户时 created_at 默认设为当天日期
2. add/update: 清除 Tabular 发送的 _text 后缀字段
   (user_status_text, orgid_text 等不是真实列，会导致 sor.U/C 失败)
3. update_users.dspy: 密码为空时从 ns 中移除，避免覆盖为空白
 2026-06-29 14:46:58 +08:00
Hermes Agent
70a19238c1 feat: 注册时检查促销码并绑定客户归属关系 
- register.dspy: 用户名密码注册后检查promo_code_id
- sms_register.dspy: 短信注册后检查promo_code_id
- code_login.dspy: 验证码登录/自动注册后检查promo_code_id
- phone_login.dspy: 手机登录/自动注册后检查promo_code_id
- 绑定失败只记日志不影响注册成功(try/except)
 2026-06-24 00:56:33 +08:00
Hermes Agent
2ea45cd380 rbac: 完善信息弹窗修复双窗口+添加标题 2026-06-18 11:09:46 +08:00
Hermes Agent
947638853f rbac: 完善信息Form使用value回填用户数据 2026-06-18 10:48:17 +08:00
yumoqing
52cd71f861 feat: add user_status check on login, enable/disable toolbar, fix editexclouded for add user 2026-06-11 16:57:04 +08:00
yumoqing
cb9f8bbb4b bugfix 2026-06-10 11:16:23 +08:00
yumoqing
12663a37e0 bugfix 2026-06-10 11:08:33 +08:00
yumoqing
f6027788b2 fix: login redirect to index.ui instead of userinfo.ui 
After login success, redirect to the main page (/index.ui)
instead of just loading userinfo.ui into user_container.
This fixes the white screen after login.
 2026-06-09 23:18:39 +08:00
yumoqing
df212ea40d bugfix 2026-06-09 16:52:12 +08:00
yumoqing
c949a51f2e fix: gen_sms_code.dspy handle both None return and exception from generate_sms_code 2026-05-31 12:26:55 +08:00
yumoqing
4038b7d0b9 fix: gen_sms_code.dspy catch exception and return actual error message 2026-05-31 11:56:46 +08:00
yumoqing
7f2c3d25dd feat: 用户菜单添加完善信息功能 - 新增 edit_profile.dspy/save_profile.dspy - usermenu.ui 添加完善信息入口 - load_path.py 注册权限路径 2026-05-31 10:52:13 +08:00
yumoqing
26d1fd1447 feat: register_user 添加 customer.admin 角色，注册时同时分配 customer 和 admin 权限 2026-05-31 10:38:32 +08:00
yumoqing
c9dd80a484 fix: 暗色主题输入框颜色全局优化 
- bricks.css: inputbox背景 #1E293B → #0F172A
- login.css: 同步更新保持一致
 2026-05-30 14:32:11 +08:00
yumoqing
b0d6b59613 fix: 注册表单仅输入区域滚动，暗色主题输入框颜色优化 
- 注册Tab结构: Text(固定) + VScrollPanel(仅Form) + Button(固定)
- 暗色主题输入框背景 #0f172a -> #1e293b，更协调
 2026-05-30 14:27:33 +08:00
yumoqing
d1b3ca0914 fix: 修复登录弹窗三个显示问题 
- 注册表单超出无滚动: 三个Tab内容均包裹VScrollPanel(scrollpanel)
- Form toolbar不可见: 滚动容器让submit/reset按钮可达
- 文本未国际化: title/label/otext均加i18n:true, archor纠正
- CSS: tabpanel flex布局, tabpanel-content flex:1+min-height:0
- PopupWindow cheight 28->30 给更多显示空间
 2026-05-30 14:16:00 +08:00
yumoqing
36569c0e41 feat: 现代化登录/注册界面改造 
- login.css: 全新现代化样式，支持亮/暗主题
- login.ui: 三Tab布局(密码登录/手机登录/注册)，手机登录支持短信验证码
- sms_register.dspy: 短信验证注册后端，验证通过后自动注册并登录
- load_path.py: 添加 sms_register.dspy 到 any 权限
- 修复手机登录 setValue 调用 (上一轮已提交)
- 注册流程: 手机号+短信验证码+用户名+密码，短信验证通过后才允许注册
 2026-05-30 14:08:11 +08:00
yumoqing
019e9702fc fix: use setValue() on codeid field widget instead of direct value assignment 2026-05-30 13:36:54 +08:00
yumoqing
cec79caf88 fix: phone login form.setValue is not a function - use name_inputs direct value set 2026-05-30 13:35:07 +08:00
yumoqing
fa9f7f5146 fix: wrap Tabular in VBox with cheight for proper scrolling 2026-05-29 22:09:56 +08:00