18913e7064
feat: domain-based reseller binding on registration + test SMS bypass
2026-07-10 11:24:25 +08:00
35750d5938
fix: 改用event.params.text直接取值，不用${text}占位符
2026-07-06 14:04:32 +08:00
a526a2222d
fix: newwindow缺referer_widget，改用script+window.open()
2026-07-06 14:03:58 +08:00
4a649aa98f
fix: urlwidget+PopupWindow无法替换${text}，改用newwindow+window.open()
2026-07-06 14:00:41 +08:00
190e4e435f
fix: $ → ，多余$导致变量未被替换
2026-07-06 13:57:57 +08:00
acdabe4c33
扫码结果改为弹新窗口(PopupWindow)展示，不再替换当前页面
...
root.page_center → PopupWindow，扫码后弹出 85% 新窗口打开链接内容
2026-07-06 13:47:39 +08:00
2c986dca13
fix: CRUD endpoint return format - remove json.dumps, use widgettype format
2026-07-03 14:50:52 +08:00
1e2897d8d4
fix: enable/disable 后自动刷新表格 + 捕获真实错误
...
1. record_toolbar 添加 name 字段 (enable_user/disable_user)
2. 新增 binds: script bind 用 fetch 调用 dspy，成功后 render() 刷新
3. api/add_user.dspy + api/update_user.dspy 用 try/except 捕获真实异常
2026-06-29 15:50:18 +08:00
5ddbf299bf
feat: 注册 api/add_user.dspy 和 api/update_user.dspy RBAC 权限
2026-06-29 15:19:45 +08:00
ad601403cf
feat: users CRUD 定制 api — 新增/编辑客制化逻辑
...
不修改生成文件，改为 json/users.json 指定 custom URLs:
- new_data_url → /rbac/api/add_user.dspy
- update_data_url → /rbac/api/update_user.dspy
客制化修复:
1. 新增用户: created_at 默认当天日期
2. 新增/编辑: 清除 Tabular 发送的 _text 后缀字段
3. 编辑: 密码为空时不覆盖原密码
2026-06-29 15:12:33 +08:00
9472c0995f
Revert "fix: users CRUD — 三个修复"
...
This reverts commit 449a0415a5ffe4237fb118e17bcc38b1bba51876.
2026-06-29 15:10:17 +08:00
449a0415a5
fix: users CRUD — 三个修复
...
1. add_users.dspy: 新增用户时 created_at 默认设为当天日期
2. add/update: 清除 Tabular 发送的 _text 后缀字段
(user_status_text, orgid_text 等不是真实列，会导致 sor.U/C 失败)
3. update_users.dspy: 密码为空时从 ns 中移除，避免覆盖为空白
2026-06-29 14:46:58 +08:00
Hermes Agent
70a19238c1
feat: 注册时检查促销码并绑定客户归属关系
...
- register.dspy: 用户名密码注册后检查promo_code_id
- sms_register.dspy: 短信注册后检查promo_code_id
- code_login.dspy: 验证码登录/自动注册后检查promo_code_id
- phone_login.dspy: 手机登录/自动注册后检查promo_code_id
- 绑定失败只记日志不影响注册成功(try/except)
2026-06-24 00:56:33 +08:00
Hermes Agent
600fddced3
feat: add i18n translations (zh/en/jp/ko) for all modules
2026-06-19 15:01:37 +08:00
Hermes Agent
2ea45cd380
rbac: 完善信息弹窗修复双窗口+添加标题
2026-06-18 11:09:46 +08:00
Hermes Agent
947638853f
rbac: 完善信息Form使用value回填用户数据
2026-06-18 10:48:17 +08:00
Hermes Agent
cd29b276f7
fix: add login.css to any permissions
2026-06-15 13:55:09 +08:00
18251e3eae
fix: add favicon.ico and i18n_getmsgs to any permissions
2026-06-11 23:54:17 +08:00
d1b81c9a9f
fix: remove Sage dependency from load_path.py, use standard pattern
2026-06-11 23:41:10 +08:00
52cd71f861
feat: add user_status check on login, enable/disable toolbar, fix editexclouded for add user
2026-06-11 16:57:04 +08:00
cb9f8bbb4b
bugfix
2026-06-10 11:16:23 +08:00
12663a37e0
bugfix
2026-06-10 11:08:33 +08:00
f6027788b2
fix: login redirect to index.ui instead of userinfo.ui
...
After login success, redirect to the main page (/index.ui)
instead of just loading userinfo.ui into user_container.
This fixes the white screen after login.
2026-06-09 23:18:39 +08:00
587241b6a9
bugfix
2026-06-09 17:01:27 +08:00
62e1985ecb
bugfix
2026-06-09 16:58:15 +08:00
df212ea40d
bugfix
2026-06-09 16:52:12 +08:00
e453883b61
chore: exclude last_login_fail, last_login, sync_from from users edit form
2026-06-05 11:14:14 +08:00
002226d17c
fix: change created_at type from timestamp to date for proper Date control
2026-06-04 16:50:20 +08:00
5809a81646
debug: add hot_reload handler logging
2026-06-01 22:53:07 +08:00
b72a487df7
fix: use ServerEnv().userpermissions instead of new UserPermissions() in event handlers
2026-06-01 18:15:37 +08:00
ce7eb2a193
refactor: bind hot_reload event via EventDispatcher, add on_hot_reload to UserPermissions
2026-06-01 18:10:29 +08:00
c949a51f2e
fix: gen_sms_code.dspy handle both None return and exception from generate_sms_code
2026-05-31 12:26:55 +08:00
4038b7d0b9
fix: gen_sms_code.dspy catch exception and return actual error message
2026-05-31 11:56:46 +08:00
7f2c3d25dd
feat: 用户菜单添加完善信息功能 - 新增 edit_profile.dspy/save_profile.dspy - usermenu.ui 添加完善信息入口 - load_path.py 注册权限路径
2026-05-31 10:52:13 +08:00
26d1fd1447
feat: register_user 添加 customer.admin 角色，注册时同时分配 customer 和 admin 权限
2026-05-31 10:38:32 +08:00
c9dd80a484
fix: 暗色主题输入框颜色全局优化
...
- bricks.css: inputbox背景 #1E293B → #0F172A
- login.css: 同步更新保持一致
2026-05-30 14:32:11 +08:00
b0d6b59613
fix: 注册表单仅输入区域滚动，暗色主题输入框颜色优化
...
- 注册Tab结构: Text(固定) + VScrollPanel(仅Form) + Button(固定)
- 暗色主题输入框背景 #0f172a -> #1e293b，更协调
2026-05-30 14:27:33 +08:00
d1b3ca0914
fix: 修复登录弹窗三个显示问题
...
- 注册表单超出无滚动: 三个Tab内容均包裹VScrollPanel(scrollpanel)
- Form toolbar不可见: 滚动容器让submit/reset按钮可达
- 文本未国际化: title/label/otext均加i18n:true, archor纠正
- CSS: tabpanel flex布局, tabpanel-content flex:1+min-height:0
- PopupWindow cheight 28->30 给更多显示空间
2026-05-30 14:16:00 +08:00
36569c0e41
feat: 现代化登录/注册界面改造
...
- login.css: 全新现代化样式，支持亮/暗主题
- login.ui: 三Tab布局(密码登录/手机登录/注册)，手机登录支持短信验证码
- sms_register.dspy: 短信验证注册后端，验证通过后自动注册并登录
- load_path.py: 添加 sms_register.dspy 到 any 权限
- 修复手机登录 setValue 调用 (上一轮已提交)
- 注册流程: 手机号+短信验证码+用户名+密码，短信验证通过后才允许注册
2026-05-30 14:08:11 +08:00
019e9702fc
fix: use setValue() on codeid field widget instead of direct value assignment
2026-05-30 13:36:54 +08:00
cec79caf88
fix: phone login form.setValue is not a function - use name_inputs direct value set
2026-05-30 13:35:07 +08:00
b532548d19
fix: keep previous rp_caches when DB returns empty result
...
sqlExe can return [] without raising an exception (bad connection,
cursor issue). When load_roleperms gets 0 records but had valid
cache before, keep the old cache instead of replacing with {}.
Prevents intermittent 403 from transient DB issues.
2026-05-30 11:34:13 +08:00
fbbe011a8d
fix: rp_caches race condition causing intermittent 403
...
load_roleperms() was setting self.rp_caches = {} before the async
DB query. During the await, other coroutines saw {} (not None),
skipped the load, and checked permissions against an empty dict,
causing intermittent 403 on random paths.
Fix: build in local dict first, assign atomically when complete.
2026-05-30 11:19:32 +08:00
c776c0b3b5
fix: rp_cache should reload from DB when cache is disabled
2026-05-30 10:19:00 +08:00
04e9b718db
fix: check_roles_path supports % wildcard alongside **
...
load_path.py scripts across modules register paths like '/module/api/%'
using SQL LIKE wildcard, but check_roles_path() only recognized '**' as
wildcard suffix. This caused all %-terminated paths to be treated as
exact matches, resulting in 403 for any sub-path.
Now both '/module/api/%' and '/module/api/**' work as prefix wildcards.
2026-05-29 23:12:22 +08:00
67687883ff
fix: RBAC crash when cache disabled - return roles directly from get_userroles
...
When module_cache.rbac=false in config.json, LRUCache.get() always returns
None and LRUCache.set() is a no-op. This caused get_userroles() to store
roles into a disabled cache, then callers read back None, leading to
TypeError in check_roles_path() when iterating over None.
Fix: get_userroles() now returns the roles list directly. Callers use the
return value instead of relying solely on cache reads. Added safety
fallback to deny access if roles is somehow still None.
2026-05-29 22:43:39 +08:00
fa9f7f5146
fix: wrap Tabular in VBox with cheight for proper scrolling
2026-05-29 22:09:56 +08:00
cf18e592c7
feat: respect module_cache config for RBAC LRU cache
2026-05-29 17:59:04 +08:00
342fc6652a
refactor: rewrite SMS login UI using pure bricks patterns
...
- login.ui: use actiontype:urlwidget for Form submit → code_login.dspy
- Removed custom JavaScript (phone_login.js)
- Send code button: minimal script action to fetch and set form value
- Login flow: bricks returns Message/Error/VBox widgets directly
- Multi-account selection: code_login.dspy returns VBox with Buttons
2026-05-29 11:58:30 +08:00
8528eebf10
revert: restore gen_sms_code.dspy (API used by other systems)
2026-05-29 11:38:35 +08:00
