yumoqing 0fbd0cab07 fix(security): load_path不再注册CRUD生成的add/update/delete_*.dspy——它们是裸sor.C/U/D绕过发券引擎原子占额/审计流水只读/org隔离/状态守卫全部校验;只注册index.ui+get_*只读,写操作仅走wwwroot/api/有校验端点(UI editable URL已指向)。HTTP实测抓到:update/delete_voucher_usage_log.dspy登录态200可篡改审计流水。RBAC默认拒绝→未注册即401

2026-09-13 11:37:47 +08:00

..

load_path.py

fix(security): load_path不再注册CRUD生成的add/update/delete_*.dspy——它们是裸sor.C/U/D绕过发券引擎原子占额/审计流水只读/org隔离/状态守卫全部校验;只注册index.ui+get_*只读,写操作仅走wwwroot/api/有校验端点(UI editable URL已指向)。HTTP实测抓到:update/delete_voucher_usage_log.dspy登录态200可篡改审计流水。RBAC默认拒绝→未注册即401

2026-09-13 11:37:47 +08:00

seed_welcome_voucher.py

feat: 代金券模块v2完成前端层+管理/客户全链路——①12个CRUD dspy重写为薄封装(request,params_kw签名对齐,Message widget返回,零import)②实例新增走发券引擎voucher_issue.dspy(原子占额/券码/有效期,禁裸插入)③作废invalidate(unused→void条件UPDATE+原因追加remark审计)④客户我的代金券页my/index.ui(机构隔离+状态过滤+过期清扫)⑤json CRUD定义修正(规则类型短名/实例状态含void/发券作废弹窗binds/流水noedit只读)⑥load_path.py改pipeline-app版(logined逐路径精确注册含CRUD四件套)⑦seed_welcome_voucher.py WELCOME400种子(400元/前100名/限pipeline/30天/幂等)⑧i18n四语key=value格式89词条⑨pyproject packages含voucher.rules⑩删sage时代遗留(sql/tables.sql,conf,menu.json,手写mysql.ddl.sql违禁)⑪update/delete守卫:模板code不可改/实例仅unused可改客户备注/used禁删保审计/删除回吐发行额度

2026-09-12 19:06:25 +08:00