 luoweijian
|
fa476b4766
|
feat: 单端在线登录（顶号）——每 (用户, 端类型) 至多一个活会话
按 .scratch/single-device-login spec（票 01-07）落地：
- 会话反向索引 session:{userId}:{clientType}->jti（token 键为真相、索引为线索，
反查必验证、脏索引自愈），与 token 键 TTL 对齐并跟随滑动续期
- login/dingtalk 增可选 clientType（默认 pc、大小写不敏感、非法值 61016）；
检测到设备在线不签正式 token，返回 61013 + 短命 preLoginToken（带 data 不抛异常）
- 新增 login/dingtalk/confirm：GETDEL 消费 preLoginToken（拿到即烧）-> 踢旧会话
（埋 kicked 标记 + 删旧 token）-> 签新 token 覆写索引；失效统一 61014
- 被顶设备下次请求：filter 埋 ATTR_KICKED_OFFLINE -> commence 输出 401 + 61015
- 登出改 CAS 删索引（Lua 脚本，防误删已被顶号覆写的新索引）
- crm-base Result 增 fail(code, msg, data) 重载；错误码 61013-61016 登记 README
- 存量会话（无 clientType）与老前端（不传 clientType）路径完全兼容；JWT 不变
- 测试：TokenServiceTest 18 / FilterTest 4 / HandlersTest 3 / AuthServiceImplTest +5，
crm-auth 183 全过，全仓 8 模块 BUILD SUCCESS
|
3 weeks ago |
|
luoweijian
|
51b7e2a749
|
feat(auth,dict,base): extract PermissionSeeder seam to replace shadow entities (ADR-0016)
- Add PermissionSeeder interface + PermissionModuleDescriptor/ButtonSeed records in crm-base
- Implement PermissionSeederImpl in crm-auth with find-or-create idempotent seeding
- Refactor DataInitializer to use seam (3 seedModule calls) + @Order(1)
- Refactor DictPermissionInitializer to use seam (1 seedModule call) + @Order(10)
- Delete 6 shadow entity/mapper files from crm-dict (SysMenuSeed, SysRoleSeed, SysRoleMenuSeed + mappers)
- Rewrite DictPermissionInitializerTest to mock PermissionSeeder (no more H2 auth tables)
- Add PermissionSeederImplTest (H2 integration test covering idempotency, catalog sharing, role-not-found)
- Add ADR-0016 documenting the decision, rationale, alternatives, and consequences
- Create crm-base/CONTEXT.md with PermissionSeeder domain glossary
- Update CONTEXT-MAP.md to link crm-base/CONTEXT.md
Eliminates schema leakage: crm-dict no longer knows sys_menu's physical schema.
Runtime dependency accepted: crm-dict needs crm-auth's PermissionSeederImpl at runtime (via crm-app classpath aggregation).
|
4 weeks ago |
|
luoweijian
|
a263f1736c
|
feat(auth): role management — ancestor completion, CRUD, permission assignment, cascade delete (ADR-0012)
Implements ADR-0005 (backend ancestor completion) and ADR-0012 (role management
architecture) across 5 tracer-bullet tickets:
- ISysMenuService.getAncestorIds: batch query full table, in-memory parentId
traversal, returns complete ancestor set (ADR-0005)
- SysRole.builtin field + DataInitializer idempotent refactor + 5 button
permission seeds (crm:role:list/detail/save/delete/assign) bound to ADMIN
- RoleController (/api/roles/*): page, saveOrUpdate, detail, assign-resources,
delete — pure hasAuthority, POST + action suffix, form params
- SysRoleServiceImpl.saveRole: roleCode uniqueness, builtin protection,
dataScope 1-4 range, create can't set builtin=true
- assignResources: calls getAncestorIds for ancestor completion, then
full replacement (delete + insert) of sys_role_menu
- getRoleDetail: returns RoleDetailVO with basic info + resourceIds
- deleteRoleCascade: cleans sys_role_menu + sys_user_role, builtin rejection,
three-table transaction
- SystemController: all role endpoints removed, unused deps cleaned
- Dead code removed: assignMenus, getMenuIdsByRoleId (superseded by
assignResources, getRoleDetail)
- H2 test schemas updated with builtin column
- 150 tests pass (16 new in SysRoleServiceImplTest, 7 in SysMenuServiceImplTest)
|
1 month ago |
