4 Commits

Author	SHA1	Message	Date
liuyun	ce2aa35a24	fix: strip passwordHash from user API responses ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-10-10 23:22:43 +08:00
liuyun	7340658305	feat: enforce RBAC, audit/login logging, and seed script ... 收口 Phase 0 三处「声明未生效」： - 三级鉴权落地：权限集存 Redis（key 前缀隔离多项目），@RequirePermissions 挂到全部受控接口，super_admin 角色绕过权限码与 data_scope - 审计/登录日志自动落库：@AuditLog 装饰器 + 拦截器异步写入（写操作+登录登出），登录成功/失败均记 login_log（脱敏） - seed 脚本：一键初始化租户 touyun/用户 touyun/超管 super_admin/全量资源树（48 资源全量授权） Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-10-10 23:19:41 +08:00
liuyun	24790e8985	feat: add Swagger API docs (/docs) with DTO schemas ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-10-10 21:39:37 +08:00
liuyun	d8d3055c73	feat: backend foundation (Prisma 6 + MySQL, auth, tenant/soft-delete/data-scope filters, core CRUD) ... Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-10-10 21:13:35 +08:00