touyun_liuyun/sysmgr-nest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
27 Commits 1 Branch 0 Tags
Commit Graph

27 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
liuyun
ba1ae43e39 feat(security): helmet + CORS 白名单 + 限流 + 定时清理 + 时间契约 Unix 毫秒 
- helmet 安全头 + CORS_ORIGIN 白名单 + Swagger 仅非生产
- @nestjs/throttler 全局限流（60s/100 次）
- @nestjs/schedule 定时清理过期 token 与旧日志
- API 时间统一 Unix 毫秒（TransformInterceptor 递归转换）

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:54:08 +08:00
liuyun
606585c3bd feat(security): 登录失败锁定 + 密码长度策略 + refresh token 哈希校验 
- 登录连续失败 5 次锁定 15 分钟（Redis 计数）
- 密码字段 @MinLength(6)
- refresh 校验 tokenHash

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:46:13 +08:00
liuyun
5c1f2992b5 fix: created_by 注入 + 登出审计记录真实 username 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:43:31 +08:00
liuyun
6553b4c5c7 feat(auth): 登录按用户名自动探测租户 + 多租户选择 
- LoginDto tenantCode 改为可选，缺省按用户名跨租户探测
- 单匹配自动登录，多匹配返回候选租户
- 前端登录页新增租户选择弹窗

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:41:19 +08:00
liuyun
6578db51c7 feat(auth): PATCH /auth/me/password 修改本人密码 
- 校验原密码 + 更新后 tokenVersion 吊销其它会话

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:34:51 +08:00
liuyun
13510ee216 feat(tenant): 租户 onboarding 模板 + 级联删除 
- 抽取 seed 资源/字典到 tenant-template.ts，initTenant 幂等初始化租户
- 创建租户自动初始化管理员/根组织/角色/资源/字典
- 删除租户级联清理全部业务数据
- 修复 BaseCrudService 对 Tenant 模型的 tenantCode 大小写注入 bug

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:32:46 +08:00
liuyun
53dbc38bab feat(auth): 注册接口 POST /auth/register 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:29:11 +08:00
liuyun
537ec4fd91 feat(rbac): 数据权限扩展至组织树与审计/登录日志 
- orgs: 列表按可见部门过滤
- audit-logs/login-logs: 按操作人所属部门过滤（self 按 userId/username）

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:24:51 +08:00
liuyun
78e537fa73 feat(rbac): 用户-角色分配 + 权限码下发接口 
- users: GET/PUT /users/:id/roles（事务化替换 + 过滤无效角色 + 清权限缓存）
- auth: GET /auth/permissions 返回 {super, permissions}
- permissions/seed: 新增 user:assign-role 权限码与资源

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:19:11 +08:00
liuyun
513688a5e6 fix(security): P0 安全越权堵漏（C1/H1-H6/H10/H11/H13/M1/M4/M6/M8-M11/M22） 
- 平台管理员模型：super_admin=平台超管、tenant_super_admin=租户顶层（保留码），tenant:* 仅平台可授予
- 软删改名回收唯一键 + P2002→409
- 删除角色级联清理关联 + 聚合过滤已删/停用角色资源
- tokenVersion 会话吊销（重置密码/停用/删除即时踢下线）
- data_scope self 按 userId 过滤 + 详情数据权限校验
- 组织树防环、seed 不重置密码、日志脱敏补 phone/email
- JWT 密钥强校验、pageSize 上限、DTO 枚举校验、Prisma 错误映射、授权事务化

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 16:10:00 +08:00
liuyun
73ed067a82 feat: dict-driven enums — built-in dicts + protection + aggregate query 
- dict_type/dict_item 增加 built_in/color_type 字段与唯一约束
- seed 预置 5 个内置枚举字典（幂等）
- 内置类型/项删除与内置项 value 修改保护
- 新增 GET /dicts 聚合接口（登录态）

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 14:29:18 +08:00
liuyun
0823c750b2 feat: tenant list search filter 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 12:50:23 +08:00
liuyun
f516e98f7f feat: list search filters for user/config/role/audit-log/login-log 
- user/config/role/audit-log/login-log 列表增加搜索过滤（ListXxxQuery）
- audit-logs/login-logs 新增 dto + listXxx 方法

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 12:46:10 +08:00
liuyun
489d7232e3 feat: user list search + current-user menu tree endpoint 
- GET /auth/menus：当前用户菜单树（超管全量，非超管按角色 + 补祖先）
- 用户列表支持 username/nickname/phone/status 过滤（ListUserQuery）
- seed：菜单补图标、新增「权限管理」顶级分组（用户/角色/资源/组织），dashboard path 修正为 /

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-11 12:19:42 +08:00
liuyun
ce2aa35a24 fix: strip passwordHash from user API responses 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 23:22:43 +08:00
liuyun
7340658305 feat: enforce RBAC, audit/login logging, and seed script 
收口 Phase 0 三处「声明未生效」：
- 三级鉴权落地：权限集存 Redis（key 前缀隔离多项目），@RequirePermissions 挂到全部受控接口，super_admin 角色绕过权限码与 data_scope
- 审计/登录日志自动落库：@AuditLog 装饰器 + 拦截器异步写入（写操作+登录登出），登录成功/失败均记 login_log（脱敏）
- seed 脚本：一键初始化租户 touyun/用户 touyun/超管 super_admin/全量资源树（48 资源全量授权）

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 23:19:41 +08:00
liuyun
c680fb9dc7 feat: log request body (masked, debug level) and drop headers from request logs 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 22:13:33 +08:00
liuyun
2c4f3008cf feat: add source location (src) to logs for locating call sites 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 22:01:22 +08:00
liuyun
43dacdba11 feat: single-line pretty log output 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 21:52:34 +08:00
liuyun
f6fddb4a53 feat: use pino-pretty for readable dev logs (LOG_PRETTY, default true) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 21:49:34 +08:00
liuyun
0a0f999589 feat: log startup success and swagger address 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 21:47:12 +08:00
liuyun
2f839f714f chore: allow @scarf/scarf build script 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 21:39:43 +08:00
liuyun
24790e8985 feat: add Swagger API docs (/docs) with DTO schemas 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 21:39:37 +08:00
liuyun
bbc06ae775 feat: add pino structured logging (stdout + optional file via env) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 21:31:05 +08:00
liuyun
39a4e21eed fix: rename logs module to audit-logs/login-logs (avoid gitignore collision) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 21:25:57 +08:00
liuyun
d8d3055c73 feat: backend foundation (Prisma 6 + MySQL, auth, tenant/soft-delete/data-scope filters, core CRUD) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 21:13:35 +08:00
liuyun
dc40ca3343 chore: init sysmgr-nest (NestJS scaffold) 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
 2026-10-10 14:03:17 +08:00