heqiapp/platforms
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: enforce platform resource allowlists

Browse Source
This commit is contained in:
yanweidong
2026-07-27 09:56:33 +08:00
parent bc06d9b5f9
commit 98995d6968
7 changed files with 1302 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.superpowers/sdd/2026-07-27-platform-admin-full-audit/task-6-report.md
View File

@@ -28,3 +28,11 @@ The tree page consumes `parent_identity`; the corresponding menu API must expose
- Corrected the safety, e-commerce, staff, and user API paths to match the registered backend routes exactly.
- Added audit assertions for exact path/mode/page-kind contracts, separate read-only UI surfaces, identifier leakage, and tree semantics.
- Detail drawers now filter `id` and `*_id` fields before rendering.
## Fix round 2
- The resource catalogue now contains exactly the 46 backend `ExpectedResources` names, including the append-only `saf_event_disposal` contract rather than a synthetic dashboard entry.
- Every definition has its own backend write allowlist and required `*_identity` fields; no resource inherits a generic `name/status` schema.
- Safety disposal is a detail action on `saf_event` (`/safety/saf_event/:identity/disposals`) and has no standalone menu or page.
- `ec_category` and `platform_menu` use tree pages. The shared tree preserves identity-first behavior and uses backend `parent_id` only for in-memory hierarchy adaptation when `parent_identity` is unavailable.
- The audit transpiles and evaluates `resources.ts`, then compares the resulting definitions, allowlists, required identities, modes, page types, tree semantics, and identifier-safety rules to the complete expected contract.