2 Commits

Author	SHA1	Message	Date
SpecialX	1b5781bf42	fix: add missing @RequirePermission decorators ... Adds @RequirePermission to 19 TS GraphQL resolvers across 5 subgraphs (iam, config-service, core-edu, content, msg) per audit report §6.1. Maps: iam user/role -> IAM_USER_READ; config-service 5 queries -> CONFIG_USER; core-edu classInfo -> CLASS_READ, exam -> EXAM_READ, grade -> GRADE_READ, homework -> HOMEWORK_READ, datascope visibleGrades/visibleExams -> GRADE_READ/EXAM_READ; content chapter/knowledgePoint/question/ textbook -> CONTENT_*_READ; msg notifications -> MSG_NOTIFICATION_READ, template -> MSG_NOTIFICATION_MANAGE. Federation resolveReference left unguarded. Python subgraphs (data-ana, ai) deferred to follow-up infrastructure work.	2026-07-17 13:26:58 +08:00
SpecialX	6bed673d9f	feat(iam): graphql subgraph with dataloader and router auth guard ... - GraphQLModule: Apollo Federation 2 subgraph at /graphql - UserResolver/RoleResolver: @key with @ResolveReference using DataLoader (ADR-035) - DataScopeResolver: ScopeToken for visible class/student IDs (ADR-041) - RouterAuthGuard: validate Router-Authorization header (ADR-036) - DataLoaderService: REQUEST-scoped userLoader + roleLoader - IamRepository.batchFindRoles: batch query for DataLoader - IamService.getVisibleClassIds/getVisibleStudentIds: dataScope calculation - app.module.ts: register PermissionGuard + RouterAuthGuard as APP_GUARD	2026-07-14 23:48:16 +08:00