SpecialX
|
1b5781bf42
|
fix: add missing @RequirePermission decorators
Adds @RequirePermission to 19 TS GraphQL resolvers across 5
subgraphs (iam, config-service, core-edu, content, msg) per
audit report §6.1. Maps: iam user/role -> IAM_USER_READ;
config-service 5 queries -> CONFIG_USER; core-edu classInfo ->
CLASS_READ, exam -> EXAM_READ, grade -> GRADE_READ, homework
-> HOMEWORK_READ, datascope visibleGrades/visibleExams ->
GRADE_READ/EXAM_READ; content chapter/knowledgePoint/question/
textbook -> CONTENT_*_READ; msg notifications ->
MSG_NOTIFICATION_READ, template -> MSG_NOTIFICATION_MANAGE.
Federation resolveReference left unguarded. Python subgraphs
(data-ana, ai) deferred to follow-up infrastructure work.
|
2026-07-17 13:26:58 +08:00 |
|
SpecialX
|
514e26ebb4
|
feat(portal-shell): implement portal-shell with apollo-router integration
M8: portal-shell unified frontend shell (Modular Monolith + micro-kernel).
- Apollo Client -> apollo-router (port 4010, RSC prefetch)
- 5 layouts: classic/focus/split/triple/canvas
- Registry + PluginLoader (dynamic import ssr:false)
- 3-layer props merge, Zustand PluginStore
- 4 widgets: grades/notification-bell/user-menu/class-selector
- config-service: new pluginConfig GraphQL resolver
- apollo-router: CORS + header propagation for portal-shell
- docker-compose.yml: portal-shell service block
|
2026-07-15 08:06:09 +08:00 |
|