diff --git a/.doc/audit/ISSUES.md b/.doc/audit/ISSUES.md index 17927579..643a56f0 100644 --- a/.doc/audit/ISSUES.md +++ b/.doc/audit/ISSUES.md @@ -2,10 +2,12 @@ 维护规则:[问题记录与开发经验闭环](../ops/2026-09-23-issue-learning-workflow.md)。每个问题一个稳定 ID;主记录是事实与状态来源,本表为可检索投影。新发现及时登记,修复后保留记录;发布 blocker 仍见 [gap-matrix](../remediation/gap-matrix.md)。 -更新:2026-09-28。非编制人触发小队账本提交被 `uow: permission denied` 拒绝(fixing,待 dev 重跑)。test 注册 INTERNAL:标准角色 role-guest 缺失导致 FK 23503,已补种并重启 test(goose 77,resolved)。重复用户名 400 在新代码单测通过;当前 rc 二进制仍返回 INTERNAL,随下次含本提交的 test 制品生效。管理台重置密码入口被 F4-A 误删(端点仍在),已恢复 UI(resolved)。2026-09-27。上传链路:登记并修复上传文档跨端不可访问(占位模板退化 + 元数据/正文不落服务端,fixing 待 dev 集成)。2026-09-26。docgov 批准链:登记并修复 review_snapshot_id 装载缺失与 uow 行锁自死锁(resolved);memDocs 持久化失败缓存投毒(investigating)。历史 resolved 不表示本日产品回归通过。系统 code review P0/P1 批次修复落账(5 resolved + 1 deferred + 1 open,主记录见 [整改文档](2026-09-26-system-code-review-fixes.md),来源 [审计](2026-09-26-system-code-review.md))。 +更新:2026-09-28。激活预览:未纳入人工审批的计划前端直接请求导致 400(fixing,待 dev 浏览器复验);管理台 5 个密钥框不在 form 内触发 password DOM 警告(fixing)。非编制人触发小队账本提交被 `uow: permission denied` 拒绝(fixing,待 dev 重跑)。test 注册 INTERNAL:标准角色 role-guest 缺失导致 FK 23503,已补种并重启 test(goose 77,resolved)。重复用户名 400 在新代码单测通过;当前 rc 二进制仍返回 INTERNAL,随下次含本提交的 test 制品生效。管理台重置密码入口被 F4-A 误删(端点仍在),已恢复 UI(resolved)。2026-09-27。上传链路:登记并修复上传文档跨端不可访问(占位模板退化 + 元数据/正文不落服务端,fixing 待 dev 集成)。2026-09-26。docgov 批准链:登记并修复 review_snapshot_id 装载缺失与 uow 行锁自死锁(resolved);memDocs 持久化失败缓存投毒(investigating)。历史 resolved 不表示本日产品回归通过。系统 code review P0/P1 批次修复落账(5 resolved + 1 deferred + 1 open,主记录见 [整改文档](2026-09-26-system-code-review-fixes.md),来源 [审计](2026-09-26-system-code-review.md))。 | issue_id | 模块 / 检索词 | 问题 | 严重度 | issue_state | owner | 证据日期 / 范围 | 唯一主记录 | 经验 | |---|---|---|---|---|---|---|---|---| +| ISSUE-20260928-activation-preview-precheck | web / projectSettings / activation-preview / NO_GOVERNED_DOCUMENT / clientDutyIssues | 全部文档未纳入人工审批时前端仍 POST activation-preview,控制台 400 | medium | fixing | Cursor | 2026-09-28;dev 项目 6022 令牌表仅 00:45:08 一行,首次保存后无令牌 | [主记录](../ops/short-term/2026-09-28-activation-preview-precheck.md#issue-20260928-activation-preview-precheck) | 待浏览器复验后补 | +| ISSUE-20260928-admin-secret-password-form | web / EnvSettingsSection / password / form / secrets | 管理台 5 个密钥输入不在 form 内,Chromium 报 password DOM 警告 | low | fixing | Cursor | 2026-09-28;与 `secrets.*` 五条 Secret 设置数量一致 | [主记录](../ops/short-term/2026-09-28-activation-preview-precheck.md#issue-20260928-admin-secret-password-form) | 待浏览器复验后补 | | ISSUE-20260928-squad-commit-authority | bizdev / docflow / dutyAuthorizer / uow permission denied / OnBehalfOf / bd_intake | 非编制人触发受控小队任务时,账本提交用触发者身份,被编制人职责门拒绝,正文无法落盘 | high | fixing | Cursor | 2026-09-28;dev task_runs user 74 ≠ author 4(doc_proj6022_bd_intake);单测已绿,dev 重跑未做 | [主记录](../ops/short-term/2026-09-28-squad-commit-authority.md#issue-20260928-squad-commit-authority) | [LESSON-20260928-squad-commit-as-author](../ops/lessons/2026-09-28-squad-commit-as-author.md) | | ISSUE-20260928-register-internal | auth / register / role-guest / system_roles / 23503 / 23505 / INTERNAL | test 缺 role-guest 时注册 FK 失败被脱敏为 INTERNAL;重复用户名唯一冲突同样 500 | high | resolved | Cursor | 2026-09-28;test:8081 补种并重启后注册 200(goose 77,req_regfix_after_restart);重复用户名 400 由单测覆盖,rc 二进制仍为 INTERNAL | [主记录](../ops/short-term/2026-09-28-auth-register-internal.md#issue-20260928-register-internal) | [LESSON-20260928-standard-role-reseed](../ops/lessons/2026-09-28-standard-role-reseed.md) | | ISSUE-20260928-admin-reset-ui-removed | web / UsersSection / 重置密码 / F4-A / adminResetPassword | F4-A 在 F4-B 端点已合入的基线上删除管理台重置密码按钮,管理员无法重置口令 | high | resolved | Cursor | 2026-09-28;dev API :8080 + worktree Vite :3110 真实 UI 探针 PASS(临时口令长度 16、强制改密仅一次、旧口令 401) | [主记录](../ops/short-term/2026-09-28-restore-admin-password-reset.md#issue-20260928-admin-reset-ui-removed) | [LESSON-20260928-ui-dead-control](../ops/lessons/2026-09-28-ui-dead-control.md) | diff --git a/.doc/ops/CURRENT.md b/.doc/ops/CURRENT.md index 88c2634e..99c7857c 100644 --- a/.doc/ops/CURRENT.md +++ b/.doc/ops/CURRENT.md @@ -18,6 +18,7 @@ | owner | task | branch | worktree | mutex | status | |---|---|---|---|---|---| +| Cursor | activation-preview-precheck-2026-09-28 | fix/activation-preview-400-precheck-2026-09-28 | .worktrees/activation-preview-400-precheck-2026-09-28 | web-activation-preview | in_progress | | Cursor | squad-commit-authority-2026-09-28 | fix/squad-commit-authority-2026-09-28 | .worktrees/squad-commit-authority-2026-09-28 | bizdev+docflow | in_progress | | Cursor | auth-register-internal-2026-09-28 | fix/auth-register-internal-2026-09-28 | .worktrees/auth-register-internal-2026-09-28 | auth-register | done | | Cursor | restore-admin-password-reset-2026-09-28 | feature/restore-admin-password-reset-2026-09-28 | .worktrees/restore-admin-password-reset-2026-09-28 | auth | done | diff --git a/.doc/ops/short-term/2026-09-28-activation-preview-precheck.md b/.doc/ops/short-term/2026-09-28-activation-preview-precheck.md new file mode 100644 index 00000000..759e0273 --- /dev/null +++ b/.doc/ops/short-term/2026-09-28-activation-preview-precheck.md @@ -0,0 +1,60 @@ +--- +title: "修复激活预览 400 与管理台密码框警告" +task_id: activation-preview-precheck-2026-09-28 +status: in_progress +created: 2026-09-28 +updated: 2026-09-28 +owner: Cursor +task_type: fix +policy_revision: "AGENTS.md + agent-worktree-workflow @ 2026-09-21" +branch: fix/activation-preview-400-precheck-2026-09-28 +worktree: .worktrees/activation-preview-400-precheck-2026-09-28 +base_dev_sha: "b1ed8ecfe9fc5849288b6febf2bb4780319c8aca" +write_scope: + - web + - .doc +mutex: web-activation-preview +review_state: pending +integration_state: pending +deployment: pending +cleanup: pending +remote_sync: not_requested +--- + +# 修复激活预览 400 与管理台密码框警告 + +## 用户目标与授权 + +用户在 dev(`frp-mix.com:58880`)创建项目并添加「测试员工」后,浏览器控制台出现 `POST /api/v1/projects/6022/activation-preview 400`,以及 5 条 password 字段不在 form 内的 DOM 警告。授权:检查 dev 是否存在该问题并修复 dev。 + +## 检索 + +- 检索词:`activation-preview`、`NO_GOVERNED_DOCUMENT`、`clientDutyIssues`、`type="password"`。 +- 问题台账无 activation-preview / NO_GOVERNED 既有条目。 +- catalog overlap(mutex `web-activation-preview`)hard/soft 为空。登记时 `integrate-squad-commit-authority-2026-09-28` scope 为 `.`、`squad-commit-authority-2026-09-28` scope 为 `.doc`+`internal`,二者队列或分支均已是 dev 祖先且无活动 run,已 `task close --status done` 以释放写范围,未删除其 worktree。 + +## 事实 + +dev 库项目 6022「测试项目」(创建人 4,成员 74「测试员工」):`00:43:51` 保存规划 revision 1,激活令牌表无对应行;`00:45:08` 才发出令牌并在 `00:45:09` 激活。最终快照里仅 `bd_intake` 为 `author_only`,其余文档未纳入人工审批。服务端 `validateActivationPlan` 在零份完整职责时返回 400 `NO_GOVERNED_DOCUMENT`,行为符合门禁。缺口是前端 `clientDutyIssues` 不预检该门禁,用户可直接提交必然失败的计划。 + +5 条 DOM 警告对应管理台「模型与密钥」恰好 5 个 `Secret: true` 输入(`EnvSettingsSection`),`type=password` 且不在 `
); })} diff --git a/web/src/components/project/ProjectSettingsModal.tsx b/web/src/components/project/ProjectSettingsModal.tsx index d2786e92..965f78b9 100644 --- a/web/src/components/project/ProjectSettingsModal.tsx +++ b/web/src/components/project/ProjectSettingsModal.tsx @@ -33,7 +33,9 @@ import { clientDutyIssues, formatDutyIssues, locateDutyIssue, + needsGovernedDocument, needsThreeMembersForDuties, + NO_GOVERNED_DOCUMENT_MESSAGE, resolveClientDocTaskDuty, toggleAuthorOnly, toggleHumanApproval, @@ -226,6 +228,10 @@ export const ProjectSettingsModal: React.FC允许裁剪的文档可选择是否纳入人工审批。关闭后仍会生成并进入版本账本,只是不走三权。
+ {!liveEdit && !needsGovernedDocument(plan) && ( +