rootandClaude Opus 5.5
f48e1aac96
- POST /approvals and PATCH /approvals/{id} require a console admin session
(EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
21 lines
1.1 KiB
Markdown
21 lines
1.1 KiB
Markdown
# @umt/web
|
|
|
|
React Router 7 SPA 控制台(`ssr:false`),沿用 uhd_web 设计系统(token 见 `app/app.css`,规范见 `docs/design/`)。只通过 `/api/v1` 与 server 通信,请求/响应类型一律来自 `@umt/contracts`,不手写重复 DTO。开发端口 5180,`/api` 代理到 http://localhost:4380。
|
|
|
|
## 命令
|
|
|
|
在仓库根目录执行:
|
|
|
|
- `deno task dev:web`:开发服务器(5180)。
|
|
- `cd apps/web && deno task build`:生产构建到 `build/client`,由 server 的 `WEB_ROOT` 同端口托管。
|
|
- `cd apps/web && deno task test`:单测(`app/**/*.test.ts`)。
|
|
- `deno task test:web:smoke`:Playwright 全页面冒烟,前提与环境变量见仓库 README。
|
|
- `deno task check:tokens`:设计 token 守卫。
|
|
|
|
## 目录
|
|
|
|
- `app/routes/`:页面(`routes.ts` 登记全部路由);`app/routes/console/` 为控制台。
|
|
- `app/api/`:按资源分的 react-query hook,路径与 schema 取 `@umt/contracts` 的 `Api` 注册表。
|
|
- `app/components/`:业务组件与 `ui/` 基础组件。
|
|
- Agent 页的 `?mock=1` 演示模式只在开发构建或后端 `pi.provider = "fake"` 时生效,生产构建连真实模型时忽略。
|