rootandClaude Opus 5.5
f48e1aac96
- POST /approvals and PATCH /approvals/{id} require a console admin session
(EndpointDef auth:"session"); API keys incl. admin scope get 403, so an
organize.execute key can no longer approve its own plan (S1)
- tests for single-use approval checks: expired, revision/payload hash
mismatch, consumed, revoked, pending/rejected, plan mismatch; re-approve
after plan change succeeds once and cannot be replayed (S4)
- one redact key table in @umt/contracts shared by server logger and agent
redactForModel: rsskey, torrent_pass, authkey, downhash, c_secure_pass,
passkey variants, x-api-key, cookie headers, nested objects/arrays (S2)
- TMDB network errors: message and cause redacted via redactUrl (S3)
- web Agent ?mock=1 only in DEV builds or when pi.provider is fake (S7)
- EndpointDef auth annotations for /auth/*, asserted against
PUBLIC_AUTH_PATHS (S10); doc drift fixes (S11)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
@umt/web
React Router 7 SPA 控制台(ssr:false),沿用 uhd_web 设计系统(token 见 app/app.css,规范见 docs/design/)。只通过 /api/v1 与 server 通信,请求/响应类型一律来自 @umt/contracts,不手写重复 DTO。开发端口 5180,/api 代理到 http://localhost:4380。
命令
在仓库根目录执行:
deno task dev:web:开发服务器(5180)。cd apps/web && deno task build:生产构建到build/client,由 server 的WEB_ROOT同端口托管。cd apps/web && deno task test:单测(app/**/*.test.ts)。deno task test:web:smoke:Playwright 全页面冒烟,前提与环境变量见仓库 README。deno task check:tokens:设计 token 守卫。
目录
app/routes/:页面(routes.ts登记全部路由);app/routes/console/为控制台。app/api/:按资源分的 react-query hook,路径与 schema 取@umt/contracts的Api注册表。app/components/:业务组件与ui/基础组件。- Agent 页的
?mock=1演示模式只在开发构建或后端pi.provider = "fake"时生效,生产构建连真实模型时忽略。